From 3cc8d7e775c1c86ea7d78c550f2998a85ebed445 Mon Sep 17 00:00:00 2001 From: John Myers <9696606+johntmyers@users.noreply.github.com> Date: Fri, 23 Oct 2026 13:37:52 -0700 Subject: [PATCH 1/2] fix(providers): enforce static credential request placement Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> --- crates/openshell-core/README.md | 16 + crates/openshell-core/src/grpc_client.rs | 8 + .../src/provider_credentials.rs | 597 ++++- crates/openshell-core/src/secrets.rs | 306 ++- crates/openshell-core/src/secrets_body.rs | 7 + crates/openshell-providers/src/profiles.rs | 7 + crates/openshell-server/README.md | 12 + .../src/config_delivery/mod.rs | 42 +- crates/openshell-server/src/grpc/mod.rs | 5 +- crates/openshell-server/src/grpc/policy.rs | 69 +- .../src/grpc/policy/endpoint_status_tests.rs | 2 + crates/openshell-server/src/grpc/provider.rs | 443 +++- .../src/grpc/provider_readiness_tests.rs | 1 + crates/openshell-server/src/storage_proto.rs | 6 +- .../src/supervisor_session.rs | 26 +- crates/openshell-supervisor-network/README.md | 10 + .../src/google_cloud_metadata.rs | 7 + .../src/l7/mod.rs | 31 + .../src/l7/relay.rs | 351 ++- .../src/l7/rest.rs | 3 + .../src/l7/websocket.rs | 76 +- .../openshell-supervisor-network/src/proxy.rs | 29 +- .../src/supervisor_session.rs | 1 + .../src/config_runtime.rs | 43 +- crates/openshell-supervisor/src/lib.rs | 73 +- docs/how-it-works/policies/network-rules.mdx | 5 +- docs/how-it-works/policies/schema.mdx | 4 +- docs/how-it-works/providers/overview.mdx | 23 +- docs/how-it-works/providers/profiles.mdx | 38 +- e2e/python/test_sandbox_providers.py | 104 + proto/openshell.proto | 25 +- providers/codex.yaml | 7 + sdk/go/proto/openshellv1/openshell.pb.go | 2045 +++++++++-------- skills/debug-inference/SKILL.md | 3 +- skills/openshell-cli/SKILL.md | 7 + 35 files changed, 3268 insertions(+), 1164 deletions(-) diff --git a/crates/openshell-core/README.md b/crates/openshell-core/README.md index 1cf1b7e70e..d1c5153651 100644 --- a/crates/openshell-core/README.md +++ b/crates/openshell-core/README.md @@ -58,6 +58,22 @@ router agree on provider defaults. Profiles define: Do not duplicate provider-specific inference behavior in callers. Add shared behavior here, then consume it from the gateway, sandbox, and router. +## Static Credential Resolution + +Static credential bindings carry both an endpoint boundary and a placement +boundary. `provider_credentials` compiles them together and preserves placement +when creating a request-scoped resolver. Request rewriting supplies the actual +header name, query key, or path slot before resolving each reference. Missing or +unsupported placement fails closed. + +Header placement authorizes a header name independently of authentication +scheme. Basic authentication applies the same check before resolving decoded +references. Body and WebSocket rewriting cannot override a credential's declared +placement. Signing-only material uses the supervisor's trusted signing path. + +Placement changes are authorization changes: retained references and stable +handles must not retain access to the previous placement. + ## Middleware Contracts Built-in supervisor middleware identifiers, host-selector matching, and pure diff --git a/crates/openshell-core/src/grpc_client.rs b/crates/openshell-core/src/grpc_client.rs index 3a13ed88e5..26ba139ca0 100644 --- a/crates/openshell-core/src/grpc_client.rs +++ b/crates/openshell-core/src/grpc_client.rs @@ -1317,6 +1317,7 @@ pub async fn fetch_provider_environment_with_stable_placeholders( .get_sandbox_provider_environment(GetSandboxProviderEnvironmentRequest { sandbox_id: sandbox_id.to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, }) .await @@ -1386,6 +1387,13 @@ mod provider_environment_tests { path: "/v1/**".to_string(), }], credential_identity: "provider:TOKEN".to_string(), + placement: Some(crate::proto::StaticCredentialPlacement { + location: Some( + crate::proto::static_credential_placement::Location::HeaderName( + "authorization".into(), + ), + ), + }), ..Default::default() }, )]), diff --git a/crates/openshell-core/src/provider_credentials.rs b/crates/openshell-core/src/provider_credentials.rs index d71f34b7c6..d6c33a09fd 100644 --- a/crates/openshell-core/src/provider_credentials.rs +++ b/crates/openshell-core/src/provider_credentials.rs @@ -3,7 +3,7 @@ //! Runtime provider credential snapshots. -use crate::secrets::SecretResolver; +use crate::secrets::{CredentialPlacement, SecretResolver}; use crate::{ endpoint_path::EndpointPathPattern, host_pattern::HostPattern, @@ -61,12 +61,14 @@ struct ProviderCredentialStateInner { #[derive(Debug)] struct StaticCredentialIdentityEpoch { - identity: String, + credential_identity: String, + placement: CredentialPlacement, revisions: Arc>, } #[derive(Debug, Clone)] struct CompiledStaticCredentialBinding { + placement: CredentialPlacement, endpoints: Vec, credential_identity: String, workload_credential_handle: String, @@ -304,11 +306,21 @@ impl ProviderCredentialState { } pub fn resolver(&self) -> Option> { - self.inner + let inner = self + .inner .read() - .expect("provider credential state poisoned") - .combined_resolver - .clone() + .expect("provider credential state poisoned"); + inner.combined_resolver.as_ref().map(|resolver| { + Arc::new( + resolver.as_ref().clone().with_placements( + inner + .static_credential_bindings + .iter() + .map(|(key, binding)| (key.clone(), binding.placement.clone())) + .collect(), + ), + ) + }) } /// Resolve provider placeholders only for credentials bound to this @@ -395,7 +407,10 @@ impl ProviderCredentialState { inner .static_credential_bindings .get(*key) - .is_some_and(|binding| binding.credential_identity == epoch.identity) + .is_some_and(|binding| { + binding.credential_identity == epoch.credential_identity + && binding.placement == epoch.placement + }) }) .map(|(key, epoch)| (key.clone(), epoch.revisions.clone())) .collect(), @@ -410,15 +425,30 @@ impl ProviderCredentialState { && inner .static_credential_bindings .get(*key) - .is_some_and(|binding| binding.credential_identity == epoch.identity) + .is_some_and(|binding| { + binding.credential_identity == epoch.credential_identity + && binding.placement == epoch.placement + }) }) .map(|(key, epoch)| (key.clone(), epoch.revisions.clone())) .collect(); - Arc::new(resolver.scoped_to_env_keys( - &inner.known_static_credential_keys, - &allowed, - revision_fallback_allowed_revisions, - )) + Arc::new( + resolver + .as_ref() + .clone() + .with_placements( + inner + .static_credential_bindings + .iter() + .map(|(key, binding)| (key.clone(), binding.placement.clone())) + .collect(), + ) + .scoped_to_env_keys( + &inner.known_static_credential_keys, + &allowed, + revision_fallback_allowed_revisions, + ), + ) }); (resolver, classifier, revision) } @@ -1065,6 +1095,7 @@ fn compile_static_credential_bindings( key, CompiledStaticCredentialBinding { endpoints, + placement: compile_credential_placement(binding.placement)?, credential_identity: binding.credential_identity, workload_credential_handle: binding.workload_credential_handle, }, @@ -1073,6 +1104,38 @@ fn compile_static_credential_bindings( .collect() } +fn compile_credential_placement( + placement: Option, +) -> Result { + use crate::proto::static_credential_placement::Location; + match placement.and_then(|placement| placement.location) { + Some(Location::HeaderName(name)) + if !name.is_empty() + && name + .bytes() + .all(|b| b.is_ascii_alphanumeric() || b"!#$%&'*+-.^_`|~".contains(&b)) => + { + Ok(CredentialPlacement::Header(name.to_ascii_lowercase())) + } + Some(Location::QueryParam(name)) + if !name.is_empty() && !name.chars().any(|c| c.is_control() || "&=#?".contains(c)) => + { + Ok(CredentialPlacement::QueryParam(name)) + } + Some(Location::PathTemplate(template)) + if template.starts_with('/') + && template.matches("{credential}").count() == 1 + && !template.chars().any(|c| c.is_control() || "?#".contains(c)) => + { + Ok(CredentialPlacement::PathTemplate(template)) + } + Some(Location::SigningOnly(true)) => Ok(CredentialPlacement::SigningOnly), + _ => Err(binding_error( + "static credential binding has missing or invalid credential placement", + )), + } +} + fn compile_static_credential_endpoint( endpoint: StaticCredentialEndpointBinding, ) -> Result { @@ -1088,10 +1151,15 @@ fn compile_static_credential_endpoint( fn static_credential_identities( bindings: &HashMap, -) -> HashMap<&str, &str> { +) -> HashMap<&str, (&str, &CredentialPlacement)> { bindings .iter() - .map(|(key, binding)| (key.as_str(), binding.credential_identity.as_str())) + .map(|(key, binding)| { + ( + key.as_str(), + (binding.credential_identity.as_str(), &binding.placement), + ) + }) .collect() } @@ -1127,18 +1195,25 @@ fn update_static_credential_identity_epochs( continue; } match epochs.get_mut(key) { - Some(epoch) if epoch.identity == binding.credential_identity => { + Some(epoch) + if epoch.credential_identity == binding.credential_identity + && epoch.placement == binding.placement => + { Arc::make_mut(&mut epoch.revisions).insert(revision); } Some(epoch) => { - epoch.identity.clone_from(&binding.credential_identity); + epoch + .credential_identity + .clone_from(&binding.credential_identity); + epoch.placement.clone_from(&binding.placement); epoch.revisions = Arc::new(HashSet::from([revision])); } None => { epochs.insert( key.clone(), StaticCredentialIdentityEpoch { - identity: binding.credential_identity.clone(), + credential_identity: binding.credential_identity.clone(), + placement: binding.placement.clone(), revisions: Arc::new(HashSet::from([revision])), }, ); @@ -1355,9 +1430,91 @@ mod tests { }], credential_identity: "provider-a:API_KEY".to_string(), workload_credential_handle: String::new(), + placement: Some(crate::proto::StaticCredentialPlacement { + location: Some( + crate::proto::static_credential_placement::Location::HeaderName( + "Authorization".into(), + ), + ), + }), } } + #[test] + fn missing_or_unknown_credential_placement_is_rejected() { + for placement in [ + None, + Some(crate::proto::StaticCredentialPlacement { location: None }), + Some(crate::proto::StaticCredentialPlacement { + location: Some( + crate::proto::static_credential_placement::Location::SigningOnly(false), + ), + }), + ] { + let mut metadata = binding("api.example.com", 443, "/**"); + metadata.placement = placement; + assert!( + ProviderCredentialState::from_bound_environment( + 1, + HashMap::from([("API_KEY".into(), "secret".into())]), + HashMap::new(), + HashMap::new(), + HashMap::from([("API_KEY".into(), metadata)]), + vec![] + ) + .is_err() + ); + } + } + + #[test] + fn changed_placement_revokes_old_revision_even_with_reused_identity() { + let original = binding("api.example.com", 443, "/**"); + let state = ProviderCredentialState::from_bound_environment( + 1, + HashMap::from([("API_KEY".into(), "secret".into())]), + HashMap::new(), + HashMap::new(), + HashMap::from([("API_KEY".into(), original.clone())]), + vec![], + ) + .unwrap(); + let old_token = state.snapshot().child_env["API_KEY"].clone(); + let mut replacement = original; + replacement.placement = Some(crate::proto::StaticCredentialPlacement { + location: Some( + crate::proto::static_credential_placement::Location::QueryParam("api_key".into()), + ), + }); + state + .install_bound_environment( + 2, + HashMap::from([("API_KEY".into(), "replacement".into())]), + HashMap::new(), + HashMap::new(), + HashMap::from([("API_KEY".into(), replacement)]), + vec![], + ) + .unwrap(); + let resolver = state + .resolver_for_endpoint("api.example.com", 443, "/search") + .unwrap(); + let query = resolver.with_request_location( + crate::secrets::RequestCredentialLocation::QueryParam("api_key".into()), + ); + assert_eq!(query.resolve_placeholder(&old_token), None); + assert_eq!( + query.resolve_placeholder(&state.snapshot().child_env["API_KEY"]), + Some("replacement") + ); + assert!( + resolver + .rewrite_header_value_for_name("Authorization", &old_token) + .unwrap_err() + .is_placement_mismatch() + ); + } + fn stable_binding(host: &str, port: u32, path: &str, handle: &str) -> StaticCredentialBinding { let mut binding = binding(host, port, path); binding.credential_identity = format!("refresh:{handle}"); @@ -1472,7 +1629,14 @@ mod tests { let allowed = state .resolver_for_endpoint("api.example.com", 443, "/v1/messages?stream=true") .expect("resolver"); - assert_eq!(allowed.resolve_placeholder(placeholder), Some("secret")); + assert_eq!( + allowed + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder(placeholder), + Some("secret") + ); for (host, port, path) in [ ("example.com", 443, "/v1/messages"), @@ -1483,7 +1647,7 @@ mod tests { .resolver_for_endpoint(host, port, path) .expect("resolver"); let error = denied - .rewrite_header_value(placeholder) + .rewrite_header_value_for_name("Authorization", placeholder) .expect_err("endpoint mismatch must fail closed"); assert!(error.is_endpoint_mismatch(), "{host}:{port}{path}"); } @@ -1522,16 +1686,28 @@ mod tests { .resolver_for_endpoint("tools.example.com", 443, "/mcp/local") .expect("endpoint resolver"); assert_eq!( - resolver.resolve_placeholder(&stable_placeholder), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder(&stable_placeholder), Some("old") ); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:ORDINARY_TOKEN"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:ORDINARY_TOKEN"), None, "ordinary endpoint-bound credentials remain revision scoped" ); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v1_ORDINARY_TOKEN"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v1_ORDINARY_TOKEN"), Some("ordinary") ); @@ -1559,16 +1735,28 @@ mod tests { .resolver_for_endpoint("tools.example.com", 443, "/mcp/local") .expect("refreshed endpoint resolver"); assert_eq!( - refreshed.resolve_placeholder(&stable_placeholder), + refreshed + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder(&stable_placeholder), Some("new") ); assert_eq!( - refreshed.resolve_placeholder("openshell:resolve:env:EXTERNAL_ASSERTION"), + refreshed + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:EXTERNAL_ASSERTION"), None, "an identityless current-name alias must remain unavailable" ); assert_eq!( - refreshed.resolve_placeholder("openshell:resolve:env:ORDINARY_TOKEN"), + refreshed + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:ORDINARY_TOKEN"), None ); @@ -1591,12 +1779,20 @@ mod tests { .resolver_for_endpoint("tools.example.com", 443, "/mcp/local") .expect("replacement endpoint resolver"); assert_eq!( - replacement.resolve_placeholder(&stable_placeholder), + replacement + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder(&stable_placeholder), None, "a placeholder issued for an earlier provider identity must be revoked" ); assert_eq!( - replacement.resolve_placeholder(&state.snapshot().child_env["EXTERNAL_ASSERTION"]), + replacement + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder(&state.snapshot().child_env["EXTERNAL_ASSERTION"]), Some("replacement") ); } @@ -1650,16 +1846,26 @@ mod tests { .resolver_for_endpoint("api.example.com", 443, "/v1/chat/completions") .expect("authorized endpoint resolver"); assert!( - resolver.resolve_placeholder(&original) + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder(&original) == Some(format!("synthetic-{revision}").as_str()) ); assert!( resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) .resolve_placeholder("openshell:resolve:env:API_KEY") .is_none() ); assert!( resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) .resolve_placeholder("openshell:resolve:env:v1_API_KEY") .is_none() ); @@ -1681,6 +1887,9 @@ mod tests { reconstructed .resolver_for_endpoint("api.example.com", 443, "/v1/chat/completions") .expect("reconstructed resolver") + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) .resolve_placeholder(&original) == Some("synthetic-13") ); @@ -1692,7 +1901,11 @@ mod tests { let resolver = reconstructed .resolver_for_endpoint(host, port, path) .expect("endpoint-scoped resolver"); - assert!(resolver.rewrite_header_value(&original).is_err()); + assert!