Documentation
¶
Overview ¶
Package types holds artifactweave's internal domain model (decision 0020): one representation per entity in docs/research/15-data-model.md, in the shape the services and stores work with. JFrog's several wire forms of the same entity (legacy camelCase, Access snake_case, the YAML descriptor) are converted to and from these types; the wire structs themselves live in pkg/types/wire and nowhere else.
The repository configuration is the one entity whose wire and internal shapes coincide, so it stays pkg/repo.Config and is not duplicated here.
JSON tags appear only on types the stores persist as JSON documents (research 15 section 4 lists which columns are documents): role flags, permission resources, webhook criteria and handlers, cleanup and archive criteria, the trash record, settings values, release bundle specs and distribution rules, federation and worker filters. Those tags are snake_case and belong to artifactweave's storage format, not to any JFrog API. Every other type is a plain Go value. Secrets carried in memory are tagged `json:"-"` so they can never reach a document; the stores keep them in sealed columns (decision 0017).
Index ¶
- Constants
- Variables
- func AssignOrderKeys(c VersionComparator, versions []PackageVersion)
- func BuildInfoRepo(projectKey string) string
- func CheckPropertyKeyLength(key string) error
- func CompareMaven(a, b string) int
- func CompareMercury(a, b string) int
- func CompareNuGet(a, b string) int
- func ComparePEP440(a, b string) int
- func CompareSemver(a, b string) int
- func DistributionStream(trackerID int64, peerInstanceID string) string
- func EffectiveAdmin(u User, groups []Group) bool
- func EncodeBuildInfoSegment(s string) string
- func GroupToAccess(g Group) wire.AccessGroup
- func GroupToLegacy(g Group) wire.LegacyGroup
- func IsBuiltinEnvironment(name string) bool
- func IsGlobalRoleAction(a string) bool
- func IsReferenceToken(s string) bool
- func KnownUseCase(u UseCase) bool
- func MatchesRepository(target, key, class string) bool
- func ParseMemberURL(raw string) (baseURL, repoKey string, err error)
- func PermissionToAccess(p Permission) wire.AccessPermission
- func PermissionToV1(p Permission) (wire.PermissionTargetV1, error)
- func PermissionToV2(p Permission) (wire.PermissionTargetV2, error)
- func ProjectRepoKey(projectKey, name string) string
- func RepositoryStream(repoKey string) string
- func ResolveRepoKey(key string) (stored string, cached bool)
- func Revocable(expiresIn, threshold time.Duration, force, refreshable bool) bool
- func SortVersions(c VersionComparator, versions []PackageVersion)
- func SplitItemPath(full string) (parent, name string, depth int, err error)
- func TruncatePropertyValue(v string, limit int) string
- func UserToAccess(u User, effectiveAdmin bool) wire.AccessUser
- func UserToLegacy(u User) wire.LegacyUser
- func ValidEnvironmentName(name string) bool
- func ValidateEventTypes(d WebhookDomain, types []string) error
- func ValidateInstanceID(id string) error
- func ValidateProjectKey(key string) error
- func ValidatePropertyKey(key string) error
- func ValidateWorkerSource(src string) error
- func ValidateWorkerState(state map[string]string) error
- type AccessFederationTarget
- type AccessLockSettings
- type Actions
- type AdminPrivileges
- type AppliedMarker
- type ArchiveExecution
- type ArchiveFamily
- type ArchivePolicy
- type ArchivedItem
- type Blob
- type BlobReplica
- type BlobState
- type Build
- type BuildFile
- type BuildFileRef
- type BuildModule
- type BuildName
- type BuildPromotion
- type BuildRetention
- type BuildRun
- type BundleArtifact
- type BundleExport
- type BundleOperation
- type BundleOrigin
- type BundleQuery
- type BundleRetentionAudit
- type BundleRetentionConfig
- type BundleSpec
- type BundleState
- type Certificate
- type Checksums
- type CleanupCriteria
- type CleanupItemType
- type CleanupPolicy
- type CleanupRun
- type ConfigDocument
- type ConfigKind
- type CreatedOrder
- type DistributionJob
- type DistributionRule
- type DistributionTarget
- type DistributionTracker
- type Environment
- type ExecutionKind
- type ExecutionState
- type FailedBlobFetch
- type FederatedEntity
- type FederationMember
- type FederationPriority
- type FederationSettings
- type FolderDownloadSettings
- type FullSyncRun
- type Grants
- type Group
- type HLC
- type HandlerType
- type Header
- type InstanceIdentity
- type Item
- type ItemStats
- type JobStatus
- type Keypair
- type KeypairRole
- type KeypairType
- type Lease
- type MFAStatus
- type Matrix
- type NamedSecret
- type OutboxEntry
- type Package
- type PackageVersion
- type PairingNonce
- type PasswordExpirationPolicy
- type PasswordPolicy
- type PathMapping
- type PatternFilter
- type Peer
- type PeerCursor
- type PeerStatus
- type Permission
- type PlatformFederation
- type PrincipalType
- type Project
- type ProjectMember
- type Properties
- type PropertyValues
- type RegistryAccess
- type RegistryGrant
- type ReleaseBundle
- type ReleaseNotes
- type ReplicaState
- type Replication
- type ReplicationDirection
- type ReplicationRun
- type ReplicationStatus
- type RepositoryAssignment
- type Resource
- type ResourceType
- type RestoreRequest
- type RestoreType
- type Role
- type RoleFlags
- type RoleType
- type RunStatus
- type Scope
- type ScopeActions
- type ScopeEntry
- type ScopeKind
- type SigningKey
- type Stamp
- type StreamKind
- type StringComparator
- type Subject
- type SyncStatus
- type Target
- type Token
- type TokenIdentity
- type Topology
- type TopologySite
- type TrackerKind
- type TrashEntry
- type TrashRecord
- type TrashcanSettings
- type TrustedKey
- type UseCase
- type User
- type UserLockPolicy
- type UserStatus
- type VersionComparator
- type VersionFile
- type WebhookCriteria
- type WebhookDelivery
- type WebhookDomain
- type WebhookHandler
- type WebhookSubscription
- type WorkItem
- type WorkState
- type WorkStats
- type Worker
- type WorkerAction
- type WorkerExecution
- type WorkerFilter
- type WorkerTrigger
Constants ¶
const ( PropertyValueMax = 2400 BuildPropertyValueMax = 2048 )
PropertyValueMax and BuildPropertyValueMax are the longest property values the stores keep, in UTF-16 code units, as Artifactory's Java counts them. JFrog's 7.x documentation limits property values to 2400 characters ("JFrog Properties"); build and module properties keep 6.20's 2048 (BuildsDao and BuildModulesDao), which the documentation does not cover. Artifactory 6.20 cuts a longer value on write rather than refusing it (PropertiesDao), and so do the stores.
const ( SettingUserLockPolicy = "security.user_lock_policy" SettingPasswordExpirationPolicy = "security.password_expiration_policy" SettingPasswordPolicy = "security.password_policy" SettingBasicAuthEnabled = "security.basic_auth_enabled" SettingDefaultTokenExpiry = "token.default_expiry" SettingAnonymousAccess = "security.anonymous_access" SettingTrashcan = "trashcan" // SettingFolderDownload holds FolderDownloadSettings // (folderDownloadConfig in the descriptor). SettingFolderDownload = "folder_download" SettingBundleRetention = "distribution.bundle_retention" // SettingSeeded marks that the built-in principals were created, so a // later start never recreates one an administrator removed. SettingSeeded = "bootstrap.seeded" // SettingBootstrapDescriptor marks that bootstrap.descriptor was // applied, so it is applied once. SettingBootstrapDescriptor = "bootstrap.descriptor_applied" // SettingAccessLockSettings holds AccessLockSettings, the Access user // lock policy's fields that the lock and expiration policies have no // place for. SettingAccessLockSettings = "security.access_lock_settings" )
Setting keys of the singleton settings table.
const ( TargetAny = "ANY" TargetAnyLocal = "ANY LOCAL" TargetAnyRemote = "ANY REMOTE" TargetAnyDistribution = "ANY DISTRIBUTION" // BuildInfoRepository is the fixed target of the legacy build section. BuildInfoRepository = "artifactory-build-info" // ReleaseBundlesRepository is the default target of the legacy release // bundle section, the default release bundle source repository. ReleaseBundlesRepository = "release-bundles" )
Special targets. A target is otherwise a repository key (or, for builds, the build-info repository).
const ( MaxWorkerSource = 100000 MaxWorkerStateItems = 10 MaxWorkerStateKey = 40 MaxWorkerStateValue = 250 )
Worker limits from decision 0026, matching JFrog's defaults.
const ( EnvironmentDev = "DEV" EnvironmentProd = "PROD" )
Built-in environments.
const ( // DefaultTokenExpiry is token.default-expiry, the lifetime of an Access // token created without expires_in while no administrator has set one: // one year, as the Access configuration reference and the JFrog CLI give // it. JFrog's access-tokens page says 3600 s instead; decision 0005 // records the conflict, which the live check on #216 settles. DefaultTokenExpiry = 365 * 24 * time.Hour DefaultRevocableThreshold = 6 * time.Hour DefaultRefreshGrace = 24 * time.Hour // LegacyTokenExpiry is the lifetime of a token the legacy // POST /api/security/token creates without expires_in. It is that // route's own default, not token.default-expiry, so raising the Access // default leaves the legacy route as it was (research 05 lists the 7.x // value as unconfirmed). LegacyTokenExpiry = time.Hour )
Token defaults from the Access configuration (research 05).
const AccessStream = string(StreamAccess)
AccessStream is the Access Federation stream.
const CacheSuffix = "-cache"
CacheSuffix marks a remote repository's cache in item and AQL responses.
const MaxCustomGlobalRoles = 30
MaxCustomGlobalRoles is how many CUSTOM_GLOBAL roles JFrog allows.
const MaxRestoreItems = 30000
MaxRestoreItems caps one restore job, as JFrog does.
const MaxScopeLength = 500
MaxScopeLength is the longest scope string Access accepts on token create.
const PairingTokenTTL = 300 * time.Second
PairingTokenTTL is how long a pairing token can be redeemed: 300 seconds, the JFrog pairing-token default (decision 0021).
const PropertyKeyMax = 255
PropertyKeyMax is the longest property key, in characters: the limit JFrog's 7.x documentation gives ("JFrog Properties"), and the width of Artifactory's VARCHAR(255) key columns. Artifactory checks nothing before its database refuses a longer key (RTFACT-21394); artifactweave answers 400 (DV-059).
const ProtocolVersion = 1
ProtocolVersion is the peer protocol version this build speaks (decision 0021); peers advertise theirs at pairing.
const RealmInternal = "internal"
RealmInternal is the realm of users and groups artifactweave manages itself.
const ( // RegistryTokenExpiry is a registry token's lifetime, shortened to the // remaining life of the credential that obtained it. RegistryTokenExpiry = time.Hour )
Registry token defaults (decision 0005).
const RootPath = "."
