Struct CursorRegistry 

pub struct CursorRegistry { /* private fields */ }

Issue #807 / PRD #750 — process-wide cursor registry for /query/stream.

On a fresh stream the server mints an opaque token, pins the read snapshot LSN, and records it here scoped to the requesting (tenant, principal) with a TTL. A later resume request presents the token; resolve returns the pinned query + snapshot only when the token is live AND the caller’s scope matches.

In-memory is acceptable for this first cut (per the issue): the registry is shared via Arc so cloned server handles enforce against one map.

Implementations

impl CursorRegistry

pub fn new() -> Arc<Self>

pub fn register( &self, snapshot_lsn: u64, tenant: &str, principal: &str, query: &str, entity_types: Option<Vec<String>>, capabilities: Option<Vec<String>>, opened_at_ms: u64, ttl_ms: u64, ) -> String

Mint + record a cursor for a freshly-opened stream, returning the opaque token handed to the client. The entry expires at opened_at_ms + ttl_ms (saturating).

pub fn cancel_token_for(&self, token: &str) -> Option<CancelToken>

Issue #808 / 750d — clone out the shared cancel token for a cursor the caller just minted, so the live streaming handler can poll the same flag a later cancel request raises. No scope check: the only caller is the handler that owns the freshly-registered token.

pub fn cancel( &self, token: &str, tenant: &str, principal: &str, ) -> Result<CancelToken, CursorReject>

Issue #808 / 750d — cancel + tombstone a cursor on behalf of (tenant, principal). Raises the shared cancel token (so an in-flight stream observing it stops) and marks the entry cancelled so a later resume is refused with CursorReject::Cancelled.

Scope is checked exactly as in resolve: a token owned by a different tenant/principal — or one that never existed — returns CursorReject::NotFound so an unauthorized caller cannot cancel, or even confirm the existence of, a foreign stream. Cancelling an already-cancelled cursor is idempotent.

pub fn resolve( &self, token: &str, tenant: &str, principal: &str, now_ms: u64, ) -> Result<CursorResume, CursorReject>

Resolve a resume token for (tenant, principal) as of now_ms.

Scope is checked before expiry: a token owned by a different tenant or principal resolves to CursorReject::NotFound — identical to a token that was never issued — so an unauthorized caller learns nothing about its existence. Only the rightful owner can observe CursorReject::Expired.

Trait Implementations

impl Debug for CursorRegistry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CursorRegistry

fn default() -> CursorRegistry

Returns the “default value” for a type.