Struct TransactionStore 

pub struct TransactionStore { /* private fields */ }

Implementations

impl TransactionStore

pub fn open_read_only( path: impl AsRef<Path>, ) -> Result<Self, TransactionStoreError>

Open the store with no audit chain key. Inserts will fail with AuditChainMissing — only suitable for read-only callers (e.g. sysknife audit verify which loads the key separately).

pub fn open(path: impl AsRef<Path>) -> Result<Self, TransactionStoreError>

Open the store and bind it to an audit chain key. Every insert computes a forward Ed25519-signed chain hash linked to the previous row.

The key path defaults to <db_dir>/audit-key so dev/test runs with per-tempdir databases are fully isolated. Production deployments override with SYSKNIFE_AUDIT_KEY_PATH=/etc/sysknife/audit-key.

pub fn open_with_key( path: impl AsRef<Path>, audit_key: Arc<AuditKey>, ) -> Result<Self, TransactionStoreError>

Open the store with an explicit audit key. Used by tests and by production code paths that want to inject a key from a specific path.

pub fn record( &self, transaction: NewTransaction, ) -> Result<TransactionRecord, TransactionStoreError>

pub fn record_previewed( &self, transaction: NewTransaction, preview: PreviewEnvelope, ) -> Result<RecordedPreviewedTransaction, TransactionStoreError>

pub fn get( &self, transaction_id: &str, ) -> Result<Option<TransactionRecord>, TransactionStoreError>

pub fn get_preview( &self, transaction_id: &str, ) -> Result<Option<PreviewEnvelope>, TransactionStoreError>

pub fn update_status( &self, transaction_id: &str, new_status: JobState, ) -> Result<(), TransactionStoreError>

pub fn approve_transaction( &self, transaction_id: &str, ) -> Result<Option<String>, TransactionStoreError>

Attach one immutable approval receipt digest to a fresh queued preview.

pub fn revoke_unconsumed_approval( &self, transaction_id: &str, ) -> Result<bool, TransactionStoreError>

Remove an approval that was persisted but could not be delivered to the caller. Consumed receipts are never revocable.

pub fn claim_approved_for_execution( &self, transaction_id: &str, receipt_digest: &str, ) -> Result<bool, TransactionStoreError>

Atomically consume an approved receipt and transition Queued to Running.

pub fn cleanup_stale_queued(&self) -> Result<u64, TransactionStoreError>

Cancel all Queued transactions whose created_at timestamp is older than the 15-minute TTL window. Returns the number of rows affected.

State-machine safety: the WHERE clause pins status = Queued before applying Queued → Canceled, which is the only legal transition reachable from Queued other than Running. A row that has progressed to Running (or any terminal state) in between the TTL match and our UPDATE is skipped because the predicate no longer matches it. This makes the bulk SQL semantically equivalent to fetching each candidate, building a JobStateMachine, and calling cancel() on it — but in a single statement so we don’t race ourselves when many rows expire at once. The cleanup_stale_queued_does_not_clobber_running_rows regression test in tests/coverage_gaps.rs pins this guarantee.

pub fn cancel_queued( &self, transaction_id: &str, ) -> Result<bool, TransactionStoreError>

Cancel one still-Queued transaction (Queued → Canceled). Returns true iff a queued row was transitioned.

Option A semantics: the status = ?3 (Queued) guard means a Running transaction — one whose privileged action is already executing — is never cancelled, so we never leave a half-applied root mutation behind a Canceled record. Missing or already-terminal transactions return false.

pub fn list_transactions( &self, limit: u32, status_filter: Option<&str>, action_filter: Option<&str>, since_hours: Option<u32>, ) -> Result<Vec<TransactionRecord>, TransactionStoreError>

List transactions with optional filters, ordered by newest first.

• limit: max number of rows (capped at 100)
• status_filter: if set, only return rows matching this status (must be a valid JobState variant: "succeeded", "failed", "queued", "running", "canceled", "rolled_back", "needs_reboot")
• action_filter: if set, only return rows with this exact action name
• since_hours: if set, only return rows created within the last N hours

pub fn list_history( &self, limit: u32, status_filter: Option<&str>, action_filter: Option<&str>, since_hours: Option<u32>, ) -> Result<Vec<JobHistoryEntry>, TransactionStoreError>

Structured history for programmatic clients (the MCP sysknife_history tool). Unlike list_transactions it selects created_at and returns JobHistoryEntry so risk_level and created_at reach the caller typed, without text re-parsing.

pub fn fetch_chain_rows(&self) -> Result<Vec<ChainRow>, TransactionStoreError>

Return all rows in seq order with the chain fields needed for verify.

pub fn verify_audit_chain( &self, key: &AuditKey, ) -> Result<VerifyOutcome, TransactionStoreError>

Walk the audit chain with key and report integrity status.

pub fn verify_audit_chain_with_pubkey( &self, verifying_key_hex: &str, ) -> Result<VerifyOutcome, TransactionStoreError>

Verify the chain with only the hex-encoded Ed25519 public key. The auditor path: proves the chain without the private key and cannot forge.

pub fn fetch_chain_row( &self, transaction_id: &str, ) -> Result<Option<ChainRow>, TransactionStoreError>

Fetch a single row’s chain metadata by transaction_id. Used by the audit-log forwarder to construct an AuditEvent after insert.

Trait Implementations

impl Clone for TransactionStore

fn clone(&self) -> TransactionStore

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TransactionStore

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.