Documentation
¶
Overview ¶
Package query is the query service as a library: search, facets, get, export, tail and resolve over what the writer wrote, behind the grants a caller holds, with every read recorded in the trail it reads.
This is what the audit-query binary runs: that binary is built on this package. It is exported because the binary needs it and a test may, not as a way to deploy — the query service of an installation is its own Deployment, beside the writer.
q, err := query.New(query.Config{
Searcher: postgres.NewReader(pool), // or &s3scan.Scanner{Store: archive}
Archive: archive,
Authenticator: session, // the application's own sign-in
Authorizer: grants, // e.g. authn.AccessRoster, or auth.Declarative
Sink: w, // the writer: every read is recorded
})
path, handler := q.Handler()
mux.Handle(path, handler)
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// Searcher answers the questions: postgres.NewReader over the index, as a
// role that does not own the tables, or an s3scan.Scanner over the archive.
Searcher index.Searcher
// Authenticator says who is calling, from the request.
Authenticator auth.Authenticator
// Authorizer says what they may read. There is no default: a service that
// answered without one would answer everything.
Authorizer auth.Authorizer
// Sink is where every read is recorded: the installation's writer.
// Reading an audit trail is itself an auditable event, and a service that
// records none is half a service.
Sink sink.Sink
// Archive, when given, is where resolve finds sealed identities, and where
// a record's provenance finds the seal that covers its hour.
Archive store.Store
// Keys, when given together with Archive, offers resolve: the way back
// from a pseudonym to the identity behind it. It must open what the
// writer sealed — the same keys, or a role on them that may decrypt.
// Without it, resolve is refused whatever a grant says.
Keys keys.Sealer
// Exports, when given, offers export.
Exports *Exports
Version string
Instance string
// Logger, default slog.Default(). A read that happened and was not
// recorded is logged there as an error; a deployment alerts on it.
Logger *slog.Logger
}
Config is what the service needs. Searcher, Authenticator, Authorizer and Sink are required.
type Exports ¶
type Exports struct {
Store store.Store
Presigner store.Presigner
// Expiry is how long an export is kept. Default 7 days.
Expiry time.Duration
// LinkValid is how long a download link works. Default one hour.
LinkValid time.Duration
// MaxRecords bounds one export. Default 100000.
MaxRecords int
}
Exports is where exports are written and how they are collected. The store is not the archive: an export is an unlocked copy meant to be cleared, and the archive's policy denies every delete.
Source Files