registry

package
v0.1.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 14, 2026 License: Apache-2.0 Imports: 10 Imported by: 0

Documentation

Index

Constants

View Source
const ActiveStorePurgeTarget = 24 * time.Hour

Variables

View Source
var (
	ErrUnauthenticated   = errors.New("registry principal is not authenticated")
	ErrForbidden         = errors.New("registry operation is forbidden")
	ErrNotOwner          = errors.New("registry object is owned by another principal")
	ErrExpired           = errors.New("registry object has expired")
	ErrDigestMismatch    = errors.New("registry digest does not match prepared digest")
	ErrInvalidTransition = errors.New("invalid registry state transition")
	ErrConflict          = errors.New("registry operation conflicts with existing state")
)

Functions

This section is empty.

Types

type ChallengeStatus

type ChallengeStatus string
const (
	ChallengePending  ChallengeStatus = "pending"
	ChallengeVerified ChallengeStatus = "verified"
	ChallengeExpired  ChallengeStatus = "expired"
)

type Dispute

type Dispute struct {
	// contains filtered or unexported fields
}

func NewDispute

func NewDispute(
	principal Principal,
	id schema.InstanceID,
	observationID schema.Digest,
	subject SubjectNamespace,
	subjectOwner PrincipalID,
	statement string,
	now time.Time,
) (*Dispute, error)

func RestoreDispute

func RestoreDispute(snapshot DisputeSnapshot) (*Dispute, error)

func (*Dispute) AddOwnerResponse

func (dispute *Dispute) AddOwnerResponse(
	principal Principal,
	ownership *Ownership,
	statement string,
	now time.Time,
) (DisputeSnapshot, error)

func (*Dispute) BeginReview

func (dispute *Dispute) BeginReview(principal Principal, now time.Time) (DisputeSnapshot, error)

func (*Dispute) Resolve

func (dispute *Dispute) Resolve(principal Principal, resolution string, now time.Time) (DisputeSnapshot, error)

func (*Dispute) Snapshot

func (dispute *Dispute) Snapshot() DisputeSnapshot

func (*Dispute) Supersede

func (dispute *Dispute) Supersede(
	principal Principal,
	replacementID schema.Digest,
	reason string,
	now time.Time,
) (DisputeSnapshot, error)

type DisputeEvent

type DisputeEvent struct {
	Sequence      uint64
	Kind          DisputeEventKind
	Actor         PrincipalID
	At            time.Time
	Statement     string
	ReplacementID schema.Digest
}

type DisputeEventKind

type DisputeEventKind string
const (
	DisputeEventOpened        DisputeEventKind = "opened"
	DisputeEventOwnerResponse DisputeEventKind = "owner_response"
	DisputeEventReviewStarted DisputeEventKind = "review_started"
	DisputeEventResolved      DisputeEventKind = "resolved"
	DisputeEventSuperseded    DisputeEventKind = "superseded"
)

type DisputeSnapshot

type DisputeSnapshot struct {
	ID            schema.InstanceID
	ObservationID schema.Digest
	Subject       SubjectNamespace
	Creator       PrincipalID
	SubjectOwner  PrincipalID
	Reviewer      PrincipalID
	Status        DisputeStatus
	Events        []DisputeEvent
}

type DisputeStatus

type DisputeStatus string
const (
	DisputeOpened      DisputeStatus = "opened"
	DisputeUnderReview DisputeStatus = "under_review"
	DisputeResolved    DisputeStatus = "resolved"
	DisputeSuperseded  DisputeStatus = "superseded"
)

type IngestSession

type IngestSession struct {
	// contains filtered or unexported fields
}

IngestSession is the concurrency-safe domain state for two-phase upload. Owner, expiry and expected digest are fixed at prepare time.

func PrepareIngest

func PrepareIngest(
	principal Principal,
	sessionID schema.InstanceID,
	expectedDigest schema.Digest,
	expiresAt time.Time,
	now time.Time,
) (*IngestSession, error)

func RestoreIngest

func RestoreIngest(snapshot IngestSnapshot) (*IngestSession, error)

RestoreIngest reconstructs previously validated durable state. It is used only by Registry stores and applies stricter lifecycle consistency checks than ordinary JSON decoding.

func (*IngestSession) BeginValidation

func (session *IngestSession) BeginValidation() (IngestSnapshot, error)

BeginValidation is called only by the isolated verifier service, not by a submitter-controlled request. It is idempotent under at-least-once queue delivery.

func (*IngestSession) Commit

func (session *IngestSession) Commit(principal Principal, digest schema.Digest, now time.Time) (IngestSnapshot, error)

Commit is idempotent for the owner and exact prepared digest. Once a commit has succeeded, replaying it remains successful even if the upload session subsequently expires or validation advances.