RootPath is the parent path of an item that sits at the repository root. AQL reports it as "." and the item table stores it the same way, so a root listing and a nested listing are the same query (decision 0004).
const TokenPurposeEncryptedPassword = "encrypted_password"
TokenPurposeEncryptedPassword marks the reference token that stands in for a user's encrypted password (GET /api/security/encryptedPassword). A user has at most one; it keeps its value, sealed, so it can be shown again, and it is revoked whenever the password is set or expired.
Variables ¶
var BuiltinEnvironments = []string{EnvironmentDev, EnvironmentProd}
BuiltinEnvironments are the global environments every instance has. They are not stored: they cannot be renamed or deleted, and a repository belongs to DEV unless told otherwise.
var ErrInvalidEventType = errors.New("invalid webhook event type")
ErrInvalidEventType reports an event type the domain does not define.
var ErrInvalidHLC = errors.New("invalid hybrid logical clock value")
ErrInvalidHLC reports a hybrid logical clock value that does not parse.
var ErrInvalidInstanceID = errors.New("invalid instance id")
ErrInvalidInstanceID reports an instance id that is not jfrt@<uuid>.
var ErrInvalidItemPath = errors.New("invalid item path")
ErrInvalidItemPath reports a repository path that cannot name an item.
var ErrInvalidMemberURL = errors.New("invalid federation member URL")
ErrInvalidMemberURL reports a federation member URL that does not name a repository on an instance.
var ErrInvalidProjectKey = errors.New("invalid project key")
ErrInvalidProjectKey reports a project key outside the documented pattern.
var ErrInvalidPropertyKey = errors.New("invalid property key")
ErrInvalidPropertyKey reports a property key that the matrix-parameter and properties-query syntaxes could not carry.
var ErrInvalidRestore = errors.New("invalid restore request")
ErrInvalidRestore reports a restore request that cannot be executed.
var ErrInvalidScope = errors.New("invalid token scope")
ErrInvalidScope reports a token scope string the grammar does not accept.
var ErrInvalidStatus = errors.New("invalid user status")
ErrInvalidStatus reports a user status no wire form defines.
var ErrInvalidStream = errors.New("invalid stream name")
ErrInvalidStream reports a stream name with an unknown form.
var ErrInvalidSubject = errors.New("invalid token subject")
ErrInvalidSubject reports a token subject that is not an Access subject.
var ErrInvalidTimestamp = errors.New("invalid timestamp")
ErrInvalidTimestamp reports a timestamp a wire form could not have sent.
var ErrInvalidWorker = errors.New("invalid worker")
ErrInvalidWorker reports a worker definition or state the runtime refuses.
var ErrLossyProjection = errors.New("permission cannot be expressed in this wire form")
ErrLossyProjection reports a permission the requested legacy form cannot express. The legacy forms hold one include/exclude pattern pair per section, so a permission whose targets carry different patterns has no faithful legacy view; returning an error beats silently granting more or less than the stored permission.
var ErrPropertyKeyTooLong = fmt.Errorf("%w: longer than %d characters", ErrInvalidPropertyKey, PropertyKeyMax)
ErrPropertyKeyTooLong reports a key longer than PropertyKeyMax. It wraps ErrInvalidPropertyKey.
var ErrUnknownAction = errors.New("unknown permission action")
ErrUnknownAction reports an action name or letter no wire form defines.
var GlobalRoleActions = []string{
"READ_REPOSITORY", "ANNOTATE_REPOSITORY", "DEPLOY_CACHE_REPOSITORY",
"DELETE_OVERWRITE_REPOSITORY", "MANAGE_XRAY_MD_REPOSITORY",
"READ_RELEASE_BUNDLE", "ANNOTATE_RELEASE_BUNDLE", "CREATE_RELEASE_BUNDLE",
"DISTRIBUTE_RELEASE_BUNDLE", "DELETE_RELEASE_BUNDLE", "MANAGE_XRAY_MD_RELEASE_BUNDLE",
"READ_BUILD", "ANNOTATE_BUILD", "DEPLOY_BUILD", "DELETE_BUILD", "MANAGE_XRAY_MD_BUILD",
"READ_SOURCES_PIPELINE", "TRIGGER_PIPELINE", "READ_INTEGRATIONS_PIPELINE",
"READ_POOLS_PIPELINE",
"REPORTS_SECURITY", "WATCHES_SECURITY", "POLICIES_SECURITY", "RULES_SECURITY",
"READ_POLICIES_SECURITY",
}
GlobalRoleActions is the global role action vocabulary, in the order the Access API and the platform provider's validator list it (research 07). Only the repository and build actions grant anything in artifactweave; the rest are stored and echoed so roles round-trip.
Functions ¶
func AssignOrderKeys ¶
func AssignOrderKeys(c VersionComparator, versions []PackageVersion)
AssignOrderKeys sorts versions with c and sets OrderKey to each version's rank, starting at 1 for the oldest. Equivalent versions share a rank.
func BuildInfoRepo ¶
BuildInfoRepo returns the repository holding a project's build-info documents: artifactory-build-info for the default project ("" or "default") and <project>-build-info otherwise.
func CheckPropertyKeyLength ¶
CheckPropertyKeyLength returns ErrPropertyKeyTooLong for a key longer than PropertyKeyMax characters. The stores check it too: on PostgreSQL a key is indexed whole beside a value's prefix, and a much longer key would not fit a B-tree entry.
func CompareMaven ¶
CompareMaven orders Maven, Gradle, Ivy and SBT versions the way Maven's ComparableVersion does, so 1.0-SNAPSHOT < 1.0 < 1.0-sp1 and 1.10 > 1.9.
func CompareMercury ¶
CompareMercury orders versions the way Artifactory's versions and latest version searches do (Mercury's ComparableVersion): 1.0-SNAPSHOT < 1.0-alpha-1 < 1.0-rc1 < 1.0 < 1.0-sp1, and 1.10 > 1.9.
func CompareNuGet ¶
CompareNuGet orders NuGet versions: up to four numeric components (NuGet keeps the legacy revision), then pre-release labels compared like semver but case-insensitively, which is how NuGet treats 1.0.0-Beta and 1.0.0-beta as one version.
func ComparePEP440 ¶
ComparePEP440 orders Python versions by epoch, release, pre-release, post-release, development release and local label with the sentinel rules of the packaging library: a final release sorts after its pre-releases and before its post-releases, and a version without a local label sorts before the same version with one.
func CompareSemver ¶
CompareSemver orders semantic versions: the numeric core first, then a release sorts after its pre-releases, and pre-release identifiers compare numerically when both are numeric, numeric before alphanumeric otherwise, with the longer list winning a shared prefix. Build metadata is ignored, as semver requires. A leading "v" is accepted because Go modules require it.
func DistributionStream ¶
DistributionStream names one distribution job's stream.
func EffectiveAdmin ¶
EffectiveAdmin reports whether u is an administrator directly or through a group with admin privileges; the Access user view reports it as effective_admin.
func EncodeBuildInfoSegment ¶
EncodeBuildInfoSegment encodes a build name, number or project key as the CLI's encodeForBuildInfoRepository does: every whitespace rune becomes a space, the AQL-special characters are percent-encoded, and a space next to an encoded slash becomes %20.
func GroupToAccess ¶
func GroupToAccess(g Group) wire.AccessGroup
GroupToAccess renders the Access v2 view.
func GroupToLegacy ¶
func GroupToLegacy(g Group) wire.LegacyGroup
GroupToLegacy renders the legacy view.
func IsBuiltinEnvironment ¶
IsBuiltinEnvironment reports whether name is DEV or PROD, compared without regard to case as environment names are.
func IsGlobalRoleAction ¶
IsGlobalRoleAction reports whether a is in GlobalRoleActions.
func IsReferenceToken ¶
IsReferenceToken reports whether s has the reference-token form, which is how the authenticator tells a reference token from a JWT or an API key.
func KnownUseCase ¶
KnownUseCase reports whether u can be paired; JFrog use cases with no counterpart (mission-control, bridge, artifactory-cold) answer 404.
func MatchesRepository ¶
MatchesRepository reports whether target covers a repository of the given key and class (local, remote, virtual, federated, distribution).
func ParseMemberURL ¶
ParseMemberURL splits "<base URL>/artifactory/<repoKey>" into the instance base URL and the repository key.
func PermissionToAccess ¶
func PermissionToAccess(p Permission) wire.AccessPermission
PermissionToAccess renders the Access v2 form.
func PermissionToV1 ¶
func PermissionToV1(p Permission) (wire.PermissionTargetV1, error)
PermissionToV1 renders the legacy v1 view. Sections other than artifact are left out, as Artifactory's v1 API does; patterns must be uniform.
func PermissionToV2 ¶
func PermissionToV2(p Permission) (wire.PermissionTargetV2, error)
PermissionToV2 renders the legacy v2 view of the artifact, build and release bundle sections; other resource types have no legacy section.
func ProjectRepoKey ¶
ProjectRepoKey is the key a repository created inside a project gets.
func RepositoryStream ¶
RepositoryStream names a federated repository's stream.
func ResolveRepoKey ¶
ResolveRepoKey maps a key as a client sent it to the stored key and the cached flag: "maven-remote-cache" is the cache of "maven-remote". Repository keys cannot end in the suffix (pkg/repo.Validate), so the mapping is unambiguous.
func Revocable ¶
Revocable applies Access's rule: a token is revocable when it never expires, lives at least the revocable threshold, the caller forced it, or it is refreshable ("created with force_revocable: true or refreshable: true", revoketokenbyvalue). Other short-lived tokens are not tracked for revocation because they expire before a revocation list would matter; a refreshable one outlives its expiry through its refresh token.
func SortVersions ¶
func SortVersions(c VersionComparator, versions []PackageVersion)
SortVersions sorts versions oldest first in place.
func SplitItemPath ¶
SplitItemPath turns a repository-relative path into the canonical parent, name and depth. Leading and trailing slashes are ignored, so folder paths from deploys ("a/b/") and storage paths ("/a/b") both work; empty, "." and ".." segments are refused because they would let a path escape or alias another item.
func TruncatePropertyValue ¶
TruncatePropertyValue cuts v to at most limit UTF-16 code units. Java's substring, which Artifactory uses, can split a surrogate pair; here a character that would straddle the limit is dropped whole, so the result stays valid UTF-8.
func UserToAccess ¶
func UserToAccess(u User, effectiveAdmin bool) wire.AccessUser
UserToAccess renders the Access v2 view. effectiveAdmin comes from EffectiveAdmin, which needs the user's groups.
func UserToLegacy ¶
func UserToLegacy(u User) wire.LegacyUser
UserToLegacy renders the legacy view. Role flags the legacy form does not know are dropped.
func ValidEnvironmentName ¶
ValidEnvironmentName reports whether name is 1 to 32 letters, digits, hyphens and underscores.
func ValidateEventTypes ¶
func ValidateEventTypes(d WebhookDomain, types []string) error
ValidateEventTypes checks that every event type belongs to the domain.
func ValidateInstanceID ¶
ValidateInstanceID checks the jfrt@<uuid> form /api/system/service_id serves and peers identify themselves by.
func ValidateProjectKey ¶
ValidateProjectKey checks the documented key rule: 2 to 32 characters, lower-case letters, digits and hyphens, starting with a letter. The key prefixes repository keys, so it is immutable once created.
func ValidatePropertyKey ¶
ValidatePropertyKey refuses keys that the ";key=value" matrix syntax and the "?properties=k=v|k2=v2" query syntax could not carry unambiguously, and keys CheckPropertyKeyLength refuses.
func ValidateWorkerSource ¶
ValidateWorkerSource applies the size limit checked on save.
func ValidateWorkerState ¶
ValidateWorkerState applies the per-worker state limits; an execution whose state breaks them fails and its state is not saved.
