-- Hoogle documentation, generated by Haddock
-- See Hoogle, http://www.haskell.org/hoogle/


-- | IFC enforcing web platform framework
--   
--   Hails is a framework for building multi-app web platforms. This module
--   exports a library for building Hails platforms.
@package hails
@version 0.1.1


-- | This module re-exports <a>Data.Time</a> wrapped in <a>LIO</a>. It is
--   important to note that this module is only safe with the latest
--   version of <a>LIO</a>, where <tt>toLabeled</tt> has been removed and
--   timing attacked have been addressed. In similar vain, when executing a
--   piece of code that you do not trust, it is important that the time
--   primitives not be directly available.
module LIO.Data.Time

-- | Get the current UTC time from the system clock.
getCurrentTime :: LabelState l p s => LIO l p s UTCTime

-- | Get the local time together with a TimeZone.
getZonedTime :: LabelState l p s => LIO l p s ZonedTime

-- | Convert UTC time to local time with TimzeZone
utcToLocalZonedTime :: LabelState l p s => UTCTime -> LIO l p s ZonedTime


-- | This module exports various cryptographic primitives.
module Hails.Crypto


-- | This module exports various authentication methods.
module Hails.HttpServer.Auth

-- | Authentication function
type AuthFunction m s = HttpReq s -> m (Either (HttpResp m) (HttpReq s))

-- | Perform basic authentication
basicAuth :: Monad m => (HttpReq s -> m Bool) -> AuthFunction m s

-- | Basic authentication, that always succeeds. The function uses the
--   username in the cookie (as in <a>externalAuth</a>), if it is set. If
--   the cookie is not set, <tt>bsicAuth</tt> is used.
basicNoAuth :: Monad m => AuthFunction m s

-- | Use an external authentication service that sets a cookie. The cookie
--   name is <tt>_hails_user</tt>, and its contents contain a string of the
--   form <tt>user-name:HMAC-SHA1(user-name)</tt>. This function simply
--   checks that the cookie exits and the MAC'd user name is correct. If
--   this is the case, it returns a request with the cookie removed.
--   Otherwise it retuns a redirect (to the provided url) response.
externalAuth :: L -> String -> AuthFunction DC s

module Hails.IterIO.Conversions

-- | Lift the underlying monad of an <a>Iter</a> from <a>IO</a> to
--   <a>LIO</a>.
iterIOtoIterLIO :: (LabelState l p s, ChunkData t) => Iter t IO a -> Iter t (LIO l p s) a

-- | Lift the underlying monad of an <a>IterR</a> from <a>IO</a> to
--   <a>LIO</a>.
ioIterRtoLIO :: (LabelState l p s, ChunkData t) => IterR t IO a -> IterR t (LIO l p s) a

-- | Lift the underlying monad of an <a>Inum</a> from <a>IO</a> to
--   <a>LIO</a>.
onumIOtoOnumLIO :: LabelState l p s => Onum L IO L -> Onum L (LIO l p s) a
inumIOtoInumLIO :: (ChunkData tIn, ChunkData tOut) => Inum tIn tOut IO a -> LIOstate DCLabel TCBPriv () -> Inum tIn tOut DC a


-- | Exports basic HTTP client functions inside the <a>DC</a> Monad.
--   Computations are allowed to communicate over HTTP as long as they can
--   read and write to a labeled origin. An origin is associated with two
--   labels. When writing, the origin has a label of the form <tt>&lt;
--   {["scheme://authority"]}, True &gt;</tt>, where <tt>scheme</tt> is
--   either 'http' or 'https', and <tt>authority</tt> is the domain name or
--   IP address used in the request and port number of the connection. In
--   other words, the secrecy component contains the origin information,
--   while the integrity component is the same as that of public data. When
--   reading, the origin has a label of the form <tt>&lt; True,
--   {["scheme://authority"]} &gt;</tt>.
--   
--   This means that <a>LIO</a> (specifically, <a>DC</a>) computations can
--   export data if the current label is not higher than that of the
--   labeled origin, and read data that is no more trustworthy than that of
--   the origin. Practically, this means that untrusted computation can
--   export data so long as the they have not observed any data more
--   sensitive than the label of the target domain. Reading (which also
--   occurs on every request/write) further raises the current label to the
--   join of the current label and origin.
--   
--   For example, suppose some piece of data, <tt>myLoc</tt>, has the
--   label:
--   
--   <pre>
--   aliceLocL = newDC ("alice" ./\. "http://maps.googleapis.com:80") (&lt;&gt;)
--   </pre>
--   
--   created as:
--   
--   <pre>
--   myLoc &lt;- labelP alicePriv  aliceLocL "3101 24th Street, San Francisco, CA"
--   </pre>
--   
--   Then, untrusted code (with initial label set to public) running on
--   behalf of "alice" , may perform the following operation:
--   
--   <pre>
--   let mapBase = "http://maps.googleapis.com/maps/api/geocode/json?sensor=false"
--   aliceLoc &lt;- urlEncode &lt;$&gt; (unlabelP alicePriv myLoc)
--   resp &lt;- simpleGetHttp $ mapBase ++ "&amp;address=" ++ aliceLoc
--   </pre>
--   
--   In this case the <a>unlabelP</a> will raise the current label to the
--   label:
--   
--   <pre>
--   &lt; {["http://maps.googleapis.com:80"]}, True &gt;
--   </pre>
--   
--   by exercising "alice"s privilges. Directly, the <a>simpleHttp</a> will
--   be permitted. However, if
--   
--   <pre>
--   let mapBase = "http://maps.evilalternatives.org/geocode/json?sensor=false"
--   </pre>
--   
--   an exception will be thrown since the current label does not flow to
--   the label of <tt>mapBase</tt>.
module Hails.IterIO.HttpClient

-- | A HTTP response, containing the status, headers, and parsed body.
data HttpRespDC
HttpRespDC :: !HttpStatus -> ![(S, S)] -> DC (Onum L DC ()) -> HttpRespDC

-- | Response status
respStatusDC :: HttpRespDC -> !HttpStatus

-- | Response headers
respHeadersDC :: HttpRespDC -> ![(S, S)]

-- | Response body
respBodyDC :: HttpRespDC -> DC (Onum L DC ())

-- | Perform a simple HTTP request, given the the request header, body and
--   SSL context, if any. Note that that request must have the scheme, host
--   fields set.
simpleHttp :: HttpReq () -> L -> DC HttpRespDC

-- | Same as <a>simpleHttp</a>, but uses privileges.
simpleHttpP :: DCPrivTCB -> HttpReq () -> L -> DC HttpRespDC

-- | Simple HTTP GET request.
simpleGetHttp :: String -> DC HttpRespDC

-- | Simple HTTP GET request.
simpleGetHttpP :: DCPrivTCB -> String -> DC HttpRespDC

-- | Simple HTTP HEAD request.
simpleHeadHttp :: String -> DC HttpRespDC

-- | Simple HTTP HEAD request.
simpleHeadHttpP :: DCPrivTCB -> String -> DC HttpRespDC

-- | Extract body from response
extractBody :: HttpRespDC -> DC L

-- | An HTTP client that reuses a connection to perform multiple requests.
--   Note that a <tt>wguard</tt> is only performed at the connection
--   establishment.
multiHttp :: (HttpReq (), L) -> DCHttpResponseHandler -> DC ()

-- | An HTTP response handler in the <a>DC</a> monad.
type DCHttpResponseHandler = HttpRespDC -> Iter L DC (Maybe (HttpReq (), L))

-- | Create a simple HEAD request. The <tt>url</tt> must be an
--   <tt>absoluteURI</tt>.
headRequest :: String -> HttpReq ()

-- | Create a simple GET request. The <tt>url</tt> must be an
--   <tt>absoluteURI</tt>.
getRequest :: String -> HttpReq ()