func (*IngestSession) Publish

func (session *IngestSession) Publish() (IngestSnapshot, error)

func (*IngestSession) Quarantine

func (session *IngestSession) Quarantine(reasonClass string) (IngestSnapshot, error)

func (*IngestSession) Snapshot

func (session *IngestSession) Snapshot() IngestSnapshot

func (*IngestSession) Stage

func (session *IngestSession) Stage(principal Principal, digest schema.Digest, now time.Time) (IngestSnapshot, error)

type IngestSnapshot

type IngestSnapshot struct {
	SessionID       schema.InstanceID
	Owner           PrincipalID
	ExpectedDigest  schema.Digest
	StagedDigest    schema.Digest
	ExpiresAt       time.Time
	Status          IngestStatus
	QuarantineClass string
}

type IngestStatus

type IngestStatus string
const (
	IngestPrepared    IngestStatus = "prepared"
	IngestStaged      IngestStatus = "staged"
	IngestCommitted   IngestStatus = "committed"
	IngestValidating  IngestStatus = "validating"
	IngestQuarantined IngestStatus = "quarantined"
	IngestPublished   IngestStatus = "published"
)

type Ownership

type Ownership struct {
	// contains filtered or unexported fields
}

func OwnershipFromChallenge

func OwnershipFromChallenge(challenge *OwnershipChallenge, validUntil, now time.Time) (*Ownership, error)

func RestoreOwnership

func RestoreOwnership(snapshot OwnershipSnapshot) (*Ownership, error)

func (*Ownership) AuthorizeManage

func (ownership *Ownership) AuthorizeManage(principal Principal, now time.Time) error

func (*Ownership) Current

func (ownership *Ownership) Current(now time.Time) bool

func (*Ownership) Revoke

func (ownership *Ownership) Revoke(principal Principal, reason string, now time.Time) (OwnershipSnapshot, error)

func (*Ownership) Snapshot

func (ownership *Ownership) Snapshot() OwnershipSnapshot

func (*Ownership) Transfer

func (ownership *Ownership) Transfer(
	principal Principal,
	newChallenge *OwnershipChallenge,
	newValidUntil time.Time,
	now time.Time,
) (*Ownership, error)

Transfer requires a still-current old owner and a separately verified challenge for the same exact subject namespace.

type OwnershipChallenge

type OwnershipChallenge struct {
	// contains filtered or unexported fields
}

func NewOwnershipChallenge

func NewOwnershipChallenge(
	principal Principal,
	id schema.InstanceID,
	subject SubjectNamespace,
	method OwnershipMethod,
	nonce string,
	expiresAt time.Time,
	now time.Time,
) (*OwnershipChallenge, error)

func RestoreOwnershipChallenge

func RestoreOwnershipChallenge(snapshot OwnershipChallengeSnapshot) (*OwnershipChallenge, error)

func (*OwnershipChallenge) PersistentSnapshot

func (challenge *OwnershipChallenge) PersistentSnapshot() OwnershipChallengeSnapshot

func (*OwnershipChallenge) Snapshot

func (challenge *OwnershipChallenge) Snapshot(now time.Time) OwnershipChallengeSnapshot

func (*OwnershipChallenge) Verify

func (challenge *OwnershipChallenge) Verify(evidenceDigest schema.Digest, now time.Time) (OwnershipChallengeSnapshot, error)

Verify records the result of an already policy-constrained verifier. It does not perform DNS, GitHub or HTTP access itself.

type OwnershipChallengeSnapshot

type OwnershipChallengeSnapshot struct {
	ID             schema.InstanceID
	Subject        SubjectNamespace
	Requester      PrincipalID
	Method         OwnershipMethod
	Nonce          string
	ExpiresAt      time.Time
	Status         ChallengeStatus
	VerifiedAt     time.Time
	EvidenceDigest schema.Digest
}

type OwnershipMethod

type OwnershipMethod string
const (
	OwnershipDNS       OwnershipMethod = "dns_txt"
	OwnershipGitHubOrg OwnershipMethod = "github_org"
	OwnershipDomain    OwnershipMethod = "controlled_domain"
)

type OwnershipSnapshot

type OwnershipSnapshot struct {
	Subject    SubjectNamespace
	Owner      PrincipalID
	Method     OwnershipMethod
	Evidence   schema.Digest
	VerifiedAt time.Time
	ValidUntil time.Time
	RevokedAt  time.Time
	Reason     string
}

type Principal

type Principal struct {
	// contains filtered or unexported fields
}

Principal is an authenticated issuer/subject identity with an exact set of Registry scopes. It deliberately has no implicit admin bypass.

