query

type Exporter struct {
	// Store is where exports are written. It may be the archive's bucket under
	// the export prefix, or a bucket of its own; it must not be a prefix any
	// profile writes to.
	Store store.Store
	// Presigner makes the link. Without one an export can be produced and not
	// collected, so the service refuses rather than filling a bucket with
	// files nobody can reach.
	Presigner store.Presigner
	// Expiry is how long an export is kept. It has a short default and no
	// unlimited setting: an export is an unlocked copy of audit records, and
	// one that outlives the question it answered is a second archive that
	// nobody is managing. Default 7 days.
	Expiry time.Duration
	// MaxRecords bounds one export. Beyond it the job fails and says to narrow
	// the filter, rather than reading a whole profile into memory because a
	// grant happened to allow it. Default 100000.
	MaxRecords int
	// LinkValid is how long a link works. Default one hour: a URL to audit
	// records that outlives the conversation it was shared in is a copy of the
	// trail nobody is tracking.
	LinkValid time.Duration
	Now       func() time.Time
}

type Handler struct {
	auditv1connect.UnimplementedQueryServiceHandler
	Service *Service
	// Authenticator establishes who is asking. There is no default: a handler
	// that answered without one would answer anybody.
	Authenticator auth.Authenticator
}

type Job struct {
	ID        string     `json:"id"`
	Profile   string     `json:"profile"`
	Format    string     `json:"format"`
	By        string     `json:"by"`
	Rule      string     `json:"rule"`
	AskedAt   time.Time  `json:"asked_at"`
	Records   int        `json:"records,omitempty"`
	DoneAt    *time.Time `json:"done_at,omitempty"`
	Failed    string     `json:"failed,omitempty"`
	ExpiresAt time.Time  `json:"expires_at"`
}

type ProfileAccess struct {
	Profile    string
	Operations []auth.Operation
	// Grant is the effective grant for search, or for the first operation
	// allowed when search is not: its tenants and window.
	Grant auth.Grant
}

type Service struct {
	Searcher index.Searcher
	// Authorizer decides what the caller may see. There is no default: a
	// service that answered without one would answer everything.
	Authorizer auth.Authorizer
	// Sink and Catalogue are where reads are recorded. Without them the service
	// runs and the reading of the trail leaves no trace, which a deployment
	// should have to choose rather than fall into.
	Sink      sink.Sink
	Catalogue *catalogue.Catalogue
	// Exporter writes exports, when a deployment offers them. Without one the
	// export operation is refused: a grant may name it, and nothing here will
	// produce a copy of records that the deployment did not configure a place
	// for.
	Exporter *Exporter
	// Identities, when given, is where Resolve finds the way back from a
	// pseudonym. Without it Resolve is not offered.
	Identities *identity.Map
	// Seals, when given, is the archive the seals are looked for in: a record
	// read from an object whose hour has been sealed says which seal covers it.
	Seals    store.Store
	Version  string
	Instance string
	// OnUnrecorded is called when a read happened and the trail does not say
	// so. A deployment alerts on it: the reading of an audit trail going
	// unrecorded is not a degraded service, it is the service failing at one of
	// the two things it is for.
	OnUnrecorded func(action string, err error)
	// contains filtered or unexported fields
}