-- | Given a URL, Content-Type, and message body, perform a simple POST
--   request. Note: message body must be properly encoded (e.g.,
--   URL-encoded if the Content-Type is
--   "application/x-www-form-urlencoded").
postRequest :: String -> String -> L -> HttpReq ()

module Hails.IterIO.Mime

-- | Given a file extension (e.g., "hs") return its MIME type (e.g.,
--   "text/x-haskell"). If there is no recognized MIME type (or none of the
--   default paths exist), this function returns "application/octet-stream"
systemMimeMap :: String -> ByteString

module Hails.TCB.Types

-- | Application name
type AppName = String

-- | Application configuration.
data AppConf
AppConf :: !Principal -> !AppName -> !TCBPriv -> HttpReq () -> AppConf

-- | User the app is running on behalf of
appUser :: AppConf -> !Principal

-- | The app's name
appName :: AppConf -> !AppName

-- | The app's privileges.
appPriv :: AppConf -> !TCBPriv

-- | The request message
appReq :: AppConf -> HttpReq ()

-- | Application handler.
type AppReqHandler = HttpReq () -> DCLabeled L -> DC (HttpResp DC)

-- | Application route.
type AppRoute = HttpRoute DC ()

module Hails.IterIO.HailsRoute
routeFileSys :: LabelState l p st => (String -> ByteString) -> (FilePath -> HttpRoute (LIO l p st) s) -> FilePath -> HttpRoute (LIO l p st) s

module Hails.HttpServer

-- | Return a server, given a port number and app.
secureHttpServer :: AuthFunction DC () -> PortNumber -> AppReqHandler -> TCPServer L DC

module Hails.App

-- | Application handler.
type AppReqHandler = HttpReq () -> DCLabeled L -> DC (HttpResp DC)

-- | Application route.
type AppRoute = HttpRoute DC ()

-- | Get the user the app is running on behalf of
getHailsUser :: Action t b DC String

-- | Get the app the app is running on behalf of
getHailsApp :: Action t b DC String


-- | This module exports an interface for LBSON (Labeled BSON) object. An
--   LBSON object is either a BSON object (see <a>Bson</a>) with the added
--   support for labeled <a>Value</a>s. More specifically, a LBSON document
--   is a list of <a>Field</a>s (which are 'Key'-'Value' pairs), where the
--   <a>Value</a> of a <a>Field</a> can either be a standard <a>Value</a>
--   type or a <a>Labeled</a> <a>Value</a> type.
module Hails.Data.LBson.TCB

-- | A LBSON document is a list of <a>Field</a>s
type Document l = [Field l]

-- | A labeled <a>Document</a>
type LabeledDocument l = Labeled l (Document l)

-- | Value of field in document, or fail (Nothing) if field not found
look :: (Monad m, Label l) => Key -> Document l -> m (Value l)

-- | Lookup value of field in document and cast to expected type. Fail
--   (Nothing) if field not found or value not of expected type.
lookup :: (Val l v, Monad m, Label l) => Key -> Document l -> m v

-- | Value of field in document. Error if missing.
valueAt :: Label l => Key -> [Field l] -> Value l

-- | Typed value of field in document. Error if missing or wrong type.
at :: (Val l v, Label l) => Key -> Document l -> v

-- | Only include fields of document in key list
include :: Label l => [Key] -> Document l -> Document l

-- | Exclude fields from document in key list
exclude :: Label l => [Key] -> Document l -> Document l

-- | Merge documents with preference given to first one when both have the
--   same key. I.e. for every (k := v) in first argument, if k exists in
--   second argument then replace its value with v, otherwise add (k := v)
--   to second argument.
merge :: Label l => Document l -> Document l -> Document l

-- | A <tt>Field</tt> is a 'Key'-'Value' pair.
data Field l
(:=) :: !Key -> Value l -> Field l
key :: Field l -> !Key
value :: Field l -> Value l

-- | Field with given label and typed value
(=:) :: (Val l v, Label l) => Key -> v -> Field l

-- | If <tt>Just</tt> value then return one field document, otherwise
--   return empty document
(=?) :: (Val l a, Label l) => Key -> Maybe a -> Document l

-- | A <a>Key</a>, or attribute is a BSON label.
type Key = Label

-- | This prefix is reserved for HAILS keys. It should not be used by
--   arbitrary code.
hailsInternalKeyPrefix :: Key

-- | Check if a key is unsafe.
isUnsafeKey :: Key -> Bool

-- | A <tt>Value</tt> is either a standard BSON value, a labeled value, or
--   a policy-labeled value.
data Value l

-- | Unlabeled BSON value
BsonVal :: Value -> Value l

-- | Labeled (LBSON) value
LabeledVal :: (Labeled l Value) -> Value l

-- | Policy labeled (LBSON) value
PolicyLabeledVal :: (PolicyLabeled l Value) -> Value l

-- | Haskell types of this class correspond to LBSON value types.
class (Typeable a, Show a, Eq a, Label l) => Val l a
val :: Val l a => a -> Value l
cast' :: Val l a => Value l -> Maybe a

-- | Convert Value to expected type, or fail (Nothing) if not of that type
cast :: (Label l, Val l a, Monad m) => Value l -> m a

-- | Convert Value to expected type. Error if not that type.
typed :: (Val l a, Label l) => Value l -> a

-- | Simple sum type used to denote a policy-labeled type. A
--   <tt>PolicyLabeled</tt> type can be either labeled (policy applied), or
--   unabled (policy not yet applied).
data PolicyLabeled l a

-- | Policy was not applied
PU :: a -> PolicyLabeled l a

-- | Policy applied
PL :: (Labeled l a) -> PolicyLabeled l a

-- | Wrap an unlabeled value by <a>PolicyLabeled</a>.
pu :: (Label l, Val a) => a -> PolicyLabeled l a

-- | Wrap an already-labeled value by <a>PolicyLabeled</a>.
pl :: (Label l, Val a) => Labeled l a -> PolicyLabeled l a
newtype Binary :: *
Binary :: ByteString -> Binary
newtype Function :: *
Function :: ByteString -> Function
newtype UUID :: *
UUID :: ByteString -> UUID
newtype MD5 :: *
MD5 :: ByteString -> MD5
newtype UserDefined :: *
UserDefined :: ByteString -> UserDefined

-- | The first string is the regex pattern, the second is the regex options
--   string. Options are identified by characters, which must be listed in
--   alphabetical order. Valid options are *i* for case insensitive
--   matching, *m* for multiline matching, *x* for verbose mode, *l* to
--   make \w, \W, etc. locale dependent, *s* for dotall mode ("." matches
--   everything), and *u* to make \w, \W, etc. match unicode.
data Regex :: *
Regex :: UString -> UString -> Regex

-- | Javascript code with possibly empty environment mapping variables to
--   values that the code may reference
data Javascript :: *
Javascript :: Document -> UString -> Javascript
newtype Symbol :: *
Symbol :: UString -> Symbol
newtype MongoStamp :: *
MongoStamp :: Int64 -> MongoStamp
data MinMaxKey :: *
MinKey :: MinMaxKey
MaxKey :: MinMaxKey

-- | A BSON ObjectID is a 12-byte value consisting of a 4-byte timestamp
--   (seconds since epoch), a 3-byte machine id, a 2-byte process id, and a
--   3-byte counter. Note that the timestamp and counter fields must be
--   stored big endian unlike the rest of BSON. This is because they are
--   compared byte-by-byte and we want to ensure a mostly increasing order.
data ObjectId :: *
Oid :: Word32 -> Word64 -> ObjectId

-- | Time when objectId was created
timestamp :: ObjectId -> UTCTime

-- | Generate fresh <a>ObjectId</a>.
genObjectId :: LabelState l p s => LIO l p s ObjectId

-- | Export <a>Value</a>
type BsonValue = Value

-- | Safely convert from a <a>Value</a> to a <a>BsonValue</a>.
safeToBsonValue :: Label l => Value l -> Maybe BsonValue

-- | Safely convert from a <a>BsonValue</a> to a <a>Value</a>.
safeFromBsonValue :: (Serialize l, Label l) => BsonValue -> Maybe (Value l)