func NewPrincipal

func NewPrincipal(id PrincipalID, scopes ...Scope) (Principal, error)

func (Principal) HasScope

func (principal Principal) HasScope(scope Scope) bool

func (Principal) ID

func (principal Principal) ID() PrincipalID

func (Principal) RequireScope

func (principal Principal) RequireScope(scope Scope) error

func (Principal) Scopes

func (principal Principal) Scopes() []Scope

type PrincipalID

type PrincipalID string

func (PrincipalID) Validate

func (id PrincipalID) Validate() error

type PurgeEvent

type PurgeEvent struct {
	Sequence uint64
	Actor    PrincipalID
	Action   string
	Target   PurgeTarget
	At       time.Time
}

type PurgeReason

type PurgeReason string
const (
	PurgeSecret       PurgeReason = "secret"
	PurgePII          PurgeReason = "pii"
	PurgeUnlawful     PurgeReason = "unlawful_content"
	PurgeUnauthorized PurgeReason = "unauthorized_submission"
)

type PurgeRequest

type PurgeRequest struct {
	// contains filtered or unexported fields
}

func NewPurgeRequest

func NewPurgeRequest(principal Principal, eventID schema.InstanceID, reason PurgeReason, now time.Time) (*PurgeRequest, error)

func (*PurgeRequest) CompleteTarget

func (request *PurgeRequest) CompleteTarget(
	principal Principal,
	target PurgeTarget,
	status PurgeTargetStatus,
	now time.Time,
) (PurgeSnapshot, error)

func (*PurgeRequest) MissedDeadline

func (request *PurgeRequest) MissedDeadline(now time.Time) bool

func (*PurgeRequest) Snapshot

func (request *PurgeRequest) Snapshot() PurgeSnapshot

func (*PurgeRequest) Start

func (request *PurgeRequest) Start(principal Principal, now time.Time) (PurgeSnapshot, error)

type PurgeSnapshot

type PurgeSnapshot struct {
	EventID     schema.InstanceID
	Reason      PurgeReason
	Status      PurgeStatus
	RequestedAt time.Time
	Deadline    time.Time
	CompletedAt time.Time
	Targets     map[PurgeTarget]PurgeTargetStatus
	Events      []PurgeEvent
}

PurgeSnapshot is safe for a restricted audit log: it intentionally has no content digest, blob key, URL, or hash of material being removed.

type PurgeStatus

type PurgeStatus string
const (
	PurgeRequested  PurgeStatus = "requested"
	PurgeInProgress PurgeStatus = "in_progress"
	PurgeCompleted  PurgeStatus = "completed"
)

type PurgeTarget

type PurgeTarget string
const (
	PurgeObjectStore PurgeTarget = "object_store"
	PurgeCDN         PurgeTarget = "cdn"
	PurgeSearch      PurgeTarget = "search"
	PurgeCache       PurgeTarget = "cache"
	PurgePublicPage  PurgeTarget = "public_page"
)

type PurgeTargetStatus

type PurgeTargetStatus string
const (
	PurgeTargetPending       PurgeTargetStatus = "pending"
	PurgeTargetPurged        PurgeTargetStatus = "purged"
	PurgeTargetNotApplicable PurgeTargetStatus = "not_applicable"
)

type Scope

type Scope string
const (
	ScopeObservationPrepare Scope = "observation:prepare"
	ScopeObservationCommit  Scope = "observation:commit"
	ScopeOwnershipManage    Scope = "ownership:manage"
	ScopeDisputeCreate      Scope = "dispute:create"
	ScopeRunnerSubmit       Scope = "runner:submit"
	ScopeModerationReview   Scope = "moderation:review"
	ScopeRegistryAdmin      Scope = "registry:admin"
)

type SubjectNamespace

type SubjectNamespace string

func (SubjectNamespace) Validate

func (namespace SubjectNamespace) Validate() error

type Supersession

type Supersession struct {
	OriginalID    schema.Digest
	ReplacementID schema.Digest
	Reason        string
	Actor         PrincipalID
	CreatedAt     time.Time
}

func NewSupersession

func NewSupersession(
	principal Principal,
	originalID, replacementID schema.Digest,
	reason string,
	now time.Time,
) (Supersession, error)

type Tombstone

type Tombstone struct {
	ObservationID schema.Digest
	Reason        string
	Actor         PrincipalID
	CreatedAt     time.Time
}

func NewTombstone

func NewTombstone(principal Principal, observationID schema.Digest, reason string, now time.Time) (Tombstone, error)

Directories

Path Synopsis
Package httpapi implements the Registry's standard-library HTTP contract.
Package httpapi implements the Registry's standard-library HTTP contract.
Package store defines persistence boundaries for the Registry HTTP layer.
Package store defines persistence boundaries for the Registry HTTP layer.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL