refactor: narrow startup and ecstore root facades (#3679)

* refactor: narrow startup owner visibility

* refactor: prune remaining ecstore root facades

rustfs/src/startup_embedded.rs

@@ -73,13 +73,13 @@ impl EmbeddedStartupArgs {
 }
 
 pub(crate) struct EmbeddedStartedServer {
-    pub bound_addr: SocketAddr,
-    pub access_key: String,
-    pub secret_key: String,
-    pub region: String,
-    pub shutdown_handle: ShutdownHandle,
-    pub cancel_token: CancellationToken,
-    pub temp_dir: Option<PathBuf>,
+    pub(crate) bound_addr: SocketAddr,
+    pub(crate) access_key: String,
+    pub(crate) secret_key: String,
+    pub(crate) region: String,
+    pub(crate) shutdown_handle: ShutdownHandle,
+    pub(crate) cancel_token: CancellationToken,
+    pub(crate) temp_dir: Option<PathBuf>,
 }
 
 #[derive(Debug)]

rustfs/src/startup_fs_guard.rs

@@ -72,7 +72,7 @@ fn collect_local_paths(endpoint_pools: &EndpointServerPools) -> Vec<String> {
     local_paths.into_iter().collect()
 }
 
-pub fn enforce_unsupported_fs_policy(endpoint_pools: &EndpointServerPools) -> Result<()> {
+pub(crate) fn enforce_unsupported_fs_policy(endpoint_pools: &EndpointServerPools) -> Result<()> {
     let local_paths = collect_local_paths(endpoint_pools);
     if local_paths.is_empty() {
         return Ok(());

rustfs/src/startup_iam.rs

@@ -39,12 +39,12 @@ const IAM_RETRY_MAX_INTERVAL: Duration = Duration::from_secs(30);
 const IAM_RETRY_ESCALATION_THRESHOLD: u64 = 12;
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum IamBootstrapDisposition {
+pub(crate) enum IamBootstrapDisposition {
     ReadyInline,
     Deferred,
 }
 
-pub async fn publish_ready_for_iam_bootstrap(
+pub(crate) async fn publish_ready_for_iam_bootstrap(
     disposition: IamBootstrapDisposition,
     readiness: &GlobalReadiness,
     state_manager: Option<&ServiceStateManager>,
@@ -307,7 +307,7 @@ async fn attempt_init_iam_sys(store: Arc<ECStore>) -> std::result::Result<(), st
 /// Returns `Ok(ReadyInline)` if IAM initialized immediately, `Ok(Deferred)` if
 /// recovery is happening in the background, or `Err` if IAM succeeded but
 /// app context initialization failed (unexpected, indicates a bug).
-pub async fn bootstrap_or_defer_iam_init(
+pub(crate) async fn bootstrap_or_defer_iam_init(
     store: Arc<ECStore>,
     kms_interface: Arc<KmsServiceManager>,
     readiness: Arc<GlobalReadiness>,
@@ -349,7 +349,7 @@ pub async fn bootstrap_or_defer_iam_init(
     Ok(IamBootstrapDisposition::Deferred)
 }
 
-pub async fn bootstrap_or_defer_iam_init_with_startup_kms(
+pub(crate) async fn bootstrap_or_defer_iam_init_with_startup_kms(
     store: Arc<ECStore>,
     readiness: Arc<GlobalReadiness>,
     state_manager: Option<Arc<ServiceStateManager>>,

rustfs/src/startup_lifecycle.rs

@@ -82,18 +82,18 @@ fn mark_embedded_global_init_started(
     Ok(())
 }
 
-pub struct StartupRuntimeLifecycle {
-    pub server_address: String,
-    pub state_manager: Arc<ServiceStateManager>,
-    pub s3_shutdown_tx: Option<ShutdownHandle>,
-    pub console_shutdown_tx: Option<ShutdownHandle>,
-    pub service_runtime: StartupServiceRuntime,
-    pub store: Arc<ECStore>,
-    pub shutdown_token: CancellationToken,
-    pub readiness: Arc<GlobalReadiness>,
+pub(crate) struct StartupRuntimeLifecycle {
+    pub(crate) server_address: String,
+    pub(crate) state_manager: Arc<ServiceStateManager>,
+    pub(crate) s3_shutdown_tx: Option<ShutdownHandle>,
+    pub(crate) console_shutdown_tx: Option<ShutdownHandle>,
+    pub(crate) service_runtime: StartupServiceRuntime,
+    pub(crate) store: Arc<ECStore>,
+    pub(crate) shutdown_token: CancellationToken,
+    pub(crate) readiness: Arc<GlobalReadiness>,
 }
 
