| 1 | package objstore |
| 2 | |
| 3 | import "context" |
| 4 | |
| 5 | // Provisioner is the backend seam (§3): everything the console needs a |
| 6 | // backend to do, and nothing an app ever calls. Every method is idempotent — |
| 7 | // "already exists" and "already gone" are successes — because every walk |
| 8 | // that drives one must be re-runnable after a half-failure (§5). |
| 9 | // |
| 10 | // v1 ships the AWS implementation and this package's in-memory fake. A |
| 11 | // Hetzner/R2/Minio provisioner arrives here later without touching a walk. |
| 12 | type Provisioner interface { |
| 13 | // EnsureBucket creates the bucket if absent and answers its region. |
| 14 | EnsureBucket(ctx context.Context, name string) (region string, err error) |
| 15 | // EnsureUser creates the credential principal if absent, scoped to |
| 16 | // exactly bucketARN (ListBucket on it; Get/Put/DeleteObject under it). |
| 17 | // deny, when non-nil, adds a Deny on reading an object tagged infected. |
| 18 | // It is threaded from the RECORD rather than asked of a Scanner, so a |
| 19 | // repair walk on a deployment with no engine built can still write the |
| 20 | // policy the record asks for instead of silently dropping enforcement. |
| 21 | EnsureUser(ctx context.Context, name, path, bucketARN string, deny *DenyTag) (arn string, err error) |
| 22 | MintKey(ctx context.Context, user string) (id, secret string, err error) |
| 23 | DeleteKey(ctx context.Context, user, id string) error |
| 24 | // ReapKeys deletes every access key of user NOT named in keep. The grant |
| 25 | // walk's crash-safety depends on it: a key minted before a failed |
| 26 | // delivery is recorded nowhere, so only list-and-delete can find it. |
| 27 | ReapKeys(ctx context.Context, user string, keep []string) error |
| 28 | // EmptyBucket deletes every object; paginated and resumable. |
| 29 | EmptyBucket(ctx context.Context, name string) error |
| 30 | DeleteBucket(ctx context.Context, name string) error |
| 31 | // DeleteUser removes the user's keys and inline policy first. |
| 32 | DeleteUser(ctx context.Context, user string) error |
| 33 | } |
| 34 | |
amadan