Types ¶
type AccessFederationTarget ¶
type AccessFederationTarget struct {
Name string
PeerInstanceID string
Active bool
Entities []FederatedEntity
PermissionFilters PatternFilter
GroupFilters PatternFilter
Created time.Time
}
AccessFederationTarget is a peer that receives this instance's identity changes on the access stream (decision 0025).
func (AccessFederationTarget) Streams ¶
func (t AccessFederationTarget) Streams(e FederatedEntity) bool
Streams reports whether the target receives entity e.
type AccessLockSettings ¶
type AccessLockSettings struct {
SecondsToUnlock int `json:"seconds_to_unlock"`
AdminPasswordExpirable bool `json:"admin_password_expirable"`
MaxLoginDelayIncorrectAttempts int `json:"max_login_delay_incorrect_attempts"`
MaxLoginDelayMillis int64 `json:"max_login_delay_millis"`
BaseLoginDelayMillis int64 `json:"base_login_delay_millis"`
ClientLoginSuspensionEnabled bool `json:"client_login_suspension_enabled"`
}
AccessLockSettings are the Access user lock policy's fields beyond the lock limit (UserLockPolicy) and the password expiry (PasswordExpirationPolicy). The four login delay fields drive the temporary login suspension after failed Basic logins; SecondsToUnlock and AdminPasswordExpirable are stored and returned only, as the Access OpenAPI source says field by field.
func DefaultAccessLockSettings ¶
func DefaultAccessLockSettings() AccessLockSettings
DefaultAccessLockSettings is in force while none is stored: Access's server defaults. docs.jfrog.com, supported Access configurations (security.user-lock-policy), documents the two delays and seconds-to-unlock. The JFrog KB article on intermittent 403 errors gives the 2 failed attempts before a suspension. The getAccessUserLockPolicy reference page, the source of the suspension switch, is gone; the endpoint is now documented only in the migration notes of the deprecated JFrog APIs page.
type Actions ¶
type Actions uint8
Actions is a set of permission actions. The internal model uses the Access v2 vocabulary; the legacy letters and names map onto it one to one (managedXrayMeta is SCAN, distribute is EXECUTE).
const ( ActionRead Actions = 1 << iota ActionAnnotate ActionWrite ActionDelete ActionManage ActionScan ActionExecute )
Actions, in the order the Access API lists them.
func ParseAccessActions ¶
ParseAccessActions reads Access v2 action names, case-insensitively as Access does.
func ParseLegacyActions ¶
ParseLegacyActions reads legacy v2 action names.
func ParseLetters ¶
ParseLetters reads legacy v1 action letters.
func RoleActions ¶
func RoleActions(actions []string, resource ResourceType) Actions
RoleActions returns what a role's actions grant on one resource type. It is how the permission evaluator reads a role: pipeline, Release Bundle and security actions grant nothing here.
func (Actions) AccessNames ¶
AccessNames are the actions in the Access v2 spelling.
func (Actions) LegacyNames ¶
LegacyNames are the actions in the legacy v2 permission-target spelling.
func (Actions) MarshalJSON ¶
MarshalJSON stores actions as Access names so a permission document reads the same as the Access API.
func (*Actions) UnmarshalJSON ¶
UnmarshalJSON reads Access names.
type AdminPrivileges ¶
type AdminPrivileges struct {
ManageMembers bool `json:"manage_members,omitempty"`
ManageResources bool `json:"manage_resources,omitempty"`
IndexResources bool `json:"index_resources,omitempty"`
ManageRemoteRepository bool `json:"manage_remote_repository,omitempty"`
CreateRemoteRepository bool `json:"create_remote_repository,omitempty"`
DeleteRemoteRepository bool `json:"delete_remote_repository,omitempty"`
CreateLocalRepository bool `json:"create_local_repository,omitempty"`
DeleteLocalRepository bool `json:"delete_local_repository,omitempty"`
CreateVirtualRepository bool `json:"create_virtual_repository,omitempty"`
DeleteVirtualRepository bool `json:"delete_virtual_repository,omitempty"`
}
AdminPrivileges are the project admin switches, stored as one document.
type AppliedMarker ¶
AppliedMarker is the receiver's record of the last sequence applied from one origin's stream, updated in the apply transaction so a retried batch is idempotent.
func (AppliedMarker) Expect ¶
func (m AppliedMarker) Expect() int64
Expect is the sequence the next batch must start at.
type ArchiveExecution ¶
type ArchiveExecution struct {
ID int64
PolicyKey string
Kind ExecutionKind
State ExecutionState
Started time.Time
Finished time.Time
Total int64
Completed int64
Failed int64
TotalBytes int64
SuccessBytes int64
FailureBytes int64
TriggeredBy string
Destination []byte
}
ArchiveExecution is one run of an archive policy, a restore job or a purge.
func (ArchiveExecution) Progress ¶
func (e ArchiveExecution) Progress() int
Progress is the completed share in percent, as progressPercentage reports.
type ArchiveFamily ¶
type ArchiveFamily string
ArchiveFamily is which of JFrog's two archive policy APIs a policy belongs to (decision 0024): cold-storage retention v1 or smart archiving v2.
const ( ArchiveRetentionV1 ArchiveFamily = "retention_v1" ArchiveSmartV2 ArchiveFamily = "smart_v2" )
Archive families.
type ArchivePolicy ¶
type ArchivePolicy struct {
Key string
Family ArchiveFamily
Description string
Enabled bool
CronExp string
ProjectKey string
DurationMinutes int
ExpirationMonths int
SkipTrashcan bool
Criteria []byte
Created time.Time
Updated time.Time
}
ArchivePolicy moves selected items to the cold blob store. Criteria is the family's selection document, kept in that family's wire shape because the two families select differently.
type ArchivedItem ¶
type ArchivedItem struct {
ID int64
Namespace string
Item Item
Properties Properties
Stats ItemStats
PackageType string
PackageName string
PackageVersion string
PolicyKey string
ExecutionID int64
ArchivedAt time.Time
ExpiresAt time.Time
ColdBlobSHA256 string
}
ArchivedItem is the record an archived item leaves behind: its full metadata, so a restore recreates it and AQL over archives can search it.
type Blob ¶
type Blob struct {
Checksums Checksums
Size int64
Created time.Time
Refs int64
// State is where the row stands in garbage collection (decision 0010);
// only live rows serve content.
State BlobState
// Deleted is when garbage collection marked the content for deletion
// (deleting) or removed it (deleted). A row revived by a deploy keeps the
// time until it is pruned, so the deploy knows the content it found may
// have been removed after it was written and checks it is still there.
Deleted time.Time
}
Blob is the index record of one stored content blob. Items reference blobs by SHA256; Refs counts those references (and those of trash entries and bundle artifacts) so garbage collection removes a blob only when nothing can serve it again. SHA512, SHA1 and MD5 are recorded so checksum deploy, the checksum searches and checksum files resolve without reading content.
type BlobReplica ¶
type BlobReplica struct {
SHA256 string
Member string
State ReplicaState
Size int64
Attempts int
LastError string
Updated time.Time
}
BlobReplica records one mirror member's copy of one blob. The mirror keeps this index so reads go straight to a holder and repair works from a queue, where Artifactory's sharding has no index and probes every shard.
type BlobState ¶
type BlobState string
BlobState is a blob index row's stage in garbage collection. A row is marked deleting before its content is removed and becomes deleted (a tombstone) once it has been, so a deploy of the same content can never reference content that is being removed (decision 0010).
type Build ¶
type Build struct {
// ID is assigned by the store when the run is put.
ID int64
// ProjectKey is "" for the default project.
ProjectKey string
Name string
Number string
// Started is the document's start time, at millisecond precision in
// the document; it stays fixed through promotion and replication.
Started time.Time
URL string
Created time.Time
CreatedBy string
Modified time.Time
ModifiedBy string
// Properties are the document's build-level properties, the AQL
// build.property domain.
Properties Properties
Modules []BuildModule
// Document is the build-info JSON as published.
Document []byte
}
Build is one run of a build (decision 0014). One name and number may be published several times, and each publish is a new run, so a run is identified by ProjectKey, Name, Number and Started together (research 22 §3.3). The document is kept as published, for the read API; the modules, properties and files are kept as rows, for the AQL build domains and the checksum searches.
func (Build) DocumentItem ¶
DocumentItem returns where b's document is also stored as an item: the build-info repository and the full path within it. The CLI finds the item with AQL $match on these encoded segments, for LATEST and build-append (research 22 §3.3), so the encoding must equal the CLI's byte for byte.
type BuildFile ¶
type BuildFile struct {
// ID is a dependency's id; artifacts have none.
ID string
Name string
Type string
Path string
// Scopes are a dependency's scopes; artifacts have none.
Scopes []string
Checksums Checksums
}
BuildFile is an artifact a module produced or a dependency it consumed. Its checksums link it to items, which is how the AQL build domains join (decision 0014). Build-info records sha1, sha256 and md5, so SHA512 is always empty here.
type BuildFileRef ¶
BuildFileRef is a build file found by checksum, with the run and module it belongs to.
type BuildModule ¶
type BuildModule struct {
// ID is the module's id in the document. A module of type "build"
// names another build as <name>/<number>.