-pub async fn run_startup_runtime_lifecycle(lifecycle: StartupRuntimeLifecycle) -> Result<()> {
+pub(crate) async fn run_startup_runtime_lifecycle(lifecycle: StartupRuntimeLifecycle) -> Result<()> {
     let StartupRuntimeLifecycle {
         server_address,
         state_manager,
@@ -151,7 +151,10 @@ pub async fn run_startup_runtime_lifecycle(lifecycle: StartupRuntimeLifecycle) -
     Ok(())
 }
 
-pub async fn publish_embedded_startup_ready(iam_bootstrap: IamBootstrapDisposition, readiness: &GlobalReadiness) -> Result<()> {
+pub(crate) async fn publish_embedded_startup_ready(
+    iam_bootstrap: IamBootstrapDisposition,
+    readiness: &GlobalReadiness,
+) -> Result<()> {
     publish_ready_for_iam_bootstrap(iam_bootstrap, readiness, None).await?;
     rustfs_common::set_global_init_time_now().await;
     Ok(())
@@ -168,7 +171,7 @@ pub(crate) fn embedded_endpoint_address(address: SocketAddr) -> SocketAddr {
     SocketAddr::new(ip, address.port())
 }
 
-pub fn log_embedded_server_ready(endpoint_address: SocketAddr) {
+pub(crate) fn log_embedded_server_ready(endpoint_address: SocketAddr) {
     info!(
         target: "rustfs::embedded",
         component = LOG_COMPONENT_EMBEDDED,

rustfs/src/startup_optional_runtime_sidecars.rs

@@ -24,17 +24,17 @@ const LOG_COMPONENT_MAIN: &str = "main";
 const LOG_SUBSYSTEM_STARTUP: &str = "startup";
 const EVENT_PROTOCOL_SYSTEM_STATE: &str = "protocol_system_state";
 
-pub struct OptionalRuntimeServices {
-    pub protocols: ProtocolShutdownSenders,
+pub(crate) struct OptionalRuntimeServices {
+    pub(crate) protocols: ProtocolShutdownSenders,
 }
 
 impl OptionalRuntimeServices {
-    pub fn new(protocols: ProtocolShutdownSenders) -> Self {
+    pub(crate) fn new(protocols: ProtocolShutdownSenders) -> Self {
         Self { protocols }
     }
 }
 
-pub async fn init_optional_runtime_services() -> Result<OptionalRuntimeServices> {
+pub(crate) async fn init_optional_runtime_services() -> Result<OptionalRuntimeServices> {
     let protocols = init_protocol_shutdown_senders().await?;
     Ok(OptionalRuntimeServices::new(protocols))
 }
@@ -76,7 +76,7 @@ fn optional_runtime_shutdown_steps(protocols: &ProtocolShutdownSenders) -> Vec<O
     steps
 }
 
-pub fn prepare_optional_runtime_shutdowns(optional_runtimes: OptionalRuntimeServices) -> Vec<ShutdownHandle> {
+pub(crate) fn prepare_optional_runtime_shutdowns(optional_runtimes: OptionalRuntimeServices) -> Vec<ShutdownHandle> {
     let ProtocolShutdownSenders { ftp, ftps, webdav, sftp } = optional_runtimes.protocols;
 
     let mut protocol_shutdowns = Vec::new();
@@ -100,7 +100,7 @@ pub fn prepare_optional_runtime_shutdowns(optional_runtimes: OptionalRuntimeServ
     protocol_shutdowns
 }
 
-pub async fn shutdown_optional_runtime_services(protocol_shutdowns: Vec<ShutdownHandle>) {
+pub(crate) async fn shutdown_optional_runtime_services(protocol_shutdowns: Vec<ShutdownHandle>) {
     join_all(protocol_shutdowns.into_iter().map(ShutdownHandle::shutdown)).await;
 }
 

rustfs/src/startup_preflight.rs

@@ -29,7 +29,7 @@ const EVENT_OBSERVABILITY_GUARD_SET: &str = "observability_guard_set";
 const EVENT_OBSERVABILITY_GUARD_SET_FAILED: &str = "observability_guard_set_failed";
 
 #[derive(Debug)]
-pub enum StartupServerPreflightError {
+pub(crate) enum StartupServerPreflightError {
     ObservabilityInit(Error),
     Other(Error),
 }
@@ -54,12 +54,12 @@ impl std::error::Error for StartupServerPreflightError {
     }
 }
 