-- | Export <a>Document</a>
type BsonDocument = Document

-- | Safe version of <a>toBsonDoc</a>.
safeToBsonDoc :: (Serialize l, Label l) => Document l -> Maybe BsonDocument

-- | Safe version of <a>fromBsonDoc</a>.
safeFromBsonDoc :: (Serialize l, Label l) => BsonDocument -> Maybe (Document l)

-- | Encodea document
encodeDoc :: BsonDocSerialize doc => doc -> ByteString

-- | Decode a document
decodeDoc :: BsonDocSerialize doc => ByteString -> doc

-- | Convert a <a>Document</a> to a Bson <tt>Document</tt>. It is an error
--   to call this function with malformed <a>Document</a>s (i.e., those for
--   which a policy has not been applied.
toBsonDoc :: (Serialize l, Label l) => Document l -> Document

-- | Convert a Bson <tt>Document</tt> to a <a>Document</a>. This
--   implementation is relaxed and omits any fields that were not
--   converted. Use the <a>fromBsonDocStrict</a> for a strict conversion.
fromBsonDoc :: (Serialize l, Label l) => Document -> Document l

-- | Same as <a>fromBsonDoc</a>, but fails (returns <tt>Nothing</tt>) if
--   any of the field values failed to be serialized.
fromBsonDocStrict :: (Serialize l, Label l) => Document -> Maybe (Document l)

-- | If value is a document, remove any fields that have
--   <a>hailsInternalKeyPrefix</a> as a prefix, otherwise return the value
--   unchanged. This is equivilant to <a>exceptInternal</a> except it
--   operates on BSON values as opposed to Hails Documents.
sanitizeBsonValue :: Value -> Value
instance [overlap ok] Typeable2 PolicyLabeled
instance [overlap ok] Typeable1 Value
instance [overlap ok] Typeable1 Field
instance [overlap ok] Label l => Eq (Field l)
instance [overlap ok] (Serialize l, Label l) => BsonDocSerialize (Document l)
instance [overlap ok] BsonDocSerialize BsonDocument
instance [overlap ok] Label l => Eq (PolicyLabeled l a)
instance [overlap ok] (Show a, Label l) => Show (PolicyLabeled l a)
instance [overlap ok] Label l => Eq (Labeled l a)
instance [overlap ok] (Show a, Label l) => Show (Labeled l a)
instance [overlap ok] (Val a, Label l) => Val l (PolicyLabeled l a)
instance [overlap ok] (Val a, Label l) => Val l (Labeled l a)
instance [overlap ok] Label l => Val l (Value l)
instance [overlap ok] (Val a, Label l) => Val l a
instance [overlap ok] Label l => Eq (Value l)
instance [overlap ok] Label l => Show (Value l)
instance [overlap ok] Label l => Show (Field l)

module Hails.Database.MongoDB.TCB.Types

-- | Name of collection
type CollectionName = Collection

-- | A labeled <a>Collection</a> map.
type CollectionMap l = Labeled l (Map CollectionName (CollectionPolicy l))

-- | Labels and policies associated with a collection. See
--   <a>Collection</a>.
data CollectionPolicy l
CollectionPolicy :: l -> l -> RawPolicy l -> CollectionPolicy l

-- | Collection label
colLabel :: CollectionPolicy l -> l

-- | Collection clearance
colClear :: CollectionPolicy l -> l

-- | Collection labeling policy
colPolicy :: CollectionPolicy l -> RawPolicy l

-- | A collection policy is is a label, clearance and labeling policy. The
--   label specifies who can write to a collection (i.e., only computatoin
--   whose current label flows to the label of the collection). The
--   clearance limits the sensitivity of the data written to the collection
--   (i.e., the labels of all data in the collection must flow to the
--   clearance). Note that the collection label does <i>not</i> impose a
--   restriction on the data (i.e., data can have high integrity). The
--   collection policy specifies the policies for labeling documents and
--   fields of documents.
data Collection l
Collection :: CollectionName -> CollectionPolicy l -> Collection l

-- | Collection name
colIntern :: Collection l -> CollectionName

-- | Collection secutiry policies: access control and labeling policies
colSec :: Collection l -> CollectionPolicy l

-- | Create a collection given a collection name, label, clearance, and
--   policy. Note that the collection label and clearance must be above the
--   current label and below the current clearance.
collection :: LabelState l p s => CollectionName -> l -> l -> RawPolicy l -> LIO l p s (Collection l)

-- | Same as <a>collection</a>, but uses privileges when comparing the
--   collection label and clearance with the current label and clearance.
collectionP :: LabelState l p s => p -> CollectionName -> l -> l -> RawPolicy l -> LIO l p s (Collection l)

-- | Same as <a>collection</a>, but ignores IFC.
collectionTCB :: LabelState l p s => CollectionName -> l -> l -> RawPolicy l -> LIO l p s (Collection l)

-- | Name of database
type DatabaseName = Database

-- | A database has a label, which is used for controlling access to the
--   database, an internal identifier corresponding to the underlying
--   MongoDB database, and a set of <a>Collection</a>s protected by a
--   label.
data Database l
Database :: DatabaseName -> l -> CollectionMap l -> Database l

-- | Actual MongoDB
dbIntern :: Database l -> DatabaseName

-- | Label of database
dbLabel :: Database l -> l

-- | Collections associated with databsae
dbColPolicies :: Database l -> CollectionMap l

-- | Same as <a>databaseP</a>, but does not use privileges when comparing
--   the current label (and clearance) with the supplied database label.
database :: LabelState l p s => DatabaseName -> l -> CollectionMap l -> LIO l p s (Database l)

-- | Create a <a>Database</a>. Given a set of privileges, the name of the
--   database, the database label, and set of collections, create a
--   database. Note that this does not restrict an application from
--   creating arbitrary databases and collections---this should be handled
--   by a shim layer.
databaseP :: LabelState l p s => p -> DatabaseName -> l -> CollectionMap l -> LIO l p s (Database l)

-- | Sameas <a>databaseP</a>, but ignores IFC checks.
databaseTCB :: LabelState l p s => DatabaseName -> l -> CollectionMap l -> LIO l p s (Database l)

-- | Same as <a>assocCollectionP</a>, but does not use privileges when
--   writing to database collection map.
assocCollection :: LabelState l p s => Collection l -> Database l -> LIO l p s (Database l)

-- | Associate a collection with the underlying database.
assocCollectionP :: LabelState l p s => p -> Collection l -> Database l -> LIO l p s (Database l)

-- | Same as <a>assocCollectionP</a>, but ignores IFC.
assocCollectionTCB :: LabelState l p s => Collection l -> Database l -> LIO l p s (Database l)

-- | A <tt>RawPolicy</tt> encodes a document policy, and all field
--   policies. It is required that all fields of type <tt>PolicyLabled</tt>
--   have a field/column policy -- if using only this low-level interface a
--   runtime-error will occur if this is not satisfied.
data RawPolicy l
RawPolicy :: (Document l -> l) -> [(Key, FieldPolicy l)] -> RawPolicy l

-- | A row (document) policy is a function from a <a>Document</a> to a
--   <a>Label</a>.
rawDocPolicy :: RawPolicy l -> Document l -> l

-- | A column (field) policy is a function from a <a>Document</a> to a
--   <a>Label</a>, for each field of type <a>PolicyLabeled</a>.
rawFieldPolicies :: RawPolicy l -> [(Key, FieldPolicy l)]

-- | A <tt>FieldPolicy</tt> specifies the policy-generated label of a
--   field. <tt>SearchabelField</tt> specifies that the field can be
--   referenced in the selection clause of a <tt>Query</tt>, and therefore
--   the document label does not apply to it.
data FieldPolicy l
SearchableField :: FieldPolicy l
FieldPolicy :: (Document l -> l) -> FieldPolicy l

-- | Returns True if the policy is for a searchable field
isSearchableField :: FieldPolicy l -> Bool

-- | Returns a list of the <tt>SearchableField</tt>s speicified in a
--   <tt>RawPolicy</tt>
searchableFields :: RawPolicy l -> [Key]

