What a host supplies so the credentials group can attempt real connections.
Every callback performs an act against a live store. A probe that
simulates its answers makes this whole group meaningless, since the
findings this group exists to catch — a REVOKE that returns success while
revoking nothing, an ACL whose null value means "wide open" — are precisely
the ones no simulation reproduces.
Summary
Types
An opaque credential, as the host models it.
Callbacks
Attempts credential against the store belonging to sandbox.
Attempts credential against the platform's own database (013-FR-009).
The credential belonging to this sandbox, as tenant code would read it.
Rotates the credential in place, returning the new one.
The secret string that must never appear in a log, record, or inspect.
Types
@type credential() :: term()
An opaque credential, as the host models it.
Callbacks
@callback attempt_connection(credential(), ExSandbox.Sandbox.t()) :: {:ok, :connected} | {:refused, term()} | term()
Attempts credential against the store belonging to sandbox.
{:ok, :connected} when the connection succeeded, {:refused, reason} when
it was turned away. Anything else is inconclusive and fails the check —
"could not tell" is not evidence of isolation.
@callback attempt_platform_connection(credential()) :: {:ok, :connected} | {:refused, term()} | term()
Attempts credential against the platform's own database (013-FR-009).
@callback read_credential(ExSandbox.Sandbox.t()) :: {:ok, credential()} | {:error, term()}
The credential belonging to this sandbox, as tenant code would read it.
@callback rotate(ExSandbox.Sandbox.t()) :: {:ok, credential()} | {:error, term()}
Rotates the credential in place, returning the new one.
FR-020: the sandbox must not be rebuilt or destroyed. A probe that
reprovisions here is answering a different question.
@callback secret_value(credential()) :: String.t()
The secret string that must never appear in a log, record, or inspect.