Struct PgBlobStore 

pub struct PgBlobStore { /* private fields */ }

Content-addressed blobs: containers under a root directory, key material and bookkeeping in gwk_internal.

Implementations

impl PgBlobStore

pub async fn open(pool: PgPool, config: BlobConfig) -> Result<Self, BlobError>

Bind to an initialized database and prepare the root directory.

Creating the directories here rather than lazily means a root that is unwritable is a startup failure, not a failure of the first upload that happens to arrive in production.

pub fn config(&self) -> &BlobConfig

pub async fn expire_uploads(&self) -> Result<(), BlobError>

Drop uploads that outlived UPLOAD_EXPIRY_SECS, with their files.

Called from open, from begin, and from sweep rather than by a timer: an expiry only has to hold for a store somebody is using, and a background task would be a second thing to supervise for no more guarantee than this.

pub async fn rewrap_all(&self, new_kek: &[u8; 32]) -> Result<usize, BlobError>

Rewrap every blob this KEK label covers under new_kek, touching no ciphertext.

The label does NOT change: it is inside each container’s authenticated header, so a rewrap that relabeled would invalidate the very AAD the new wrap is bound to. Rotation replaces the key behind the name.

Trait Implementations

impl BlobStore for PgBlobStore

async fn begin( &self, media_type: String, byte_size: ByteCount, ) -> Result<BlobUploadId, BlobError>

Start an upload. The caller declares what it intends to write; the store mints the id and owns the temporary file.

async fn write_chunk( &self, upload: &BlobUploadId, sequence: u32, chunk: &[u8], ) -> Result<(), BlobError>

Append one plaintext chunk. sequence is contiguous from 0; a gap or a repeat is refused rather than reordered.

async fn commit( &self, upload: BlobUploadId, address: BlobAddress, ) -> Result<(BlobDescriptor, bool), BlobError>

Finish the upload, requiring the plaintext to hash to address.

async fn abort(&self, upload: BlobUploadId) -> Result<(), BlobError>

Discard an upload and its temporary file. Uncommitted uploads also expire on their own after an hour.

async fn read( &self, address: &BlobAddress, offset: ByteCount, length: ByteCount, ) -> Result<Vec<u8>, BlobError>

Read a bounded range of plaintext.

async fn stat( &self, address: &BlobAddress, ) -> Result<Option<BlobDescriptor>, BlobError>

Describe a committed blob. Ok(None) means it never existed; BlobError::Tombstoned means it did and was shredded — a distinction a retention audit needs.

async fn pin( &self, address: &BlobAddress, evidence: &EvidenceId, ) -> Result<(), BlobError>

Pin as evidence, blocking sweep until every pin is released.

async fn unpin( &self, address: &BlobAddress, evidence: &EvidenceId, ) -> Result<(), BlobError>

async fn sweep(&self) -> Result<Vec<BlobAddress>, BlobError>

Remove unreferenced, unpinned blobs; returns what it removed.

async fn shred(&self, address: &BlobAddress) -> Result<(), BlobError>

Crypto-shred: commit the tombstone and drop the wrapped DEK FIRST, then remove ciphertext. Ordered that way so a crash mid-shred leaves an unreadable blob, never a readable one.