( + resolver + .rewrite_header_value_for_name("Authorization", &original) + .is_err() + ); } // Current-value expiry must not fall back to a previously valid value. @@ -1710,7 +1923,14 @@ mod tests { let resolver = reconstructed .resolver_for_endpoint("api.example.com", 443, "/v1/chat/completions") .expect("expired resolver"); - assert!(resolver.resolve_placeholder(&original).is_none()); + assert!( + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder(&original) + .is_none() + ); // An activated detach removes the current binding and all authority for // a still-running process, even when it retains its original reference. @@ -1729,7 +1949,12 @@ mod tests { assert!( state .resolver_for_endpoint("api.example.com", 443, "/v1/chat/completions") - .is_none_or(|resolver| resolver.resolve_placeholder(&original).is_none()) + .is_none_or(|resolver| resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder(&original) + .is_none()) ); } @@ -1856,11 +2081,19 @@ mod tests { .resolver_for_endpoint("a.example.com", 443, "/a/check") .expect("endpoint A resolver"); assert_eq!( - resolver_a.resolve_placeholder("openshell:resolve:env:v7_KEY_A"), + resolver_a + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v7_KEY_A"), Some("secret-a") ); assert_eq!( - resolver_a.resolve_placeholder("openshell:resolve:env:v7_KEY_B"), + resolver_a + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v7_KEY_B"), None, "credential B must not resolve at endpoint A" ); @@ -1869,11 +2102,19 @@ mod tests { .resolver_for_endpoint("b.example.com", 443, "/b/check") .expect("endpoint B resolver"); assert_eq!( - resolver_b.resolve_placeholder("openshell:resolve:env:v7_KEY_B"), + resolver_b + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v7_KEY_B"), Some("secret-b") ); assert_eq!( - resolver_b.resolve_placeholder("openshell:resolve:env:v7_KEY_A"), + resolver_b + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v7_KEY_A"), None, "credential A must not resolve at endpoint B" ); @@ -1912,7 +2153,11 @@ mod tests { .resolver_for_endpoint("new.example.com", 443, "/v2/messages") .expect("replacement endpoint resolver"); assert_eq!( - replacement.resolve_placeholder("openshell:resolve:env:v2_API_KEY"), + replacement + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v2_API_KEY"), Some("new") ); @@ -1920,7 +2165,7 @@ mod tests { .resolver_for_endpoint("old.example.com", 443, "/v1/messages") .expect("restricted resolver"); let error = removed - .rewrite_header_value("openshell:resolve:env:v2_API_KEY") + .rewrite_header_value_for_name("Authorization", "openshell:resolve:env:v2_API_KEY") .expect_err("replaced endpoint binding must no longer authorize the credential"); assert!(error.is_endpoint_mismatch()); } @@ -1948,7 +2193,14 @@ mod tests { &format!("/bot{placeholder}/sendMessage?stream=true"), ) .expect("syntax-redacted path should select the binding"); - assert_eq!(resolver.resolve_placeholder(placeholder), Some("secret")); + assert_eq!( + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder(placeholder), + Some("secret") + ); } #[test] @@ -1974,7 +2226,11 @@ mod tests { ) .expect("syntax-redacted alias path should select the binding"); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v7_API_KEY"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v7_API_KEY"), Some("secret") ); } @@ -2021,7 +2277,11 @@ mod tests { .resolver_for_endpoint("unrelated.example", 1234, "/") .expect("resolver"); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v3_GCP_PROJECT_ID"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v3_GCP_PROJECT_ID"), Some("project") ); } @@ -2076,7 +2336,11 @@ mod tests { .resolver_for_endpoint("api.example.com", 443, "/v1") .expect("resolver"); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v1_API_KEY"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v1_API_KEY"), Some("recovered"), "a metadata failure must not permanently strand placeholders from the same provider identity" ); @@ -2128,7 +2392,11 @@ mod tests { .resolver_for_endpoint("api.example.com", 443, "/v1") .expect("resolver"); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v1_API_KEY"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v1_API_KEY"), Some("new"), "the running process placeholder should recover against the current same-identity secret" ); @@ -2167,11 +2435,19 @@ mod tests { .resolver_for_endpoint("api.example.com", 443, "/v1") .expect("resolver"); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v1_API_KEY"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v1_API_KEY"), Some("old") ); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v2_API_KEY"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v2_API_KEY"), Some("new") ); } @@ -2202,6 +2478,9 @@ mod tests { state .resolver_for_endpoint("api.example.com", 443, "/v1") .expect("resolver") + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) .resolve_placeholder(&workload_placeholder), None, "the expired access token must fail closed" @@ -2210,7 +2489,10 @@ mod tests { state .resolver_for_endpoint("api.example.com", 443, "/v1") .expect("resolver") - .rewrite_header_value(&format!("Bearer {}", jwt_alias(&workload_placeholder))) + .rewrite_header_value_for_name( + "Authorization", + &format!("Bearer {}", jwt_alias(&workload_placeholder)) + ) .is_err(), "wrapping a placeholder must not bypass access-token expiry" ); @@ -2231,17 +2513,28 @@ mod tests { .resolver_for_endpoint("api.example.com", 443, "/v1") .expect("resolver"); assert_eq!( - resolver.resolve_placeholder(&workload_placeholder), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder(&workload_placeholder), Some("current") ); assert_eq!( resolver - .rewrite_header_value(&format!("Bearer {}", jwt_alias(&workload_placeholder))) + .rewrite_header_value_for_name( + "Authorization", + &format!("Bearer {}", jwt_alias(&workload_placeholder)) + ) .expect("refresh updates the JWT alias"), Some("Bearer current".to_string()) ); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v2_API_KEY"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v2_API_KEY"), None, "refresh-managed credentials must not expose revision aliases" ); @@ -2283,6 +2576,9 @@ mod tests { state .resolver_for_endpoint("api.example.com", 443, "/v1") .expect("resolver") + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) .resolve_placeholder(&workload_placeholder), Some(token.as_str()) ); @@ -2315,6 +2611,9 @@ mod tests { reconstructed .resolver_for_endpoint("api.example.com", 443, "/v1") .expect("resolver") + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) .resolve_placeholder(&workload_placeholder), Some("token-14") ); @@ -2322,7 +2621,10 @@ mod tests { reconstructed .resolver_for_endpoint("api.example.com", 443, "/v1") .expect("resolver") - .rewrite_header_value(&format!("Bearer {}", jwt_alias(&workload_placeholder))) + .rewrite_header_value_for_name( + "Authorization", + &format!("Bearer {}", jwt_alias(&workload_placeholder)) + ) .expect("the JWT alias survives supervisor reconstruction"), Some("Bearer token-14".to_string()) ); @@ -2363,10 +2665,20 @@ mod tests { let current = state .resolver_for_endpoint("new.example.com", 443, "/v2/messages") .expect("current resolver"); - assert_eq!(current.resolve_placeholder(&old_placeholder), None); + assert_eq!( + current + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder(&old_placeholder), + None + ); assert!( current - .rewrite_header_value(&format!("Bearer {}", jwt_alias(&old_placeholder))) + .rewrite_header_value_for_name( + "Authorization", + &format!("Bearer {}", jwt_alias(&old_placeholder)) + ) .is_err(), "a JWT alias must not carry a revoked identity into the new epoch" ); @@ -2377,27 +2689,34 @@ mod tests { ] { assert!( current - .rewrite_header_value(&format!("Bearer {alias}")) + .rewrite_header_value_for_name("Authorization", &format!("Bearer {alias}")) .is_err(), "identityless and malformed JWT aliases must fail closed" ); } assert_eq!( - current.resolve_placeholder(&state.snapshot().child_env["API_KEY"]), + current + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder(&state.snapshot().child_env["API_KEY"]), Some("new") ); let wrong_endpoint = state .resolver_for_endpoint("old.example.com", 443, "/v1/messages") .expect("endpoint-scoped resolver"); let error = wrong_endpoint - .rewrite_header_value(&state.snapshot().child_env["API_KEY"]) + .rewrite_header_value_for_name("Authorization", &state.snapshot().child_env["API_KEY"]) .expect_err("new handle must not resolve at the old endpoint"); assert!(error.is_endpoint_mismatch()); let error = wrong_endpoint - .rewrite_header_value(&format!( - "Bearer {}", - jwt_alias(&state.snapshot().child_env["API_KEY"]) - )) + .rewrite_header_value_for_name( + "Authorization", + &format!( + "Bearer {}", + jwt_alias(&state.snapshot().child_env["API_KEY"]) + ), + ) .expect_err("JWT wrapping preserves endpoint authorization"); assert!(error.is_endpoint_mismatch()); } @@ -2442,7 +2761,11 @@ mod tests { .resolver_for_endpoint("api.example.com", 443, "/v2/inference") .expect("resolver"); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v50_API_KEY"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v50_API_KEY"), Some("secret-6"), "an aged-out placeholder may use the current secret across revisions in both numeric directions while its provider identity is unchanged" ); @@ -2484,35 +2807,50 @@ mod tests { .resolver_for_endpoint("b.example.com", 443, "/v1") .expect("resolver"); assert_eq!( - resolver.resolve_placeholder(&format!("openshell:resolve:env:v{}_API_KEY", u64::MAX)), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder(&format!("openshell:resolve:env:v{}_API_KEY", u64::MAX)), None, "an opaque revision from another provider identity must fail closed even when it is numerically greater" ); assert!( resolver - .rewrite_header_value(&format!( - "Bearer {}", - jwt_alias(&format!("openshell:resolve:env:v{}_API_KEY", u64::MAX)) - )) + .rewrite_header_value_for_name( + "Authorization", + &format!( + "Bearer {}", + jwt_alias(&format!("openshell:resolve:env:v{}_API_KEY", u64::MAX)) + ) + ) .is_err(), "a JWT alias must not resolve a replacement provider's credential" ); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:API_KEY"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:API_KEY"), None, "an identityless canonical placeholder must not resolve a replacement provider" ); assert_eq!( - resolver.resolve_placeholder("vendor-OPENSHELL-RESOLVE-ENV-API_KEY"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("vendor-OPENSHELL-RESOLVE-ENV-API_KEY"), None, "an identityless provider alias must not resolve a replacement provider" ); - assert_eq!( + assert!( resolver .resolve_current_env_key_checked("API_KEY", "trusted-transform") - .expect("binding authorizes the endpoint"), - Some("provider-b-secret"), - "trusted supervisor transforms may select the current bound credential by key" + .unwrap_err() + .is_placement_mismatch(), + "trusted signing cannot unwrap a header-bound credential" ); } @@ -2546,17 +2884,29 @@ mod tests { .resolver_for_endpoint("b.example.com", 443, "/v1") .expect("resolver"); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v1_API_KEY"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v1_API_KEY"), None, "a placeholder issued before detach must not resolve to a replacement provider" ); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:API_KEY"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:API_KEY"), None, "an identityless canonical placeholder must not cross a failed refresh into a replacement identity" ); assert_eq!( - resolver.resolve_placeholder("vendor-OPENSHELL-RESOLVE-ENV-API_KEY"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("vendor-OPENSHELL-RESOLVE-ENV-API_KEY"), None, "an identityless provider alias must not cross a failed refresh into a replacement identity" ); @@ -2600,12 +2950,20 @@ mod tests { .resolver_for_endpoint("a.example.com", 443, "/v1") .expect("resolver"); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v1_API_KEY"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v1_API_KEY"), None, "a successful empty environment represents detach and must invalidate old membership" ); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v4_API_KEY"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v4_API_KEY"), Some("reattached") ); } @@ -2638,19 +2996,35 @@ mod tests { let resolver = state.resolver().expect("resolver"); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), Some("old") ); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v11_GITHUB_TOKEN"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v11_GITHUB_TOKEN"), Some("new") ); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:GITHUB_TOKEN"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:GITHUB_TOKEN"), Some("new") ); assert_eq!( - resolver.resolve_placeholder("provider-OPENSHELL-RESOLVE-ENV-GITHUB_TOKEN"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("provider-OPENSHELL-RESOLVE-ENV-GITHUB_TOKEN"), Some("new") ); } @@ -2669,15 +3043,27 @@ mod tests { assert!(state.snapshot().child_env.is_empty()); let resolver = state.resolver().expect("old resolver retained"); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), Some("old") ); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:GITHUB_TOKEN"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:GITHUB_TOKEN"), None ); assert_eq!( - resolver.resolve_placeholder("provider-OPENSHELL-RESOLVE-ENV-GITHUB_TOKEN"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("provider-OPENSHELL-RESOLVE-ENV-GITHUB_TOKEN"), None ); } @@ -2707,11 +3093,19 @@ mod tests { let resolver = state.resolver().expect("resolver"); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), None ); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v11_GITHUB_TOKEN"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v11_GITHUB_TOKEN"), Some("new") ); } @@ -3075,11 +3469,19 @@ mod tests { .resolver_for_endpoint("api.example.com", 443, "/") .unwrap(); assert_eq!( - resolver.resolve_placeholder(&old_placeholder), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder(&old_placeholder), Some("first-secret") ); assert_eq!( - resolver.resolve_placeholder(&live.snapshot().child_env["API_KEY"]), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder(&live.snapshot().child_env["API_KEY"]), Some("second-secret"), ); } @@ -3138,7 +3540,14 @@ mod tests { let resolver = observer .resolver_for_endpoint("api.example.com", 443, "/") .unwrap(); - assert!(resolver.resolve_placeholder(&old_placeholder).is_none()); + assert!( + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder(&old_placeholder) + .is_none() + ); } #[test] @@ -3303,7 +3712,11 @@ mod tests { let resolver = state.resolver().expect("resolver"); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), Some("new-19") ); } @@ -3328,7 +3741,11 @@ mod tests { let resolver = state.resolver().expect("retained resolver"); assert_eq!