Struct Store 

pub struct Store { /* private fields */ }

One tenant’s vCons.

Implementations

impl Store

pub fn backup_to(&self, dir: &Path) -> Result<Copied, BackupError>

Copies this tenant’s catalog and object files into dir, made if new. Anything already in dir from an earlier try is replaced or removed.

Each try copies the catalog first, in one step inside one read transaction, then the object file of each version row in that copy. An object file is written once and never changed, so a file copied at any try is still right; a row whose file is gone was purged after the copy, and the next try copies the catalog again. Files the final copy has no row for are removed. Every file and directory written is synced, so the backup is whole once this returns.

impl Store

pub fn examine( &self, retention: Retention, key_since: OffsetDateTime, now: OffsetDateTime, ) -> Result<Examination, ExamineError>

Examines the Store under retention at now, counting purges made since key_since.

pub fn purges_since( &self, since: OffsetDateTime, ) -> Result<(u64, Option<OffsetDateTime>), StoreError>

How many purges were recorded since since, and when the oldest of them was made: work only the tenant key’s next rotation finishes.

impl Store

pub fn tenant(&self) -> TenantId

The tenant this Store holds.

pub fn kept_versions( &self, since: Option<i64>, until: Option<i64>, ) -> Result<Vec<KeptVersion>, StoreError>

Every kept version, live or hidden, stored at or after since and before until (nanoseconds since the epoch), by store time and then version id, all from one snapshot of the catalog.

pub fn sealed_of( &self, kept: &KeptVersion, ) -> Result<Option<Vec<u8>>, StoreError>

The sealed blob of a version kept_versions listed, from its object or its pack file, byte for byte. None when the version has been purged since: its row is gone and its blob with it. A blob missing while its row is still there is damage.

pub fn open_sealed( &self, kept: &KeptVersion, sealed: &[u8], ) -> Result<Vec<u8>, StoreError>

The body sealed, the object of kept, holds: what get returns.

impl Store

pub fn legal_get( &self, who: &Caller, uuid: Uuid, version: Option<VersionId>, ) -> Result<Legal, StoreError>

Reads version of uuid, or with None its current version, or its latest kept one when the uuid is deleted. A version purged, never stored or of another uuid is NotFound; a purged uuid is Gone. The whole read, object included, is one immediate transaction, so a purge cannot remove what is being read. Each answer is recorded.

pub fn legal_versions( &self, who: &Caller, uuid: Uuid, ) -> Result<Vec<VersionInfo>, StoreError>

Every kept version of uuid, oldest first, with its times. A purged uuid is Gone and one never stored NotFound. Each answer is recorded.

pub fn restore(&self, who: &Caller, uuid: Uuid) -> Result<VersionId, StoreError>

Makes the latest kept version of a deleted uuid current again: its hidden time and the uuid’s deleted time are cleared, so no sweep purges it. Older hidden versions stay hidden. A live uuid is NotDeleted, a purged one Gone, one never stored NotFound. Recorded.

pub fn set_hold( &self, who: &Caller, uuid: Uuid, on: bool, ) -> Result<(), StoreError>

Turns the legal hold on uuid on or off. A held uuid is never purged; a delete still hides it. A purged uuid is Gone, one never stored NotFound. Recorded.

impl Store

pub fn list( &self, who: &Caller, query: &ListQuery, ) -> Result<Listing, StoreError>

A page of the tenant’s live vCons, newest first by when each uuid was first stored, then by uuid. The page and its audit record are one transaction.

impl Store

pub fn purge_due(&self, retention: Retention) -> Result<PurgeReport, StoreError>

Erases every version due under retention. Each goes in a transaction of its own that checks the rule again, so a restore or a hold that commits first keeps it. The transaction deletes the version’s row, and with it the only copy of its wrapped data key, and records the purge; a deleted uuid left with no version gives up its row for a tombstone. The object file is removed after the commit. Last, the WAL is checkpointed with truncation, tried again while readers finish, so no page that held a purged key is left in it.

