Protected ReadonlycacheProtected ReadonlydbProtected ReadonlyindexProtected Readonlys3Read at each use: a config namespace's resolver.
Protected Readonlys3ProtectedfileCalled once a file's row is soft-deleted, whether or not its object is gone.
ProtectedfileCalled once a file's row is written and its owner's pages busted.
A 15-minute link that downloads the file under its name; null as getStream.
A document of any other type is not found.
The file's first maxBytes, for a preview that must not pull a whole
report. Null as getStream.
The file's body from S3; null for a folder, a missing row or a missing object.
ProtectedindexIndexes a file a dashboard user's browser has put in S3 through
signUpload. Its size is read from S3 and its content type from its
name; neither is taken from the caller or from what the browser sent. The
object must be that upload: newer than the row it replaces, or recent
where there is no row. replaced says whether a live file was at the path.
Clear each customer's membership tag and each record tag wherever cached,
and always this namespace's collection tag. keys are exact deletes in this
instance's key space: the only bust a null client honours.
ProtectedinvalidateWhat a write of ids under ownerId clears: the owner's membership tag,
each document's record tag and folded-get key, and the collection tag.
The owner's own record tag is its writers' to clear, never a document's.
Protectedowner{ [ownerKey]: ownerId }, as documents and cache keys spell it.
ProtectedownerProtectedownerThe owner's workspace row and S3 root; an owner that does not exist is a caller bug.
ProtectedpageTags for a page of one owner's documents: the owner's membership tag, which is the query's scope and so on an empty page too, and each held document.
ProtectedprefixWhere type's objects go under the owner's root, below folder if given.
Optionalfolder: stringProtectedreconcileBrings the index into line with S3 for one key, whatever prompted the
look: a live object with no row gets one, a row whose object has gone is
soft-deleted. S3 is only read. A signed upload is completeUpload's.
ProtectedreconcileIndexes what is already in S3 for one owner: inserts the file and folder
rows that are missing and never modifies an existing one. dryRun reads
S3 and the index and reports what a run would insert. files.found counts
every live object, files.skipped those whose path the index cannot hold.
ProtectedremoveSoft-deletes a document of type and, for a file, removes its object. An
id that names nothing of that type and those kinds is fine. So is one
already deleted, whose object is removed again: that is how a retry
finishes a delete whose S3 call failed. A folder that still holds a live
document is refused and left as it is.
One owner's documents, folders before files and then by orderBy, which
defaults to name ascending. folders matches the parent path exactly,
so [""] lists the root. A filter given an empty list matches nothing.
ProtectedsearchTags for a page: the scope its query searched (each customer's membership
tag, else the collection tag), so an empty page is bustable too, plus the
records it projects and the fields that chose or ordered its rows.
ProtectedsignedA 15-minute link that downloads the object at key as name; null when S3 has none.
ProtectedsignChecks a dashboard user's upload and signs the PUT their browser sends
straight to S3. Writes no row: indexUpload indexes the file once the
bytes are there. headers is exactly what the PUT must carry: the
uploader, signed into the object's metadata, and a condition on what the
key holds now, so the URL writes once and cannot replay over a later write.
OptionalupdatedByUserId?: stringThe dashboard user writing it; omit for CFX staff, who leave it null.
Whether a live file already at the path may be overwritten.
In bytes; the signature holds the upload to exactly this length.
ProtectedwriteWrites a file from a caller that names its own path: a workflow, or CFX staff. The folders above it are created as needed. A path that is not clean segments, that another type's objects occupy, or that a live node of the other kind holds, throws.
ProtectedwriteMakes an empty folder for a dashboard user. Nothing is written to S3: a
folder is a row. folder is the parent and must exist; "" is the root.
StaticgetThe exact key BankDocumentQueryService.get reads through. Writers
delete it so read-after-write holds under a null client.
Root of the bank document hierarchy: owns the
bank-document-searchnamespaceBankDocumentQueryServicereads through andBankDocumentServicebusts. One read surface, so every instance takes the samekeyPrefix.updatedByUserNameis joined frombank.bank_dashboard_user, a record with no kind to tag it by: a renamed user shows under the old name until the TTL or the post-deploy flush.