ID string
Type string
Properties Properties
Artifacts []BuildFile
Dependencies []BuildFile
}
BuildModule is one module of a run: what it produced and consumed.
type BuildName ¶
BuildName is one build name with the start of its latest run, as GET /api/build lists them.
type BuildPromotion ¶
type BuildPromotion struct {
ID int64
BuildID int64
Created time.Time
// CreatedBy is the user who promoted.
CreatedBy string
Status string
Comment string
// CIUser is the CI user named in the promotion request.
CIUser string
SourceRepo string
// Repo is the target repository.
Repo string
}
BuildPromotion records one promotion of a run (decision 0014).
type BuildRetention ¶
type BuildRetention struct {
ProjectKey string
Name string
// Count keeps at most this many runs; zero keeps every run.
Count int
// MinimumBuildDate discards runs started before it; zero keeps them.
MinimumBuildDate time.Time
DeleteArtifacts bool
// KeepNumbers are build numbers never discarded.
KeepNumbers []string
}
BuildRetention is retention settings: which runs of a build name to keep. The store keeps, per build name, the settings of the latest build-info document that carried a buildRetention; that publish applied them, and later ones without settings discard nothing, as in Artifactory.
type BuildRun ¶
type BuildRun struct {
ID int64
ProjectKey string
Name string
Number string
Started time.Time
Created time.Time
}
BuildRun is one run's identity and timestamps, as listings return it.
type BundleArtifact ¶
type BundleArtifact struct {
BundleName string
BundleVersion string
SourcePath string
TargetPath string
Checksums Checksums
Size int64
Props []PropertyValues
}
BundleArtifact is one frozen entry of a bundle's artifact list.
type BundleExport ¶
type BundleExport struct {
BundleName string
BundleVersion string
Status JobStatus
ArchiveSHA256 string
Created time.Time
}
BundleExport is an exported bundle archive.
type BundleOperation ¶
type BundleOperation string
BundleOperation is a retention audit operation.
const ( BundleDelete BundleOperation = "DELETE" BundleKeep BundleOperation = "KEEP" BundleUnkeep BundleOperation = "UNKEEP" )
Bundle retention operations.
type BundleOrigin ¶
type BundleOrigin string
BundleOrigin says whether this instance created the bundle or received it.
const ( BundleSource BundleOrigin = "source" BundleReceived BundleOrigin = "received" )
Bundle origins.
type BundleQuery ¶
type BundleQuery struct {
Name string `json:"name,omitempty"`
AQL string `json:"aql"`
Mappings []PathMapping `json:"mappings,omitempty"`
AddedProps []PropertyValues `json:"added_props,omitempty"`
ExcludePropsPatterns []string `json:"exclude_props_patterns,omitempty"`
}
BundleQuery selects artifacts for a bundle by AQL.
type BundleRetentionAudit ¶
type BundleRetentionAudit struct {
BundleName string
BundleVersion string
Operation BundleOperation
Created time.Time
CreatedBy string
}
BundleRetentionAudit records a keep mark change or a retention deletion.
type BundleRetentionConfig ¶
type BundleRetentionConfig struct {
Automatic bool `json:"automatic"`
VersionsToKeepPerBundle int `json:"versions_to_keep_per_bundle"`
MaxDaysToKeep int `json:"max_days_to_keep"`
CronPattern string `json:"cron_pattern,omitempty"`
MaxDeletionsPerBackgroundRun int `json:"max_deletions_per_background_run"`
Enabled bool `json:"enabled"`
}
BundleRetentionConfig is the release bundle v1 retention singleton.
type BundleSpec ¶
type BundleSpec struct {
Queries []BundleQuery `json:"queries"`
}
BundleSpec is the creation spec, kept as a document so the bundle records how it was built.
type BundleState ¶
type BundleState string
BundleState is a release bundle version's lifecycle state (decision 0023).
const ( BundleOpen BundleState = "OPEN" BundleSigned BundleState = "SIGNED" BundleStored BundleState = "STORED" )
Bundle states. OPEN and SIGNED are Distribution's documented values (research 17); STORED records that the signed version was also written to its storing repository, which Distribution reports through storing_repository rather than a state of its own.
func (BundleState) Editable ¶
func (s BundleState) Editable() bool
Editable reports whether the bundle can still be changed; signing freezes it.
type Certificate ¶
type Certificate struct {
Alias string
PEM string
PrivateKey string `json:"-"`
IssuedTo string
IssuedBy string
IssuedOn time.Time
ValidUntil time.Time
Fingerprint string
}
Certificate is a client certificate that remote repositories present to upstreams (clientTlsCertificate). PEM holds the certificate chain and PrivateKey its key, sealed at rest (decision 0017). Every other field is parsed from the PEM once at upload, so listings never re-parse.
type Checksums ¶
type Checksums struct {
SHA256 string `json:"sha256,omitempty"`
SHA512 string `json:"sha512,omitempty"`
SHA1 string `json:"sha1,omitempty"`
MD5 string `json:"md5,omitempty"`
}
Checksums are hex digests of an item's content.
type CleanupCriteria ¶
type CleanupCriteria struct {
PackageTypes []string `json:"package_types,omitempty"`
Repos []string `json:"repos,omitempty"`
ExcludedRepos []string `json:"excluded_repos,omitempty"`
IncludedPackages []string `json:"included_packages,omitempty"`
ExcludedPackages []string `json:"excluded_packages,omitempty"`
IncludeAllProjects bool `json:"include_all_projects,omitempty"`
IncludedProjects []string `json:"included_projects,omitempty"`
CreatedBeforeInDays int `json:"created_before_in_days,omitempty"`
CreatedBeforeInMonths int `json:"created_before_in_months,omitempty"`
LastDownloadedBeforeInDays int `json:"last_downloaded_before_in_days,omitempty"`
LastDownloadedBeforeInMonths int `json:"last_downloaded_before_in_months,omitempty"`
KeepLastNVersions int `json:"keep_last_n_versions,omitempty"`
IncludedProperties map[string][]string `json:"included_properties,omitempty"`
ExcludedProperties map[string][]string `json:"excluded_properties,omitempty"`
IncludedPackageVersions []string `json:"included_package_versions,omitempty"`
ExcludedPackageVersions []string `json:"excluded_package_versions,omitempty"`
}
CleanupCriteria select what a package cleanup policy removes. Stored as the policy's document; the legacy month fields are kept so a policy written by an old client round-trips.
type CleanupItemType ¶
type CleanupItemType string
CleanupItemType is what a cleanup policy deletes.
const ( CleanupPackage CleanupItemType = "package" CleanupBuild CleanupItemType = "build" CleanupReleaseBundle CleanupItemType = "releaseBundle" )
Cleanup item types.
type CleanupPolicy ¶
type CleanupPolicy struct {
Key string
Description string
CronExp string
ProjectKey string
ItemType CleanupItemType
DurationMinutes int
Enabled bool
SkipTrashcan bool
Criteria CleanupCriteria
Created time.Time
CreatedBy string
Updated time.Time
UpdatedBy string
}
CleanupPolicy is a scheduled retention rule (decision 0010).
type CleanupRun ¶
type CleanupRun struct {
ID int64
PolicyKey string
TriggerID int64
ItemType CleanupItemType
Status RunStatus
DryRun bool
Manual bool
TriggeredBy string
Started time.Time
Ended time.Time
TotalItems int64
CleanedItems int64
CleanedSize int64
Report []byte
}
CleanupRun is one execution of a cleanup policy.
type ConfigDocument ¶
type ConfigDocument struct {
Kind ConfigKind
Key string
Enabled bool
Document []byte
Secrets map[string]string `json:"-"`
Updated time.Time
}
ConfigDocument is one configuration document. Document is the JSON the owning service defines (usually its wire form with secrets removed); Secrets holds the removed values by name and is sealed at rest, so a read of Document can never leak one. Key is unique within Kind; OIDC identity mappings use "<provider>/<name>".
type ConfigKind ¶
type ConfigKind string
ConfigKind names a family of configuration documents that are stored and returned whole and never queried by field: identity-provider settings, the YAML descriptor sections that are not repositories or security, and the external secret backends. They share one table (research 15 section 4) because a column per wire field would only mirror the document.
const ( ConfigOIDC ConfigKind = "oidc" ConfigOIDCMapping ConfigKind = "oidc_identity_mapping" ConfigLDAP ConfigKind = "ldap" ConfigLDAPGroup ConfigKind = "ldap_group" ConfigSAML ConfigKind = "saml" ConfigCrowd ConfigKind = "crowd" ConfigHTTPSSO ConfigKind = "http_sso" ConfigVault ConfigKind = "vault" ConfigProxy ConfigKind = "proxy" ConfigPropertySet ConfigKind = "property_set" ConfigLayout ConfigKind = "layout" ConfigBackup ConfigKind = "backup" ConfigMailServer ConfigKind = "mail_server" ConfigReverseProxy ConfigKind = "reverse_proxy" ConfigGPGSigningKey ConfigKind = "gpg_signing_key" ConfigCurationSettings ConfigKind = "curation" )
Configuration document kinds.
type CreatedOrder ¶
type CreatedOrder struct{}
CreatedOrder orders by creation time, then by version string so the order is total. Docker, OCI and Helm OCI tags carry no ordering of their own; Artifactory sorts them by manifest timestamp, which Max Unique Tags removes the oldest of.
func (CreatedOrder) Compare ¶
func (CreatedOrder) Compare(a, b PackageVersion) int
Compare orders by Created, falling back to the tag name.
type DistributionJob ¶
type DistributionJob struct {
TrackerID int64
PeerInstanceID string
Status JobStatus
Priority int
Started time.Time
Finished time.Time
Error string
}
DistributionJob is one tracker's work for one target, carried on its own peer stream.
type DistributionRule ¶
type DistributionRule struct {
SiteName string `json:"site_name,omitempty"`
CityName string `json:"city_name,omitempty"`
CountryCodes []string `json:"country_codes,omitempty"`
Priority int `json:"priority,omitempty"`
}
DistributionRule selects targets; empty fields match everything. SiteName accepts '*' wildcards as JFrog's rules do.
func (DistributionRule) Matches ¶
func (r DistributionRule) Matches(t DistributionTarget) bool
Matches reports whether t satisfies the rule.
type DistributionTarget ¶
type DistributionTarget struct {
PeerInstanceID string
SiteName string
CityName string
CountryCode string
}
DistributionTarget is an edge: a peer paired for distribution, with the location rules select on.
func SelectTargets ¶
func SelectTargets(rules []DistributionRule, targets []DistributionTarget) []DistributionTarget
SelectTargets returns the targets any rule matches, in target order.
type DistributionTracker ¶
type DistributionTracker struct {
ID int64
BundleName string
BundleVersion string
Kind TrackerKind
DryRun bool
AutoCreateMissingRepositories bool
Rules []DistributionRule
Status JobStatus
Created time.Time
CreatedBy string
}
DistributionTracker is one distribute or delete request (int64 id on the wire) with its selection rules.
