AnalyticsCatalogConfiguration
The analytics catalog's beans: who calls it and what each caller may send or read, and the catalog's ports.
Who calls it: CoSec's callers, from the identity the CoSec gateway verified and forwarded (the
cosecprofile, CoSec's gateway mode readingCoSec-Identity); in development without CoSec, the host's, from theWow-*identity headers any client sets (DevelopmentCallerResolver), of which a request without a user is no caller here (requireSignedInCaller): it is answered 401, as behind the gateway. A node outside development without CoSec does not start.What each may send: AnalyticsCatalogAuthorizer, by role, or CoSec's policies when CoSec decides the requests itself (its
AuthorizationChecker) andwow.cosec.authorizer.enabledis on; what each may read: AnalyticsCatalogReaderRole.The ClickHouse client: one client of
wow.clickhouse.endpointand its credentials (ClickHouseClients) the catalog, its datasets' warehouse, and the host's Sink and dataset backend share, closed with the context.The catalog: the WarehouseCatalog of the ClickHouse server that client reaches, over
wow.analytics.catalog.databases(wow.clickhouse.databasewhen none), or WarehouseCatalog.NONE without one; the TrustedWriters ofwow.analytics.catalog.trusted-writers; the KnownAggregates of the sources' snapshots; the DatasetSources a dataset's definition is checked against, the sources' latest states; and the CatalogWatcher that syncs what changed everywow.analytics.catalog.refresh-interval, unlesswow.analytics.catalog.watch.enabled=false.The datasets (-2): the DatasetWarehouse their versions' views are created in, on the same ClickHouse server (DatasetWarehouse.NONE without one), the DatasetPolicy of
wow.analytics.catalog.datasets.*, and, unlesswow.analytics.catalog.datasets.serving.enabled=false, the DatasetPublicationWatcher that serves the published versions on this node, with its readiness (datasetPublications, out of service until its first read) and its metrics (wow.analytics.catalog.datasets.sync.age,wow.analytics.catalog.datasets.publication.lag, seconds).
Functions
Who sends what: steps aside when CoSec decides (CoSecCommandAuthorizer, its policies alone, this one then having no objection); otherwise the catalog's roles decide (AnalyticsCatalogAuthorizer).
The service's one ClickHouse client, of wow.clickhouse.* as the Sink and the dataset backend read it: they use it rather than each opening its own, and never close it; the context closes it.
GET /analytics-catalog/settings: what a console offers depends on (CatalogSettings), the roles deciding as analyticsCatalogAuthorizer has them decide.
datasetPublications: out of service until the node read the datasets' publications once.
The reference actions of the datasets' rows: the commands of the peers wow.peers describes by their Manifest (contract: manifest), read with the service's WowClient in wow.peer.mode, and sent as the caller through the node's CommandClient, each context in its own mode: the context's service routes, the edge mounts them from the Manifest.
The warehouse catalog: over databases, else wow.clickhouse.database, its one reader.