-- | Field/column policies are required for every <tt>PolicyLabled</tt>
--   value in a document.
data PolicyError

-- | Policy for field not specified
NoFieldPolicy :: PolicyError

-- | Policy application invalid
InvalidPolicy :: PolicyError

-- | Policy for Collection not specified
NoColPolicy :: PolicyError

-- | Field with associated policy is not of PolicyLabeled type
InvalidFieldPolicyType :: PolicyError

-- | Searchable fields cannot contain labeled values
InvalidSearchableType :: PolicyError

-- | Policy has been violated
PolicyViolation :: PolicyError
data NoSuchDatabaseError
NoSuchDatabase :: NoSuchDatabaseError

-- | Since it would be a security violation to make <a>LIO</a> an instance
--   of <tt>MonadIO</tt>, we create a Mongo-specific, wrapper for
--   <a>LIO</a> that is instance of <tt>MonadIO</tt>.
--   
--   NOTE: IT IS IMPORTANT THAT <tt>UnsafeLIO</tt> NEVER BE EXPOSED BY
--   MODULES THAT ARE NOT Unsafe.
newtype UnsafeLIO l p s a
UnsafeLIO :: LIO l p s a -> UnsafeLIO l p s a
unUnsafeLIO :: UnsafeLIO l p s a -> LIO l p s a

-- | An LIO action with MongoDB access.
newtype LIOAction l p s a
LIOAction :: Action (UnsafeLIO l p s) a -> LIOAction l p s a
unLIOAction :: LIOAction l p s a -> Action (UnsafeLIO l p s) a
newtype Action l p s a
Action :: (ReaderT (Database l) (LIOAction l p s) a) -> Action l p s a

-- | Lift a MongoDB action into <a>Action</a> monad.
liftAction :: LabelState l p s => Action (UnsafeLIO l p s) a -> Action l p s a

-- | Get underlying database.
getDatabase :: Action l p s (Database l)

-- | A labeled cursor. The cursor is labeled with the join of the database
--   and collection it reads from.
data Cursor l
Cursor :: l -> Cursor -> Projector -> CollectionPolicy l -> Cursor l

-- | Cursorlabel
curLabel :: Cursor l -> l

-- | Actual cursor
curIntern :: Cursor l -> Cursor

-- | Projector from query
curProject :: Cursor l -> Projector

-- | Collection policy
curPolicy :: Cursor l -> CollectionPolicy l

-- | A connection failure, or a read or write exception like cursor expired
--   or inserting a duplicate key. Note, unexpected data from the server is
--   not a Failure, rather it is a programming error (you should call
--   <a>error</a> in this case) because the client and server are
--   incompatible and requires a programming change.
data Failure :: *
instance Typeable PolicyError
instance Typeable NoSuchDatabaseError
instance Functor (UnsafeLIO l p s)
instance Applicative (UnsafeLIO l p s)
instance Monad (UnsafeLIO l p s)
instance Functor (LIOAction l p s)
instance Applicative (LIOAction l p s)
instance Monad (LIOAction l p s)
instance Functor (Action l p s)
instance Applicative (Action l p s)
instance Monad (Action l p s)
instance LabelState l p s => MonadLIO (Action l p s) l p s
instance LabelState l p s => MonadLIO (LIOAction l p s) l p s
instance LabelState l p s => MonadLIO (UnsafeLIO l p s) l p s
instance LabelState l p s => MonadBaseControl IO (UnsafeLIO l p s)
instance LabelState l p s => MonadBase IO (UnsafeLIO l p s)
instance LabelState l p s => MonadIO (UnsafeLIO l p s)
instance Exception NoSuchDatabaseError
instance Show NoSuchDatabaseError
instance Exception PolicyError
instance Show PolicyError

module Hails.Database.MongoDB.TCB.Convert

-- | Trusted transformer that takes a <a>Labeled</a> tuple with
--   <a>HttpReq</a> and the request body as a <a>ByteString</a> and returns
--   a <a>Labeled</a> <a>Document</a> with keys and values corresponding to
--   the form fields from the request. The label on the <tt>Labeled</tt>
--   result is the same as input. Arguments values are parsed in to BSON
--   Strings except if the key is of the form "key_name[]" in which case
--   all such arguments will be combined into an array of Strings.
labeledDocI :: LabelState l p s => HttpReq a -> Labeled l ByteString -> LIO l p s (Labeled l (Document l))

module Hails.Database.MongoDB.TCB.Access

-- | Apply a raw field/column policy to all the fields of type
--   <a>PolicyLabeled</a>, and then apply the raw document/row policy. It
--   must be that every labeled value in the document (including the
--   document itself) have a label that is below the clearance of the
--   collection. However, this is not checked by <tt>applyRawPolicyP</tt>.
--   Instead <tt>insert</tt> (and similar operators) performs this check.
applyRawPolicyP :: LabelState l p s => p -> CollectionPolicy l -> Document l -> LIO l p s (LabeledDocument l)

-- | Same as <tt>applyRawPolicy</tt>, but ignores the current label and
--   clearance when applying policies.
applyRawPolicyTCB :: LabelState l p s => CollectionPolicy l -> Document l -> LIO l p s (LabeledDocument l)

-- | Run action against database on server at other end of pipe. Use access
--   mode for any reads and writes. Return <a>Left</a> on connection
--   failure or read/write failure. The current label is raised to the the
--   join of the database label and current label.
accessTCB :: LabelState l p s => Pipe -> AccessMode -> Database l -> Action l p s a -> LIO l p s (Either Failure a)

module Hails.Database.MongoDB.TCB.Query

-- | Insert document into collection and return its <tt>_id</tt> value,
--   which is created automatically if not supplied. It is required that
--   the current label flow to the label of the collection and database
--   (and vice versa). Additionally, the document must be well-formed with
--   respect to the collection policy. In other words, all the labeled
--   values must be below the collection clearance and the policy be
--   applied successfully.
insert :: Insert l p s doc => CollectionName -> doc -> Action l p s (Value l)

-- | Same as <a>insert</a> except it does not return <tt>_id</tt>
insert_ :: Insert l p s doc => CollectionName -> doc -> Action l p s ()

-- | Same as <a>insert</a>, but uses privileges when applying the
--   collection policies, and doing label comparisons.
insertP :: Insert l p s doc => p -> CollectionName -> doc -> Action l p s (Value l)

-- | Same as <a>insertP</a> except it does not return <tt>_id</tt>
insertP_ :: Insert l p s doc => p -> CollectionName -> doc -> Action l p s ()

-- | Update a document based on the <tt>_id</tt> value. The IFC
--   requirements subsume those of <a>insert</a>. Specifically, in addition
--   to being able to apply all the policies and requiring that the current
--   label flow to the label of the collection and database <tt>save</tt>
--   requires that the current label flow to the label of the existing
--   database record.
save :: Insert l p s doc => CollectionName -> doc -> Action l p s ()

-- | Like <a>save</a>, but uses privileges when performing label
--   comparisons.
saveP :: Insert l p s doc => p -> CollectionName -> doc -> Action l p s ()

-- | Given a query, delete first object in selection. In addition to being
--   able to read the object, write to the database and collection, it must
--   be that the current label flow to the label of the existing document.
deleteOne :: (LabelState l p s, Serialize l) => Selection l -> Action l p s ()

-- | Same as <a>deleteOne</a>, but uses privileges when performing label
--   comparisons.
deleteOneP :: (LabelState l p s, Serialize l) => p -> Selection l -> Action l p s ()

-- | Fetch documents satisfying query. A labeled <a>Cursor</a> is returned,
--   which can be used to retrieve the actual <a>Document</a>s. Current
--   label is raised to the join of the collection, database, and
--   ccollection-policy label.
find :: (Serialize l, LabelState l p s) => Query l -> Action l p s (Cursor l)

-- | Same as <a>find</a>, but uses privileges when raising the current
--   label
findP :: (Serialize l, LabelState l p s) => p -> Query l -> Action l p s (Cursor l)