-pub fn bootstrap_external_prefix_compat() -> Result<ExternalEnvCompatReport> {
+pub(crate) fn bootstrap_external_prefix_compat() -> Result<ExternalEnvCompatReport> {
     let env_compat_report = apply_external_env_compat();
     Ok(env_compat_report)
 }
 
-pub async fn init_startup_server_preflight(
+pub(crate) async fn init_startup_server_preflight(
     config: &Config,
     env_compat_report: &ExternalEnvCompatReport,
 ) -> std::result::Result<(), StartupServerPreflightError> {

rustfs/src/startup_protocols.rs

@@ -31,14 +31,14 @@ type ProtocolInitResult = std::result::Result<Option<ShutdownHandle>, Box<dyn st
 
 /// Shutdown channels for every protocol server. None means the protocol was
 /// disabled at startup or not compiled in.
-pub struct ProtocolShutdownSenders {
-    pub ftp: Option<ShutdownHandle>,
-    pub ftps: Option<ShutdownHandle>,
-    pub webdav: Option<ShutdownHandle>,
-    pub sftp: Option<ShutdownHandle>,
+pub(crate) struct ProtocolShutdownSenders {
+    pub(crate) ftp: Option<ShutdownHandle>,
+    pub(crate) ftps: Option<ShutdownHandle>,
+    pub(crate) webdav: Option<ShutdownHandle>,
+    pub(crate) sftp: Option<ShutdownHandle>,
 }
 
-pub async fn init_protocol_shutdown_senders() -> Result<ProtocolShutdownSenders> {
+pub(crate) async fn init_protocol_shutdown_senders() -> Result<ProtocolShutdownSenders> {
     Ok(ProtocolShutdownSenders {
         ftp: init_ftp_protocol().await?,
         ftps: init_ftps_protocol().await?,

rustfs/src/startup_runtime.rs

@@ -19,7 +19,7 @@ use crate::{
 };
 use std::io::Result;
 
-pub async fn init_startup_runtime_foundation(config: &Config) -> Result<()> {
+pub(crate) async fn init_startup_runtime_foundation(config: &Config) -> Result<()> {
     log_startup_runtime_diagnostics();
     init_profiling_runtime().await;
     rustfs_trusted_proxies::init();

rustfs/src/startup_runtime_hooks.rs

@@ -27,7 +27,7 @@ const EVENT_CRYPTO_PROVIDER_STATE: &str = "crypto_provider_state";
 const EVENT_DIAL9_RUNTIME_STATUS: &str = "dial9_runtime_status";
 const EVENT_RUNTIME_LICENSE_STATUS: &str = "runtime_license_status";
 
-pub fn log_startup_runtime_diagnostics() {
+pub(crate) fn log_startup_runtime_diagnostics() {
     log_dial9_runtime_status();
     log_runtime_license_status();
     debug!("{}", crate::server::LOGO);
@@ -66,7 +66,7 @@ fn log_runtime_license_status() {
     );
 }
 
-pub async fn init_profiling_runtime() {
+pub(crate) async fn init_profiling_runtime() {
     init_profiling_runtime_with(crate::profiling::init_from_env).await;
 }
 
@@ -78,7 +78,7 @@ where
     init().await;
 }
 
-pub fn shutdown_profiling_runtime() {
+pub(crate) fn shutdown_profiling_runtime() {
     shutdown_profiling_runtime_with(crate::profiling::shutdown_profiling);
 }
 
@@ -89,7 +89,7 @@ where
     shutdown();
 }
 
-pub fn install_default_crypto_provider() {
+pub(crate) fn install_default_crypto_provider() {
     if default_provider().install_default().is_err() {
         debug!(
             target: "rustfs::main",
@@ -103,7 +103,7 @@ pub fn install_default_crypto_provider() {
     }
 }
 
-pub async fn init_embedded_runtime_hooks(obs_endpoint: String) -> Result<()> {
+pub(crate) async fn init_embedded_runtime_hooks(obs_endpoint: String) -> Result<()> {
     let guard = rustfs_obs::init_obs(Some(obs_endpoint))
         .await
         .map_err(|err| Error::other(format!("init_obs: {err}")))?;

rustfs/src/startup_server.rs

@@ -40,42 +40,42 @@ const EVENT_ACTION_CREDENTIALS_INITIALIZED: &str = "action_credentials_initializ
 const EVENT_ACTION_CREDENTIALS_INITIALIZATION_FAILED: &str = "action_credentials_initialization_failed";
 const DEFAULT_CREDENTIALS_WARNING_MESSAGE: &str = "Detected default root credentials; set RUSTFS_ACCESS_KEY and RUSTFS_SECRET_KEY to non-default values for production deployments";
 