( - resolver.resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), + resolver + .with_request_location(crate::secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) + .resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), None ); } diff --git a/crates/openshell-core/src/secrets.rs b/crates/openshell-core/src/secrets.rs index 2e51c9de28..235d04361c 100644 --- a/crates/openshell-core/src/secrets.rs +++ b/crates/openshell-core/src/secrets.rs @@ -114,9 +114,18 @@ pub struct UnresolvedPlaceholderError { enum UnresolvedPlaceholderReason { Unavailable, EndpointMismatch, + PlacementMismatch, } +pub const CREDENTIAL_PLACEMENT_MISMATCH: &str = + "credential is not authorized for the request location"; + impl UnresolvedPlaceholderError { + #[must_use] + pub fn is_placement_mismatch(&self) -> bool { + self.reason == UnresolvedPlaceholderReason::PlacementMismatch + } + #[must_use] pub fn unavailable(location: &'static str) -> Self { unresolved(location) @@ -136,6 +145,7 @@ impl fmt::Display for UnresolvedPlaceholderError { match self.reason { UnresolvedPlaceholderReason::Unavailable => "credential placeholder could not be resolved", + UnresolvedPlaceholderReason::PlacementMismatch => CREDENTIAL_PLACEMENT_MISMATCH, UnresolvedPlaceholderReason::EndpointMismatch => "credential is not authorized for the request endpoint", }, @@ -180,9 +190,30 @@ pub struct RewriteTargetResult { // SecretResolver // --------------------------------------------------------------------------- +/// Credential-specific destinations authorized by the provider profile. +#[derive(Debug, Clone, PartialEq, Eq)] +pub enum CredentialPlacement { + Header(String), + QueryParam(String), + PathTemplate(String), + SigningOnly, +} + +/// The actual destination of a workload-provided credential placeholder. +#[derive(Debug, Clone, PartialEq, Eq)] +pub enum RequestCredentialLocation { + Header(String), + QueryParam(String), + Path(String), + Body, + WebSocket, +} + #[derive(Clone, Default)] pub struct SecretResolver { by_placeholder: HashMap, + placements: HashMap, + request_location: Option, denied_env_keys: HashSet, identity_bound_env_keys: HashSet, revision_fallback_allowed_revisions: HashMap>>, @@ -292,6 +323,8 @@ impl SecretResolver { let resolver = |by_placeholder: HashMap| { (!by_placeholder.is_empty()).then_some(Self { by_placeholder, + placements: HashMap::new(), + request_location: None, denied_env_keys: HashSet::new(), identity_bound_env_keys: HashSet::new(), revision_fallback_allowed_revisions: HashMap::new(), @@ -347,6 +380,8 @@ impl SecretResolver { child_env, Some(Self { by_placeholder, + placements: HashMap::new(), + request_location: None, denied_env_keys: HashSet::new(), identity_bound_env_keys: HashSet::new(), revision_fallback_allowed_revisions: HashMap::new(), @@ -357,11 +392,13 @@ impl SecretResolver { pub fn merge<'a>(resolvers: impl IntoIterator) -> Option { let mut by_placeholder = HashMap::new(); + let mut placements = HashMap::new(); let mut denied_env_keys = HashSet::new(); let mut identity_bound_env_keys = HashSet::new(); let mut revision_fallback_allowed_revisions = HashMap::new(); for resolver in resolvers { by_placeholder.extend(resolver.by_placeholder.clone()); + placements.extend(resolver.placements.clone()); denied_env_keys.extend(resolver.denied_env_keys.iter().cloned()); identity_bound_env_keys.extend(resolver.identity_bound_env_keys.iter().cloned()); revision_fallback_allowed_revisions @@ -372,6 +409,8 @@ impl SecretResolver { } else { Some(Self { by_placeholder, + placements, + request_location: None, denied_env_keys, identity_bound_env_keys, revision_fallback_allowed_revisions, @@ -405,12 +444,85 @@ impl SecretResolver { .collect(); Self { by_placeholder, + placements: self.placements.clone(), + request_location: None, denied_env_keys, identity_bound_env_keys: bound_keys.clone(), revision_fallback_allowed_revisions, } } + /// Attach mandatory placement metadata to a resolver snapshot. + pub(crate) fn with_placements( + mut self, + placements: HashMap, + ) -> Self { + self.placements = placements; + self + } + + /// Select the actual structured request destination before resolving input. + #[must_use] + pub fn with_request_location(&self, location: RequestCredentialLocation) -> Self { + let mut scoped = self.clone(); + scoped.request_location = Some(location); + scoped + } + + fn placement_permits(&self, placeholder: &str) -> bool { + let Some(key) = placeholder_env_key(placeholder) else { + return true; + }; + let Some(placement) = self.placements.get(key) else { + return true; + }; + match (placement, self.request_location.as_ref()) { + ( + CredentialPlacement::Header(expected), + Some(RequestCredentialLocation::Header(actual)), + ) => expected.eq_ignore_ascii_case(actual), + ( + CredentialPlacement::QueryParam(expected), + Some(RequestCredentialLocation::QueryParam(actual)), + ) => expected == actual, + ( + CredentialPlacement::PathTemplate(expected), + Some(RequestCredentialLocation::Path(actual)), + ) => { + // Normalize only this credential's slot; all other path text must match. + let mut normalized = String::new(); + let mut pos = 0; + let mut slots = 0; + while pos < actual.len() { + let next_canonical = actual[pos..] + .find(PLACEHOLDER_PREFIX) + .map(|offset| pos + offset); + let next_alias = actual[pos..] + .find(PROVIDER_ALIAS_MARKER) + .map(|offset| alias_start_for_marker(actual, pos + offset)); + let next = [next_canonical, next_alias].into_iter().flatten().min(); + let Some(start) = next else { + normalized.push_str(&actual[pos..]); + break; + }; + normalized.push_str(&actual[pos..start]); + let Some((end, token)) = self.credential_token_at(actual, start) else { + return false; + }; + if placeholder_env_key(token) == Some(key) { + normalized.push_str("{credential}"); + slots += 1; + } else { + normalized.push_str(token); + } + pos = end; + } + slots == 1 && normalized == *expected + } + _ => false, + } + } + fn unresolved_for( &self, location: &'static str, @@ -420,6 +532,8 @@ impl SecretResolver { .is_some_and(|key| self.denied_env_keys.contains(key)) { UnresolvedPlaceholderReason::EndpointMismatch + } else if !self.placement_permits(placeholder) { + UnresolvedPlaceholderReason::PlacementMismatch } else { UnresolvedPlaceholderReason::Unavailable }; @@ -435,6 +549,9 @@ impl SecretResolver { // handle retains the original endpoint, epoch, and expiration constraints. let canonical_alias = alias_env_key(value).map(placeholder_for_env_key); let value = canonical_alias.as_deref().unwrap_or(value); + if !self.placement_permits(value) { + return None; + } if placeholder_env_key(value).is_some_and(|key| self.identity_bound_env_keys.contains(key)) && revisioned_placeholder_parts(value).is_none() && stable_placeholder_parts(value).is_none() @@ -487,6 +604,16 @@ impl SecretResolver { reason: UnresolvedPlaceholderReason::EndpointMismatch, }); } + if self + .placements + .get(key) + .is_some_and(|placement| !matches!(placement, CredentialPlacement::SigningOnly)) + { + return Err(UnresolvedPlaceholderError { + location, + reason: UnresolvedPlaceholderReason::PlacementMismatch, + }); + } let placeholder = placeholder_for_env_key(key); Ok(self .by_placeholder @@ -510,6 +637,9 @@ impl SecretResolver { reason: UnresolvedPlaceholderReason::EndpointMismatch, }); } + if !self.placement_permits(value) { + return Err(self.unresolved_for(location, value)); + } Ok(self.resolve_placeholder(value)) } @@ -519,6 +649,15 @@ impl SecretResolver { .map(|s| s.expires_at_ms) } + pub fn rewrite_header_value_for_name( + &self, + name: &str, + value: &str, + ) -> Result, UnresolvedPlaceholderError> { + self.with_request_location(RequestCredentialLocation::Header(name.to_string())) + .rewrite_header_value(value) + } + pub fn rewrite_header_value( &self, value: &str, @@ -562,6 +701,15 @@ impl SecretResolver { &self, text: &mut String, location: &'static str, + ) -> Result { + self.with_request_location(RequestCredentialLocation::Body) + .rewrite_text_placeholders_at_location(text, location) + } + + fn rewrite_text_placeholders_at_location( + &self, + text: &mut String, + location: &'static str, ) -> Result { if !contains_raw_reserved_marker(text) { return Ok(0); @@ -627,7 +775,8 @@ impl SecretResolver { &self, text: &mut String, ) -> Result { - self.rewrite_text_placeholders(text, "websocket") + self.with_request_location(RequestCredentialLocation::WebSocket) + .rewrite_text_placeholders_at_location(text, "websocket") } fn credential_token_at<'a>( @@ -677,7 +826,7 @@ impl SecretResolver { } let mut rewritten = decoded; - let replacements = self.rewrite_text_placeholders(&mut rewritten, "header")?; + let replacements = self.rewrite_text_placeholders_at_location(&mut rewritten, "header")?; if replacements == 0 { return Ok(None); @@ -1092,6 +1241,9 @@ fn rewrite_uri_path( path: &str, resolver: &SecretResolver, ) -> Result, UnresolvedPlaceholderError> { + let scoped = + resolver.with_request_location(RequestCredentialLocation::Path(percent_decode(path))); + let resolver = &scoped; let segments: Vec<&str> = path.split('/').collect(); let mut resolved_segments = Vec::with_capacity(segments.len()); let mut redacted_segments = Vec::with_capacity(segments.len()); @@ -1202,8 +1354,11 @@ fn rewrite_uri_query_params( let decoded_value = percent_decode(value); if contains_raw_reserved_marker(&decoded_value) { let mut rewritten = decoded_value.clone(); + let decoded_key = percent_decode(&key.replace('+', " ")); + let scoped = resolver + .with_request_location(RequestCredentialLocation::QueryParam(decoded_key)); let replacements = - resolver.rewrite_text_placeholders(&mut rewritten, "query_param")?; + scoped.rewrite_text_placeholders_at_location(&mut rewritten, "query_param")?; if replacements == 0 || contains_raw_reserved_marker(&rewritten) { return Err(unresolved("query_param")); } @@ -1326,10 +1481,12 @@ pub fn rewrite_header_line_checked( return Ok(line.to_string()); }; - resolver.rewrite_header_value(value.trim())?.map_or_else( - || Ok(line.to_string()), - |rewritten| Ok(format!("{name}: {rewritten}")), - ) + resolver + .rewrite_header_value_for_name(name, value.trim())? + .map_or_else( + || Ok(line.to_string()), + |rewritten| Ok(format!("{name}: {rewritten}")), + ) } /// Resolve placeholders in a request target (path + query) for OPA evaluation. @@ -1473,6 +1630,141 @@ mod tests { )); } + fn placement_resolver(placement: CredentialPlacement) -> SecretResolver { + let (_, resolver) = SecretResolver::from_provider_env_for_revision( + HashMap::from([("TOKEN".to_string(), "secret-value".to_string())]), + HashMap::new(), + 1, + ); + resolver + .unwrap() + .with_placements(HashMap::from([("TOKEN".to_string(), placement)])) + } + + #[test] + fn static_header_placement_cannot_be_overridden_by_request_location() { + let resolver = placement_resolver(CredentialPlacement::Header("Authorization".into())); + let token = "openshell:resolve:env:v1_TOKEN"; + assert_eq!( + resolver + .rewrite_header_value_for_name("aUtHoRiZaTiOn", &format!("token {token}")) + .unwrap(), + Some("token secret-value".into()) + ); + assert!( + resolver + .rewrite_header_value_for_name("X-Reflect", token) + .unwrap_err() + .is_placement_mismatch() + ); + assert!( + rewrite_target_for_eval(&format!("/search?q={token}"), &resolver) + .unwrap_err() + .is_placement_mismatch() + ); + assert!( + rewrite_target_for_eval(&format!("/bot{token}/events"), &resolver) + .unwrap_err() + .is_placement_mismatch() + ); + assert!( + resolver + .rewrite_text_placeholders(&mut token.to_string(), "body") + .unwrap_err() + .is_placement_mismatch() + ); + assert!( + resolver + .rewrite_websocket_text_placeholders(&mut token.to_string()) + .unwrap_err() + .is_placement_mismatch() + ); + assert!(resolver.resolve_placeholder(token).is_none()); + let basic = base64::engine::general_purpose::STANDARD.encode(format!("user:{token}")); + assert!( + resolver + .rewrite_header_value_for_name("Authorization", &format!("Basic {basic}")) + .unwrap() + .is_some() + ); + assert!( + resolver + .rewrite_header_value_for_name("X-Reflect", &format!("Basic {basic}")) + .unwrap_err() + .is_placement_mismatch() + ); + } + + #[test] + fn query_placement_checks_each_decoded_parameter_name() { + let resolver = placement_resolver(CredentialPlacement::QueryParam("api_key".into())); + let token = "openshell:resolve:env:v1_TOKEN"; + let valid = format!("/search?%61pi_key={token}"); + assert_eq!( + rewrite_target_for_eval(&valid, &resolver).unwrap().resolved, + "/search?%61pi_key=secret-value" + ); + for target in [ + format!("/search?other={token}"), + format!("/search?api_key={token}&other={token}"), + "/search?other=vendor-OPENSHELL-RESOLVE-ENV-v1_TOKEN".to_string(), + ] { + assert!( + rewrite_target_for_eval(&target, &resolver) + .unwrap_err() + .is_placement_mismatch() + ); + } + assert!( + rewrite_target_for_eval( + &format!("/search?api_key={token}&api_key={token}"), + &resolver + ) + .is_ok() + ); + } + + #[test] + fn path_placement_checks_exact_slot_and_literal_template() { + let resolver = placement_resolver(CredentialPlacement::PathTemplate( + "/bot{credential}/events".into(), + )); + let token = "openshell:resolve:env:v1_TOKEN"; + assert_eq!( + rewrite_target_for_eval(&format!("/bot{token}/events"), &resolver) + .unwrap() + .resolved, + "/botsecret-value/events" + ); + assert!( + rewrite_target_for_eval(&format!("/bot{token}/echo"), &resolver) + .unwrap_err() + .is_placement_mismatch() + ); + assert!( + rewrite_target_for_eval(&format!("/echo/{token}/events"), &resolver) + .unwrap_err() + .is_placement_mismatch() + ); + assert!( + rewrite_target_for_eval( + &format!("/bot{}/events", fully_percent_encoded(token)), + &resolver + ) + .is_ok() + ); + let alias_resolver = placement_resolver(CredentialPlacement::PathTemplate( + "/{credential}/events".into(), + )); + assert!( + rewrite_target_for_eval( + "/vendor-OPENSHELL-RESOLVE-ENV-v1_TOKEN/events", + &alias_resolver + ) + .is_ok() + ); + } + fn fully_percent_encoded(marker: &str) -> String { const HEX: &[u8; 16] = b"0123456789ABCDEF"; let mut encoded = String::with_capacity(marker.len() * 3); diff --git a/crates/openshell-core/src/secrets_body.rs b/crates/openshell-core/src/secrets_body.rs index c9464f8e50..27e2e3fc94 100644 --- a/crates/openshell-core/src/secrets_body.rs +++ b/crates/openshell-core/src/secrets_body.rs @@ -352,6 +352,13 @@ mod tests { HashMap::from([( "KEY".into(), StaticCredentialBinding { + placement: Some(crate::proto::StaticCredentialPlacement { + location: Some( + crate::proto::static_credential_placement::Location::HeaderName( + "Authorization".into(), + ), + ), + }), credential_identity: "provider".into(), workload_credential_handle: handle, endpoints: vec![StaticCredentialEndpointBinding { diff --git a/crates/openshell-providers/src/profiles.rs b/crates/openshell-providers/src/profiles.rs index e289d4b80d..fa8ad7ef62 100644 --- a/crates/openshell-providers/src/profiles.rs +++ b/crates/openshell-providers/src/profiles.rs @@ -3936,6 +3936,13 @@ credentials: use openshell_core::provider_credentials::ProviderCredentialState; use openshell_core::secrets::body::BodyPlaceholderGuard; let binding = |profile: &ProviderTypeProfile| StaticCredentialBinding { + placement: Some(openshell_core::proto::StaticCredentialPlacement { + location: Some( + openshell_core::proto::static_credential_placement::Location::HeaderName( + profile.credentials[0].header_name.clone(), + ), + ), + }), credential_identity: profile.id.clone(), workload_credential_handle: String::new(), endpoints: profile diff --git a/crates/openshell-server/README.md b/crates/openshell-server/README.md index 58f735c35c..68b661ab05 100644 --- a/crates/openshell-server/README.md +++ b/crates/openshell-server/README.md @@ -18,6 +18,18 @@ Retries reuse that generation and session, including after gateway restart. Credential renewal retains both; credentials for an older launch cannot authorize the new one. +## Static credential delivery + +Provider environment entries carry placement from the owning credential's +profile declaration. The gateway withholds individual entries without usable +placement and reports `CredentialsWithheld`. Placement participates in both +ordinary credential identity and stable handle derivation, so changing it +revokes incompatible retained workload references. + +Polling supervisors must advertise placement enforcement before receiving static +material. Configuration push requires the same capability for the entire session; +older supervisors fall back to polling and its credential withholding checks. + ## Operator credential export `GetProviderCredentials` exports selected profile-declared runtime environment diff --git a/crates/openshell-server/src/config_delivery/mod.rs b/crates/openshell-server/src/config_delivery/mod.rs index dbf5fe86d5..cf5cc929c0 100644 --- a/crates/openshell-server/src/config_delivery/mod.rs +++ b/crates/openshell-server/src/config_delivery/mod.rs @@ -1735,24 +1735,34 @@ mod tests { #[tokio::test] async fn legacy_supervisor_keeps_polling_when_gateway_push_is_enabled() { - let state = push_state().await; - put_sandbox(&state, "legacy-sandbox", &[]).await; - let mut harness = - connect_supervisor_stream(&state, "legacy-sandbox", StreamFeatures::Legacy) + for features in [ + StreamFeatures::Legacy, + StreamFeatures::ApplyWithoutPlacement, + ] { + let state = push_state().await; + put_provider(&state, "github").await; + put_sandbox(&state, "legacy-sandbox", &["github"]).await; + let mut harness = connect_supervisor_stream(&state, "legacy-sandbox", features) .await .unwrap(); - let first = harness.inbound.message().await.unwrap().unwrap(); - let Some(gateway_message::Payload::SessionAccepted(accepted)) = first.payload else { - panic!