-- | Fetch the first document satisfying query, or <tt>Nothing</tt> if not
--   documents matched the query.
findOne :: (LabelState l p s, Serialize l) => Query l -> Action l p s (Maybe (LabeledDocument l))

-- | Same as <a>findOne</a>, but uses privileges when performing label
--   comparisons.
findOneP :: (LabelState l p s, Serialize l) => p -> Query l -> Action l p s (Maybe (LabeledDocument l))

-- | Return next document in query result, or <tt>Nothing</tt> if finished.
--   The current label is raised to join of the current label and
--   <a>Cursor</a> label. The document is labeled according to the
--   underlying 'Collection'\'s policies.
next :: (LabelState l p s, Serialize l) => Cursor l -> Action l p s (Maybe (LabeledDocument l))

-- | Same as <a>next</a>, but usess privileges raising the current label.
nextP :: (LabelState l p s, Serialize l) => p -> Cursor l -> Action l p s (Maybe (LabeledDocument l))

-- | Use select to create a basic query with defaults, then modify if
--   desired. Example: <tt>(select sel col) {limit =: 10}</tt>. Note that
--   unlike MongoDB's query functionality, our queries do not allow for
--   projections (since policies may need a field that is not projects).
--   Both the selection and sorting are restricted to searchable fields.
--   
--   TODO: add snapshot.
data Query l
Query :: [QueryOption] -> Selection l -> Word32 -> Limit -> Order l -> BatchSize -> Order l -> Query l

-- | Query options, default <tt>[]</tt>.
options :: Query l -> [QueryOption]

-- | <tt>WHERE</tt> clause,default <tt>[]</tt>.
selection :: Query l -> Selection l

-- | Number of documents to skip, default 0.
skip :: Query l -> Word32

-- | Max number of documents to return. Default, 0, means no limit.
limit :: Query l -> Limit

-- | Sort result by given order, default <tt>[]</tt>.
sort :: Query l -> Order l

-- | The number of document to return in each batch response from the
--   server. 0 means Mongo default.
batchSize :: Query l -> BatchSize

-- | Force mongoDB to use this index (must be only searchable fields).
--   Default <tt>[]</tt>, no hint.
hint :: Query l -> Order l

-- | Selects documents in specified collection that match the selector.
data Selection l
Selection :: Selector l -> CollectionName -> Selection l

-- | Selector
selector :: Selection l -> Selector l

-- | Collection operaing
coll :: Selection l -> CollectionName

-- | Filter for a query, analogous to the <tt>WHERE</tt> clause in SQL.
--   <tt>[]</tt> matches all documents in collection. <tt>[<a>x</a> =: a,
--   <a>y</a> =: b]</tt> is analogous to <tt>WHERE x = a AND y = b</tt> in
--   SQL.
--   
--   <i>Note</i>: all labeld (including policy-labeled) values are removed
--   from the <tt>Selector</tt>.
type Selector l = Document l

-- | <a>Query</a> or <a>Selection</a> that selects documents in collection
--   that match selector. The choice of end type depends on use, for
--   example, in <a>find</a> <tt>select sel col</tt> is a <a>Query</a>, but
--   in delete it is a <a>Selection</a>.
select :: (Select selectionOrQuery, Label l) => Selector l -> CollectionName -> selectionOrQuery l
instance (LabelState l p s, Serialize l, Insert l p s (Document l)) => Insert l p s (Labeled l (Document l))
instance (LabelState l p s, Serialize l) => Insert l p s (Document l)
instance Select Query
instance Select Selection


-- | Rexports <a>Data.Bson</a>
module Hails.Data.LBson.Rexports.Bson


-- | Moduule rexport Bson Value value-constructors
module Hails.Data.LBson.Rexports

-- | A BSON value is one of the following types of values
data Value :: *
Float :: Double -> Value
String :: UString -> Value
Doc :: Document -> Value
Array :: [Value] -> Value
Bin :: Binary -> Value
Fun :: Function -> Value
Uuid :: UUID -> Value
Md5 :: MD5 -> Value
UserDef :: UserDefined -> Value
ObjId :: ObjectId -> Value
Bool :: Bool -> Value
UTC :: UTCTime -> Value
Null :: Value
RegEx :: Regex -> Value
JavaScr :: Javascript -> Value
Sym :: Symbol -> Value
Int32 :: Int32 -> Value
Int64 :: Int64 -> Value
Stamp :: MongoStamp -> Value
MinMax :: MinMaxKey -> Value


-- | This module exports a safe subset of the labeled BSON (LBSON) module.
--   See <a>Hails.Data.LBson.TCB</a> for documentation.
module Hails.Data.LBson.Safe

-- | A LBSON document is a list of <a>Field</a>s
type Document l = [Field l]

-- | A labeled <a>Document</a>
type LabeledDocument l = Labeled l (Document l)

-- | Value of field in document, or fail (Nothing) if field not found
look :: (Monad m, Label l) => Key -> Document l -> m (Value l)

-- | Lookup value of field in document and cast to expected type. Fail
--   (Nothing) if field not found or value not of expected type.
lookup :: (Val l v, Monad m, Label l) => Key -> Document l -> m v

-- | Value of field in document. Error if missing.
valueAt :: Label l => Key -> [Field l] -> Value l

-- | Typed value of field in document. Error if missing or wrong type.
at :: (Val l v, Label l) => Key -> Document l -> v

-- | Only include fields of document in key list
include :: Label l => [Key] -> Document l -> Document l

-- | Exclude fields from document in key list
exclude :: Label l => [Key] -> Document l -> Document l

-- | Merge documents with preference given to first one when both have the
--   same key. I.e. for every (k := v) in first argument, if k exists in
--   second argument then replace its value with v, otherwise add (k := v)
--   to second argument.
merge :: Label l => Document l -> Document l -> Document l

-- | A <tt>Field</tt> is a 'Key'-'Value' pair.
data Field l
(:=) :: !Key -> Value l -> Field l
key :: Field l -> !Key
value :: Field l -> Value l

-- | Field with given label and typed value
(=:) :: (Val l v, Label l) => Key -> v -> Field l

-- | If <tt>Just</tt> value then return one field document, otherwise
--   return empty document
(=?) :: (Val l a, Label l) => Key -> Maybe a -> Document l

-- | A <a>Key</a>, or attribute is a BSON label.
type Key = Label

-- | This prefix is reserved for HAILS keys. It should not be used by
--   arbitrary code.
hailsInternalKeyPrefix :: Key

-- | A <tt>Value</tt> is either a standard BSON value, a labeled value, or
--   a policy-labeled value.
data Value l

-- | Haskell types of this class correspond to LBSON value types.
class (Typeable a, Show a, Eq a, Label l) => Val l a
val :: Val l a => a -> Value l
cast' :: Val l a => Value l -> Maybe a

-- | Convert Value to expected type, or fail (Nothing) if not of that type
cast :: (Label l, Val l a, Monad m) => Value l -> m a

-- | Convert Value to expected type. Error if not that type.
typed :: (Val l a, Label l) => Value l -> a

-- | Wrap an unlabeled value by <a>PolicyLabeled</a>.
pu :: (Label l, Val a) => a -> PolicyLabeled l a

-- | Wrap an already-labeled value by <a>PolicyLabeled</a>.
pl :: (Label l, Val a) => Labeled l a -> PolicyLabeled l a
newtype Binary :: *
Binary :: ByteString -> Binary
newtype Function :: *
Function :: ByteString -> Function
newtype UUID :: *
UUID :: ByteString -> UUID
newtype MD5 :: *
MD5 :: ByteString -> MD5
newtype UserDefined :: *
UserDefined :: ByteString -> UserDefined

-- | The first string is the regex pattern, the second is the regex options
--   string. Options are identified by characters, which must be listed in
--   alphabetical order. Valid options are *i* for case insensitive
--   matching, *m* for multiline matching, *x* for verbose mode, *l* to
--   make \w, \W, etc. locale dependent, *s* for dotall mode ("." matches
--   everything), and *u* to make \w, \W, etc. match unicode.
data Regex :: *
Regex :: UString -> UString -> Regex

