| 1 | package park |
| 2 | |
| 3 | import ( |
| 4 | "context" |
| 5 | "encoding/json" |
| 6 | "time" |
| 7 | |
| 8 | "github.com/carlosframework/platform/internal/hostclaim" |
| 9 | "github.com/carlosframework/platform/internal/lease" |
| 10 | ) |
| 11 | |
| 12 | // MoveSweepVerifier verifies the newest retired move's durable fence or |
| 13 | // release, covering every moves/<host> version in the complete census. |
| 14 | // A missing history, unresolved writer, or newer unretired move must refuse. |
| 15 | // The caller supplies the current claim and census; a timestamp alone is not |
| 16 | // evidence. Moves Plan 5 supplies this provider from its retained journals. |
| 17 | type MoveSweepVerifier interface { |
| 18 | VerifyMovesSweep(context.Context, hostclaim.Observed, []lease.ObjectVersion) (MoveSweepProof, error) |
| 19 | } |
| 20 | |
| 21 | type MoveSweepProof struct { |
| 22 | Host, ClaimETag, MoveID, Incarnation string |
| 23 | RetiredAt time.Time |
| 24 | } |
| 25 | |
| 26 | // Check permits listing-time evidence only after the newest retired move's |
| 27 | // verified fence or release. Requiring it before listing starts also excludes |
| 28 | // a retirement racing a paginated listing. The queued EvidenceAt is the end |
| 29 | // of that listing and is retained by every retry. |
| 30 | func (p MoveSweepProof) Check(o hostclaim.Observed, incarnation string, listingStarted time.Time) error { |
| 31 | if o.Absent || o.Claim == nil || o.ETag == "" || p.Host != o.Host || p.ClaimETag != o.ETag || !token(p.MoveID) || p.Incarnation != incarnation || p.RetiredAt.IsZero() || !p.RetiredAt.Before(listingStarted) { |
| 32 | return ErrUnsafe |
| 33 | } |
| 34 | c := o.Claim |
| 35 | if c.Free() || c.Op.Kind == hostclaim.KindServing { |
| 36 | return nil |
| 37 | } |
| 38 | if c.Holder == nil && c.Op.Kind == hostclaim.KindParking && c.Op.ID != "" && c.Op.Exec == "" && c.Op.Intent["park_sweep"] == "v1" { |
| 39 | return nil |
| 40 | } |
| 41 | return ErrUnsafe |
| 42 | } |
| 43 | |
| 44 | // moveSweepObservation keeps a provider's read-only input detached from the CAS. |
| 45 | func moveSweepObservation(o hostclaim.Observed) (hostclaim.Observed, error) { |
| 46 | raw, err := json.Marshal(o.Claim) |
| 47 | if err != nil { |
| 48 | return hostclaim.Observed{}, err |
| 49 | } |
| 50 | var c *hostclaim.Claim |
| 51 | if err := json.Unmarshal(raw, &c); err != nil { |
| 52 | return hostclaim.Observed{}, err |
| 53 | } |
| 54 | o.Claim = c |
| 55 | return o, nil |
| 56 | } |
| 57 | |
amadan