("expected SessionAccepted"); - }; - assert!(accepted.bootstrap.is_none()); - publish_sandbox(&state, "legacy-sandbox"); - publish_all_connected(&state); - assert!( - next_update(&mut harness, Duration::from_millis(100)) - .await - .is_none() - ); + let first = harness.inbound.message().await.unwrap().unwrap(); + let Some(gateway_message::Payload::SessionAccepted(accepted)) = first.payload else { + panic!("expected SessionAccepted"); + }; + assert!(!accepted.config_push_enabled); + assert!(accepted.bootstrap.is_none()); + assert!(!has_recipient(&state, "legacy-sandbox")); + // Rotating protected material must not deliver it later on this stream. + put_provider_with_token(&state, "github", Some("synthetic-rotated")).await; + publish_provider(&state, "default", "github"); + publish_sandbox(&state, "legacy-sandbox"); + publish_all_connected(&state); + assert!( + next_update(&mut harness, Duration::from_millis(100)) + .await + .is_none() + ); + } } #[tokio::test] diff --git a/crates/openshell-server/src/grpc/mod.rs b/crates/openshell-server/src/grpc/mod.rs index 0368025348..4e22a42c7b 100644 --- a/crates/openshell-server/src/grpc/mod.rs +++ b/crates/openshell-server/src/grpc/mod.rs @@ -1021,6 +1021,8 @@ pub mod test_support { pub enum StreamFeatures { /// Predates streamed configuration and keeps polling. Legacy, + /// Supports config push but predates static credential placement. + ApplyWithoutPlacement, /// Applies and acknowledges streamed configuration. Apply, } @@ -1084,7 +1086,8 @@ pub mod test_support { payload: Some(supervisor_message::Payload::Hello(SupervisorHello { sandbox_id: sandbox_id.into(), instance_id: "instance".into(), - supports_config_push: features == StreamFeatures::Apply, + supports_config_push: features != StreamFeatures::Legacy, + supports_static_credential_placement: features == StreamFeatures::Apply, connection_epoch, supports_provider_readiness: false, redirected: false, diff --git a/crates/openshell-server/src/grpc/policy.rs b/crates/openshell-server/src/grpc/policy.rs index 374a3b5759..e2ea82822a 100644 --- a/crates/openshell-server/src/grpc/policy.rs +++ b/crates/openshell-server/src/grpc/policy.rs @@ -3804,7 +3804,8 @@ pub(super) async fn handle_get_sandbox_provider_environment( request: Request, ) -> Result, Status> { let sandbox_id = request.get_ref().sandbox_id.clone(); - let supports_static_credential_bindings = request.get_ref().supports_static_credential_bindings; + let supports_static_credential_bindings = request.get_ref().supports_static_credential_bindings + && request.get_ref().supports_static_credential_placement; let supports_stable_placeholder_environment_keys = request .get_ref() .supports_stable_placeholder_environment_keys; @@ -12173,6 +12174,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-snapshot-consistency".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14017,6 +14019,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-provider-env".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14030,6 +14033,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-provider-env".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14103,6 +14107,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-files-and-credentials".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: false, })), ) @@ -14151,6 +14156,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-static-ready".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: false, })), ) @@ -14205,24 +14211,29 @@ mod tests { .await .unwrap(); - let response = handle_get_sandbox_provider_environment( - &state, - with_user(Request::new(GetSandboxProviderEnvironmentRequest { - sandbox_id: "sb-legacy-provider-env".to_string(), - supports_static_credential_bindings: false, - supports_stable_placeholder_environment_keys: false, - })), - ) - .await - .unwrap() - .into_inner(); + for (supports_bindings, supports_placement) in + [(false, false), (true, false), (false, true)] + { + let response = handle_get_sandbox_provider_environment( + &state, + with_user(Request::new(GetSandboxProviderEnvironmentRequest { + sandbox_id: "sb-legacy-provider-env".to_string(), + supports_static_credential_bindings: supports_bindings, + supports_static_credential_placement: supports_placement, + supports_stable_placeholder_environment_keys: false, + })), + ) + .await + .unwrap() + .into_inner(); - assert!(!response.environment.contains_key("GITHUB_TOKEN")); - assert!(response.static_credential_bindings.is_empty()); - assert_eq!( - response.readiness_reason, - ProviderReadinessReason::UnsupportedSupervisor as i32 - ); + assert!(!response.environment.contains_key("GITHUB_TOKEN")); + assert!(response.static_credential_bindings.is_empty()); + assert_eq!( + response.readiness_reason, + ProviderReadinessReason::UnsupportedSupervisor as i32 + ); + } } #[tokio::test] @@ -14255,6 +14266,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-unbound-provider-env".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14308,6 +14320,8 @@ mod tests { credentials: vec![openshell_core::proto::ProviderProfileCredential { name: "cloud_token".to_string(), env_vars: vec!["CLOUD_TOKEN".to_string()], + auth_style: "bearer".to_string(), + header_name: "authorization".to_string(), stable_placeholder: true, ..Default::default() }], @@ -14370,6 +14384,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-policy-binding".to_string(), supports_static_credential_bindings: supports_bindings, + supports_static_credential_placement: supports_bindings, supports_stable_placeholder_environment_keys: supports_stable, })), ) @@ -14414,6 +14429,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-policy-binding".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14492,6 +14508,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-policy-binding".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14558,6 +14575,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-policy-binding".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14655,6 +14673,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-mixed-provider-env".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14764,6 +14783,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-token-exchange-subject".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14832,6 +14852,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-provider-revision".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14872,6 +14893,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-provider-revision".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -15191,7 +15213,7 @@ mod tests { .static_credential_bindings .get("GITHUB_TOKEN") .map(|binding| binding.credential_identity.as_str()), - Some("provider-identity-a:GITHUB_TOKEN") + Some("provider-identity-a:GITHUB_TOKEN:0a0d617574686f72697a6174696f6e") ); assert_eq!(first_environment.dynamic_credentials.len(), 1); assert!( @@ -15233,7 +15255,7 @@ mod tests { .static_credential_bindings .get("GITHUB_TOKEN") .map(|binding| binding.credential_identity.as_str()), - Some("provider-identity-b:GITHUB_TOKEN") + Some("provider-identity-b:GITHUB_TOKEN:0a0d617574686f72697a6174696f6e") ); assert_eq!(replacement_environment.dynamic_credentials.len(), 1); assert!( @@ -15495,6 +15517,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-attach-lifecycle".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -15529,6 +15552,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-attach-lifecycle".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -15571,6 +15595,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-attach-lifecycle".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -15676,6 +15701,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-attach-lifecycle".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -15713,6 +15739,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-attach-lifecycle".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -15754,6 +15781,7 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-attach-lifecycle".to_string(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -25492,6 +25520,7 @@ mod tests { non_member_request(GetSandboxProviderEnvironmentRequest { sandbox_id: "sandbox-other".into(), supports_static_credential_bindings: true, + supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, }), ) diff --git a/crates/openshell-server/src/grpc/policy/endpoint_status_tests.rs b/crates/openshell-server/src/grpc/policy/endpoint_status_tests.rs index eb36132fa2..b4b76e0543 100644 --- a/crates/openshell-server/src/grpc/policy/endpoint_status_tests.rs +++ b/crates/openshell-server/src/grpc/policy/endpoint_status_tests.rs @@ -1947,6 +1947,7 @@ async fn replacement_reset_timeout_invalidates_superseded_evidence() { redirected: false, supports_session_redirect: false, supports_config_push: false, + supports_static_credential_placement: false, })), }; let error = gateway_client(Arc::clone(&state)) @@ -2021,6 +2022,7 @@ async fn replacement_reset_retry_does_not_hold_gateway_shutdown() { redirected: false, supports_session_redirect: false, supports_config_push: false, + supports_static_credential_placement: false, })), }; let error = gateway_client(Arc::clone(&state)) diff --git a/crates/openshell-server/src/grpc/provider.rs b/crates/openshell-server/src/grpc/provider.rs index b77b9ed45b..14d12d8e82 100644 --- a/crates/openshell-server/src/grpc/provider.rs +++ b/crates/openshell-server/src/grpc/provider.rs @@ -27,7 +27,7 @@ use openshell_core::proto::{ CredentialHandle, Provider, ProviderCredentialRefreshStrategy, ProviderCredentialTokenGrantAudienceOverride, ProviderCredentialTokenGrantType, ProviderProfile, ProviderProfileCredential, Sandbox, StaticCredentialBinding, - StaticCredentialEndpointBinding, + StaticCredentialEndpointBinding, StaticCredentialPlacement, static_credential_placement, }; use openshell_core::telemetry::{ LifecycleOperation, ProviderProfile as TelemetryProviderProfile, TelemetryOutcome, @@ -44,6 +44,7 @@ use super::{MAX_MAP_KEY_LEN, MAX_MAP_VALUE_LEN, MAX_PROVIDER_CONFIG_ENTRIES}; const GATEWAY_SPIFFE_WORKLOAD_API_SOCKET: &str = "OPENSHELL_GATEWAY_SPIFFE_WORKLOAD_API_SOCKET"; const EXTERNAL_STABLE_PLACEHOLDER_EPOCH: &str = "external-stable-placeholder-v1"; +const CREDENTIAL_PATH_SLOT: &str = "{credential}"; // --------------------------------------------------------------------------- // CRUD helpers @@ -1264,6 +1265,10 @@ pub(super) async fn resolve_provider_environment_from_records_with_policy_bindin }; let has_no_usable_endpoint = effective_endpoints.is_some_and(Vec::is_empty); let refresh_epochs = refresh_authorization_epochs_by_key(record)?; + let placements = profile + .as_ref() + .map(static_credential_placements) + .unwrap_or_default(); for (key, value) in &provider.credentials { if accepted_stored_credential_keys @@ -1304,6 +1309,13 @@ pub(super) async fn resolve_provider_environment_from_records_with_policy_bindin openshell_core::proto::ProviderReadinessReason::CredentialsWithheld; continue; } + let Some(placement) = placements.get(key) else { + warn!(provider_name = %name, key = %key, + "withholding credential: declare auth_style and its request location in the provider profile"); + readiness_reason = + openshell_core::proto::ProviderReadinessReason::CredentialsWithheld; + continue; + }; let expires_at_ms = provider .credential_expiration_times .get(key) @@ -1340,6 +1352,7 @@ pub(super) async fn resolve_provider_environment_from_records_with_policy_bindin record, key, endpoints, + placement, refresh_epochs.get(key).map(String::as_str), profile_stable_placeholder_keys.contains(key), ), @@ -1401,6 +1414,13 @@ pub(super) async fn resolve_provider_environment_from_records_with_policy_bindin openshell_core::proto::ProviderReadinessReason::CredentialsWithheld; continue; } + let Some(placement) = placements.get(&key) else { + warn!(provider_name = %name, key = %key, + "withholding credential: declare auth_style and its request location in the provider profile"); + readiness_reason = + openshell_core::proto::ProviderReadinessReason::CredentialsWithheld; + continue; + }; if let Some(expires_at_ms) = resolved_refs.expires_at_ms.get(&key).copied() { expires.entry(key.clone()).or_insert(expires_at_ms); } @@ -1419,6 +1439,7 @@ pub(super) async fn resolve_provider_environment_from_records_with_policy_bindin record, &key, endpoints, + placement, refresh_epochs.get(&key).map(String::as_str), profile_stable_placeholder_keys.contains(&key), ), @@ -1565,11 +1586,92 @@ fn refresh_authorization_epochs_by_key( Ok(epochs) } +/// Resolve only profile-declared request locations. Empty metadata never grants +/// permission to use an arbitrary HTTP location. AWS signing uses only the +/// canonical signer keys and an authoritative signing/STS declaration. +fn static_credential_placements( + profile: &ProviderTypeProfile, +) -> HashMap { + use static_credential_placement::Location; + let uses_signer = profile.endpoints.iter().any(|endpoint| { + matches!( + endpoint.credential_signing.as_str(), + "sigv4" | "sigv4:body" | "sigv4:no_body" + ) + }) || profile.credentials.iter().any(|credential| { + credential.refresh.as_ref().is_some_and(|refresh| { + refresh.strategy == ProviderCredentialRefreshStrategy::AwsStsAssumeRole + }) + }); + let mut placements = HashMap::new(); + for credential in &profile.credentials { + let location = match credential.auth_style.trim().to_ascii_lowercase().as_str() { + "basic" => Some(Location::HeaderName("authorization".into())), + "header" | "bearer" + if credential + .header_name + .trim() + .parse::() + .is_ok() => + { + Some(Location::HeaderName( + credential.header_name.trim().to_ascii_lowercase(), + )) + } + "query" + if !credential.query_param.trim().is_empty() + && !credential + .query_param + .chars() + .any(|c| c.is_control() || "&=#?".contains(c)) => + { + Some(Location::QueryParam(credential.query_param.trim().into())) + } + "path" + if credential.path_template.starts_with('/') + && credential + .path_template + .matches(CREDENTIAL_PATH_SLOT) + .count() + == 1 + && !credential + .path_template + .chars() + .any(|c| c.is_control() || "?#".contains(c)) => + { + Some(Location::PathTemplate(credential.path_template.clone())) + } + _ => None, + }; + for key in credential.accepted_stored_keys() { + let location = location.clone().or_else(|| { + (uses_signer + && credential.auth_style.trim().is_empty() + && matches!( + key, + "AWS_ACCESS_KEY_ID" | "AWS_SECRET_ACCESS_KEY" | "AWS_SESSION_TOKEN" + )) + .then_some(Location::SigningOnly(true)) + }); + if let Some(location) = location { + placements.insert( + key.to_string(), + StaticCredentialPlacement { + location: Some(location), + }, + ); + } + } + } + placements +} + fn static_credential_binding( sandbox_id: Option<&str>, record: &ProviderEnvironmentRecord, key: &str, endpoints: &[StaticCredentialEndpointBinding], + placement: &StaticCredentialPlacement, authorization_epoch: Option<&str>, stable_external_placeholder: bool, ) -> StaticCredentialBinding { @@ -1581,11 +1683,22 @@ fn static_credential_binding( let workload_credential_handle = sandbox_id .zip(handle_epoch) .map(|(sandbox_id, epoch)| { - derive_workload_credential_handle(sandbox_id, &record.object_id, key, epoch, endpoints) + derive_workload_credential_handle( + sandbox_id, + &record.object_id, + key, + epoch, + endpoints, + placement, + ) }) .unwrap_or_default(); let credential_identity = if workload_credential_handle.is_empty() { - format!("{}:{key}", record.object_id) + format!( + "{}:{key}:{}", + record.object_id, + hex::encode(placement.encode_to_vec()) + ) } else { format!