feat: add read-only retention inventory

cmd/orbit-admin/main.go

@@ -23,17 +23,19 @@ func main() {
 }
 func run() error {
 	if len(os.Args) < 2 {
-		return errors.New("usage: orbit-admin bootstrap|verify|credential status|rotate|revoke|apply")
+		return errors.New("usage: orbit-admin bootstrap|verify|retention inventory|credential status|rotate|revoke|apply")
 	}
 	switch os.Args[1] {
 	case "bootstrap":
 		return runBootstrap(os.Args[2:])
 	case "verify":
 		return runVerify(os.Args[2:])
+	case "retention":
+		return runRetention(os.Args[2:])
 	case "credential":
 		return runCredential(os.Args[2:])
 	}
-	return errors.New("usage: orbit-admin bootstrap|verify|credential status|rotate|revoke|apply")
+	return errors.New("usage: orbit-admin bootstrap|verify|retention inventory|credential status|rotate|revoke|apply")
 }
 
 func runVerify(args []string) error {
@@ -67,6 +69,43 @@ func runVerify(args []string) error {
 	return nil
 }
 
+func runRetention(args []string) error {
+	if len(args) == 0 || args[0] != "inventory" {
+		return errors.New("usage: orbit-admin retention inventory --before RFC3339")
+	}
+	flags := flag.NewFlagSet("retention inventory", flag.ContinueOnError)
+	var before string
+	flags.StringVar(&before, "before", "", "UTC cutoff; only records strictly before it are counted")
+	if err := flags.Parse(args[1:]); err != nil {
+		return err
+	}
+	if flags.NArg() != 0 || before == "" {
+		return errors.New("--before RFC3339 is required")
+	}
+	cutoff, err := time.Parse(time.RFC3339Nano, before)
+	if err != nil {
+		return errors.New("--before must be RFC3339")
+	}
+	cfg, err := config.Load()
+	if err != nil {
+		return err
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	db, err := mysql.Open(ctx, cfg.MySQLDSN, 2, 1)
+	if err != nil {
+		return errors.New("database unavailable")
+	}
+	defer db.Close()
+	inventory, err := mysql.ReadRetentionInventory(ctx, db, cutoff)
+	encoded, encodeErr := json.Marshal(inventory)
+	if encodeErr != nil {
+		return encodeErr
+	}
+	fmt.Println(string(encoded))
+	return err
+}
+
 func runBootstrap(args []string) error {
 	flags := flag.NewFlagSet("bootstrap", flag.ContinueOnError)
 	var in mysql.BootstrapInput