-- | Javascript code with possibly empty environment mapping variables to
--   values that the code may reference
data Javascript :: *
Javascript :: Document -> UString -> Javascript
newtype Symbol :: *
Symbol :: UString -> Symbol
newtype MongoStamp :: *
MongoStamp :: Int64 -> MongoStamp
data MinMaxKey :: *
MinKey :: MinMaxKey
MaxKey :: MinMaxKey

-- | A BSON ObjectID is a 12-byte value consisting of a 4-byte timestamp
--   (seconds since epoch), a 3-byte machine id, a 2-byte process id, and a
--   3-byte counter. Note that the timestamp and counter fields must be
--   stored big endian unlike the rest of BSON. This is because they are
--   compared byte-by-byte and we want to ensure a mostly increasing order.
data ObjectId :: *
Oid :: Word32 -> Word64 -> ObjectId

-- | Time when objectId was created
timestamp :: ObjectId -> UTCTime

-- | Generate fresh <a>ObjectId</a>.
genObjectId :: LabelState l p s => LIO l p s ObjectId

-- | Export <a>Value</a>
type BsonValue = Value

-- | Safely convert from a <a>Value</a> to a <a>BsonValue</a>.
safeToBsonValue :: Label l => Value l -> Maybe BsonValue

-- | Safely convert from a <a>BsonValue</a> to a <a>Value</a>.
safeFromBsonValue :: (Serialize l, Label l) => BsonValue -> Maybe (Value l)

-- | Export <a>Document</a>
type BsonDocument = Document

-- | Safe version of <a>toBsonDoc</a>.
safeToBsonDoc :: (Serialize l, Label l) => Document l -> Maybe BsonDocument

-- | Safe version of <a>fromBsonDoc</a>.
safeFromBsonDoc :: (Serialize l, Label l) => BsonDocument -> Maybe (Document l)

-- | Encodea document
encodeDoc :: BsonDocSerialize doc => doc -> ByteString

-- | Decode a document
decodeDoc :: BsonDocSerialize doc => ByteString -> doc

module Hails.Data.LBson

module Hails.Database.MongoDB.TCB.DCAccess

-- | Database configuration, used to invoke <tt>withDB</tt>
data DBConf
DBConf :: DatabaseName -> DCPrivTCB -> DBConf
dbConfName :: DBConf -> DatabaseName
dbConfPriv :: DBConf -> DCPrivTCB
type DCAction = Action DCLabel DCPrivTCB ()

-- | Open a pipe to a supplied server, or <tt>localhost</tt>. TODO: add
--   support for connecting to replicas.
dcAccess :: Database DCLabel -> DCAction a -> DC (Either Failure a)

-- | The <tt>withDB</tt> functions should use this function to label their
--   databases. TODO (DS/AL(: make every searchable field indexable.
labelDatabase :: DBConf -> DCLabel -> DCLabel -> DC (Database DCLabel)

-- | Policy modules are instances of this class. In particular, when an
--   application accesses a database, the runtime invokes
--   <tt>createDatabasePolicy</tt> in the appropriate policy module.
class DatabasePolicy dbp
createDatabasePolicy :: DatabasePolicy dbp => DBConf -> DCPrivTCB -> DC dbp
policyDB :: DatabasePolicy dbp => dbp -> Database DCLabel

-- | Class used to define groups in a policy-specific manner.
class DatabasePolicy dbp => PolicyGroup dbp where expandGroup _ princ = return [princ] relabelGroups _ = return
expandGroup :: PolicyGroup dbp => dbp -> Principal -> DCAction [Principal]
relabelGroups :: PolicyGroup dbp => dbp -> DCLabeled a -> DC (DCLabeled a)

-- | Looks for disjuctions the privilege is able to downgrade and rewrites
--   them by invoking <a>expandGroup</a> on each principle in the
--   disjuction. Using the result, the function relabels the <a>Labeled</a>
--   value. Clients should not call this directly, instead clients should
--   call <a>relabelGroups</a> which policies may implement by wrapping
--   this function.
relabelGroupsP :: PolicyGroup dbp => dbp -> DCPrivTCB -> Labeled DCLabel a -> DC (DCLabeled a)

-- | A wrapper around <a>relabelGroups</a> that drops the current
--   privileges and restores them after getting a result from
--   <a>relabelGroups</a>.
relabelGroupsSafe :: PolicyGroup dbp => dbp -> Labeled DCLabel a -> DC (DCLabeled a)

-- | Class used to define policy-specifi privilege granting gate.
class DatabasePolicy dbp => PrivilegeGrantGate dbp
grantPriv :: PrivilegeGrantGate dbp => dbp -> Principal -> DC (DCGate DCPrivTCB)

-- | Given a set of privileges, a desired label and action. Lower the
--   current label as close tothe desired label as possible, execute the
--   action and raise the current label.
withLabel :: DCPrivTCB -> DCLabel -> DC a -> DC a

-- | Given a set of privileges, a labeled document and computaiton on the
--   (unlabeled version of the) documnet, downgrade the current label with
--   the supplied privileges execute (only integrity), unlabel the document
--   and apply the computation to it. The result is then labeled with the
--   current label and the current label is reset to the original (if
--   possible).
gateToLabeled :: DCPrivTCB -> DCLabeled (Document DCLabel) -> (Document DCLabel -> DC a) -> DC (DCLabeled a)
instance Show DBConf

module Hails.Database

-- | Create a <tt>DatabasePolicy</tt> with the appropriate underline
--   databse name and privileges, determined by the actual instance
--   requested.
mkPolicy :: (DatabasePolicy dbp, Typeable dbp) => DC dbp

-- | Given a database name and a database action, execute the action on the
--   database.
withDB :: DatabasePolicy dbp => dbp -> DCAction a -> DC (Either Failure a)

module Hails.Database.MongoDB

-- | Name of collection
type CollectionName = Collection

-- | Labels and policies associated with a collection. See
--   <a>Collection</a>.
data CollectionPolicy l

-- | A collection policy is is a label, clearance and labeling policy. The
--   label specifies who can write to a collection (i.e., only computatoin
--   whose current label flows to the label of the collection). The
--   clearance limits the sensitivity of the data written to the collection
--   (i.e., the labels of all data in the collection must flow to the
--   clearance). Note that the collection label does <i>not</i> impose a
--   restriction on the data (i.e., data can have high integrity). The
--   collection policy specifies the policies for labeling documents and
--   fields of documents.
data Collection l

-- | A labeled <a>Collection</a> map.
type CollectionMap l = Labeled l (Map CollectionName (CollectionPolicy l))

-- | Create a collection given a collection name, label, clearance, and
--   policy. Note that the collection label and clearance must be above the
--   current label and below the current clearance.
collection :: LabelState l p s => CollectionName -> l -> l -> RawPolicy l -> LIO l p s (Collection l)

-- | Same as <a>collection</a>, but uses privileges when comparing the
--   collection label and clearance with the current label and clearance.
collectionP :: LabelState l p s => p -> CollectionName -> l -> l -> RawPolicy l -> LIO l p s (Collection l)

-- | Name of database
type DatabaseName = Database

-- | A database has a label, which is used for controlling access to the
--   database, an internal identifier corresponding to the underlying
--   MongoDB database, and a set of <a>Collection</a>s protected by a
--   label.
data Database l

-- | Same as <a>assocCollectionP</a>, but does not use privileges when
--   writing to database collection map.
assocCollection :: LabelState l p s => Collection l -> Database l -> LIO l p s (Database l)

-- | Associate a collection with the underlying database.
assocCollectionP :: LabelState l p s => p -> Collection l -> Database l -> LIO l p s (Database l)

-- | A <tt>RawPolicy</tt> encodes a document policy, and all field
--   policies. It is required that all fields of type <tt>PolicyLabled</tt>
--   have a field/column policy -- if using only this low-level interface a
--   runtime-error will occur if this is not satisfied.
data RawPolicy l
RawPolicy :: (Document l -> l) -> [(Key, FieldPolicy l)] -> RawPolicy l

