Crate coven_storage 

Storage providers, encrypted objects at paths, and recorded upload sessions (§20).

This crate handles encrypted objects without performing coven’s object cryptography. Provider adapters authenticate their native requests. The caller records upload sessions and commits credentials to key custody only after setup succeeds. Providers never read the database.

Modules

providers

Built-in provider network implementations.

test_utils

An in-memory provider, fault injection and the shared provider conformance suite.

Structs

ByteProgress

Told how far through an object a request’s bytes reach, counted from the object’s start, each time more are handed over or received. A request sent again, such as after a refreshed sign-in, counts again from where it starts. Clones tell the same place.

ByteRange

A nonempty half-open byte range; end must not exceed the object’s length.

ConfirmedPart

One part a provider whose parts are independent confirmed, for the caller to add to its session (UploadSession::confirm).

ConnectionCredentials

Connection data used between coven crates; credentials never enter restore codes.

CooldownNotRecorded

The provider asked for a cooldown that could not be persisted. The work that observed it fails; automatic retry waits for the app.

CoolingDown

A request refused before it was sent, while a provider cooldown is live.

FolderLabel

A Dropbox shared folder’s or a OneDrive folder’s name and web address, as the member’s account named them at this device’s latest connection (§20.2). Display only: coven never reaches storage through them.

LeftUpload

One upload a device left: an unfinished provider session, a staged temporary, or a detection probe. Only the provider that listed it can end it.

NoCooldown

No cooldown is kept: raw fixtures and probes outside a store’s lifetime.

OAuthTokens

Device sign-in tokens exchanged between provider code and credential custody.

ObjectListing

The connection’s listing result. Native providers add entries while consuming pages so a conflict stops the request before fetching another page.

ObjectPath

One validated encrypted-object path in the layout of §§5, 10, 12, 13, 16 and 17.

ObjectPrefix

A prefix of the validated object layout, used for provider listing.

ObjectRead

Encrypted bytes and the provider observation identifying those exact bytes.

ObjectStream

Metadata and the single body response it describes. A consumer must read through EOF before treating a complete object as received. Dropping this value cancels the response and establishes no completion verdict.

PartPermit

A part the connection admitted (§17.9): no provider cooldown was live, the session names the connection’s location, the part fits the session, and its destination could be published. Admitting a planned session’s first part marked its plan. Sending the part consumes the permit.

PathError

A path is outside the canonical object layout.

PublicationRequest

One destination and its shared gate, retained through native waits and retries.

RequestCounts

Every kind’s totals since the connection was made.

RequestTotal

One kind’s requests: how many were sent, the body bytes sent or received, and the time from sending each until its response, plus the time spent waiting for a read’s body.

RestoreStorage

What a restore code tells a new device about storage: the store’s location and, on S3, the member’s key when the person’s own device sends the one it holds (§13.1). Never OAuth tokens or a share token.

RetainedAccess

A grant that revocation left for the owner to inspect.

S3Credentials

This member’s S3 credentials, made by an admin in the provider console (§20.10).

S3Detection

What detection observed at one location (§20.7).

S3DetectionRun

What one detection did (§20.7).

S3DetectionRuns

The detection runs one detection cleans up after (§20.7): its own, which the caller recorded before detection writes its first probe, and the earlier runs at the same bucket whose probes and uploads no cleanup has confirmed gone, such as one a crash cut.

S3ProbeResult

One probe’s outcome.

S3Settings

Every S3 behavior the adapter varies, one value each (§20.7).

SetupWaits

What one setup call has spent waiting to send refused requests again. The call’s steps draw on it until it connects; then the connection the call makes beside the store’s for its own requests (crate::StorageConnection::during_setup) takes it, and both go when the call and its requests end. The store’s connection never resends.

StorageConnection

Applies the storage contract around native provider calls (E5). Every consumer uses this capability and waits for the same provider cooldown.

StorageInvitation

Provider information carried inside coven’s encrypted invite code. Native share tokens admit the recipient; they never identify grants for revocation.

StoredObject

Metadata of an object returned by a provider read, exact status or listing.

TransferBudget

Compose once at the handle’s root and pass to every connection and file owner. Existing response bodies retain their leases when a limit changes.

TransferLimits

Limits shared by the open store’s transfer consumers (E5).

UploadSession

A provider upload recorded by the caller’s operation (§17.9, §11). The destination retains its original absent/revision condition across retries.

Enums

AccessGrant

Granting access succeeds either through the provider or through an admin action.

ChecksumValue

The algorithm and native encoding of a provider checksum.

CloudProvider

A provider supported by coven (§20.2).

DropboxAccess

Dropbox fixes this access level on the app registration (§20.2).

DropboxLocation

Dropbox’s permanent creation choice, retained in settings and restore codes.

InviteStorage

The storage part of format.md D13’s invitation. Account credentials are never shared; S3 credentials are the key created specifically for this invite.

