Struct Privacy 

pub struct Privacy { /* private fields */ }

Subject access and erasure over whatever the venture composed, plus the external providers a venture registered.

Implementations

impl Privacy

pub fn new() -> Self

The module, with no providers. What it reads is what the other modules declared; add a system the harness never sees with Self::provider.

pub fn provider(self, provider: HttpProvider) -> Self

Registers an external system holding data about subjects (issue #653). A provider is called on export and erasure, and its sections are merged into the response under providers; a failure there never obscures the local answer.

pub fn serve_provider(self, secret_env: impl Into<String>) -> Self

Serves the same protocol this module calls out on (issue #656), so this deployment can be the provider another deployment reaches: /v1/privacy/provider/export, /provider/erase/plan and /provider/erase/apply answer over this composition’s declarations.

secret_env names the config/env variable holding the shared HMAC secret — the same one an outbound HttpProvider::secret_env points at. The name is taken here; the value is read from the config port at request time, so one build works in every environment and a deployment that was built before the secret existed does not have to be rebuilt to start answering.

Opt-in rather than always-on because the routes are a public door: a deployment that never opted in does not answer, and a deployment that did but has no secret refuses every call rather than opening.

No admin token, deliberately. The HMAC over the raw body is the authorisation — a caller on another deployment has no account here and no ADMIN_TOKEN to present, so an admin guard would refuse every legitimate call while authorising nothing the protocol lacks.

Trait Implementations

impl Clone for Privacy

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Privacy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Privacy

fn default() -> Self

Returns the “default value” for a type.

impl Module for Privacy

fn requires(&self) -> &'static [Port]

The database it reads and erases is other modules’ tables; it owns none itself. Signer is required, not optional: without it there is no confirmation token, and erasure would have to be a single call. HttpClient and Defer join only when a provider is registered — with none, this module makes no outbound call and defers nothing. Serving the protocol (Self::serve_provider) adds no port: it reads the same tables through the Db already required here and takes its secret from the config every route already has, so a deployment that only serves does not ask for an outbound client it will never use.

fn tables(&self) -> &'static [&'static str]

No tables. A module that owned one would have to declare its own personal data, and a privacy module keeping records about the people who asked what it keeps is a joke that writes itself. Erasure keeps none either: its receipt is the confirm response, not a stored record.

fn validate_config(&self, _cfg: &dyn Config) -> Result<(), ConfigError>

Nothing to validate: the module has no configuration of its own, and what it reads is what other modules declared, which HarnessBuilder::build already checked. A provider’s secret is read at call time and its absence reported as not_configured, not refused at build.

fn name(&self) -> &'static str

Kebab-case name; mounted at /v1/<name>.

fn version(&self) -> &'static str

env!("CARGO_PKG_VERSION"), surfaced by /__health.

fn migrations(&self) -> Migrations

The module’s migrations, embedded per dialect.

fn router(&self, ctx: ModuleContext) -> Router

The module’s router, nested under /v1/<name>.

fn harness_api(&self) -> u32

Contract version, checked by Harness::build.

fn optional(&self) -> &'static [Port]

Ports the module uses when present.

fn depends_on(&self) -> &'static [&'static str]

Modules this one’s schema sits on top of, by name.

fn actor_kinds(&self) -> &'static [&'static str]

Actor kinds this module owns, each [a-z0-9_-]; duplicates across modules are a build error, and so is a kind with no handler registered through HarnessBuilder::actor.

fn personal_data(&self) -> &'static [PersonalDataSet]

What this module holds about a person, per table.

fn emits(&self) -> &'static [&'static str]

Event names this module emits ("<module>.<event>"), listed by /__health.

fn public_writes(&self) -> bool

Whether the module has public write endpoints.

fn public_write_policy(&self) -> RoutePolicy

What actually protects those public writes, for a module with no ADR 0010 surface to hang a per-action RoutePolicy on (issue #143).

fn signature_verification(&self) -> SignatureVerification

Which verifier proves this module’s RoutePolicy::Signature deliveries (issue #533): how a webhook handler checks a machine signature before acting.

fn max_body_bytes(&self, _cfg: &dyn Config) -> usize

The largest request body any route of this module accepts, so a runtime can refuse an oversize body before buffering it (issue #440).

fn streaming_routes(&self) -> &'static [StreamRoute]

Routes this module serves in streaming mode (issue #585), each with its own StreamRoute::max_bytes ceiling. Opt-in: the default is empty, and every existing route keeps the buffered behaviour it always had.

fn max_blob_object_bytes(&self) -> u64

The largest object this module’s streamed and multipart blob writes may produce (issue #586), enforced by the ScopedBlob the harness hands the module on put_stream, upload_part and complete_multipart.

fn self_check(&self) -> Vec<String>

Problems the module can find in itself, with no configuration and no environment: its own embedded data, checked against its own declarations.

fn well_known(&self) -> Option<Router>

Routes this module serves at the root under /.well-known, for spec-mandated discovery documents (OIDC openid-configuration, jwks.json) that must live outside /v1 (issue #46). Paths are relative to the prefix: register /jwks.json, not /.well-known/jwks.json.

fn surface(&self) -> Surface

The module’s UI surface (ADR 0010): the actions a renderer may offer and the views that compose them. Input schemas come from the handler’s own body types (Action::input::<Body>()), so the declaration cannot drift from the route. Harness::build validates it; GET /__surface serves the composition. Default: nothing, and a module that declares nothing renders nothing.

fn events( &self, ) -> Vec<(String, Arc<dyn Fn(&Scope, Value) -> Pin<Box<dyn Future<Output = Result<(), Box<dyn Error + Sync + Send>>> + Send>> + Sync + Send>)>

Handlers for events other modules emit; registered at Harness::build.

fn scheduled<'a>( &'a self, ctx: &'a ModuleContext, cron: &'a str, ) -> Pin<Box<dyn Future<Output = Result<(), Box<dyn Error + Sync + Send>>> + Send + 'a>>

Scheduled work (cron is the trigger expression). Default: none.