-- | A row (document) policy is a function from a <a>Document</a> to a
--   <a>Label</a>.
rawDocPolicy :: RawPolicy l -> Document l -> l

-- | A column (field) policy is a function from a <a>Document</a> to a
--   <a>Label</a>, for each field of type <a>PolicyLabeled</a>.
rawFieldPolicies :: RawPolicy l -> [(Key, FieldPolicy l)]

-- | A <tt>FieldPolicy</tt> specifies the policy-generated label of a
--   field. <tt>SearchabelField</tt> specifies that the field can be
--   referenced in the selection clause of a <tt>Query</tt>, and therefore
--   the document label does not apply to it.
data FieldPolicy l
SearchableField :: FieldPolicy l
FieldPolicy :: (Document l -> l) -> FieldPolicy l

-- | Returns True if the policy is for a searchable field
isSearchableField :: FieldPolicy l -> Bool

-- | Field/column policies are required for every <tt>PolicyLabled</tt>
--   value in a document.
data PolicyError

-- | Policy for field not specified
NoFieldPolicy :: PolicyError

-- | Policy application invalid
InvalidPolicy :: PolicyError

-- | Policy for Collection not specified
NoColPolicy :: PolicyError

-- | Field with associated policy is not of PolicyLabeled type
InvalidFieldPolicyType :: PolicyError

-- | Searchable fields cannot contain labeled values
InvalidSearchableType :: PolicyError

-- | Policy has been violated
PolicyViolation :: PolicyError
data Action l p s a

-- | Get underlying database.
getDatabase :: Action l p s (Database l)

-- | Selects documents in specified collection that match the selector.
data Selection l
Selection :: Selector l -> CollectionName -> Selection l

-- | Selector
selector :: Selection l -> Selector l

-- | Collection operaing
coll :: Selection l -> CollectionName

-- | Use select to create a basic query with defaults, then modify if
--   desired. Example: <tt>(select sel col) {limit =: 10}</tt>. Note that
--   unlike MongoDB's query functionality, our queries do not allow for
--   projections (since policies may need a field that is not projects).
--   Both the selection and sorting are restricted to searchable fields.
--   
--   TODO: add snapshot.
data Query l
Query :: [QueryOption] -> Selection l -> Word32 -> Limit -> Order l -> BatchSize -> Order l -> Query l

-- | Query options, default <tt>[]</tt>.
options :: Query l -> [QueryOption]

-- | <tt>WHERE</tt> clause,default <tt>[]</tt>.
selection :: Query l -> Selection l

-- | Number of documents to skip, default 0.
skip :: Query l -> Word32

-- | Max number of documents to return. Default, 0, means no limit.
limit :: Query l -> Limit

-- | Sort result by given order, default <tt>[]</tt>.
sort :: Query l -> Order l

-- | The number of document to return in each batch response from the
--   server. 0 means Mongo default.
batchSize :: Query l -> BatchSize

-- | Force mongoDB to use this index (must be only searchable fields).
--   Default <tt>[]</tt>, no hint.
hint :: Query l -> Order l

-- | A labeled cursor. The cursor is labeled with the join of the database
--   and collection it reads from.
data Cursor l

-- | Database configuration, used to invoke <tt>withDB</tt>
data DBConf
type DCAction = Action DCLabel DCPrivTCB ()

-- | Open a pipe to a supplied server, or <tt>localhost</tt>. TODO: add
--   support for connecting to replicas.
dcAccess :: Database DCLabel -> DCAction a -> DC (Either Failure a)

-- | The <tt>withDB</tt> functions should use this function to label their
--   databases. TODO (DS/AL(: make every searchable field indexable.
labelDatabase :: DBConf -> DCLabel -> DCLabel -> DC (Database DCLabel)

-- | Policy modules are instances of this class. In particular, when an
--   application accesses a database, the runtime invokes
--   <tt>createDatabasePolicy</tt> in the appropriate policy module.
class DatabasePolicy dbp
createDatabasePolicy :: DatabasePolicy dbp => DBConf -> DCPrivTCB -> DC dbp
policyDB :: DatabasePolicy dbp => dbp -> Database DCLabel

-- | Class used to define groups in a policy-specific manner.
class DatabasePolicy dbp => PolicyGroup dbp where expandGroup _ princ = return [princ] relabelGroups _ = return
expandGroup :: PolicyGroup dbp => dbp -> Principal -> DCAction [Principal]
relabelGroups :: PolicyGroup dbp => dbp -> DCLabeled a -> DC (DCLabeled a)

-- | Looks for disjuctions the privilege is able to downgrade and rewrites
--   them by invoking <a>expandGroup</a> on each principle in the
--   disjuction. Using the result, the function relabels the <a>Labeled</a>
--   value. Clients should not call this directly, instead clients should
--   call <a>relabelGroups</a> which policies may implement by wrapping
--   this function.
relabelGroupsP :: PolicyGroup dbp => dbp -> DCPrivTCB -> Labeled DCLabel a -> DC (DCLabeled a)

-- | A wrapper around <a>relabelGroups</a> that drops the current
--   privileges and restores them after getting a result from
--   <a>relabelGroups</a>.
relabelGroupsSafe :: PolicyGroup dbp => dbp -> Labeled DCLabel a -> DC (DCLabeled a)

-- | Class used to define policy-specifi privilege granting gate.
class DatabasePolicy dbp => PrivilegeGrantGate dbp
grantPriv :: PrivilegeGrantGate dbp => dbp -> Principal -> DC (DCGate DCPrivTCB)

-- | Given a set of privileges, a desired label and action. Lower the
--   current label as close tothe desired label as possible, execute the
--   action and raise the current label.
withLabel :: DCPrivTCB -> DCLabel -> DC a -> DC a

-- | Given a set of privileges, a labeled document and computaiton on the
--   (unlabeled version of the) documnet, downgrade the current label with
--   the supplied privileges execute (only integrity), unlabel the document
--   and apply the computation to it. The result is then labeled with the
--   current label and the current label is reset to the original (if
--   possible).
gateToLabeled :: DCPrivTCB -> DCLabeled (Document DCLabel) -> (Document DCLabel -> DC a) -> DC (DCLabeled a)

-- | Insert document into collection and return its <tt>_id</tt> value,
--   which is created automatically if not supplied. It is required that
--   the current label flow to the label of the collection and database
--   (and vice versa). Additionally, the document must be well-formed with
--   respect to the collection policy. In other words, all the labeled
--   values must be below the collection clearance and the policy be
--   applied successfully.
insert :: Insert l p s doc => CollectionName -> doc -> Action l p s (Value l)

-- | Same as <a>insert</a> except it does not return <tt>_id</tt>
insert_ :: Insert l p s doc => CollectionName -> doc -> Action l p s ()

-- | Same as <a>insert</a>, but uses privileges when applying the
--   collection policies, and doing label comparisons.
insertP :: Insert l p s doc => p -> CollectionName -> doc -> Action l p s (Value l)

-- | Same as <a>insertP</a> except it does not return <tt>_id</tt>
insertP_ :: Insert l p s doc => p -> CollectionName -> doc -> Action l p s ()

-- | Update a document based on the <tt>_id</tt> value. The IFC
--   requirements subsume those of <a>insert</a>. Specifically, in addition
--   to being able to apply all the policies and requiring that the current
--   label flow to the label of the collection and database <tt>save</tt>
--   requires that the current label flow to the label of the existing
--   database record.
save :: Insert l p s doc => CollectionName -> doc -> Action l p s ()

-- | Like <a>save</a>, but uses privileges when performing label
--   comparisons.
saveP :: Insert l p s doc => p -> CollectionName -> doc -> Action l p s ()

-- | Given a query, delete first object in selection. In addition to being
--   able to read the object, write to the database and collection, it must
--   be that the current label flow to the label of the existing document.
deleteOne :: (LabelState l p s, Serialize l) => Selection l -> Action l p s ()

