Struct OplogContentSyncStore 

pub struct OplogContentSyncStore<'a> { /* private fields */ }

A SyncStore over one account’s OWN /3 content on a live connection (phase D, #406) — the memories themselves, where OplogSyncStore moves the account log that authorizes them.

Scoped to a single account, like the account-log store: a session restores the account’s own memories onto a fresh sibling. Content authored by OTHER accounts (shared streams) is a later slice (#407) and is refused here. Received bytes go through content_ingest, which re-resolves the roster key and re-verifies the signature from scratch — the transport adds no trust.

Run this AFTER an account-log session in the same restore: content_ingest needs the roster and grant material the account log carries to ACCEPT (rather than park) a candidate, so the account authority must be in place first. A content session run before authority lands still transfers every byte — it just parks candidates that a later settle promotes once authority arrives.

Implementations

impl<'a> OplogContentSyncStore<'a>

pub fn new(conn: &'a Connection, account_id: AccountId, now_ms: i64) -> Self

Trait Implementations

impl NodeAuth for OplogContentSyncStore<'_>

fn local_binding(&self, local_node: &[u8; 32], now_ms: i64) -> Result<Vec<u8>>

Our signed binding vouching that local_node is this account’s local device, stamped now_ms. Err if this store cannot authorize (e.g. no local account/device yet — the onboarding case).

fn authorize( &self, binding: &[u8], remote_node: &[u8; 32], now_ms: i64, ) -> Result<bool>

Whether binding authorizes a peer whose iroh-authenticated node key is remote_node, judged fresh against now_ms. Returns a plain bool — the store collapses the internal failure taxonomy so the wire stays uniform. Err is reserved for a real fault (e.g. the DB read failed), not a rejected peer.

impl SyncStore for OplogContentSyncStore<'_>

fn account_id(&self) -> [u8; 32]

The account this session is scoped to. A peer whose hello names a different account is a misdirected connection and the session aborts.

fn snapshot(&self) -> Result<Vec<([u8; 32], Vec<u8>)>>

Every held account-log entry as (dedup_key, signed_bytes), read ONCE at session start. The key is the SIGNED-envelope hash (sha256(signed_bytes)), NOT the entry_hash — two envelopes can share an entry_hash but differ in signature, and the wire must treat them as distinct or a peer holding one would suppress the other. Snapshotting up front keeps what we send independent of what we concurrently ingest, so the two session halves never contend.

fn ingest(&mut self, signed_bytes: &[u8]) -> Result<Ingested>

Ingest one received entry’s signed_bytes. Must be idempotent (re-ingesting a held entry is a no-op) and must re-verify — the bytes came off the wire from an untrusted peer.