type Environment ¶
Environment is a deployment stage repositories are assigned to. ProjectKey is empty for global environments.
type ExecutionKind ¶
type ExecutionKind string
ExecutionKind is what an archive execution does.
const ( ExecutionArchive ExecutionKind = "archive" ExecutionRestore ExecutionKind = "restore" ExecutionPurge ExecutionKind = "purge" )
Execution kinds.
type ExecutionState ¶
type ExecutionState string
ExecutionState is the state of an archive, restore or purge execution.
const ( ExecutionPending ExecutionState = "PENDING" ExecutionInProgress ExecutionState = "IN_PROGRESS" ExecutionInProgressWithErrors ExecutionState = "IN_PROGRESS_WITH_ERRORS" ExecutionComplete ExecutionState = "COMPLETE" ExecutionCompleteWithErrors ExecutionState = "COMPLETE_WITH_ERRORS" ExecutionFailed ExecutionState = "FAILED" )
Execution states as the cold-storage API reports them.
type FailedBlobFetch ¶
type FailedBlobFetch struct {
Stream string
SHA256 string
SHA1 string
RepoKey string
FirstFailed time.Time
Failures int
LastError string
}
FailedBlobFetch records content a receiver could not fetch from a peer; it backs the federation failed-binary APIs and is retried with back-off.
type FederatedEntity ¶
type FederatedEntity string
FederatedEntity is an entity type Access Federation streams.
const ( EntityUsers FederatedEntity = "USERS" EntityGroups FederatedEntity = "GROUPS" EntityPermissions FederatedEntity = "PERMISSIONS" EntityTokens FederatedEntity = "TOKENS" )
Federated entity types.
type FederationMember ¶
type FederationMember struct {
RepoKey string
PeerInstanceID string
BaseURL string
RemoteRepoKey string
Enabled bool
}
FederationMember is one member of a federated repository, normalised from the repository's members list. Members are peers paired for federation (decision 0022); RemoteRepoKey is the repository's key on that peer.
type FederationPriority ¶
type FederationPriority string
FederationPriority orders the dispatch of a repository's outbox batches.
const ( PriorityHigh FederationPriority = "HIGH" PriorityStandard FederationPriority = "STANDARD" )
Federation priorities.
type FederationSettings ¶
type FederationSettings struct {
Priority FederationPriority `json:"priority,omitempty"`
PropagateCreatedTime bool `json:"propagate_created_time,omitempty"`
Disabled bool `json:"disabled,omitempty"`
}
FederationSettings are artifactweave's per-repository federation switches. They have no field in JFrog's repository JSON, so they are stored as their own document beside the repository configuration.
type FolderDownloadSettings ¶
type FolderDownloadSettings struct {
Enabled bool `json:"enabled"`
EnabledForAnonymous bool `json:"enabled_for_anonymous"`
MaxDownloadSizeMB int `json:"max_download_size_mb"`
MaxFiles int `json:"max_files"`
}
FolderDownloadSettings gate downloading a folder as one archive. As in Artifactory, it is off until enabled, and anonymous callers need their own switch.
type FullSyncRun ¶
type FullSyncRun struct {
ID int64
RepoKey string
PeerInstanceID string
Forced bool
SnapshotSeq int64
Started time.Time
Finished time.Time
Status RunStatus
ResultPaths []string
}
FullSyncRun is one snapshot resynchronisation of a repository with a peer.
type Grants ¶
type Grants struct {
Users map[string]Actions `json:"users,omitempty"`
Groups map[string]Actions `json:"groups,omitempty"`
}
Grants map principal names to the actions they hold.
type Group ¶
type Group struct {
Name string
Description string
AutoJoin bool
AdminPrivileges bool
Realm string
RealmAttributes string
ExternalID string
Members []string
Roles RoleFlags
}
Group is a set of users that permissions and roles can name.
func GroupFromAccess ¶
func GroupFromAccess(w wire.AccessGroup) Group
GroupFromAccess reads an Access v2 group document. The group form calls the resources role manage_resources; internally it is the same flag as the user form's resources_manager.
func GroupFromLegacy ¶
func GroupFromLegacy(w wire.LegacyGroup) Group
GroupFromLegacy reads a legacy group document.
type HLC ¶
HLC is a hybrid logical clock timestamp (Kulkarni et al., 2014): physical milliseconds plus a logical counter. It orders events across instances whose wall clocks disagree, which last-writer-wins needs (decision 0021).
func (HLC) Merge ¶
Merge is the timestamp of receiving remote at physical time now, so the local clock never runs behind anything it has seen.
type HandlerType ¶
type HandlerType string
HandlerType is the delivery mechanism of a webhook handler.
const ( HandlerWebhook HandlerType = "webhook" HandlerCustomWebhook HandlerType = "custom-webhook" )
Handler types.
type InstanceIdentity ¶
type InstanceIdentity struct {
InstanceID string
PublicKey ed25519.PublicKey
PrivateKey ed25519.PrivateKey `json:"-"`
NamespaceID string // cold-storage namespace (decision 0024)
ProtocolVersion int
}
InstanceIdentity is this instance's singleton identity, created at first start. The private key is sealed (decision 0017) and never serialised.
type Item ¶
type Item struct {
ID int64 `json:"id"`
RepoKey string `json:"repo_key"`
Path string `json:"path"`
Name string `json:"name"`
Depth int `json:"depth"`
Folder bool `json:"folder"`
Cached bool `json:"cached"`
Size int64 `json:"size"`
Actual Checksums `json:"actual"`
Original Checksums `json:"original"`
MimeType string `json:"mime_type,omitempty"`
Created time.Time `json:"created"`
CreatedBy string `json:"created_by,omitempty"`
Modified time.Time `json:"modified"`
ModifiedBy string `json:"modified_by,omitempty"`
Updated time.Time `json:"updated"`
RemoteURL string `json:"remote_url,omitempty"`
PropertiesModified time.Time `json:"properties_modified,omitzero"`
}
Item is one file or folder in the canonical form of decision 0004. Path is the parent folder ("." at the root), Name the last segment, and Depth the number of segments in the full path, so an item at the root has depth 1. Cached items belong to a remote repository's cache and are reported under RepoKey plus CacheSuffix. Actual holds what the server computed; Original holds what the client declared at deploy time, so a mismatch stays visible to the bad-checksum search. The type is persisted as part of the trash record, hence the tags.
PropertiesModified is when the item's properties last changed, zero while it has none; the storage API lists it as mdTimestamps.properties. Only the property methods of store.ItemStore set it. Put keeps the stored value whatever the caller passes, so a trash record or a copied item cannot carry another item's time onto the one written.
func RootItem ¶
RootItem is the record of a repository root, which holds the properties set on the repository itself. AQL reports a root with "." as both its path and its name and a depth of 0, so the record is stored that way; no other item can be named ".", because SplitItemPath refuses the segment.
func (Item) FullPath ¶
FullPath is the item's path inside its repository without a leading slash, "" for a repository root.
func (Item) ReportedRepoKey ¶
ReportedRepoKey is the repository key clients see for the item: the cache alias for cached items (decision 0007).
func (Item) StoragePath ¶
StoragePath is the path as the storage API prints it, with a leading slash.
type ItemStats ¶
type ItemStats struct {
DownloadCount int64 `json:"download_count"`
LastDownloaded time.Time `json:"last_downloaded"`
LastDownloadedBy string `json:"last_downloaded_by,omitempty"`
RemoteDownloadCount int64 `json:"remote_download_count"`
RemoteLastDownloaded time.Time `json:"remote_last_downloaded"`
RemoteLastDownloadedBy string `json:"remote_last_downloaded_by,omitempty"`
RemoteOrigin string `json:"remote_origin,omitempty"`
RemotePath string `json:"remote_path,omitempty"`
}
ItemStats are an item's download statistics. They change out of band of the item record (every download updates them), so they live in their own table.
type JobStatus ¶
type JobStatus string
JobStatus is the state of a tracker or of one per-target job. The strings are Distribution's display values as jfrog-client-go and the archived REST examples show them (research 17); Aborted is artifactweave's, reported after an abort request because no published example shows that state.
const ( JobNotDistributed JobStatus = "Not distributed" JobInQueue JobStatus = "In queue" JobInProgress JobStatus = "In progress" JobCompleted JobStatus = "Completed" JobFailed JobStatus = "Failed" JobAborted JobStatus = "Aborted" )
Job statuses.
func TrackerStatus ¶
func TrackerStatus(jobs []DistributionJob) JobStatus
TrackerStatus summarises job statuses: failed if any failed, in progress while any is running or queued, completed when all completed.
type Keypair ¶
type Keypair struct {
Name string
Type KeypairType
Alias string
PublicKey string
PrivateKey string `json:"-"`
Passphrase string `json:"-"`
}
Keypair is a named signing key pair (the security API's pairName). The private key and passphrase are sealed at rest (decision 0017).
type KeypairRole ¶
type KeypairRole string
KeypairRole is how a repository uses a key pair: the primary key signs metadata, the secondary is published for clients rotating to it.
const ( KeypairPrimary KeypairRole = "primary" KeypairSecondary KeypairRole = "secondary" )
Key pair roles.
type KeypairType ¶
type KeypairType string
KeypairType is the kind of a stored key pair.
const ( KeypairRSA KeypairType = "RSA" KeypairGPG KeypairType = "GPG" )
Key pair types the security API accepts.
type Lease ¶
Lease is a named lock on background work (cleanup runs, replication, GC, archive runs). The scheduler takes one before a run so a job never overlaps itself, and the locks endpoint reports the table.
type MFAStatus ¶
type MFAStatus string
MFAStatus is the legacy view's multi-factor status; artifactweave has no MFA of its own, so it reports what an identity provider recorded or NONE.
type Matrix ¶
type Matrix struct {
Props Properties
Mandatory map[string]bool
}
Matrix is a download's matrix parameters: the values asked for per key, and the keys sent as "key+=value", which the item must carry.
func (Matrix) Matches ¶
func (m Matrix) Matches(props Properties) bool
Matches reports whether a file carrying props serves a download that asks for m: a key the file carries must have one of the values asked for, and a mandatory key must be carried. A key the file lacks does not stop a match otherwise.
type NamedSecret ¶
NamedSecret is a custom webhook secret. The value is sealed in its own table (decision 0017) and never written into the document.
type OutboxEntry ¶
type OutboxEntry struct {
Origin string
Stream string
Seq int64
Time HLC
EventType string
Payload []byte
BlobSHA256 string
BlobSize int64
Created time.Time
}
OutboxEntry is one change queued for peers, written in the same transaction as the change it records. (Origin, Stream, Seq) is unique and Seq is gap-free per stream, which lets a receiver detect a missing batch. BlobSHA256 is set for content events; receivers pull the blob.
