index

type Boundary struct {
	Values []string
	ID     string
	// RecordedAt and Sequence are what a tail advances on.
	RecordedAt time.Time
	Sequence   uint64
}

type Capabilities struct {
	// FreeText is whether the searcher can answer an unstructured query.
	FreeText bool
	// Facets is whether it can count values.
	Facets bool
	// DataPredicates is whether it can filter on extension properties.
	DataPredicates bool
	// MaxConjunctions bounds the OR. Beyond it a query is refused rather than
	// turned into work nobody bounded.
	MaxConjunctions int
	// SortFields are the orderings it can answer.
	SortFields []string
}

type Conjunction struct {
	ID            []Predicate
	OccurredAt    []TimePredicate
	RecordedAt    []TimePredicate
	Source        []Predicate
	Action        []Predicate
	Operation     []Predicate
	Outcome       []Predicate
	TenantID      []Predicate
	ActorKind     []Predicate
	ActorID       []Predicate
	SubjectKind   []Predicate
	SubjectID     []Predicate
	RequestID     []Predicate
	TraceID       []Predicate
	ClientAddress []Predicate
	ObserverID    []Predicate
	TargetType    []Predicate
	TargetID      []Predicate
	// Data are predicates on the extension properties a catalogue marked
	// filterable, addressed by JSON pointer.
	Data []PathPredicate
}

type Facet struct {
	Field  string
	Values []FacetValue
}

type FacetDelta struct {
	TenantID string
	Hour     time.Time
	Field    string
	Value    string
	Count    int64
}

type FacetValue struct {
	Value string
	Count int64
}

type Fields struct {
	// Filter are pointers a query may name in a predicate.
	Filter []string
	// Facet are pointers a searcher may count. Every facet is filterable.
	Facet []string
}

type Indexer interface {
	// Index writes rows and the facet counts they imply. A row already there
	// changes nothing, including the counts.
	Index(ctx context.Context, profile string, rows []Row) error
	// Purge forgets what a profile no longer keeps. The archive's objects are
	// under a lock and are not affected; this is the index catching up with a
	// retention that has already expired, and with the narrower schedule the
	// identifying columns are kept on.
	Purge(ctx context.Context, profile string, before time.Time, what Scope) error
}

type Kind string

type Memory struct {
	Indexed int
	// contains filtered or unexported fields
}

type ObjectAt struct {
	Key  string
	Line int
}

type Op string

type Page struct {
	Rows []Row
	// More says whether the next page would have anything in it. It is answered
	// by asking for one row more than the limit, rather than by counting.
	More bool
	// Next is the boundary for the following page. It is present even on the
	// last page, because a tail keeps polling it and a record recorded after
	// this page must come back through it.
	Next *Boundary
	Prev *Boundary
}

type PathPredicate struct {
	Path string
	Op   Op
	// Text, Int and At are the value, whichever kind the property has.
	Text   string
	Values []string
	Int    int64
	At     time.Time
	Kind   Kind
}

type Predicate struct {
	Op     Op
	Value  string
	Values []string
}

type Provenance struct {
	ObjectKey string
	Line      int
	// Digest is the key of the seal that accounts for the object's hour, when
	// there is one. Empty means no seal covers it yet, which is the ordinary
	// state of the current hour and a finding in any other.
	Digest string
	// VerifiedAt is when that seal was last verified clean. Zero means it
	// has not been, or the last verification found a problem.
	VerifiedAt time.Time
}

type Query struct {
	Profile string
	// Tenants is the grant: the caller may see these and no others. Empty means
	// every tenant, which only an operator's grant carries.
	Tenants []string
	// Filter is OR-joined: a row matches if it matches any conjunction.
	Filter []Conjunction
	Sort   []SortBy
	Limit  int
	// After is the keyset boundary a cursor carries.
	After *Boundary
	// Backwards pages towards older results.
	Backwards bool
}

type Row struct {
	ID         string
	TenantID   string
	OccurredAt time.Time
	RecordedAt time.Time
	Sequence   uint64
	Source     string
	Action     string
	Operation  string
	Outcome    string

	TargetTypes []string
	TargetIDs   []string

	// ObjectKey and Line are where the copy is in the archive, which is what
	// lets a reader check any answer the index gives against the object the
	// digest chain accounts for.
	ObjectKey string
	Line      int

	// The identifying columns. They are kept apart because a profile purges
	// them on a shorter schedule than the event, and because a store that
	// separates them can grant a reader one without the other.
	ActorKind     string
	ActorID       string
	SubjectKind   string
	SubjectID     string
	ClientAddress string
	RequestID     string
	TraceID       string
	ObserverID    string

	// Data are the extension properties the action marked filterable, by
	// pointer into its data slot.
	Data []Value
}

type Scope int

type Searcher interface {
	// Search returns a page. The cursor in a request must have come from a
	// response to the same query.
	Search(ctx context.Context, q Query) (Page, error)
	// Facets counts values of the named fields under the same filter.
	Facets(ctx context.Context, q Query, fields []string, limit int) ([]Facet, error)
	// Get returns one row and where it came from.
	Get(ctx context.Context, profile, id string) (Row, Provenance, error)
	// Capabilities says what this implementation can do, so that a caller is
	// refused rather than quietly given a narrower answer than it asked for.
	Capabilities() Capabilities
}

type SortBy struct {
	Field      string
	Descending bool
}

type TimePredicate struct {
	From time.Time
	// To is exclusive, so that adjacent ranges neither overlap nor leave a gap.
	To time.Time
}

type Value struct {
	Path string
	Kind Kind
	Text string
	Int  int64
	At   time.Time
	// Facet marks a value the index counts as well as stores.
	Facet bool
}