-pub struct StartupListenContext {
-    pub readiness: Arc<GlobalReadiness>,
-    pub server_addr: SocketAddr,
-    pub server_address: String,
+pub(crate) struct StartupListenContext {
+    pub(crate) readiness: Arc<GlobalReadiness>,
+    pub(crate) server_addr: SocketAddr,
+    pub(crate) server_address: String,
 }
 
-pub struct EmbeddedStartupListenContext {
-    pub readiness: Arc<GlobalReadiness>,
-    pub server_addr: SocketAddr,
-    pub server_address: String,
+pub(crate) struct EmbeddedStartupListenContext {
+    pub(crate) readiness: Arc<GlobalReadiness>,
+    pub(crate) server_addr: SocketAddr,
+    pub(crate) server_address: String,
 }
 
 pub(crate) struct EmbeddedStartupConfig {
-    pub config: Config,
-    pub identity: EmbeddedServerIdentity,
+    pub(crate) config: Config,
+    pub(crate) identity: EmbeddedServerIdentity,
     pub(crate) temp_dir_guard: Option<TempDir>,
 }
 
 pub(crate) struct EmbeddedServerIdentity {
-    pub access_key: String,
-    pub secret_key: String,
-    pub region: String,
+    pub(crate) access_key: String,
+    pub(crate) secret_key: String,
+    pub(crate) region: String,
 }
 
 pub(crate) struct EmbeddedHttpServer {
-    pub shutdown_handle: ShutdownHandle,
-    pub bound_addr: SocketAddr,
+    pub(crate) shutdown_handle: ShutdownHandle,
+    pub(crate) bound_addr: SocketAddr,
 }
 
-pub struct StartupHttpServers {
-    pub state_manager: Arc<ServiceStateManager>,
-    pub s3_shutdown_tx: Option<ShutdownHandle>,
-    pub console_shutdown_tx: Option<ShutdownHandle>,
+pub(crate) struct StartupHttpServers {
+    pub(crate) state_manager: Arc<ServiceStateManager>,
+    pub(crate) s3_shutdown_tx: Option<ShutdownHandle>,
+    pub(crate) console_shutdown_tx: Option<ShutdownHandle>,
 }
 
-pub async fn init_startup_listen_context(config: &Config) -> Result<StartupListenContext> {
+pub(crate) async fn init_startup_listen_context(config: &Config) -> Result<StartupListenContext> {
     log_sanitized_server_config(config);
     let readiness = Arc::new(GlobalReadiness::new());
 
@@ -171,7 +171,7 @@ pub(crate) fn find_embedded_available_port() -> Result<u16> {
     Ok(port)
 }
 
-pub async fn init_embedded_startup_listen_context(config: &Config) -> Result<EmbeddedStartupListenContext> {
+pub(crate) async fn init_embedded_startup_listen_context(config: &Config) -> Result<EmbeddedStartupListenContext> {
     let readiness = Arc::new(GlobalReadiness::new());
 
     let server_addr =
@@ -214,7 +214,7 @@ pub(crate) async fn start_embedded_http_server(config: &Config, readiness: Arc<G
     })
 }
 
-pub async fn init_startup_http_servers(config: &Config, readiness: Arc<GlobalReadiness>) -> Result<StartupHttpServers> {
+pub(crate) async fn init_startup_http_servers(config: &Config, readiness: Arc<GlobalReadiness>) -> Result<StartupHttpServers> {
     init_capacity_management().await;
     let state_manager = Arc::new(ServiceStateManager::new());
     state_manager.update(ServiceState::Starting);

rustfs/src/startup_services.rs

@@ -32,17 +32,17 @@ use rustfs_common::GlobalReadiness;
 use std::{io::Result, sync::Arc};
 use tokio_util::sync::CancellationToken;
 
-pub struct StartupServiceRuntime {
-    pub optional_runtimes: OptionalRuntimeServices,
-    pub iam_bootstrap: IamBootstrapDisposition,
-    pub enable_scanner: bool,
+pub(crate) struct StartupServiceRuntime {
+    pub(crate) optional_runtimes: OptionalRuntimeServices,
+    pub(crate) iam_bootstrap: IamBootstrapDisposition,
+    pub(crate) enable_scanner: bool,
 }
 
