sinkserver

type Handler ¶

type Handler struct {
	auditv1connect.UnimplementedSinkServiceHandler
	// contains filtered or unexported fields
}

Handler serves SinkService from a Sink, which is how the writer is reached by anything that cannot call it in process.

func (h *Handler) Write(
	ctx context.Context, req *connect.Request[auditv1.WriteRequest],
) (*connect.Response[auditv1.WriteResponse], error)

type Receiver ¶

type Receiver struct {
	// To is the next hop, normally a stream publisher.
	To sink.Sink
	// Self names this receiver when a record arrives with no verified caller,
	// which is an in-process call or a trial install accepting anonymous
	// writes. Empty leaves the observer empty, which is what an anonymous
	// write means.
	Self string
	// Version and Instance name this build and this pod on the records it
	// stamps, where the emitter left them empty.
	Version  string
	Instance string
	// Now is the clock, for tests. Default time.Now.
	Now func() time.Time
}

Receiver is the front door of an installation that keeps its records on a stream: it stamps each record with the caller it verified and hands the batch to the next hop, which publishes it.

Stamping has to happen here. The consumer on the other side of a stream has no caller to verify — it is reading messages, not serving a request — so a record that reached the stream unstamped would be written with no observer at all, and the trail would not say who reported what. The writer on the far side keeps a stamp that verifies rather than replacing it, because it can only be reading its own installation's stream.

It is the same reasoning as everywhere else here: a reporter never says who it is. The identity comes from the token the authenticator checked, and the application cannot choose it.

func (r *Receiver) Guarantees() sink.Durability

func (r *Receiver) Write(ctx context.Context, req *sink.Request) (*sink.Result, error)