("refresh:{workload_credential_handle}") }; @@ -1593,6 +1706,7 @@ fn static_credential_binding( endpoints: endpoints.to_vec(), credential_identity, workload_credential_handle, + placement: Some(placement.clone()), } } @@ -1602,6 +1716,7 @@ fn derive_workload_credential_handle( credential_key: &str, authorization_epoch: &str, endpoints: &[StaticCredentialEndpointBinding], + placement: &StaticCredentialPlacement, ) -> String { let mut endpoints = endpoints .iter() @@ -1627,6 +1742,7 @@ fn derive_workload_credential_handle( hash_handle_component(&mut hasher, provider_id.as_bytes()); hash_handle_component(&mut hasher, credential_key.as_bytes()); hash_handle_component(&mut hasher, authorization_epoch.as_bytes()); + hash_handle_component(&mut hasher, &placement.encode_to_vec()); for (host, port, path) in endpoints { hash_handle_component(&mut hasher, host.as_bytes()); hash_handle_component(&mut hasher, &port.to_le_bytes()); @@ -10918,10 +11034,19 @@ mod tests { ) .await .unwrap(); - assert_eq!(result.get("API_TOKEN"), Some(&"rotated-token".to_string())); + assert!(!result.contains_key("API_TOKEN")); + assert!(!result.contains_key("SECONDARY")); assert_eq!( - result.get("SECONDARY"), - Some(&"secondary-token".to_string()) + result.readiness_reason, + openshell_core::proto::ProviderReadinessReason::CredentialsWithheld + ); + let resolved = credentials + .resolve_provider_handles(&stored, crate::persistence::current_time_ms()) + .await + .unwrap(); + assert_eq!( + resolved.values.get("API_TOKEN").map(String::as_str), + Some("rotated-token") ); } @@ -12164,6 +12289,209 @@ mod tests { ); } + #[tokio::test] + async fn missing_placement_withholds_only_the_affected_credential() { + let store = test_store().await; + let mut profile = custom_profile("partial-placement"); + profile.credentials = vec![ + ProviderProfileCredential { + name: "configured".into(), + env_vars: vec!["CONFIGURED".into()], + auth_style: "header".into(), + header_name: "x-api-key".into(), + ..Default::default() + }, + ProviderProfileCredential { + name: "unconfigured".into(), + env_vars: vec!["UNCONFIGURED".into()], + ..Default::default() + }, + ]; + profile.endpoints = vec![NetworkEndpoint { + host: "api.example.com".into(), + port: 443, + protocol: "rest".into(), + access: openshell_core::proto::NetworkAccessPreset::Full as i32, + ..Default::default() + }]; + let sources = ProviderProfileSources::from_test_profiles(vec![profile]); + let catalog = sources.snapshot_catalog(&store, "default").await.unwrap(); + let mut provider = provider_with_credential_value( + "partial", + "partial-placement", + "CONFIGURED", + "synthetic-a", + ); + provider + .credentials + .insert("UNCONFIGURED".into(), "synthetic-b".into()); + create_provider_record_with_catalog(&store, &catalog, "default", provider) + .await + .unwrap(); + let records = load_provider_environment_records(&store, "default", &["partial".into()]) + .await + .unwrap(); + let result = resolve_provider_environment_from_records_with_policy_bindings( + &catalog, + &records, + &HashMap::new(), + ) + .await + .unwrap(); + assert_eq!( + result.get("CONFIGURED").map(String::as_str), + Some("synthetic-a") + ); + assert!(result.static_credential_bindings.contains_key("CONFIGURED")); + assert!(!result.contains_key("UNCONFIGURED")); + assert!(!result.static_credential_keys.contains("UNCONFIGURED")); + assert!( + !result + .static_credential_bindings + .contains_key("UNCONFIGURED") + ); + assert_eq!( + result.readiness_reason, + openshell_core::proto::ProviderReadinessReason::CredentialsWithheld + ); + } + + #[test] + fn static_placement_uses_explicit_locations_and_canonical_signer_roles() { + use static_credential_placement::Location; + let mut profile = custom_profile("placements"); + profile.credentials = [ + ("HEADER", "header", "X-Api-Key", "", ""), + ("BASIC", "basic", "", "", ""), + ("QUERY", "query", "", "access_token", ""), + ("PATH", "path", "", "", "/v1/{credential}/events"), + ("MISSING", "", "", "", ""), + ("UNKNOWN", "future", "", "", ""), + ("AWS_ACCESS_KEY_ID", "", "", "", ""), + ("AWS_SECRET_ACCESS_KEY", "", "", "", ""), + ("UNRELATED", "", "", "", ""), + ] + .into_iter() + .map( + |(key, style, header, query, path)| ProviderProfileCredential { + name: key.to_ascii_lowercase(), + env_vars: vec![key.into()], + auth_style: style.into(), + header_name: header.into(), + query_param: query.into(), + path_template: path.into(), + ..Default::default() + }, + ) + .collect(); + profile.credentials.push(ProviderProfileCredential { + name: "LOGICAL_KEY".into(), + auth_style: "header".into(), + header_name: "x-logical".into(), + ..Default::default() + }); + let locations = static_credential_placements(&ProviderTypeProfile::from_proto(&profile)); + assert_eq!( + locations["LOGICAL_KEY"].location, + Some(Location::HeaderName("x-logical".into())) + ); + assert_eq!( + locations["HEADER"].location, + Some(Location::HeaderName("x-api-key".into())) + ); + assert_eq!( + locations["BASIC"].location, + Some(Location::HeaderName("authorization".into())) + ); + assert_eq!( + locations["QUERY"].location, + Some(Location::QueryParam("access_token".into())) + ); + assert_eq!( + locations["PATH"].location, + Some(Location::PathTemplate("/v1/{credential}/events".into())) + ); + for key in ["MISSING", "UNKNOWN", "AWS_ACCESS_KEY_ID", "UNRELATED"] { + assert!(!locations.contains_key(key)); + } + profile.endpoints = vec![NetworkEndpoint { + host: "s3.amazonaws.com".into(), + credential_signing: "sigv4".into(), + ..Default::default() + }]; + for signing in ["sigv4", "sigv4:body", "sigv4:no_body"] { + profile.endpoints[0].credential_signing = signing.into(); + let signed = static_credential_placements(&ProviderTypeProfile::from_proto(&profile)); + assert_eq!( + signed["AWS_ACCESS_KEY_ID"].location, + Some(Location::SigningOnly(true)) + ); + assert_eq!( + signed["AWS_SECRET_ACCESS_KEY"].location, + Some(Location::SigningOnly(true)) + ); + assert!(!signed.contains_key("UNRELATED")); + assert!(!signed.contains_key("MISSING")); + } + } + + #[test] + fn changing_placement_revokes_workload_handles_and_credential_identity() { + let record = ProviderEnvironmentRecord { + name: "provider".into(), + object_id: "provider-a".into(), + resource_version: 1, + provider: Provider::default(), + refresh_states: Vec::new(), + }; + let endpoints = vec![StaticCredentialEndpointBinding { + host: "api.example.com".into(), + port: 443, + path: "/**".into(), + }]; + let header = authorization_placement(); + let query = StaticCredentialPlacement { + location: Some(static_credential_placement::Location::QueryParam( + "api_key".into(), + )), + }; + for stable in [false, true] { + let old = static_credential_binding( + Some("sandbox"), + &record, + "KEY", + &endpoints, + &header, + None, + stable, + ); + let new = static_credential_binding( + Some("sandbox"), + &record, + "KEY", + &endpoints, + &query, + None, + stable, + ); + assert_ne!(old.credential_identity, new.credential_identity); + if stable { + assert_ne!( + old.workload_credential_handle, + new.workload_credential_handle + ); + } + } + } + + fn authorization_placement() -> StaticCredentialPlacement { + StaticCredentialPlacement { + location: Some(static_credential_placement::Location::HeaderName( + "authorization".into(), + )), + } + } + #[test] fn external_stable_placeholder_binding_preserves_only_value_changes() { let mut record = ProviderEnvironmentRecord { @@ -12180,7 +12508,15 @@ mod tests { }]; let external_binding = |sandbox, record: &ProviderEnvironmentRecord, key, endpoints: &[_]| { - static_credential_binding(Some(sandbox), record, key, endpoints, None, true) + static_credential_binding( + Some(sandbox), + record, + key, + endpoints, + &authorization_placement(), + None, + true, + ) }; let initial = external_binding("sandbox-a", &record, "API_KEY", &endpoints); assert!(!initial.workload_credential_handle.is_empty()); @@ -12217,9 +12553,17 @@ mod tests { "recreating the same provider name must revoke the original handle" ); assert!( - static_credential_binding(None, &record, "API_KEY", &endpoints, None, true) - .workload_credential_handle - .is_empty(), + static_credential_binding( + None, + &record, + "API_KEY", + &endpoints, + &authorization_placement(), + None, + true + ) + .workload_credential_handle + .is_empty(), "an external handle requires an authenticated sandbox binding" ); } @@ -12246,6 +12590,7 @@ mod tests { "ACCESS_TOKEN", "epoch-a", &endpoints, + &authorization_placement(), ); assert_eq!( first, @@ -12255,6 +12600,7 @@ mod tests { "ACCESS_TOKEN", "epoch-a", &reordered, + &authorization_placement(), ) ); for changed in [ @@ -12264,6 +12610,7 @@ mod tests { "ACCESS_TOKEN", "epoch-a", &endpoints, + &authorization_placement(), ), derive_workload_credential_handle( "sandbox-a", @@ -12271,6 +12618,7 @@ mod tests { "ACCESS_TOKEN", "epoch-a", &endpoints, + &authorization_placement(), ), derive_workload_credential_handle( "sandbox-a", @@ -12278,6 +12626,7 @@ mod tests { "OTHER_TOKEN", "epoch-a", &endpoints, + &authorization_placement(), ), derive_workload_credential_handle( "sandbox-a", @@ -12285,6 +12634,7 @@ mod tests { "ACCESS_TOKEN", "epoch-b", &endpoints, + &authorization_placement(), ), derive_workload_credential_handle( "sandbox-a", @@ -12296,6 +12646,7 @@ mod tests { port: 443, path: "/v2/**".to_string(), }], + &authorization_placement(), ), ] { assert_ne!(first, changed); @@ -12480,6 +12831,9 @@ mod tests { credential_state .resolver_for_endpoint("api.example.com", 443, "/v1/messages") .unwrap() + .with_request_location(openshell_core::secrets::RequestCredentialLocation::Header( + "authorization".into() + )) .resolve_placeholder(&original_placeholder), Some("token-1") ); @@ -12535,6 +12889,9 @@ mod tests { credential_state .resolver_for_endpoint("api.example.com", 443, "/v1/messages") .unwrap() + .with_request_location(openshell_core::secrets::RequestCredentialLocation::Header( + "authorization".into() + )) .resolve_placeholder(&original_placeholder), Some("token-2") ); @@ -12552,6 +12909,9 @@ mod tests { reconstructed .resolver_for_endpoint("api.example.com", 443, "/v1/messages") .unwrap() + .with_request_location(openshell_core::secrets::RequestCredentialLocation::Header( + "authorization".into() + )) .resolve_placeholder(&original_placeholder), Some("token-2") ); @@ -12598,6 +12958,9 @@ mod tests { credential_state .resolver_for_endpoint("api.example.com", 443, "/v1/messages") .unwrap() + .with_request_location(openshell_core::secrets::RequestCredentialLocation::Header( + "authorization".into() + )) .resolve_placeholder(&original_placeholder), None ); @@ -13051,7 +13414,7 @@ mod tests { } #[tokio::test] - async fn resolve_provider_env_allows_static_provider_without_profile() { + async fn resolve_provider_env_withholds_static_provider_without_profile() { let store = test_store().await; create_provider_record( &store, @@ -13066,7 +13429,12 @@ mod tests { .await .unwrap(); - assert_eq!(result.get("API_TOKEN"), Some(&"token-123".to_string())); + assert!(!result.contains_key("API_TOKEN")); + assert!(!result.contains_key("SECONDARY")); + assert_eq!( + result.readiness_reason, + openshell_core::proto::ProviderReadinessReason::CredentialsWithheld + ); assert!(result.dynamic_credentials.is_empty()); assert!(!result.static_credential_bindings.contains_key("API_TOKEN")); } @@ -13201,9 +13569,37 @@ mod tests { assert!(result.expired_static_keys.contains("GITHUB_TOKEN")); } + async fn store_static_test_profile(store: &Store, keys: &[&str]) { + let mut profile = custom_profile("test"); + profile.credentials = keys + .iter() + .map(|key| static_credential(&key.to_ascii_lowercase(), key, false)) + .collect(); + profile.endpoints = vec![NetworkEndpoint { + host: "api.example.com".into(), + port: 443, + protocol: "rest".into(), + access: openshell_core::proto::NetworkAccessPreset::Full as i32, + ..Default::default() + }]; + store + .put_message(&StoredProviderProfile { + metadata: Some(openshell_core::proto::datamodel::v1::ObjectMeta { + id: "test-profile".into(), + name: "test".into(), + workspace: "default".into(), + ..Default::default() + }), + profile: Some(profile), + }) + .await + .unwrap(); + } + #[tokio::test] async fn resolve_provider_env_skips_expired_credentials_and_returns_expiry_metadata() { let store = test_store().await; + store_static_test_profile(&store, &["FRESH_TOKEN", "STALE_TOKEN", "EPOCH_TOKEN"]).await; let now_ms = crate::persistence::current_time_ms(); let provider = Provider { metadata: Some(openshell_core::proto::datamodel::v1::ObjectMeta { @@ -13269,6 +13665,7 @@ mod tests { #[tokio::test] async fn resolve_provider_env_skips_invalid_credential_keys() { let store = test_store().await; + store_static_test_profile(&store, &["VALID_KEY"]).await; let provider = Provider { metadata: Some(openshell_core::proto::datamodel::v1::ObjectMeta { id: String::new(), @@ -13323,7 +13720,7 @@ mod tests { workspace: "default".to_string(), deletion_time: None, }), - r#type: "claude".to_string(), + r#type: "anthropic".to_string(), credentials: std::iter::once(( "ANTHROPIC_API_KEY".to_string(), "sk-abc".to_string(), @@ -13343,7 +13740,7 @@ mod tests { Provider { metadata: Some(openshell_core::proto::datamodel::v1::ObjectMeta { id: String::new(), - name: "gitlab-local".to_string(), + name: "github-local".to_string(), created_time: None, labels: HashMap::new(), resource_version: 0, @@ -13351,9 +13748,12 @@ mod tests { workspace: "default".to_string(), deletion_time: None, }), - r#type: "gitlab".to_string(), - credentials: std::iter::once(("GITLAB_TOKEN".to_string(), "glpat-xyz".to_string())) - .collect(), + r#type: "github".to_string(), + credentials: std::iter::once(( + "GITHUB_TOKEN".to_string(), + "synthetic-github-token".to_string(), + )) + .collect(), config: HashMap::new(), credential_expiration_times: HashMap::new(), profile_workspace: "default".to_string(), @@ -13366,12 +13766,15 @@ mod tests { let result = resolve_provider_environment( &store, "default", - &["claude-local".to_string(), "gitlab-local".to_string()], + &["claude-local".to_string(), "github-local".to_string()], ) .await .unwrap(); assert_eq!(result.get("ANTHROPIC_API_KEY"), Some(&"sk-abc".to_string())); - assert_eq!(result.get("GITLAB_TOKEN"), Some(&"glpat-xyz".to_string())); + assert_eq!( + result.get("GITHUB_TOKEN"), + Some(&"synthetic-github-token".to_string()) + ); } #[tokio::test] @@ -14125,7 +14528,7 @@ mod tests { workspace: "default".to_string(), deletion_time: None, }), - r#type: "claude".to_string(), + r#type: "anthropic".to_string(), credentials: std::iter::once(( "ANTHROPIC_API_KEY".to_string(), "sk-test".to_string(), diff --git a/crates/openshell-server/src/grpc/provider_readiness_tests.rs b/crates/openshell-server/src/grpc/provider_readiness_tests.rs index c046b320dd..060103b943 100644 --- a/crates/openshell-server/src/grpc/provider_readiness_tests.rs +++ b/crates/openshell-server/src/grpc/provider_readiness_tests.rs @@ -73,6 +73,7 @@ fn hello() -> SupervisorHello { connection_epoch: 0, supports_provider_readiness: true, supports_config_push: false, + supports_static_credential_placement: false, redirected: false, supports_session_redirect: true, } diff --git a/crates/openshell-server/src/storage_proto.rs b/crates/openshell-server/src/storage_proto.rs index 3b902df1f9..86c79701f2 100644 --- a/crates/openshell-server/src/storage_proto.rs +++ b/crates/openshell-server/src/storage_proto.rs @@ -156,8 +156,10 @@ mod tests { // Sandbox-wide grant reporting adds TokenGrantFailureObservation to both // closures and TokenGrantStatus to public reports. Older rows have no grant // record; absent report extensions retain compatibility without a rewrite. + // Static credential placement adds one public-only message and negotiated + // capabilities. Durable provider schemas and their closure are unchanged. const PUBLIC_RPC_SCHEMA_SHA256: &str = - "a91e2244a2c1a8e369efe85bd0e4f2769f0f29f6263137280fe38e8a8da3cc6e"; + "044707c72ea20c4fe564ac7af51d9f075a49ea3fef7c8e639d283accf5936a7e"; const DURABLE_SCHEMA_SHA256: &str = "d4dc7abdb91b919db1f7be0d4652e30cbfda86f3b2ed9b59d5de1f76a2bf691d"; const PUBLIC_DURABLE_OVERLAP_SHA256: &str = @@ -695,7 +697,7 @@ mod tests { overlap_hash.as_str(), ), ( - (328, 29), + (329, 29), (95, 22), (83, 22), PUBLIC_RPC_SCHEMA_SHA256, diff --git a/crates/openshell-server/src/supervisor_session.rs b/crates/openshell-server/src/supervisor_session.rs index a0fb2654be..ee446e1692 100644 --- a/crates/openshell-server/src/supervisor_session.rs +++ b/crates/openshell-server/src/supervisor_session.rs @@ -2449,6 +2449,13 @@ async fn accept_supervisor_session(setup: SessionSetup) -> Result<(), Status> { Ok(()) } +// A pushed session reuses its capability for its entire lifetime, including +// bootstrap and subsequent credential refreshes. Older supervisors are accepted +// in polling mode, whose request capability gates all static credential values. +fn supports_protected_config_push(hello: &SupervisorHello) -> bool { + hello.supports_config_push && hello.supports_static_credential_placement +} + pub async fn handle_connect_supervisor( state: &Arc, request: Request>, @@ -2481,7 +2488,7 @@ pub async fn handle_connect_supervisor( // apply it; the rest keep polling. let pushes_config = state.config.config_delivery_mode == openshell_core::config::ConfigDeliveryMode::Push - && hello.supports_config_push; + && supports_protected_config_push(&hello); let mode = if pushes_config { SessionMode::Push } else { @@ -5475,6 +5482,23 @@ mod tests { } } + #[test] + fn static_placement_capability_gates_the_entire_push_session() { + for supports_push in [false, true] { + for supports_placement in [false, true] { + let hello = SupervisorHello { + supports_config_push: supports_push, + supports_static_credential_placement: supports_placement, + ..Default::default() + }; + assert_eq!