Struct Store 

pub struct Store { /* private fields */ }

One tenant’s vCons.

Implementations

impl Store

pub fn examine( &self, retention: Retention, key_since: OffsetDateTime, now: OffsetDateTime, ) -> Result<Examination, StoreError>

Examines the Store under retention at now, counting purges made since key_since.

pub fn purges_since( &self, since: OffsetDateTime, ) -> Result<(u64, Option<OffsetDateTime>), StoreError>

How many purges were recorded since since, and when the oldest of them was made: work only the tenant key’s next rotation finishes.

impl Store

pub fn legal_get( &self, who: &Caller, uuid: Uuid, version: Option<VersionId>, ) -> Result<Legal, StoreError>

Reads version of uuid, or with None its current version, or its latest kept one when the uuid is deleted. A version purged, never stored or of another uuid is NotFound; a purged uuid is Gone. The whole read, file included, is one immediate transaction, so a purge cannot remove what is being read. Each answer is recorded.

pub fn legal_versions( &self, who: &Caller, uuid: Uuid, ) -> Result<Vec<VersionInfo>, StoreError>

Every kept version of uuid, oldest first, with its times. A purged uuid is Gone and one never stored NotFound. Each answer is recorded.

pub fn restore(&self, who: &Caller, uuid: Uuid) -> Result<VersionId, StoreError>

Makes the latest kept version of a deleted uuid current again: its hidden time and the uuid’s deleted time are cleared, so no sweep purges it. Older hidden versions stay hidden. A live uuid is NotDeleted, a purged one Gone, one never stored NotFound. Recorded.

pub fn set_hold( &self, who: &Caller, uuid: Uuid, on: bool, ) -> Result<(), StoreError>

Turns the legal hold on uuid on or off. A held uuid is never purged; a delete still hides it. A purged uuid is Gone, one never stored NotFound. Recorded.

impl Store

pub fn list( &self, who: &Caller, query: &ListQuery, ) -> Result<Listing, StoreError>

A page of the tenant’s live vCons, newest first by when each uuid was first stored, then by uuid. The page and its audit record are one transaction.

impl Store

pub fn purge_due(&self, retention: Retention) -> Result<PurgeReport, StoreError>

Erases every version due under retention. Each goes in a transaction of its own that checks the rule again, so a restore or a hold that commits first keeps it. The transaction deletes the version’s row, and with it the only copy of its wrapped data key, and records the purge; a deleted uuid left with no version gives up its row for a tombstone. The object file is removed after the commit. Last, the WAL is checkpointed with truncation, tried again while readers finish, so no page that held a purged key is left in it.

impl Store

pub fn rewrap(&self, new: &Key, limit: usize) -> Result<usize, StoreError>

Rewraps up to limit of the data keys still wrapped under this Store’s tenant key so they are wrapped under new, in one transaction, and returns how many it rewrapped; 0 means none is left. Each rewrap is counted against new, and refused at its wrap limit.

pub fn rows_under_other_keys(&self) -> Result<u64, StoreError>

How many version rows name a key other than this Store’s tenant key: a rotation stopped part way leaves some.

impl Store

pub fn open( dir: &Path, tenant: TenantId, tenant_key: Key, fs: Arc<dyn Fs>, clock: Arc<dyn Clock>, ) -> Result<Store, StoreError>

Opens the tenant’s catalog under its catalog key, making it if new, then runs start-up recovery.

pub fn open_beside( dir: &Path, tenant: TenantId, tenant_key: Key, fs: Arc<dyn Fs>, clock: Arc<dyn Clock>, ) -> Result<Store, StoreError>

Opens the store as a command running beside a server does: without start-up recovery, which would take the server’s writes in progress for a crash’s leftovers.

pub fn create( &self, who: &Caller, found: &Inspection, body: &[u8], ) -> Result<Created, StoreError>

Stores a new vCon. The uuid’s state is checked before anything is sealed, the body is written in the order below, and the commit checks the state again, so of two racing writers one wins and the other’s file is removed.

pub fn get(&self, who: &Caller, uuid: Uuid) -> Result<Stored, StoreError>

Reads the current version of uuid. The body is decrypted whole, then one transaction checks that the version is still current and commits the audit record; only then is the body returned. If the version changed meanwhile, the read starts again.

pub fn replace( &self, who: &Caller, if_match: VersionId, found: &Inspection, body: &[u8], ) -> Result<VersionId, StoreError>

Replaces the current version of found.uuid, if it is if_match and neither signed nor encrypted. The caller has checked that the body’s uuid is the one asked for. The old version is hidden, and kept for legal reads until it is purged. As in create, the state is checked before sealing and again at the commit, so of two racing replaces one wins and the other’s file is removed.

pub fn delete( &self, who: &Caller, uuid: Uuid, retention: Retention, ) -> Result<(), StoreError>

Deletes uuid: one transaction marks it deleted, empties its current version and hides every kept version, with the audit record. Its versions stay for legal reads until they are purged; any already as old as retention is purged at once, so a zero period erases the vCon inside the request. Deleting a deleted or purged uuid succeeds again. A legal hold does not stop a delete, only a purge.

pub fn check(&self) -> Result<Vec<VersionId>, StoreError>

Every version whose object file is missing. Such a version answers 500 when read; it is reported, never dropped.

pub fn counts(&self) -> Result<Counts, StoreError>

How many versions the Store keeps and how many uuids are held.

pub fn export( &self, since: Option<i64>, out: &mut dyn Write, ) -> Result<(), AuditError>

Writes the tenant’s log after since as JSON lines, oldest first. Not recorded: reading the log changes nothing.

pub fn audit_page( &self, who: &Caller, query: &AuditQuery, ) -> Result<Vec<u8>, StoreError>

A page of the tenant’s log as JSON lines, the lines export writes for the same records. The read is recorded as audit_read in the same log and transaction, after the page is read, so a page never holds its own record.

pub fn log(&self, entry: &Entry) -> Result<(), StoreError>

Records, in a transaction of its own, an action on the tenant taken elsewhere, such as a change to its retention period.

pub fn count(&self, entry: &Entry) -> Result<(), StoreError>

Counts, in a transaction of its own, an event the tenant’s log keeps one record per minute for, such as a failed check of one of its keys.