Console
An operator console that keeps a record.
The console runs on a listener of its own, apart from the S3 API. It loads no font and no script from anywhere else, and runs only its own script under a strict content security policy. Everything it does goes through a JSON API you can call directly.
Overview
The node, the cluster and the space, on one screen.
Stored bytes and objects as of the last measurement, the data drive's capacity, and on a cluster member every member, whether it answers, its zone, its drive and how many objects wait for healing.
Buckets
Every bucket with its size, logical and on the drives.
Objects, logical size, size on the drives with erasure overhead, quota, creation time and region per bucket. From each row: media rules, a quota, an upload key for one object, deletion under a reason.
Objects
Browse a bucket without opening an object.
Keys with their type as stored at write, size, age and ETag. A selected key's headers, user metadata and checksums come from its record in TessariDB, not from reading the object. Pages arrive by the server's cursor as you scroll; a name filter lists only a longer prefix.
Downloads are always attachments. A delete names the ETag the operator saw: if the object changed meanwhile, the delete is refused with 412 and the object is kept.
People and keys
Sign in the way your organisation already does.
OpenID Connect
Authorization code with PKCE, the ID token checked against the provider's keys with a fixed algorithm list, and a second factor required through amr.
Keys shown once
Issuing is idempotent: a form submitted twice issues one key. A secret is shown once and never again. Revocation takes a reason.
Recent sign-in for privileged acts
Issuing a key, setting a grant or a quota, deleting a bucket: each needs a sign-in from the last five minutes.
Break-glass
The root key beside a provider is the emergency path: it owes a reason, lasts 15 minutes, is recorded before the session exists and announced to a webhook.
Back-channel logout
The provider ends a session at its next request. Measured on a test node: refused 8 ms after the logout's answer.
The action record
Every change and every download, with the key and the reason, kept a year in TessariDB, which refuses to change or remove an entry.