impl Store

pub fn rewrap(&self, new: &Key, limit: usize) -> Result<usize, StoreError>

Rewraps up to limit of the data keys still wrapped under this Store’s tenant key so they are wrapped under new, in one transaction, and returns how many it rewrapped; 0 means none is left. Each rewrap is counted against new, and refused at its wrap limit.

pub fn rows_under_other_keys(&self) -> Result<u64, StoreError>

How many version rows name a key other than this Store’s tenant key: a rotation stopped part way leaves some.

impl Store

pub fn open( dir: &Path, tenant: TenantId, tenant_key: Key, fs: Arc<dyn Fs>, clock: Arc<dyn Clock>, ) -> Result<Store, OpenError>

Opens the tenant’s local catalog under its catalog key, making it if new, then runs start-up recovery.

pub fn open_beside( dir: &Path, tenant: TenantId, tenant_key: Key, fs: Arc<dyn Fs>, clock: Arc<dyn Clock>, ) -> Result<Store, OpenError>

Opens the store as a command running beside a server does: without start-up recovery, which would take the server’s writes in progress for a crash’s leftovers.

pub fn create( &self, who: &Caller, found: &Inspection, body: &[u8], ) -> Result<Created, StoreError>

Stores a new vCon. The uuid’s state is checked before anything is sealed, the body is written in the order below, and the commit checks the state again, so of two racing writers one wins and the other’s object is removed.

pub fn get(&self, who: &Caller, uuid: Uuid) -> Result<Stored, StoreError>

Reads the current version of uuid. The body is decrypted whole, then one transaction checks that the version is still current and commits the audit record; only then is the body returned. If the version changed meanwhile, the read starts again.

pub fn replace( &self, who: &Caller, if_match: VersionId, found: &Inspection, body: &[u8], ) -> Result<VersionId, StoreError>

Replaces the current version of found.uuid, if it is if_match and neither signed nor encrypted. The caller has checked that the body’s uuid is the one asked for. The old version is hidden, and kept for legal reads until it is purged. As in create, the state is checked before sealing and again at the commit, so of two racing replaces one wins and the other’s object is removed.

pub fn delete( &self, who: &Caller, uuid: Uuid, retention: Retention, ) -> Result<(), StoreError>

Deletes uuid: one transaction marks it deleted, empties its current version and hides every kept version, with the audit record. Its versions stay for legal reads until they are purged; any already as old as retention is purged at once, so a zero period erases the vCon inside the request. Deleting a deleted or purged uuid succeeds again. A legal hold does not stop a delete, only a purge.

pub fn check(&self) -> Result<Vec<VersionId>, StoreError>

Every version whose object is missing, or, for a packed version, whose pack file is missing or not the length its row says. Such a version answers 500 when read; it is reported, never dropped.

pub fn packed_versions(&self) -> Result<u64, StoreError>

How many versions are packed into pack files: once there are any, the storage must keep Parquet storage on, since nothing turns them back into objects.

pub fn counts(&self) -> Result<Counts, StoreError>

How many versions the Store keeps and how many uuids are held.

pub fn export( &self, since: Option<i64>, out: &mut dyn Write, ) -> Result<(), AuditError>

Writes the tenant’s log after since as JSON lines, oldest first. Not recorded: reading the log changes nothing.

pub fn audit_page( &self, who: &Caller, query: &AuditQuery, ) -> Result<Vec<u8>, StoreError>

A page of the tenant’s log as JSON lines, the lines export writes for the same records. The read is recorded as audit_read in the same log and transaction, after the page is read, so a page never holds its own record.

pub fn log(&self, entry: &Entry) -> Result<(), StoreError>

Records, in a transaction of its own, an action on the tenant taken elsewhere, such as a change to its retention period.

pub fn count(&self, entry: &Entry) -> Result<(), StoreError>

Counts, in a transaction of its own, an event the tenant’s log keeps one record per minute for, such as a failed check of one of its keys.