type Package ¶
Package is one name in one repository's package index (decision 0018). The pair (RepoKey, Name) is unique; Type is copied from the repository so the index can be queried without a join.
type PackageVersion ¶
type PackageVersion struct {
ID int64
PackageID int64
Version string
OrderKey int64
Created time.Time
LastDownloaded time.Time
Metadata []byte
}
PackageVersion is one version of a package. OrderKey is the version's rank under the package type's comparator, recomputed by the store whenever the package's version set changes, so SQL can sort and window (keepLastNVersions) without reimplementing every comparator in two dialects. Metadata is the format handler's per-version document (a packument fragment, a nuspec summary, a chart entry) and is opaque here.
type PairingNonce ¶
type PairingNonce struct {
NonceHash []byte
UseCase UseCase
ExpiresAt time.Time
RedeemedAt time.Time
}
PairingNonce backs a single-use pairing token. Only the nonce hash is stored until the token is redeemed.
type PasswordExpirationPolicy ¶
type PasswordExpirationPolicy struct {
Enabled bool `json:"enabled"`
MaxAgeDays int `json:"max_age_days"`
NotifyByEmail bool `json:"notify_by_email"`
}
PasswordExpirationPolicy expires internal passwords after MaxAgeDays.
type PasswordPolicy ¶
type PasswordPolicy struct {
Uppercase int `json:"uppercase"`
Lowercase int `json:"lowercase"`
Digit int `json:"digit"`
SpecialChar int `json:"special_char"`
Length int `json:"length"`
NotMatchOld bool `json:"not_match_old"`
}
PasswordPolicy constrains new internal passwords.
DefaultPasswordPolicy is in force while none is stored, and a replacing PUT resets every field it leaves out to it.
func DefaultPasswordPolicy ¶
func DefaultPasswordPolicy() PasswordPolicy
DefaultPasswordPolicy is Access's documented default: no character classes required, at least 4 characters, and not the old password (docs.jfrog.com, supported Access configurations, security.password-policy). The documented rule that a password cannot match the username has no field and always applies.
type PathMapping ¶
PathMapping rewrites a source path to a target path; Output may refer to capture groups of Input.
type PatternFilter ¶
type PatternFilter struct {
Include []string `json:"include_patterns,omitempty"`
Exclude []string `json:"exclude_patterns,omitempty"`
}
PatternFilter includes and excludes names by glob; an empty include list includes everything.
func (PatternFilter) Matches ¶
func (f PatternFilter) Matches(name string) bool
Matches reports whether name passes the filter.
type Peer ¶
type Peer struct {
InstanceID string
BaseURL string
PublicKey ed25519.PublicKey
ProtocolVersion int
UseCases []UseCase
Status PeerStatus
LastSeen time.Time
DisplayName string
CityName string
CountryCode string
EdgeRole bool
}
Peer is another instance this one is paired with: a federation member, a distribution edge, an Access Federation target, a follower JPD or a topology site. Location fields are set by the administrator.
func (Peer) DeriveStatus ¶
func (p Peer) DeriveStatus( now time.Time, stale time.Duration, rejected bool, failingUseCases int, ) PeerStatus
DeriveStatus computes the JPD status: UNAUTHORIZED when the last signed exchange was rejected, OFFLINE when nothing succeeded within the stale window, PARTIAL when some use cases are failing, ONLINE otherwise.
type PeerCursor ¶
type PeerCursor struct {
PeerInstanceID string
Stream string
AckedSeq int64
LastSent time.Time
LastError string
}
PeerCursor is the highest sequence a peer has acknowledged on a stream.
func (PeerCursor) Behind ¶
func (c PeerCursor) Behind(head int64) int64
Behind is how many entries the peer still has to apply, given the stream's head sequence.
type PeerStatus ¶
type PeerStatus string
PeerStatus is a peer's health as the JPD APIs report it (decision 0025).
const ( PeerOnline PeerStatus = "ONLINE" PeerOffline PeerStatus = "OFFLINE" PeerPartial PeerStatus = "PARTIAL" )
Peer statuses.
type Permission ¶
type Permission struct {
Name string
Description string
Resources map[ResourceType]Resource
Created time.Time
Updated time.Time
}
Permission is the single internal representation of every permission wire form (decision 0006). Resources are stored as one JSON document in the Access v2 shape; the grants are also flattened into a table the authorizer queries by principal (research 15 section 4).
func PermissionFromAccess ¶
func PermissionFromAccess(w wire.AccessPermission) (Permission, error)
PermissionFromAccess reads an Access v2 permission. It is the internal shape already, so every resource type round-trips.
func PermissionFromV1 ¶
func PermissionFromV1(w wire.PermissionTargetV1) (Permission, error)
PermissionFromV1 reads a legacy v1 permission target. It covers repositories only, so the result has just the artifact resource.
func PermissionFromV2 ¶
func PermissionFromV2(w wire.PermissionTargetV2) (Permission, error)
PermissionFromV2 reads a legacy v2 permission target.
func (Permission) ResourceTypes ¶
func (p Permission) ResourceTypes() []ResourceType
ResourceTypes returns the permission's sections in a stable order.
type PlatformFederation ¶
type PlatformFederation struct {
ID string
Name string
Description string
ConnectionGroups map[string][]string
Entities []string
}
PlatformFederation is a named set of connection groups of follower JPDs. The entity types are Curation's and carry no data in artifactweave; they are stored so the federation round-trips.
type PrincipalType ¶
type PrincipalType string
PrincipalType distinguishes users from groups in memberships and grants.
const ( PrincipalUser PrincipalType = "user" PrincipalGroup PrincipalType = "group" )
Principal types.
type Project ¶
type Project struct {
Key string
DisplayName string
Description string
AdminPrivileges AdminPrivileges
StorageQuotaBytes int64 // -1 or 0 means unlimited, as the provider sends
SoftLimit bool
QuotaEmail bool
}
Project groups repositories, members and roles under a key.
type ProjectMember ¶
type ProjectMember struct {
ProjectKey string
Type PrincipalType
Name string
Roles []string
}
ProjectMember is a user or group's roles in one project.
type Properties ¶
Properties are an item's multi-valued properties. Values are kept sorted and unique so listings and comparisons are deterministic.
func (Properties) Add ¶
func (p Properties) Add(key string, values ...string)
Add adds values to key, keeping existing ones.
func (Properties) Equal ¶
func (p Properties) Equal(o Properties) bool
Equal reports whether p and o hold the same keys with the same values in the same order; nil and empty are equal. Values in the order Set keeps them compare as sets.
func (Properties) Has ¶
func (p Properties) Has(key, value string) bool
Has reports whether key carries value; an empty value matches any value, which is how property search treats a key given without a value.
func (Properties) Set ¶
func (p Properties) Set(key string, values ...string)
Set replaces the values of key.
type PropertyValues ¶
PropertyValues is one key and its values in a bundle spec or artifact.
type RegistryAccess ¶
type RegistryAccess struct {
// Realm is the repository key the token endpoint was addressed by, the
// <repo> of .../api/docker/<repo>/v2/token or a subdomain's repository;
// empty for null and for /v2/token on the repository path, where each
// name begins with its repository key.
Realm string `json:"realm,omitempty"`
Grants []RegistryGrant `json:"access"`
}
RegistryAccess is what a registry token grants: the scopes the client asked the token endpoint for, each with only the actions the caller held.
type RegistryGrant ¶
type RegistryGrant struct {
Type string `json:"type"`
Name string `json:"name"`
Actions []string `json:"actions"`
}
RegistryGrant is one granted scope in the Docker token specification's form: type repository with an image name as the client addresses it and the actions pull, push and delete, or type registry with name catalog.
type ReleaseBundle ¶
type ReleaseBundle struct {
Name string
Version string
Description string
Notes ReleaseNotes
StoringRepository string
State BundleState
Spec BundleSpec
ProjectKey string
Origin BundleOrigin
Created time.Time
CreatedBy string
SignedAt time.Time
SigningKeyAlias string
Signature []byte
}
ReleaseBundle is one version of a release bundle v1.
type ReleaseNotes ¶
type ReleaseNotes struct {
Syntax string `json:"syntax,omitempty"`
Content string `json:"content,omitempty"`
}
ReleaseNotes accompany a bundle version.
type ReplicaState ¶
type ReplicaState string
ReplicaState is where one member of a blob mirror stands with one blob (decision 0028).
const ( // ReplicaPresent: the member holds the blob. ReplicaPresent ReplicaState = "present" // ReplicaPending: the member should hold the blob and the repair worker // will copy it there. ReplicaPending ReplicaState = "pending" // ReplicaDeleting: the blob was deleted and this member's copy still has // to be removed. ReplicaDeleting ReplicaState = "deleting" // ReplicaFailed: repair gave up after repeated attempts; an operator or a // manual repair pass has to act. ReplicaFailed ReplicaState = "failed" )
Replica states.
type Replication ¶
type Replication struct {
RepoKey string
Key string
URL string
Username string
Password string `json:"-"`
Enabled bool
CronExp string
EventReplication bool
SyncDeletes bool
SyncProperties bool
SyncStatistics bool
IncludePathPrefix string
ExcludePathPrefix string
Proxy string
DisableProxy bool
CheckBinaryExistence bool
SocketTimeout time.Duration
}
Replication is one replication target of a repository. Key is the server-assigned replicationKey; Password is sealed.
type ReplicationDirection ¶
type ReplicationDirection string
ReplicationDirection is derived from the repository class.
const ( ReplicationPush ReplicationDirection = "push" ReplicationPull ReplicationDirection = "pull" )
Replication directions.
func DirectionFor ¶
func DirectionFor(c repo.Class) (ReplicationDirection, bool)
DirectionFor returns how a repository of class c replicates: locals push, remotes pull; other classes do not replicate.
type ReplicationRun ¶
type ReplicationRun struct {
ReplicationKey string
Started time.Time
Completed time.Time
Status ReplicationStatus
}
ReplicationRun records one execution of a replication, for the status endpoint. A zero Completed means the run is still going.
type ReplicationStatus ¶
type ReplicationStatus string
ReplicationStatus is the reported state of a repository's replication.
const ( ReplicationUnknown ReplicationStatus = "unknown" ReplicationNeverRun ReplicationStatus = "never_run" ReplicationIncomplete ReplicationStatus = "incomplete" ReplicationError ReplicationStatus = "error" ReplicationWarn ReplicationStatus = "warn" ReplicationOK ReplicationStatus = "ok" ReplicationInconsistent ReplicationStatus = "inconsistent" ReplicationPartialFailure ReplicationStatus = "partial_failure" )
Replication statuses.
