Documentation
¶
Overview ¶
Package compliance describes personal-data and confidentiality classifications and the kernel-owned lifecycle of erasable subject keys. It performs no local cryptography. Confidentiality keys are never PII keys and cannot be erased here.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrLifecycle = errors.New("chronicle: subject-key lifecycle failed")
ErrLifecycle identifies an unsuccessful or incomplete subject-key operation. A failure is not evidence that no key was erased. Retry erasure deliberately; never automatically authorize replacement keys as error recovery.
Functions ¶
func ValidateSubject ¶
ValidateSubject rejects empty subjects and identifiers in the kernel's reserved confidentiality key space. Call before admitting writes or operating on PII keys. Event subjects are checked even for currently unclassified events, since their subject can propagate to protected read models. Kernel 19.32.2 and later refuse PII for a reserved identifier (Chronicle#4553) but still accept it as the subject of an unclassified event, so this check remains defense in depth.
Types ¶
type Classification ¶
type Classification struct {
PII bool
Encrypted bool
Scope Scope
Details string
// DetailsSet distinguishes an explicitly empty rationale from inheritance.
// Nonempty Details and Encrypted imply presence without setting this flag.
DetailsSet bool
}
Classification is copied declaration metadata. PII and Encrypted are mutually exclusive. Details is the compliance rationale or encryption purpose; it is schema metadata, not a place for personal data or secrets. An empty Scope with Encrypted means Subject. Details alone can supply a declaring type's rationale.
type Declaration ¶
type Declaration struct {
// contains filtered or unexported fields
}
Declaration supplies type-wide, property-specific or provider classifications. Use For, Property or Using. Options copy declarations; no global type registry exists, so catalogs can classify the same Go type independently.
func For ¶
func For[T any](metadata Classification) Declaration
For declares classification on T, including its occurrences in collections. Repeated declarations of the same type are rejected rather than overwritten.
func Property ¶
func Property(path string, metadata Classification) Declaration
Property classifies an exact serialized property path. Field tags are preferred when the declaration belongs to the model; duplicate property declarations fail.
func Using ¶
func Using(provider Provider) Declaration
Using registers a provider in declaration order. Nil providers are invalid.
func (Declaration) Metadata ¶
func (d Declaration) Metadata() Classification
Metadata returns the copied classification.
func (Declaration) Path ¶
func (d Declaration) Path() string
Path returns a property declaration's serialized path, or empty.
func (Declaration) Provider ¶
func (d Declaration) Provider() Provider
Provider returns the provider, or nil for a static declaration.
func (Declaration) TargetType ¶
func (d Declaration) TargetType() reflect.Type
TargetType returns a type declaration's target, or nil.
type InvalidSubjectError ¶
type InvalidSubjectError struct {
// Reserved distinguishes a confidentiality key identifier from an empty subject.
Reserved bool
}
InvalidSubjectError identifies an empty or reserved compliance subject. It never retains the identifier, which may itself contain personal data.
func (*InvalidSubjectError) Error ¶
func (e *InvalidSubjectError) Error() string
Error returns a payload-free description.
func (*InvalidSubjectError) Unwrap ¶
func (e *InvalidSubjectError) Unwrap() error
Unwrap exposes the invalid-configuration category.
type LifecycleError ¶
type LifecycleError struct {
// Operation is ErasePII or AllowNewEncryptionKeyFor.
Operation string
// Cause preserves gRPC status, cancellation and ErrUnsupported identities.
Cause error
}
LifecycleError preserves error identity without printing identifiers or server diagnostics. Inspect Cause only within the application's sensitive-data boundary.
func (*LifecycleError) Error ¶
func (e *LifecycleError) Error() string
Error returns a payload-free description.
func (*LifecycleError) Unwrap ¶
func (e *LifecycleError) Unwrap() []error
Unwrap exposes both the lifecycle category and underlying failure.
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager borrows its transport and is safe for concurrent use. Its operations affect every event store in its namespace, not other namespaces. The kernel owns fencing, durable key deletion, peer-cache eviction and authorization.
func New ¶
func New(store metadata.StoreName, namespace metadata.Namespace, conn grpc.ClientConnInterface) (*Manager, error)
New constructs a manager without I/O. EventStore.Compliance supplies the normal connection lifecycle and registration barriers; adapters own those themselves.
func (*Manager) AllowNewEncryptionKeyFor ¶
AllowNewEncryptionKeyFor explicitly permits future PII writes after erasure. It does not recover erased ciphertext. Authorization is namespace-wide across stores. Old kernels report ErrUnsupported, never silent success.
func (*Manager) DeleteEncryptionKeyFor ¶
DeleteEncryptionKeyFor is the C#-named equivalent of ErasePII.
func (*Manager) ErasePII ¶
ErasePII fences and destroys the subject's PII keys across stores in this namespace. Repeated erasure is safe. Events remain stored but become unreadable; future PII writes are refused until deliberately reauthorized. Confidentiality keys are disjoint and never erased. No automatic retry or local key cache exists.
type Provider ¶
type Provider func(Target) (Classification, error)
Provider supplies classifications during schema compilation, never at runtime. It must be deterministic, concurrency-safe and free of I/O. A zero result means no metadata. Errors abort registration and must not contain personal data.
type Scope ¶
type Scope string
Scope selects a confidentiality key's ownership, independently of PII.
Source Files