-pub struct EmbeddedStartupServiceRuntime {
-    pub iam_bootstrap: IamBootstrapDisposition,
+pub(crate) struct EmbeddedStartupServiceRuntime {
+    pub(crate) iam_bootstrap: IamBootstrapDisposition,
 }
 
-pub async fn init_embedded_startup_runtime_services(
+pub(crate) async fn init_embedded_startup_runtime_services(
     config: &Config,
     endpoint_pools: EndpointServerPools,
     store: Arc<ECStore>,
@@ -59,7 +59,7 @@ pub async fn init_embedded_startup_runtime_services(
     Ok(EmbeddedStartupServiceRuntime { iam_bootstrap })
 }
 
-pub async fn init_startup_runtime_services(
+pub(crate) async fn init_startup_runtime_services(
     config: &Config,
     endpoint_pools: EndpointServerPools,
     store: Arc<ECStore>,

rustfs/src/startup_shutdown.rs

@@ -59,7 +59,7 @@ fn background_shutdown_steps(enable_scanner: bool, enable_heal: bool) -> Vec<Bac
     steps
 }
 
-pub async fn run_startup_shutdown_sequence(
+pub(crate) async fn run_startup_shutdown_sequence(
     state_manager: &ServiceStateManager,
     shutdown_signal: ShutdownSignal,
     s3_shutdown_handle: Option<ShutdownHandle>,
@@ -201,7 +201,7 @@ pub async fn run_startup_shutdown_sequence(
     );
 }
 
-pub async fn run_embedded_shutdown_cleanup() {
+pub(crate) async fn run_embedded_shutdown_cleanup() {
     shutdown_event_notifier().await;
 
     if let Err(err) = stop_audit_system().await {
@@ -235,7 +235,7 @@ pub(crate) fn run_embedded_server_drop_cleanup(
     }
 }
 
-pub async fn run_embedded_server_shutdown(
+pub(crate) async fn run_embedded_server_shutdown(
     ctx: &CancellationToken,
     shutdown_handle: &mut Option<ShutdownHandle>,
     temp_dir: Option<&Path>,

rustfs/src/startup_storage.rs

@@ -39,12 +39,12 @@ const EVENT_STORAGE_POOL_HOST_RISK: &str = "storage_pool_host_risk";
 const EVENT_EMBEDDED_STORAGE_INIT_FAILED: &str = "embedded_storage_init_failed";
 const EVENT_EMBEDDED_STORAGE_INIT_RETRY: &str = "embedded_storage_init_retry";
 
-pub struct StartupStorageRuntime {
-    pub store: Arc<ECStore>,
-    pub shutdown_token: CancellationToken,
+pub(crate) struct StartupStorageRuntime {
+    pub(crate) store: Arc<ECStore>,
+    pub(crate) shutdown_token: CancellationToken,
 }
 
-pub async fn init_startup_storage_foundation(server_address: &str, volumes: &[String]) -> Result<EndpointServerPools> {
+pub(crate) async fn init_startup_storage_foundation(server_address: &str, volumes: &[String]) -> Result<EndpointServerPools> {
     info!(
         target: "rustfs::main::run",
         event = EVENT_ENDPOINT_PARSING_STARTED,
@@ -106,7 +106,10 @@ pub async fn init_startup_storage_foundation(server_address: &str, volumes: &[St
     Ok(endpoint_pools)
 }
 
-pub async fn init_embedded_startup_storage_foundation(server_address: &str, volumes: &[String]) -> Result<EndpointServerPools> {
+pub(crate) async fn init_embedded_startup_storage_foundation(
+    server_address: &str,
+    volumes: &[String],
+) -> Result<EndpointServerPools> {
     let (endpoint_pools, setup_type) = EndpointServerPools::from_volumes(server_address, volumes.to_vec())
         .await
         .map_err(|err| Error::other(format!("endpoints: {err}")))?;
@@ -123,7 +126,7 @@ pub async fn init_embedded_startup_storage_foundation(server_address: &str, volu
     Ok(endpoint_pools)
 }
 
-pub async fn init_startup_storage_runtime(
+pub(crate) async fn init_startup_storage_runtime(
     server_addr: SocketAddr,
     endpoint_pools: &EndpointServerPools,
     readiness: Arc<GlobalReadiness>,
@@ -164,7 +167,7 @@ pub async fn init_startup_storage_runtime(
     })
 }
 
-pub async fn init_embedded_startup_storage_runtime(
+pub(crate) async fn init_embedded_startup_storage_runtime(
     server_addr: SocketAddr,
     endpoint_pools: &EndpointServerPools,
     readiness: Arc<GlobalReadiness>,