-- | Same as <a>deleteOne</a>, but uses privileges when performing label
--   comparisons.
deleteOneP :: (LabelState l p s, Serialize l) => p -> Selection l -> Action l p s ()

-- | Fetch documents satisfying query. A labeled <a>Cursor</a> is returned,
--   which can be used to retrieve the actual <a>Document</a>s. Current
--   label is raised to the join of the collection, database, and
--   ccollection-policy label.
find :: (Serialize l, LabelState l p s) => Query l -> Action l p s (Cursor l)

-- | Same as <a>find</a>, but uses privileges when raising the current
--   label
findP :: (Serialize l, LabelState l p s) => p -> Query l -> Action l p s (Cursor l)

-- | Fetch the first document satisfying query, or <tt>Nothing</tt> if not
--   documents matched the query.
findOne :: (LabelState l p s, Serialize l) => Query l -> Action l p s (Maybe (LabeledDocument l))

-- | Same as <a>findOne</a>, but uses privileges when performing label
--   comparisons.
findOneP :: (LabelState l p s, Serialize l) => p -> Query l -> Action l p s (Maybe (LabeledDocument l))

-- | Return next document in query result, or <tt>Nothing</tt> if finished.
--   The current label is raised to join of the current label and
--   <a>Cursor</a> label. The document is labeled according to the
--   underlying 'Collection'\'s policies.
next :: (LabelState l p s, Serialize l) => Cursor l -> Action l p s (Maybe (LabeledDocument l))

-- | Same as <a>next</a>, but usess privileges raising the current label.
nextP :: (LabelState l p s, Serialize l) => p -> Cursor l -> Action l p s (Maybe (LabeledDocument l))

-- | <a>Query</a> or <a>Selection</a> that selects documents in collection
--   that match selector. The choice of end type depends on use, for
--   example, in <a>find</a> <tt>select sel col</tt> is a <a>Query</a>, but
--   in delete it is a <a>Selection</a>.
select :: (Select selectionOrQuery, Label l) => Selector l -> CollectionName -> selectionOrQuery l

-- | A connection failure, or a read or write exception like cursor expired
--   or inserting a duplicate key. Note, unexpected data from the server is
--   not a Failure, rather it is a programming error (you should call
--   <a>error</a> in this case) because the client and server are
--   incompatible and requires a programming change.
data Failure :: *

-- | Trusted transformer that takes a <a>Labeled</a> tuple with
--   <a>HttpReq</a> and the request body as a <a>ByteString</a> and returns
--   a <a>Labeled</a> <a>Document</a> with keys and values corresponding to
--   the form fields from the request. The label on the <tt>Labeled</tt>
--   result is the same as input. Arguments values are parsed in to BSON
--   Strings except if the key is of the form "key_name[]" in which case
--   all such arguments will be combined into an array of Strings.
labeledDocI :: LabelState l p s => HttpReq a -> Labeled l ByteString -> LIO l p s (Labeled l (Document l))

module Hails.Policy

module Hails.Database.MongoDB.Structured

-- | Class for converting from "structured" records to documents (and vice
--   versa).
class DCRecord a where findBy = findByP noPrivs findWhere = findWhereP noPrivs insertRecord = insertRecordP noPrivs saveRecord = saveRecordP noPrivs deleteBy = deleteByP noPrivs deleteWhere = deleteWhereP noPrivs insertRecordP p policy record = do { let colName = collectionName record; p' <- getPrivileges; withDB policy $ insertP (p' `mappend` p) colName $ toDocument record } saveRecordP p policy record = do { let colName = collectionName record; p' <- getPrivileges; withDB policy $ saveP (p' `mappend` p) colName $ toDocument record } findByP p policy colName k v = findWhereP p policy (select [k =: v] colName) findWhereP p policy query = do { result <- withDB policy $ findOneP p query; c <- getClearance; case result of { Right (Just r) | leqp p (labelOf r) c -> fromDocument `liftM` unlabelP p r _ -> return Nothing } } deleteByP p policy colName k v = deleteWhereP p policy (select [k =: v] colName) deleteWhereP p policy sel = do { mdoc <- findWhereP p policy $ select (selector sel) (coll sel); p' <- getPrivileges; res <- withDB policy $ deleteOneP (p' `mappend` p) sel; case res of { Right _ -> return mdoc _ -> return Nothing } }
fromDocument :: (DCRecord a, Monad m) => Document DCLabel -> m a
toDocument :: DCRecord a => a -> Document DCLabel
collectionName :: DCRecord a => a -> CollectionName
findBy :: (DCRecord a, Val DCLabel v, DatabasePolicy p) => p -> CollectionName -> Key -> v -> DC (Maybe a)
findWhere :: (DCRecord a, DatabasePolicy p) => p -> Query DCLabel -> DC (Maybe a)
insertRecord :: (DCRecord a, DatabasePolicy p) => p -> a -> DC (Either Failure (Value DCLabel))
saveRecord :: (DCRecord a, DatabasePolicy p) => p -> a -> DC (Either Failure ())
deleteBy :: (DCRecord a, Val DCLabel v, DatabasePolicy p) => p -> CollectionName -> Key -> v -> DC (Maybe a)
deleteWhere :: (DCRecord a, DatabasePolicy p) => p -> Selection DCLabel -> DC (Maybe a)
findByP :: (DCRecord a, Val DCLabel v, DatabasePolicy p) => DCPrivTCB -> p -> CollectionName -> Key -> v -> DC (Maybe a)
findWhereP :: (DCRecord a, DatabasePolicy p) => DCPrivTCB -> p -> Query DCLabel -> DC (Maybe a)
insertRecordP :: (DCRecord a, DatabasePolicy p) => DCPrivTCB -> p -> a -> DC (Either Failure (Value DCLabel))
saveRecordP :: (DCRecord a, DatabasePolicy p) => DCPrivTCB -> p -> a -> DC (Either Failure ())
deleteByP :: (DCRecord a, Val DCLabel v, DatabasePolicy p) => DCPrivTCB -> p -> CollectionName -> Key -> v -> DC (Maybe a)
deleteWhereP :: (DCRecord a, DatabasePolicy p) => DCPrivTCB -> p -> Selection DCLabel -> DC (Maybe a)

-- | Class for inserting and saving labeled records.
class DCRecord a => DCLabeledRecord a where insertLabeledRecord = insertLabeledRecordP noPrivs saveLabeledRecord = saveLabeledRecordP noPrivs insertLabeledRecordP p policy lrecord = do { let colName = collectionName (forceType lrecord); p' <- getPrivileges; ldoc <- mkToLabeledDocument policy lrecord; withDB policy $ insertP (p' `mappend` p) colName ldoc } saveLabeledRecordP p policy lrecord = do { let colName = collectionName (forceType lrecord); p' <- getPrivileges; ldoc <- mkToLabeledDocument policy lrecord; withDB policy $ saveP (p' `mappend` p) colName ldoc }
insertLabeledRecord :: (DCLabeledRecord a, MkToLabeledDocument p) => p -> DCLabeled a -> DC (Either Failure (Value DCLabel))
saveLabeledRecord :: (DCLabeledRecord a, MkToLabeledDocument p) => p -> DCLabeled a -> DC (Either Failure ())
insertLabeledRecordP :: (DCLabeledRecord a, MkToLabeledDocument p) => DCPrivTCB -> p -> DCLabeled a -> DC (Either Failure (Value DCLabel))
saveLabeledRecordP :: (DCLabeledRecord a, MkToLabeledDocument p) => DCPrivTCB -> p -> DCLabeled a -> DC (Either Failure ())

-- | Classe used by a database policy to translate a labeled record to a
--   labeled document.
class DatabasePolicy p => MkToLabeledDocument p
mkToLabeledDocument :: (MkToLabeledDocument p, DCRecord a) => p -> DCLabeled a -> DC (DCLabeled (Document DCLabel))

-- | Same as <a>toDocument</a> but for uses the policy's privileges to
--   convert a labeled record to a labeled document.
toDocumentP :: DCRecord a => DCPrivTCB -> DCLabeled a -> DC (DCLabeled (Document DCLabel))