Struct OplogSyncStore 

pub struct OplogSyncStore<'a> { /* private fields */ }

A SyncStore over one account’s op log on a live connection. Scoped to a single account: a session syncs one account, and the hello handshake refuses a peer naming a different one.

Implementations

impl<'a> OplogSyncStore<'a>

pub fn new(conn: &'a Connection, account_id: AccountId, now_ms: i64) -> Self

Trait Implementations

impl NodeAuth for OplogSyncStore<'_>

fn local_binding(&self, local_node: &[u8; 32], now_ms: i64) -> Result<Vec<u8>>

Our signed binding vouching that local_node is this account’s local device, stamped now_ms. Err if this store cannot authorize (e.g. no local account/device yet — the onboarding case).

fn authorize( &self, binding: &[u8], remote_node: &[u8; 32], now_ms: i64, ) -> Result<bool>

Whether binding authorizes a peer whose iroh-authenticated node key is remote_node, judged fresh against now_ms. Returns a plain bool — the store collapses the internal failure taxonomy so the wire stays uniform. Err is reserved for a real fault (e.g. the DB read failed), not a rejected peer.

impl SyncStore for OplogSyncStore<'_>

fn account_id(&self) -> [u8; 32]

The account this session is scoped to. A peer whose hello names a different account is a misdirected connection and the session aborts.

fn snapshot(&self) -> Result<Vec<([u8; 32], Vec<u8>)>>

Every held account-log entry as (dedup_key, signed_bytes), read ONCE at session start. The key is the SIGNED-envelope hash (sha256(signed_bytes)), NOT the entry_hash — two envelopes can share an entry_hash but differ in signature, and the wire must treat them as distinct or a peer holding one would suppress the other. Snapshotting up front keeps what we send independent of what we concurrently ingest, so the two session halves never contend.

fn ingest(&mut self, signed_bytes: &[u8]) -> Result<Ingested>

Ingest one received entry’s signed_bytes. Must be idempotent (re-ingesting a held entry is a no-op) and must re-verify — the bytes came off the wire from an untrusted peer.