MemberAccess

An account to share with, or the id of a member’s S3 key.

OAuthAccess

The access requested by one sign-in and retained with its credentials.

ObjectChecksum

Full-content checksums and multipart composites have different comparison rules.

ProviderAuth

What a connection authenticates with (§20.2).

ProviderSignOut

How a removed device’s member cuts off its provider access (§14.2, E9).

RequestKind

A kind of provider request.

RetainedAccessReason

The provider’s reason that a grant was retained.

RetryAfter

The wait a provider requested with a response (§6.7).

S3BucketVersioning

The bucket’s versioning state, read through the service’s XML API (§20.7).

S3Checksums

How returned checksums are read.

S3CopyCondition

The destination condition on a publishing copy.

S3CopyPublication

Which publications proceed by a conditional copy of a reserved temporary (§20.6).

S3Listing

The listing protocol.

S3MultipartTimestamp

What a native multipart object’s Last-Modified dates.

S3Probe

A behavior detection probes.

S3Profile

An S3 location’s behaviors: a catalogued service’s, or its own.

S3ProfileName

An S3 service whose catalogued profile a location names (§20.7). Self-hosted services have arbitrary endpoints, so no hostname identifies them.

S3ResponseHeaders

Which response headers carry metadata, generation and hashes.

S3Revision

Where a replaceable object’s revision comes from.

S3Signing

Request authentication.

S3SinglePut

The create-once condition on a single PUT.

StorageCheck

The provider operation checked before setup commits anything (E5).

StorageCheckError

A provider or S3 settings check refused the location (§20.7, §20.8).

StorageConfig

The store’s location; credentials are kept separately in key custody.

StorageCredentials

Device credentials committed separately from provider settings.

StorageError

A storage error preserves its cause without converting it into text.

StorageFailure

Failures the app can distinguish and act on (Appendix F.5).

UploadTarget

The one condition under which all uploaded bytes may become visible.

Constants

BUFFERED_READ_LIMIT

Maximum collected response; larger objects use the incremental reader.

BUFFERED_REQUEST_LIMIT

Most bytes a caller collects in memory for one request body, matching crate::BUFFERED_READ_LIMIT for response bodies. A single request carries its whole body, so no object goes in one request past this, even on a provider accepting more: a large object goes one part at a time and never has to fit in memory (§17.1).

LONGEST_RETRY_DELAY

The longest ordinary delay between unsuccessful attempts.

SETUP_RATE_LIMIT_WAIT

The longest one setup call waits, in total, to send rate-limited requests again.

Traits

Cooldown

The store’s provider cooldown, shared by every consumer of its connection: sync passes, operations, file transfers and joining.

ObjectBody

A native response body. Reads never exceed the supplied buffer; zero means transport completed and any replacement-revision check also succeeded.

ProviderOps

Native calls used by StorageConnection. Consumers use Storage; implementations handle provider protocols after the connection checks paths, request sizes and recorded sessions. Construction receives validated settings.

PublicationGate

Re-evaluates the installation’s authority immediately before a native request. This capability carries no provider IO and must include elapsed sleep time.

Storage

The operations coven needs from a provider (§20.1).

TokenCustody

The custody of a connection’s sign-in: coven’s session custody before setup or bootstrap publishes the store, device custody afterwards (§20.2).

Functions

check_provider

Check a candidate provider before reserving or publishing setup state. The storage owner supplies a fresh path and sealed bytes: at least three, and within the single-request limit, because the conditional replacement it checks is one request. This calls the provider without committing credentials or local settings. Cleanup runs even after a lost create reply; a preexisting path is left intact. The caller must await cleanup even if its app waiter is cancelled. During setup the connection sends rate-limited requests again (§20.8), so a refusal fails the check only once the setup call’s minute is spent.

device_uploads

The reserved folder holding one device’s upload temporaries and sessions in a store (D10). It names the device, so whose they are stays known, and no object path lies under it, so listings of published objects skip it.

goes_in_parts

Whether an object of size bytes goes up in parts rather than in one request: past the provider’s single-request limit or BUFFERED_REQUEST_LIMIT, whichever is less (§20.6). The 64-KiB encryption chunk plays no part. Every upload routes by this alone: a create of complete bytes, and a caller sending a repeatable source, which reads it whole only for one request and otherwise records a session.

record_config

Atomically record config as the store’s location after the facade has established the connection.

recorded_config

Read the location recorded in the store directory’s settings file, with absence distinct from malformed settings. Credentials never enter this file.

remove_recorded_config

Remove the recorded location after the facade successfully removes credentials.

retry_delay

The delay after the unsuccessful attempt numbered attempt, counting from zero: 1, 2, 4, …, 256, then 300 seconds.

validate_directory

Validate a provider folder as a strict ancestor of an object in the layout. Empty folders left by interrupted uploads remain recognizable.