( + supports_protected_config_push(&hello), + supports_push && supports_placement + ); + } + } + } + #[test] fn redirected_supervisors_are_only_bounced_by_a_shutting_down_replica() { let hello = |redirected| SupervisorHello { diff --git a/crates/openshell-supervisor-network/README.md b/crates/openshell-supervisor-network/README.md index 7ce403a15e..170cd86f21 100644 --- a/crates/openshell-supervisor-network/README.md +++ b/crates/openshell-supervisor-network/README.md @@ -26,3 +26,13 @@ HTTP client; a token acquired for one sandbox is never served to another. Without a Workload API socket, token grants fail closed. A process hosting several instances serves `/v1/denials` from a per-instance `SandboxInstanceDenialLog` instead of the shared shorthand log files. + +## Static credential placement + +Static credential substitution checks the credential's declared request location +before writing upstream. HTTP placement violations return a safe 403 response; +WebSocket violations close the connection with policy denial. Both paths emit a +domain event and a detection finding without credential values or placeholders. +Body and WebSocket rewrite flags do not override static placement. SigV4 signing +uses the endpoint-scoped resolver's trusted signing-only access instead of a +workload-selected request location. diff --git a/crates/openshell-supervisor-network/src/google_cloud_metadata.rs b/crates/openshell-supervisor-network/src/google_cloud_metadata.rs index 988f8073aa..b38f428a34 100644 --- a/crates/openshell-supervisor-network/src/google_cloud_metadata.rs +++ b/crates/openshell-supervisor-network/src/google_cloud_metadata.rs @@ -356,6 +356,13 @@ mod tests { }], credential_identity: "test-google:token".into(), workload_credential_handle: String::new(), + placement: Some(openshell_core::proto::StaticCredentialPlacement { + location: Some( + openshell_core::proto::static_credential_placement::Location::HeaderName( + "Authorization".into(), + ), + ), + }), } } diff --git a/crates/openshell-supervisor-network/src/l7/mod.rs b/crates/openshell-supervisor-network/src/l7/mod.rs index 3f26114998..37849b9c0c 100644 --- a/crates/openshell-supervisor-network/src/l7/mod.rs +++ b/crates/openshell-supervisor-network/src/l7/mod.rs @@ -66,6 +66,37 @@ pub(crate) fn build_credential_endpoint_mismatch_finding( .build() } +pub(crate) fn build_credential_placement_mismatch_finding( + policy_name: &str, + host: &str, + protocol: Option<&str>, +) -> openshell_ocsf::OcsfEvent { + use openshell_ocsf::{ + ActionId, ActivityId, DetectionFindingBuilder, DispositionId, FindingInfo, SeverityId, + }; + let mut evidence = vec![ + ("policy", policy_name), + ("host", host), + ("disposition", "denied"), + ]; + if let Some(protocol) = protocol { + evidence.push(("protocol", protocol)); + } + DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) + .activity(ActivityId::Open) + .action(ActionId::Denied) + .disposition(DispositionId::Blocked) + .severity(SeverityId::High) + .is_alert(true) + .finding_info(FindingInfo::new( + "openshell.provider_credential.placement_mismatch", + "Provider credential used at an unauthorized request location", + )) + .evidence_pairs(&evidence) + .message("Provider credential placement mismatch; request denied") + .build() +} + /// TLS handling mode for proxy connections. #[derive(Debug, Clone, Copy, PartialEq, Eq, Default)] pub enum TlsMode { diff --git a/crates/openshell-supervisor-network/src/l7/relay.rs b/crates/openshell-supervisor-network/src/l7/relay.rs index f3e9e34741..9358627132 100644 --- a/crates/openshell-supervisor-network/src/l7/relay.rs +++ b/crates/openshell-supervisor-network/src/l7/relay.rs @@ -593,12 +593,15 @@ where W: AsyncWrite + Unpin, { let endpoint_mismatch = error.is_endpoint_mismatch(); - let status = if endpoint_mismatch { + let placement_mismatch = error.is_placement_mismatch(); + let status = if endpoint_mismatch || placement_mismatch { "403 Forbidden" } else { "500 Internal Server Error" }; - let body = if endpoint_mismatch { + let body = if placement_mismatch { + r#"{"error":"credential_placement_mismatch","message":"Credential is not authorized for this request location"}"# + } else if endpoint_mismatch { r#"{"error":"credential_endpoint_mismatch","message":"Credential is not authorized for this request endpoint"}"# } else { r#"{"error":"credential_unavailable","message":"Credential placeholder could not be resolved"}"# @@ -613,11 +616,34 @@ where .into_diagnostic()?; client.flush().await.into_diagnostic()?; - ocsf_emit!(build_credential_resolution_event( - ctx, - method, - endpoint_mismatch - )); + if placement_mismatch { + ocsf_emit!( + HttpActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .activity(ActivityId::for_http_method(method)) + .http_request(method_only_request(method)) + .http_response(openshell_ocsf::HttpResponse { code: 403 }) + .action(ActionId::Denied) + .disposition(DispositionId::Blocked) + .severity(SeverityId::High) + .status(StatusId::Failure) + .dst_endpoint(Endpoint::from_domain(&ctx.host, ctx.port)) + .firewall_rule(&ctx.policy_name, "credential-binding") + .message("Credential use denied: unauthorized request location") + .status_detail("credential_placement_mismatch") + .build() + ); + ocsf_emit!(crate::l7::build_credential_placement_mismatch_finding( + &ctx.policy_name, + &ctx.host, + None, + )); + } else { + ocsf_emit!(build_credential_resolution_event( + ctx, + method, + endpoint_mismatch + )); + } if endpoint_mismatch { ocsf_emit!(build_credential_endpoint_mismatch_finding(ctx)); @@ -3973,6 +3999,13 @@ mod tests { }], credential_identity: identity.to_string(), workload_credential_handle: String::new(), + placement: Some(openshell_core::proto::StaticCredentialPlacement { + location: Some( + openshell_core::proto::static_credential_placement::Location::HeaderName( + "Authorization".into(), + ), + ), + }), } } @@ -4113,6 +4146,9 @@ mod tests { scoped .secret_resolver .expect("endpoint resolver") + .with_request_location(secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) .resolve_placeholder("openshell:resolve:env:v42_API_TOKEN"), Some("secret") ); @@ -4296,6 +4332,292 @@ mod tests { assert_eq!(finding["disposition"], "Blocked"); } + fn placement_test_state() -> ProviderCredentialState { + ProviderCredentialState::from_bound_environment( + 1, + TestHashMap::from([("API_TOKEN".into(), "synthetic-private-token".into())]), + TestHashMap::new(), + TestHashMap::new(), + TestHashMap::from([("API_TOKEN".into(), endpoint_binding("provider:API_TOKEN"))]), + Vec::new(), + ) + .expect("bound placement fixture") + } + + #[tokio::test] + async fn header_credential_query_reflection_is_denied_before_upstream_write() { + let state = placement_test_state(); + let resolver = state + .resolver_for_endpoint("allowed.example.test", 443, "/allowed/search") + .unwrap(); + let token = state.snapshot().child_env["API_TOKEN"].clone(); + // A pagination service copies extra query parameters into its Link header. + // No request bytes may reach it when the parameter contains a header credential. + for (target, extra_headers, body, rewrite_body) in [ + ( + format!("/allowed/search?q=rust&per_page=1&probe={token}"), + String::new(), + String::new(), + false, + ), + ( + "/allowed/search".into(), + format!("X-Reflect: {token}\r\n"), + String::new(), + false, + ), + ( + "/allowed/search".into(), + String::new(), + format!("token={token}"), + true, + ), + ] { + let raw = format!( + "GET {target} HTTP/1.1\r\nHost: allowed.example.test\r\n{extra_headers}Content-Type: application/x-www-form-urlencoded\r\nContent-Length: {}\r\n\r\n{body}", + body.len() + ); + let request = crate::l7::rest::request_from_buffered_http( + "GET", + "/allowed/search", + &target, + raw.into_bytes(), + ) + .unwrap(); + let (mut app, mut client) = tokio::io::duplex(8192); + let (mut upstream, mut service) = tokio::io::duplex(8192); + let ctx = L7EvalContext { + host: "allowed.example.test".into(), + port: 443, + ..Default::default() + }; + let outcome = relay_http_request_with_credential_rejection( + &request, + &mut client, + &mut upstream, + crate::l7::rest::RelayRequestOptions { + resolver: Some(&resolver), + request_body_credential_rewrite: rewrite_body, + ..Default::default() + }, + &ctx, + None, + ) + .await + .unwrap(); + assert!(outcome.is_none()); + drop(client); + drop(upstream); + let mut response = String::new(); + app.read_to_string(&mut response).await.unwrap(); + let mut sent = Vec::new(); + service.read_to_end(&mut sent).await.unwrap(); + assert!( + sent.is_empty(), + "placement denial must precede all upstream writes" + ); + assert!(response.contains("403 Forbidden"), "{response}"); + assert!( + response.contains("credential_placement_mismatch"), + "{response}" + ); + assert!(!response.contains("synthetic-private-token")); + assert!(!response.contains(&token)); + } + let finding = crate::l7::build_credential_placement_mismatch_finding( + "test", + "allowed.example.test", + None, + ) + .to_json() + .unwrap(); + assert_eq!( + finding["finding_info"]["uid"], + "openshell.provider_credential.placement_mismatch" + ); + } + + #[tokio::test] + async fn permitted_auth_formats_preserve_pagination_without_disclosing_credentials() { + use base64::Engine as _; + let state = placement_test_state(); + let resolver = state + .resolver_for_endpoint("allowed.example.test", 443, "/allowed/search") + .unwrap(); + let token = state.snapshot().child_env["API_TOKEN"].clone(); + for (authorization, expected) in [ + ( + format!("Bearer {token}"), + "Bearer synthetic-private-token".to_owned(), + ), + ( + format!("token {token}"), + "token synthetic-private-token".to_owned(), + ), + ( + format!( + "Basic {}", + base64::engine::general_purpose::STANDARD.encode(format!("user:{token}")) + ), + format!( + "Basic {}", + base64::engine::general_purpose::STANDARD + .encode("user:synthetic-private-token") + ), + ), + ] { + let target = "/allowed/search?q=rust&per_page=1"; + let raw = format!( + "GET {target} HTTP/1.1\r\nHost: allowed.example.test\r\nAuthorization: {authorization}\r\n\r\n" + ); + let request = crate::l7::rest::request_from_buffered_http( + "GET", + "/allowed/search", + target, + raw.into_bytes(), + ) + .unwrap(); + let (mut app, mut client) = tokio::io::duplex(8192); + let (mut upstream, mut service) = tokio::io::duplex(8192); + let service_task = tokio::spawn(async move { + let mut bytes = Vec::new(); + loop { + let mut byte = [0]; + service.read_exact(&mut byte).await.unwrap(); + bytes.push(byte[0]); + if bytes.ends_with(b"\r\n\r\n") { + break; + } + } + let received = String::from_utf8(bytes).unwrap(); + let target = received + .lines() + .next() + .unwrap() + .split_whitespace() + .nth(1) + .unwrap(); + let response = format!( + "HTTP/1.1 200 OK\r\nLink: ; rel=\"next\"\r\nContent-Length: 0\r\n\r\n" + ); + service.write_all(response.as_bytes()).await.unwrap(); + received + }); + crate::l7::rest::relay_http_request_with_options_guarded( + &request, + &mut client, + &mut upstream, + crate::l7::rest::RelayRequestOptions { + resolver: Some(&resolver), + ..Default::default() + }, + ) + .await + .unwrap(); + drop(client); + let mut response = String::new(); + app.read_to_string(&mut response).await.unwrap(); + let received = service_task.await.unwrap(); + assert!( + received.contains(&format!("Authorization: {expected}")), + "{received}" + ); + assert!(response.contains("per_page=1&page=2"), "{response}"); + assert!(!response.contains("synthetic-private-token")); + } + } + + #[tokio::test] + async fn signing_only_credentials_support_supervisor_sigv4_without_request_substitution() { + let values = TestHashMap::from([ + ("AWS_ACCESS_KEY_ID".into(), "synthetic-access-key".into()), + ( + "AWS_SECRET_ACCESS_KEY".into(), + "synthetic-signing-secret".into(), + ), + ("AWS_SESSION_TOKEN".into(), "synthetic-session-token".into()), + ]); + let bindings = values + .keys() + .map(|key: &String| { + let mut binding = endpoint_binding(&format!("aws:{key}")); + binding.placement = Some(openshell_core::proto::StaticCredentialPlacement { + location: Some( + openshell_core::proto::static_credential_placement::Location::SigningOnly( + true, + ), + ), + }); + (key.clone(), binding) + }) + .collect(); + let state = ProviderCredentialState::from_bound_environment( + 1, + values, + TestHashMap::new(), + TestHashMap::new(), + bindings, + Vec::new(), + ) + .unwrap(); + let resolver = state + .resolver_for_endpoint("allowed.example.test", 443, "/allowed/api") + .unwrap(); + let placeholder = state.snapshot().child_env["AWS_SECRET_ACCESS_KEY"].clone(); + assert!( + resolver + .rewrite_header_value_for_name("Authorization", &placeholder) + .unwrap_err() + .is_placement_mismatch() + ); + let request = crate::l7::rest::request_from_buffered_http( + "GET", + "/allowed/api", + "/allowed/api", + b"GET /allowed/api HTTP/1.1\r\nHost: allowed.example.test\r\n\r\n".to_vec(), + ) + .unwrap(); + let (mut _app, mut client) = tokio::io::duplex(8192); + let (mut upstream, mut service) = tokio::io::duplex(8192); + let service_task = tokio::spawn(async move { + let mut bytes = Vec::new(); + loop { + let mut byte = [0]; + service.read_exact(&mut byte).await.unwrap(); + bytes.push(byte[0]); + if bytes.ends_with(b"\r\n\r\n") { + break; + } + } + service + .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\n") + .await + .unwrap(); + String::from_utf8(bytes).unwrap() + }); + crate::l7::rest::relay_http_request_with_options_guarded( + &request, + &mut client, + &mut upstream, + crate::l7::rest::RelayRequestOptions { + resolver: Some(&resolver), + credential_signing: crate::l7::CredentialSigning::SigV4NoBody, + signing_service: "execute-api", + signing_region: "us-west-2", + host: "allowed.example.test", + port: 443, + ..Default::default() + }, + ) + .await + .unwrap(); + let sent = service_task.await.unwrap(); + assert!(sent.contains("AWS4-HMAC-SHA256"), "{sent}"); + assert!(sent.contains("synthetic-access-key")); + assert!(sent.contains("synthetic-session-token")); + assert!