type RepositoryAssignment ¶
type RepositoryAssignment struct {
RepoKey string
ProjectKey string
Environments []string
Updated time.Time
}
RepositoryAssignment records which project owns a repository and with whom it is shared.
type ResourceType ¶
type ResourceType string
ResourceType is a section of an Access v2 permission.
const ( ResourceArtifact ResourceType = "artifact" ResourceBuild ResourceType = "build" ResourceReleaseBundle ResourceType = "release_bundle" ResourceDestination ResourceType = "destination" ResourcePipelineSource ResourceType = "pipeline_source" )
Resource types. Destination carries Distribution's DESTINATION permissions (decision 0023); pipeline sources are accepted for round-tripping only.
type RestoreRequest ¶
type RestoreRequest struct {
Type RestoreType
Items []string
ToOriginal bool
FallbackPath string
CentralPath string
NewPath string
AddNamespace bool
ManifestPaths []string
}
RestoreRequest asks for archived content back. Items are archived paths or package references; when ToOriginal is false or the original path is taken, the fallback, central or new destination applies.
func (RestoreRequest) Validate ¶
func (r RestoreRequest) Validate() error
Validate checks the request is executable: a known type, at least one and at most MaxRestoreItems items, and somewhere to put them.
type RestoreType ¶
type RestoreType string
RestoreType is what a restore request names.
const ( RestorePackage RestoreType = "PACKAGE_RESTORE" RestoreArtifact RestoreType = "ARTIFACT_RESTORE" )
Restore types.
type Role ¶
type Role struct {
ProjectKey string
Name string
Type RoleType
Description string
Environments []string
Actions []string
}
Role is a named set of actions over environments. ProjectKey is empty for global roles.
func BuiltinGlobalRole ¶
BuiltinGlobalRole returns the built-in global role called name.
func BuiltinGlobalRoles ¶
func BuiltinGlobalRoles() []Role
BuiltinGlobalRoles returns copies of the ADMIN and PREDEFINED global roles, in the order the Access API lists them.
type RoleFlags ¶
type RoleFlags struct {
WatchManager bool `json:"watch_manager,omitempty"`
PolicyViewer bool `json:"policy_viewer,omitempty"`
PolicyManager bool `json:"policy_manager,omitempty"`
ReportsManager bool `json:"reports_manager,omitempty"`
ResourcesManager bool `json:"resources_manager,omitempty"`
ManageWebhook bool `json:"manage_webhook,omitempty"`
PlatformAuditor bool `json:"platform_auditor,omitempty"`
}
RoleFlags are the platform role switches JFrog keeps on users and groups. They are stored as one JSON document per principal (research 15 section 4) because the set grows with JFrog releases and none of them is queried.
type RoleType ¶
type RoleType string
RoleType distinguishes built-in from administrator-defined roles.
type RunStatus ¶
type RunStatus string
RunStatus is the status of a cleanup or smart-archiving run.
const ( RunInProgress RunStatus = "IN_PROGRESS" RunInProgressWithErrors RunStatus = "IN_PROGRESS_WITH_ERRORS" RunCompleted RunStatus = "COMPLETED" RunCompletedWithErrors RunStatus = "COMPLETED_WITH_ERRORS" RunStopped RunStatus = "STOPPED" RunStopping RunStatus = "STOPPING" RunFailed RunStatus = "FAILED" RunPendingWarm RunStatus = "PENDING_WARM" RunPartialWarmed RunStatus = "PARTIAL_WARMED" RunWarmed RunStatus = "WARMED" )
Run statuses as JFrog reports them.
type Scope ¶
type Scope struct {
Entries []ScopeEntry
}
Scope is a parsed token scope.
func ParseScope ¶
ParseScope reads a scope string. Entries are separated by whitespace outside double quotes, because group and role names may be quoted and may contain spaces ("Project Admin").
func (Scope) Narrows ¶
Narrows reports whether s grants nothing beyond parent, which is the rule for issuing a token from another token or for a non-admin creating one: scopes only narrow (decision 0005). Resource scopes (artifact, build, repo, project) intersect the subject's applied permissions, so any applied entry covers them; system scopes grant capabilities the subject's permissions do not, so only admin or a matching system scope covers them.
type ScopeActions ¶
type ScopeActions uint16
ScopeActions are the resource-scope action letters r w d a x s m, or all.
const ( ScopeRead ScopeActions = 1 << iota ScopeWrite ScopeDelete ScopeAnnotate ScopeExecute ScopeScan ScopeManage ScopeAll )
Scope actions. ScopeAll is "*".
func (ScopeActions) Covers ¶
func (a ScopeActions) Covers(b ScopeActions) bool
Covers reports whether a grants everything b does.
func (ScopeActions) String ¶
func (a ScopeActions) String() string
type ScopeEntry ¶
type ScopeEntry struct {
Kind ScopeKind
Names []string
Project string
Target string
Path string
Qualifier string
Actions ScopeActions
}
ScopeEntry is one space-separated element of a scope string. Which fields are set depends on Kind: Names for groups and roles, Project for roles and project scopes, Target for the repository (artifact, build, repo), the project area or the system area, Path for an artifact or build ant path (a build's path is its document's, <name>/<number>-<started>.json), Qualifier for the part of a system scope after '@'.
func (ScopeEntry) String ¶
func (e ScopeEntry) String() string
String renders the entry in canonical form: names quoted only when they need it, actions in r,w,d,a,x,s,m order.
type ScopeKind ¶
type ScopeKind int
ScopeKind is the kind of one scope entry (research 05, scope grammar).
const ( ScopeUser ScopeKind = iota + 1 // applied-permissions/user ScopeAdmin // applied-permissions/admin ScopeGroups // applied-permissions/groups:"a","b" ScopeRoles // applied-permissions/roles:<project>:<role>,... ScopeArtifact // artifact:<repo|*>[/<ant path>]:<actions> ScopeRepo // repo:<key>:<actions> ScopeProject // project:<key>/<area>:<actions> ScopeSystem // system:<area>[@<qualifier>]:<actions> ScopeBuild // build:<build-info repo|*>[/<ant path>]:<actions> )
Scope kinds.
type SigningKey ¶
type SigningKey struct {
Alias string
PublicKey string
PrivateKey string `json:"-"`
Passphrase string `json:"-"`
IsDefault bool
}
SigningKey signs bundle manifests. The private key and passphrase are sealed and never serialised.
type StreamKind ¶
type StreamKind string
StreamKind is the family of an outbox stream.
const ( StreamRepository StreamKind = "repo" StreamAccess StreamKind = "access" StreamDistribution StreamKind = "distribution" )
Stream kinds (decision 0021).
func ParseStream ¶
func ParseStream(stream string) (StreamKind, string, error)
ParseStream splits a stream name into its kind and remainder.
type StringComparator ¶
StringComparator adapts a comparison of version strings.
func (StringComparator) Compare ¶
func (f StringComparator) Compare(a, b PackageVersion) int
Compare orders by the version string alone.
type Subject ¶
Subject is a parsed Access token subject, jfac@<service id>/users/<name>.
func ParseSubject ¶
ParseSubject reads a token subject. The JFrog CLI extracts the user name from the "/users/" segment, so that form is the one artifactweave issues.
type SyncStatus ¶
type SyncStatus string
SyncStatus is a federated repository's reported state.
const ( SyncSyncing SyncStatus = "SYNCING" SyncFullSyncRunning SyncStatus = "FULL_SYNC_RUNNING" SyncDisabled SyncStatus = "DISABLED" SyncOutOfSync SyncStatus = "OUT_OF_SYNC" )
Sync statuses.
func DeriveSyncStatus ¶
func DeriveSyncStatus( s FederationSettings, fullSyncRunning bool, lags []time.Duration, threshold time.Duration, ) SyncStatus
DeriveSyncStatus applies decision 0022: disabled wins, then a running snapshot, then out of sync when any member lags beyond the threshold.
type Target ¶
type Target struct {
Include []string `json:"include_patterns"`
Exclude []string `json:"exclude_patterns"`
}
Target scopes a resource to paths inside one repository or special target.
type Token ¶
type Token struct {
ID string
Subject string
Scope Scope
Audience string
Description string
ProjectKey string
IssuedAt time.Time
ExpiresAt time.Time
Refreshable bool
Revocable bool
LastUsed time.Time
AccessDigest []byte `json:"-"`
RefreshDigest []byte `json:"-"`
ReferenceDigest []byte `json:"-"`
// Purpose marks a token with a special role; empty for an ordinary one.
// A subject has at most one token of each purpose.
Purpose string
// Secret is the reference token of a purposed token, kept so it can be
// shown again; stores seal it. Empty for an ordinary token.
Secret string `json:"-"`
// Identity is how the subject resolves to a user.
Identity TokenIdentity
// Registry is set on a registry token alone, which the Docker token
// endpoint issues and nothing stores (decision 0005): what it grants.
Registry *RegistryAccess `json:"-"`
// Parent is, on a registry token obtained with a token, the stored
// token it descends from; revoking that token revokes it.
Parent string `json:"-"`
}
Token is the stored record of an access token. The JWT itself is never stored: AccessDigest, RefreshDigest and ReferenceDigest are hashes used to revoke by value and to resolve refresh and reference tokens. A zero ExpiresAt means the token never expires.
type TokenIdentity ¶
type TokenIdentity string
TokenIdentity says how a token's subject resolves to a user. Access issues tokens from an OIDC token exchange without checking that the mapped user exists (research 21), so such a token may name a user who is not stored.
const ( // IdentityStored: the subject must be a stored, enabled user. Every // token whose subject was a stored user when it was issued, other than // an OIDC exchange's. IdentityStored TokenIdentity = "" // IdentityTransient: a stored user of that name if there is one; // otherwise a transient user for the request, a member of the groups new // users join automatically. An OIDC exchange issues it, and so does an // administrator minting a token for a name that is no stored user. IdentityTransient TokenIdentity = "transient" // IdentitySynthetic: never a stored user and in no group but those the // scope names. An identity mapping without a user name issues it, so a // group-scoped token acts through exactly its groups. IdentitySynthetic TokenIdentity = "synthetic" )
Token identities.
type Topology ¶
type Topology struct {
Key string
Name string
Description string
Sites []TopologySite
Created time.Time
Modified time.Time
}
Topology is a named arrangement of sites.
type TopologySite ¶
TopologySite is one site of a topology, backed by a peer.
type TrackerKind ¶
type TrackerKind string
TrackerKind is what a distribution tracker does.
const ( TrackerDistribute TrackerKind = "distribute" TrackerDelete TrackerKind = "delete" )
Tracker kinds.
type TrashEntry ¶
type TrashEntry struct {
ID int64
Record TrashRecord
DeletedAt time.Time
DeletedBy string
}
TrashEntry is one deleted item awaiting restore or purge.
type TrashRecord ¶
type TrashRecord struct {
Item Item `json:"item"`
Properties Properties `json:"properties,omitempty"`
// PackageType is the package type of the repository the item was
// deleted from, recorded then because the trash can still shows it once
// that repository is gone, when it tells an administrator what type of
// repository to recreate for a restore.
PackageType string `json:"packageType,omitempty"`
}
TrashRecord is what the trash can keeps of a deleted item, as one JSON document, so a restore recreates the item and its properties exactly.
type TrashcanSettings ¶
type TrashcanSettings struct {
Enabled bool `json:"enabled"`
RetentionDays int `json:"retention_days"`
}
TrashcanSettings control the trash can.
type TrustedKey ¶
type TrustedKey struct {
Kid string
Alias string
PublicKey string
Fingerprint string
IssuedOn time.Time
IssuedBy string
ValidUntil time.Time
}
TrustedKey is a public GPG key trusted for verifying release bundles (/api/security/keys/trusted). Kid is server-assigned; the other derived fields are parsed from the key at upload.
type User ¶
type User struct {
Name string
Email string
PasswordHash []byte `json:"-"`
Admin bool
ProfileUpdatable bool
InternalPasswordDisabled bool
DisableUIAccess bool
Realm string
Status UserStatus
MFA MFAStatus
Groups []string
Roles RoleFlags
LastLoggedIn time.Time
Created time.Time
// FailedLogins counts consecutive failed password checks; the user lock
// policy locks the account when it reaches the limit, and a successful
// login or an unlock resets it.
FailedLogins int
// PasswordChanged is when the internal password was last set; the
// password expiration policy measures its age from here.
PasswordChanged time.Time
// PasswordExpired forces a password change: set by the expirePassword
// endpoint, cleared by unexpirePassword or a new password.
PasswordExpired bool
}
User is an account. PasswordHash is an Argon2id encoding (decision 0005) and never leaves the server; the wire forms carry passwords write-only.
func UserFromAccess ¶
func UserFromAccess(w wire.AccessUser) (User, error)
UserFromAccess reads an Access v2 user document.
func UserFromLegacy ¶
func UserFromLegacy(w wire.LegacyUser) (User, error)
UserFromLegacy reads a legacy user document. Absent flags take the documented defaults (profileUpdatable true, everything else false); the write-only password stays on the wire struct for the caller to hash.
type UserLockPolicy ¶
type UserLockPolicy struct {
Enabled bool `json:"enabled"`
LoginAttempts int `json:"login_attempts"`
}
UserLockPolicy locks an account after repeated failed logins.
type UserStatus ¶
type UserStatus string
UserStatus is the Access account status. The legacy API spells a subset of it in upper case.
const ( UserInvited UserStatus = "invited" UserEnabled UserStatus = "enabled" UserDisabled UserStatus = "disabled" UserLocked UserStatus = "locked" )
User statuses.
type VersionComparator ¶
type VersionComparator interface {
Compare(a, b PackageVersion) int
}
VersionComparator orders the versions of one package (decision 0018). Compare returns a negative number when a sorts before b, zero when they are equivalent and a positive number otherwise. Retention (keepLastNVersions), tag limits, "latest" resolution and the registration endpoints all sort through it, so one ecosystem never borrows another's rules.
func ComparatorFor ¶
func ComparatorFor(t repo.PackageType) VersionComparator
ComparatorFor returns the comparator a package type sorts with. Types without a documented scheme (generic and the ecosystems artifactweave does not implement) use Maven ordering, which is what Artifactory's layout-based version search applies to any layout with a [baseRev] token.
type VersionFile ¶
VersionFile links a version to an item that belongs to it.
type WebhookCriteria ¶
type WebhookCriteria struct {
AnyLocal bool `json:"any_local,omitempty"`
AnyRemote bool `json:"any_remote,omitempty"`
AnyFederated bool `json:"any_federated,omitempty"`
AnyBuild bool `json:"any_build,omitempty"`
AnyReleaseBundle bool `json:"any_release_bundle,omitempty"`
RepoKeys []string `json:"repo_keys,omitempty"`
SelectedBuilds []string `json:"selected_builds,omitempty"`
IncludePatterns []string `json:"include_patterns,omitempty"`
ExcludePatterns []string `json:"exclude_patterns,omitempty"`
RegisteredReleaseBundleNames []string `json:"registered_release_bundle_names,omitempty"`
SelectedReleaseBundles map[string][]string `json:"selected_release_bundles,omitempty"`
SelectedEnvironments []string `json:"selected_environments,omitempty"`
ApplicationKeys []string `json:"application_keys,omitempty"`
Stages []string `json:"stages,omitempty"`
}
WebhookCriteria select which events of the domain fire. Stored with the subscription as one document.
type WebhookDelivery ¶
type WebhookDelivery struct {
ID int64
WebhookKey string
EventID string
EventType string
AttemptedAt time.Time
Status int
Elapsed time.Duration
Request []byte
Response []byte
}
WebhookDelivery is one recorded delivery attempt for the troubleshooting endpoint. Request and Response are snapshots kept as documents.
type WebhookDomain ¶
type WebhookDomain string
WebhookDomain is the event family a subscription listens to.
const ( DomainArtifact WebhookDomain = "artifact" DomainArtifactProperty WebhookDomain = "artifact_property" DomainDocker WebhookDomain = "docker" DomainBuild WebhookDomain = "build" DomainUser WebhookDomain = "user" DomainReleaseBundle WebhookDomain = "release_bundle" DomainDistribution WebhookDomain = "distribution" DomainArtifactoryReleaseBundle WebhookDomain = "artifactory_release_bundle" DomainDestination WebhookDomain = "destination" DomainReleaseBundleV2 WebhookDomain = "release_bundle_v2" DomainReleaseBundleV2Promotion WebhookDomain = "release_bundle_v2_promotion" DomainArtifactLifecycle WebhookDomain = "artifact_lifecycle" DomainXrayScanStatus WebhookDomain = "xray_scan_status" DomainAppTrust WebhookDomain = "app_trust" DomainCuration WebhookDomain = "curation" )
Webhook domains (research 07).
type WebhookHandler ¶
type WebhookHandler struct {
Type HandlerType `json:"type"`
URL string `json:"url"`
Proxy string `json:"proxy,omitempty"`
Secret string `json:"-"`
UseSecretForSigning bool `json:"use_secret_for_signing,omitempty"`
Headers []Header `json:"headers,omitempty"`
Method string `json:"method,omitempty"`
Payload string `json:"payload,omitempty"`
Secrets []NamedSecret `json:"secrets,omitempty"`
}
WebhookHandler delivers an event. Secret is sealed like NamedSecret.Value.
type WebhookSubscription ¶
type WebhookSubscription struct {
Key string
ProjectKey string
Description string
Enabled bool
Debug bool
Domain WebhookDomain
EventTypes []string
Criteria WebhookCriteria
Handlers []WebhookHandler
Created time.Time
Updated time.Time
}
WebhookSubscription is one subscription. Key and ProjectKey are immutable.
type WorkItem ¶
type WorkItem struct {
Kind string
Key string
// Payload is a small JSON document from the latest enqueue.
Payload []byte
State WorkState
// Attempts counts the runs started since the item was last enqueued
// afresh; it is what parks a key that keeps failing.
Attempts int
// Generation increases with every lease, so a worker whose lease ran
// out cannot complete or fail the run another worker took over.
Generation int64
// NotBefore is when a pending item becomes due.
NotBefore time.Time
LeasedBy string
LeaseUntil time.Time
// DirtySince is when work was asked for again during the current run,
// which then runs once more; zero when it was not.
DirtySince time.Time
LastError string
// Enqueued is when the work the item now owes was first asked for.
Enqueued time.Time
Updated time.Time
}
WorkItem is one unit of asynchronous derived work (decision 0033). There is one item per Kind and Key, so work asked for again while an item waits coalesces into the run it is waiting for.
type WorkState ¶
type WorkState string
WorkState is where an item of the persistent work queue stands (decision 0033).
type WorkStats ¶
type WorkStats struct {
Kind string
Pending, Leased, Parked int64
// OldestPending is the earliest Enqueued of a pending item; zero when
// none is pending.
OldestPending time.Time
}
WorkStats summarises the queue for one kind, for metrics.
type Worker ¶
type Worker struct {
Key string
Action WorkerAction
SourceCode string
Enabled bool
Description string
Debug bool
ProjectKey string
Filter WorkerFilter
ProgramHash string
Failures int
BlockedUntil time.Time
Created time.Time
Updated time.Time
}
Worker is a TypeScript hook run by the embedded runtime.
type WorkerAction ¶
type WorkerAction string
WorkerAction is the hook a worker runs on, in JFrog's names (BEFORE_DOWNLOAD, AFTER_CREATE, GENERIC_EVENT and so on).
func (WorkerAction) Before ¶
func (a WorkerAction) Before() bool
Before reports whether the action runs synchronously before the operation and can refuse it (decision 0026).
type WorkerExecution ¶
type WorkerExecution struct {
ID string
WorkerKey string
Action WorkerAction
Trigger WorkerTrigger
Status string
Started time.Time
Duration time.Duration
Payload []byte
Result []byte
Logs []byte
Error string
}
WorkerExecution is one recorded run of a worker.
type WorkerFilter ¶
type WorkerFilter struct {
RepoKeys []string `json:"repo_keys,omitempty"`
IncludePatterns []string `json:"include_patterns,omitempty"`
ExcludePatterns []string `json:"exclude_patterns,omitempty"`
AnyLocal bool `json:"any_local,omitempty"`
AnyRemote bool `json:"any_remote,omitempty"`
AnyFederated bool `json:"any_federated,omitempty"`
}
WorkerFilter restricts an artifact-event worker to repositories and paths.
type WorkerTrigger ¶
type WorkerTrigger string
WorkerTrigger is what started an execution.
const ( TriggerEvent WorkerTrigger = "event" TriggerHTTP WorkerTrigger = "http" TriggerTest WorkerTrigger = "test" TriggerRerun WorkerTrigger = "rerun" )
Worker triggers.
Source Files
¶
Directories
¶
| Path | Synopsis |
|---|---|
|
Package wire mirrors the JFrog JSON forms that pkg/types converts: the legacy v1 and v2 permission targets, the Access v2 permission, and the legacy and Access user and group documents.
|
Package wire mirrors the JFrog JSON forms that pkg/types converts: the legacy v1 and v2 permission targets, the Access v2 permission, and the legacy and Access user and group documents. |