(!sent.contains("synthetic-signing-secret")); + } + #[tokio::test] async fn body_only_endpoint_mismatch_returns_typed_403() { let (_state, resolver) = endpoint_mismatch_resolver(TestHashMap::from([( @@ -5984,6 +6306,9 @@ network_policies: }], credential_identity: "provider-a:API_TOKEN".to_string(), workload_credential_handle: String::new(), + placement: Some(openshell_core::proto::StaticCredentialPlacement { + location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), + }), }, )]), Vec::new(), @@ -6088,6 +6413,9 @@ network_policies: }], credential_identity: "provider-a:API_TOKEN".to_string(), workload_credential_handle: String::new(), + placement: Some(openshell_core::proto::StaticCredentialPlacement { + location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), + }), }, )]), Vec::new(), @@ -6743,6 +7071,9 @@ network_policies: }], credential_identity: "provider-a:API_TOKEN".to_string(), workload_credential_handle: String::new(), + placement: Some(openshell_core::proto::StaticCredentialPlacement { + location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), + }), }, )]), Vec::new(), @@ -9635,6 +9966,9 @@ network_policies: }], credential_identity: "provider-a:API_TOKEN".to_string(), workload_credential_handle: String::new(), + placement: Some(openshell_core::proto::StaticCredentialPlacement { + location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), + }), }, )]), Vec::new(), @@ -12195,6 +12529,9 @@ network_policies: }], credential_identity: "provider:API_TOKEN".into(), workload_credential_handle: String::new(), + placement: Some(openshell_core::proto::StaticCredentialPlacement { + location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), + }), }, )]), Vec::new(), diff --git a/crates/openshell-supervisor-network/src/l7/rest.rs b/crates/openshell-supervisor-network/src/l7/rest.rs index 7b85942666..1c453b678b 100644 --- a/crates/openshell-supervisor-network/src/l7/rest.rs +++ b/crates/openshell-supervisor-network/src/l7/rest.rs @@ -9862,6 +9862,9 @@ mod tests { StaticCredentialBinding { credential_identity: "github".into(), workload_credential_handle: String::new(), + placement: Some(openshell_core::proto::StaticCredentialPlacement { + location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), + }), endpoints: vec![StaticCredentialEndpointBinding { host: "api.github.com".into(), port: 443, diff --git a/crates/openshell-supervisor-network/src/l7/websocket.rs b/crates/openshell-supervisor-network/src/l7/websocket.rs index f2ea281a81..8e2b1fe0ab 100644 --- a/crates/openshell-supervisor-network/src/l7/websocket.rs +++ b/crates/openshell-supervisor-network/src/l7/websocket.rs @@ -39,6 +39,7 @@ const OPCODE_BINARY: u8 = 0x2; const OPCODE_CLOSE: u8 = 0x8; const OPCODE_PING: u8 = 0x9; const OPCODE_PONG: u8 = 0xA; +const CREDENTIAL_PLACEMENT_MISMATCH: &str = "websocket credential placement mismatch"; const CREDENTIAL_ENDPOINT_MISMATCH: &str = "websocket credential endpoint mismatch"; #[derive(Clone, Debug)] @@ -582,7 +583,27 @@ where } if let Err(termination) = &result { let error = termination.error.to_string(); - if error.contains(CREDENTIAL_ENDPOINT_MISMATCH) { + if error.contains(CREDENTIAL_PLACEMENT_MISMATCH) { + ocsf_emit!( + NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .activity(ActivityId::Fail) + .action(ActionId::Denied) + .disposition(DispositionId::Blocked) + .severity(SeverityId::High) + .status(StatusId::Failure) + .dst_endpoint(Endpoint::from_domain(host, port)) + .firewall_rule(options.policy_name, "credential-binding") + .message("WebSocket credential use denied: unauthorized request location") + .status_detail("credential_placement_mismatch") + .build() + ); + ocsf_emit!(crate::l7::build_credential_placement_mismatch_finding( + options.policy_name, + host, + Some("websocket"), + )); + let _ = write_policy_violation_close(&mut client_write).await; + } else if error.contains(CREDENTIAL_ENDPOINT_MISMATCH) { emit_credential_endpoint_mismatch(host, port, options.policy_name); let _ = write_policy_violation_close(&mut client_write).await; } else if error.contains("credential") { @@ -609,7 +630,7 @@ where } async fn write_policy_violation_close(writer: &mut W) -> Result<()> { - let reason = b"credential endpoint mismatch"; + let reason = b"credential use denied"; let mut frame = Vec::with_capacity(reason.len() + 4); frame.push(0x80 | OPCODE_CLOSE); frame.push(u8::try_from(reason.len() + 2).expect("close reason fits one-byte length")); @@ -1288,7 +1309,12 @@ where resolver .rewrite_websocket_text_placeholders(&mut text) .map_err(|error| { - if error.is_endpoint_mismatch() { + if error.is_placement_mismatch() { + terminate( + WebSocketTerminationCause::PolicyDenial, + miette!(CREDENTIAL_PLACEMENT_MISMATCH), + ) + } else if error.is_endpoint_mismatch() { terminate( WebSocketTerminationCause::PolicyDenial, miette!(CREDENTIAL_ENDPOINT_MISMATCH), @@ -2724,6 +2750,9 @@ network_policies: }], credential_identity: "provider-a:DISCORD_BOT_TOKEN".to_string(), workload_credential_handle: String::new(), + placement: Some(openshell_core::proto::StaticCredentialPlacement { + location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), + }), }, )]), Vec::new(), @@ -2815,7 +2844,7 @@ network_policies: } #[tokio::test] - async fn guarded_websocket_uses_path_scoped_live_resolver() { + async fn guarded_websocket_rejects_header_credential_in_text() { let state = bound_websocket_provider_state(); let placeholder = b"openshell:resolve:env:v1_DISCORD_BOT_TOKEN"; let input = masked_frame(true, OPCODE_TEXT, placeholder); @@ -2846,18 +2875,24 @@ network_policies: ) .await; assert!( - result.is_ok(), - "path-scoped live resolver must satisfy the credential guard: {result:?}" + result.as_ref().is_err_and(|error| error + .error + .to_string() + .contains(CREDENTIAL_PLACEMENT_MISMATCH)), + "header credentials must not resolve in WebSocket frames: {result:?}" ); drop(relay_write); let mut output = Vec::new(); upstream_read.read_to_end(&mut output).await.unwrap(); - assert_eq!(decode_masked_text_frame(&output), "real-token"); + assert!( + output.is_empty(), + "placement denial must send no upstream bytes" + ); } #[tokio::test] - async fn websocket_rewrite_rejects_revocation_before_frame_write() { + async fn compressed_websocket_rejects_header_credential_before_frame_write() { let state = bound_websocket_provider_state(); let fallback = state.resolver().expect("upgrade-time resolver"); let placeholder = b"openshell:resolve:env:v1_DISCORD_BOT_TOKEN"; @@ -2884,8 +2919,6 @@ network_policies: middleware_context: None, deny_uninspected_credentials: false, }; - let reached_write = tokio::sync::Barrier::new(2); - let release_write = tokio::sync::Barrier::new(2); let (mut relay_write, mut upstream_read) = tokio::io::duplex(4096); let relay = relay_text_payload_with_before_credential_write( @@ -2899,22 +2932,15 @@ network_policies: "gateway.example.test", 443, &mut options, - async { - reached_write.wait().await; - release_write.wait().await; - }, + async { panic!("placement denial must precede credential write callback") }, ); - let revoke = async { - reached_write.wait().await; - state.revoke_static_provider_environment(2); - release_write.wait().await; - }; - let (result, ()) = tokio::join!(relay, revoke); + let result = relay.await; assert!( - result - .as_ref() - .is_err_and(|error| error.error.to_string().contains("generation changed")), - "revoked credential generation must fail before the frame write: {result:?}" + result.as_ref().is_err_and(|error| error + .error + .to_string() + .contains(CREDENTIAL_PLACEMENT_MISMATCH)), + "placement denial must fail before the frame write: {result:?}" ); drop(relay_write); @@ -2922,7 +2948,7 @@ network_policies: upstream_read.read_to_end(&mut output).await.unwrap(); assert!( output.is_empty(), - "credential revoked before the write guard must not reach upstream" + "placement-denied credential must not reach upstream" ); } diff --git a/crates/openshell-supervisor-network/src/proxy.rs b/crates/openshell-supervisor-network/src/proxy.rs index bd93c78c57..e07d8c5b58 100644 --- a/crates/openshell-supervisor-network/src/proxy.rs +++ b/crates/openshell-supervisor-network/src/proxy.rs @@ -6490,7 +6490,10 @@ async fn handle_forward_proxy( .end(openshell_core::proto::MiddlewareSessionEndReason::Cancellation) .await; } - if e.is_endpoint_mismatch() { + if e.is_placement_mismatch() { + crate::l7::relay::reject_credential_resolution(client, &l7_ctx, method, &e).await?; + client.shutdown().await.into_diagnostic()?; + } else if e.is_endpoint_mismatch() { if let Some(observer) = endpoint_observer.as_ref() { observer.observe_credential_failure(true); } @@ -10621,6 +10624,9 @@ network_policies: }], credential_identity: "provider-a:API_TOKEN".to_string(), workload_credential_handle: String::new(), + placement: Some(openshell_core::proto::StaticCredentialPlacement { + location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), + }), }, )]), Vec::new(), @@ -12987,6 +12993,9 @@ network_policies: }], credential_identity: "provider-a:API_TOKEN".to_string(), workload_credential_handle: String::new(), + placement: Some(openshell_core::proto::StaticCredentialPlacement { + location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), + }), }, )]), Vec::new(), @@ -13005,6 +13014,9 @@ network_policies: credentials .resolver .expect("endpoint resolver") + .with_request_location(secrets::RequestCredentialLocation::Header( + "Authorization".into() + )) .resolve_placeholder("openshell:resolve:env:v42_API_TOKEN"), Some("secret") ); @@ -13029,6 +13041,9 @@ network_policies: }], credential_identity: "provider-a:API_TOKEN".to_string(), workload_credential_handle: String::new(), + placement: Some(openshell_core::proto::StaticCredentialPlacement { + location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), + }), }, )]), Vec::new(), @@ -13075,6 +13090,9 @@ network_policies: }], credential_identity: "provider-a:API_TOKEN".to_string(), workload_credential_handle: String::new(), + placement: Some(openshell_core::proto::StaticCredentialPlacement { + location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), + }), }, )]), Vec::new(), @@ -13748,6 +13766,9 @@ network_policies: StaticCredentialBinding { credential_identity: "provider".into(), workload_credential_handle: String::new(), + placement: Some(openshell_core::proto::StaticCredentialPlacement { + location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), + }), endpoints: vec![StaticCredentialEndpointBinding { host: "api.example.com".into(), port: 80, @@ -13900,6 +13921,9 @@ network_policies: }], credential_identity: "provider-a:API_TOKEN".to_string(), workload_credential_handle: String::new(), + placement: Some(openshell_core::proto::StaticCredentialPlacement { + location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), + }), }, )]), Vec::new(), @@ -13991,6 +14015,9 @@ network_policies: }], credential_identity: format!("provider-a:{key}"), workload_credential_handle: String::new(), + placement: Some(openshell_core::proto::StaticCredentialPlacement { + location: Some(openshell_core::proto::static_credential_placement::Location::SigningOnly(true)), + }), }, ) }) diff --git a/crates/openshell-supervisor-process/src/supervisor_session.rs b/crates/openshell-supervisor-process/src/supervisor_session.rs index 71313e19c0..fb8643f2be 100644 --- a/crates/openshell-supervisor-process/src/supervisor_session.rs +++ b/crates/openshell-supervisor-process/src/supervisor_session.rs @@ -611,6 +611,7 @@ async fn run_single_session( redirected, supports_session_redirect: true, supports_config_push: true, + supports_static_credential_placement: true, })), }) .await diff --git a/crates/openshell-supervisor/src/config_runtime.rs b/crates/openshell-supervisor/src/config_runtime.rs index 1a83fd0887..252cc1334b 100644 --- a/crates/openshell-supervisor/src/config_runtime.rs +++ b/crates/openshell-supervisor/src/config_runtime.rs @@ -457,10 +457,9 @@ impl ConfigRuntime { Ok(generation) => { policy_runtime_reconciled = true; if let Some(prepared) = prepared_provider.as_ref() { - ctx.provider_readiness.credentials_installed( - prepared.identity.clone(), + prepared.record_installation( + &ctx.provider_readiness, &ctx.provider_credentials, - prepared.expires_at_ms, ); } ctx.provider_readiness.policy_activated( @@ -639,11 +638,7 @@ impl ConfigRuntime { if !reloads_gateway_policy && let Some(prepared) = prepared_provider.as_ref() { ctx.provider_credentials .install_prepared(&prepared.credentials); - ctx.provider_readiness.credentials_installed( - prepared.identity.clone(), - &ctx.provider_credentials, - prepared.expires_at_ms, - ); + prepared.record_installation(&ctx.provider_readiness, &ctx.provider_credentials); } if provider_env_changed || policy_runtime_reconciled { self.provider_env_revision = result.provider_env_revision; @@ -1920,6 +1915,9 @@ mod tests { }], credential_identity: "provider-a:EXTERNAL_TOKEN".into(), workload_credential_handle: String::new(), + placement: Some(openshell_core::proto::StaticCredentialPlacement { + location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("authorization".into())), + }), }, ); } @@ -1941,6 +1939,9 @@ mod tests { state .resolver_for_endpoint("tools.example.com", 443, "/v1/chat") .unwrap() + .with_request_location(openshell_core::secrets::RequestCredentialLocation::Header( + "authorization".into() + )) .resolve_placeholder(reference), Some("initial"), ); @@ -2012,6 +2013,9 @@ mod tests { state .resolver_for_endpoint("tools.example.com", 443, "/v1/chat") .unwrap() + .with_request_location(openshell_core::secrets::RequestCredentialLocation::Header( + "authorization".into() + )) .resolve_placeholder(reference), Some("initial"), ); @@ -2564,7 +2568,14 @@ mod tests { let resolved = state .resolver_for_endpoint("tools.example.com", 443, "/v1/chat") .and_then(|resolver| { - resolver.resolve_placeholder(&reference).map(str::to_owned) + resolver + .with_request_location( + openshell_core::secrets::RequestCredentialLocation::Header( + "authorization".into(), + ), + ) + .resolve_placeholder(&reference) + .map(str::to_owned) }); let observed = tracker.observation(&state); if state.revision() == revision @@ -2586,6 +2597,11 @@ mod tests { state .resolver_for_endpoint("tools.example.com", 443, "/v1/chat") .unwrap() + .with_request_location( + openshell_core::secrets::RequestCredentialLocation::Header( + "authorization".into() + ) + ) .resolve_placeholder(old_reference), Some("initial") ); @@ -2658,7 +2674,14 @@ mod tests { let resolved = state .resolver_for_endpoint("tools.example.com", 443, "/v1/chat") .and_then(|resolver| { - resolver.resolve_placeholder(&reference).map(str::to_owned) + resolver + .with_request_location( + openshell_core::secrets::RequestCredentialLocation::Header( + "authorization".into(), + ), + ) + .resolve_placeholder(&reference) + .map(str::to_owned) }); let observed = tracker.observation(&state); if state.revision() == revision diff --git a/crates/openshell-supervisor/src/lib.rs b/crates/openshell-supervisor/src/lib.rs index a84c70a4a3..e20a1ebc1b 100644 --- a/crates/openshell-supervisor/src/lib.rs +++ b/crates/openshell-supervisor/src/lib.rs @@ -2424,16 +2424,31 @@ impl VmPolicyIdentity { #[derive(Clone)] struct CapturedProviderEnvironment { credentials: ProviderCredentialState, + readiness_reason: ProviderReadinessReason, expires_at_ms: Option, identity: EnvironmentIdentity, } impl CapturedProviderEnvironment { fn install(self, readiness: &ProviderReadinessTracker) -> ProviderCredentialState { - readiness.credentials_installed(self.identity, &self.credentials, self.expires_at_ms); + self.record_installation(readiness, &self.credentials); self.credentials } + fn record_installation( + &self, + readiness: &ProviderReadinessTracker, + credentials: &ProviderCredentialState, + ) { + if self.readiness_reason == ProviderReadinessReason::Unspecified { + readiness.credentials_installed(self.identity.clone(), credentials, self.expires_at_ms); + } else { + // The reduced snapshot is valid and its remaining keys are usable, + // while readiness still reports the omitted credential material. + readiness.credentials_failed(self.identity.clone(), self.readiness_reason); + } + } + /// Validate the environment's bindings without touching live credentials. fn prepare(provider: &openshell_core::grpc_client::ProviderEnvironmentResult) -> Result { prepare_provider_environment(provider).map(|credentials| Self::new(credentials, provider)) @@ -2445,6 +2460,7 @@ impl CapturedProviderEnvironment { ) -> Self { Self { credentials, + readiness_reason: provider.readiness_reason, expires_at_ms: provider .credential_expires_at_ms .values() @@ -3622,7 +3638,7 @@ fn initial_provider_credentials( .copied() .filter(|expiry| *expiry > 0) .min(); - if result.readiness_reason != ProviderReadinessReason::Unspecified { + if !provider_environment_is_installable(result.readiness_reason) { readiness.credentials_failed(identity, result.readiness_reason); return ProviderCredentialState::from_environment( result.provider_env_revision, @@ -3643,7 +3659,11 @@ fn initial_provider_credentials( ) { Ok(credentials) => { credentials.set_managed_files(result.files); - readiness.credentials_installed(identity, &credentials, expires_at_ms); + if result.readiness_reason == ProviderReadinessReason::Unspecified { + readiness.credentials_installed(identity, &credentials, expires_at_ms); + } else { + readiness.credentials_failed(identity, result.readiness_reason); + } credentials } Err(error) => { @@ -6191,6 +6211,53 @@ network_policies: } } + #[test] + fn reduced_environment_preserves_authorized_credentials_and_omission_readiness() { + use openshell_core::proto::{ + StaticCredentialBinding, StaticCredentialEndpointBinding, StaticCredentialPlacement, + static_credential_placement, + }; + for captured in [false, true] { + let mut provider = startup_provider(10); + provider.policy_hash = "policy".into(); + provider.readiness_reason = ProviderReadinessReason::CredentialsWithheld; + provider + .environment + .insert("TOKEN".into(), "synthetic".into()); + provider.static_credential_bindings.insert( + "TOKEN".into(), + StaticCredentialBinding { + endpoints: vec![StaticCredentialEndpointBinding { + host: "api.example.com".into(), + port: 443, + path: "/**".into(), + }], + credential_identity: "provider:TOKEN".into(), + placement: Some(StaticCredentialPlacement { + location: Some(static_credential_placement::Location::HeaderName( + "authorization".into(), + )), + }), + ..Default::default() + }, + ); + let identity = EnvironmentIdentity::from_environment(&provider); + let tracker = ProviderReadinessTracker::new(); + let credentials = if captured { + CapturedProviderEnvironment::prepare(&provider) + .unwrap() + .install(&tracker) + } else { + initial_provider_credentials(provider, &tracker) + }; + assert!(credentials.snapshot().child_env.contains_key("TOKEN")); + assert!( + tracker.needs_environment(&identity), + "omitted keys remain visible in readiness" + ); + } + } + #[test] fn startup_configuration_rejects_mixed_provider_revision() { let policy = proto_policy_fixture(); diff --git a/docs/how-it-works/policies/network-rules.mdx b/docs/how-it-works/policies/network-rules.mdx index 811d920922..656dbc794c 100644 --- a/docs/how-it-works/policies/network-rules.mdx +++ b/docs/how-it-works/policies/network-rules.mdx @@ -440,8 +440,9 @@ frames or messages from the server. If the endpoint carries provider credentials, OpenShell closes the connection with close code `1008` when the client sends a binary frame, because it cannot check the frame for credentials. Set `allow_uninspected_credentials: true` to relay binary frames anyway. Set -`websocket_credential_rewrite: true` only when client text messages contain -OpenShell credential placeholders that must be resolved. +`websocket_credential_rewrite` does not override provider credential placement. +Static credentials declared for a header, query parameter, or path cannot +resolve inside WebSocket messages, even when this flag is enabled. When new network rules take effect, OpenShell closes open WebSocket connections, so the client must reconnect. The client might receive close code `1012`, or the diff --git a/docs/how-it-works/policies/schema.mdx b/docs/how-it-works/policies/schema.mdx index 693efb209c..183a317287 100644 --- a/docs/how-it-works/policies/schema.mdx +++ b/docs/how-it-works/policies/schema.mdx @@ -166,8 +166,8 @@ the gateway host. | Field | Type | Default | Description | |---|---|---|---| | `credential_binding.provider` | string | None | Binds the static credentials of an attached provider whose profile defines no endpoints. Valid only in a sandbox policy. | -| `request_body_credential_rewrite` | bool | `false` | Replaces credential placeholders in REST request bodies. | -| `websocket_credential_rewrite` | bool | `false` | Replaces credential placeholders in client WebSocket text messages. | +| `request_body_credential_rewrite` | bool | `false` | Enables REST body rewriting without overriding credential placement. Header-, query-, and path-bound static credentials cannot resolve in bodies. | +| `websocket_credential_rewrite` | bool | `false` | Enables WebSocket text rewriting without overriding credential placement. Header-, query-, and path-bound static credentials cannot resolve in messages. | | `allow_uninspected_credentials` | bool | `false` | Allows a provider-credentialed endpoint to omit request inspection or use `tls: skip`. | | `credential_signing` | string | None | AWS request signing: `sigv4`, `sigv4:body`, or `sigv4:no_body`. | | `signing_service` | string | None | AWS service name, such as `bedrock` or `s3`. Required with `credential_signing`. | diff --git a/docs/how-it-works/providers/overview.mdx b/docs/how-it-works/providers/overview.mdx index 73f209738e..685f963665 100644 --- a/docs/how-it-works/providers/overview.mdx +++ b/docs/how-it-works/providers/overview.mdx @@ -436,15 +436,17 @@ startup, OpenShell replaces each credential with an opaque placeholder token in the agent's environment. When the agent sends an HTTP request containing a placeholder, the proxy resolves it immediately before forwarding the request. -Static credential resolution has two independent authorization boundaries: +Static credential resolution has three independent authorization boundaries: 1. Network policy must allow the calling binary and request destination. 2. The credential binding must include the request host, port, and path. Profile endpoints provide the binding by default. An endpointless profile can use a sandbox policy endpoint that names the attached provider instance through `credential_binding.provider`. +3. The request location must match the credential's declared header, query + parameter, or path-template slot. -Both checks must pass. A provider profile endpoint does not grant network access +All three checks must pass. A provider profile endpoint does not grant network access unless provider policy composition or the sandbox's own policy allows the request. A plain sandbox policy endpoint does not grant credential use unless the profile already covers it or the endpoint explicitly binds an endpointless @@ -461,21 +463,26 @@ for endpoint matching and migration guidance. ### Supported injection locations -The proxy resolves credential placeholders in the following parts of an HTTP request: +The proxy resolves static credential placeholders only in their declared +placement. Moving a header credential into a query parameter, path, or another +header is denied before the request is forwarded. | Location | How the agent uses it | Example | |---|---|---| -| Header value | Agent reads `$API_KEY` from env and places it in a header. | `Authorization: Bearer ` | +| Declared header value | Agent reads `$API_KEY` from env and places it in the declared header. | `Authorization: Bearer ` | | Header value (Basic auth) | Agent base64-encodes `user:` in an `Authorization: Basic` header. The proxy decodes, resolves, and re-encodes. | `Authorization: Basic ` | -| Query parameter value | Agent places the placeholder in a URL query parameter. | `GET /api?key=` | -| URL path segment | Agent builds a URL with the placeholder in the path. Supports concatenated patterns. | `POST /bot/sendMessage` | -| Supported request body | An inspected REST endpoint opts in with `request_body_credential_rewrite: true`. | `{"api_key":""}` | -| WebSocket text message | A REST or WebSocket endpoint opts in with `websocket_credential_rewrite: true`. | `{"token":""}` | +| Declared query parameter value | Agent uses the profile's `query_param`. | `GET /api?key=` | +| Declared URL path slot | Agent uses the profile's `path_template`, including concatenated patterns. | `POST /bot/sendMessage` | | AWS SigV4 signing | An endpoint configures `credential_signing`, and the proxy signs with the endpoint-bound AWS credentials. | `credential_signing: sigv4` | The proxy does not rewrite cookies, response content, unsupported request bodies, or WebSocket binary frames. +Static credentials bound to headers, query parameters, or paths cannot resolve in +request bodies or WebSocket messages. Endpoint-wide rewrite flags do not grant +additional credential placements. See [Profiles](/how-it-works/providers/profiles#understand-static-credential-endpoint-binding) +for placement configuration and upgrade requirements. + ### Clients that parse JWT claims A trusted launcher can wrap an issued placeholder in a JWT-shaped alias when a diff --git a/docs/how-it-works/providers/profiles.mdx b/docs/how-it-works/providers/profiles.mdx index 1617e00afe..d56b15bd40 100644 --- a/docs/how-it-works/providers/profiles.mdx +++ b/docs/how-it-works/providers/profiles.mdx @@ -70,6 +70,7 @@ A request can use a static credential only when all of these checks pass: | The placeholder belongs to the current attached provider state. | Sandbox provider attachment and current provider record. | | The calling binary and destination are allowed. | Effective sandbox network policy. | | The host, port, and canonical request path match the credential binding. | Provider profile endpoints, or an explicit sandbox policy binding for an endpointless profile. | +| The request location matches the credential's declared placement. | The credential's `auth_style` and its header, query parameter, or path template. | | The HTTP method, path, or protocol operation is allowed when L7 inspection is configured. | Effective sandbox network policy. | | The credential has not expired. | Provider credential expiry metadata. | @@ -94,6 +95,35 @@ glob matching. OpenShell removes the query string and uses a canonical, secret-redacted path for this check, so a credential embedded in a request path does not need to be revealed before authorization. +Each static credential also has a placement boundary. Header credentials resolve +only in the declared header, query credentials only in the declared parameter, +and path credentials only in the `{credential}` slot of their path template. +Header names are case-insensitive. An `Authorization` binding supports the +client's authentication format, including Bearer, token, and Basic authentication; +it does not require a literal `Bearer` prefix. + +The gateway withholds static credentials that lack usable placement metadata and +reports `CredentialsWithheld`. Add the appropriate placement to the profile +before attaching it. Signing-only AWS credentials are available only to the +supervisor's SigV4 signer. +Request-body and WebSocket rewrite flags do not override a credential's placement. + +Signing-only credentials require a profile signing endpoint or an AWS STS +refresh declaration. A custom endpointless AWS profile with signing configured +only in sandbox policy is withheld; move the signing declaration into the +profile before upgrading that workload. + +The Codex reference profile declares placement for its access token and account +header. Its refresh token and ID token have no supported static HTTP placement +and are withheld. Workloads that require those environment variables need a +compatible credential flow before upgrading; body rewrite flags cannot restore +that access. + +Upgrade both gateway and supervisor before using placement-bound credentials. +An upgraded gateway withholds static credentials from supervisors that do not +advertise placement enforcement. Restart older sandboxes after upgrading, then +wait for provider readiness before launching clients. + Use an explicit sandbox policy binding when the profile intentionally defines credentials without defining service endpoints. The policy names the concrete provider instance, not the profile type: @@ -202,7 +232,6 @@ The following provider profile design items are not part of the current behavior | Roadmap item | Current behavior | |---|---| -| General profile-driven credential placement | Static `auth_style`, `header_name`, `query_param`, and `path_template` placement metadata is stored and validated, but static credential injection still depends on environment placeholders generated from provider credentials. Dynamic `token_grant` credentials support `bearer` and `header` placement for matching HTTP endpoints. | | Binary-scoped credential injection | Static placeholder resolution is endpoint-scoped. Dynamic grants in single-route REST and multi-route inspection also require admission by their owning endpoint's policy, including its binary restrictions. L4-only credential forwarding retains endpoint-selector matching. | | Credential verification on create | `openshell provider create` does not yet probe provider verification endpoints or expose `--no-verify`. | | Automatic credential scope extraction | OpenShell does not yet inspect upstream provider responses to discover credential scopes. | @@ -372,12 +401,11 @@ credentials: stable_placeholder: false # Accepted values: basic, bearer, header, query, path. - # These fields describe static credential placement. - # Static runtime injection still uses env placeholder resolution. + # These fields restrict where a static placeholder can resolve. auth_style: bearer header_name: authorization - query_param: api_key - path_template: /v1/{credential}/resources + # For auth_style: query, set query_param: api_key instead. + # For auth_style: path, set path_template: /v1/{credential}/resources instead. refresh: # Accepted values: diff --git a/e2e/python/test_sandbox_providers.py b/e2e/python/test_sandbox_providers.py index 4c39bae95f..7055b56ba9 100644 --- a/e2e/python/test_sandbox_providers.py +++ b/e2e/python/test_sandbox_providers.py @@ -236,6 +236,8 @@ def _reply(self): self.send_response(200) self.send_header("Content-Type", "application/json") self.send_header("Content-Length", str(len(encoded))) + separator = "&" if "?" in self.path else "?" + self.send_header("Link", f"<{self.path}{separator}page=2>; rel=next") self.end_headers() self.wfile.write(encoded) @@ -725,6 +727,108 @@ def call_native_openai(host: str, port: int) -> str: assert body["model"] == "fixture-openai-model" +def test_static_header_credentials_reject_reflective_request_locations( + sandbox: Callable[..., Sandbox], + sandbox_client: SandboxClient, +) -> None: + """Only the declared auth header can resolve a static credential.""" + stub = sandbox_client._stub + profile_id = f"e2e-placement-{time.time_ns()}" + secret = "synthetic-placement-secret" + profile = _native_inference_profile( + profile_id=profile_id, + env_var="API_TOKEN", + port=0, + rules=[sandbox_pb2.L7Rule(allow=sandbox_pb2.L7Allow(method="*", path="/**"))], + ) + profile.endpoints[0].request_body_credential_rewrite = True + + def probe_locations(host: str, port: int) -> str: + import json + import os + import urllib.error + import urllib.parse + import urllib.request + + token = os.environ["API_TOKEN"] + root = f"http://{host}:{port}" + requests = [ + urllib.request.Request( + root + + "/search?" + + urllib.parse.urlencode({"q": "rust", "per_page": "1", "probe": token}) + ), + urllib.request.Request(root + "/search", headers={"X-Reflect": token}), + urllib.request.Request( + root + "/" + urllib.parse.quote(token, safe="") + "/search" + ), + urllib.request.Request( + root + "/search", + data=urllib.parse.urlencode({"token": token}).encode(), + headers={"Content-Type": "application/x-www-form-urlencoded"}, + ), + ] + results = [] + for request in requests: + try: + with urllib.request.urlopen(request, timeout=30) as response: + results.append( + {"status": response.status, "body": response.read().decode()} + ) + except urllib.error.HTTPError as error: + results.append( + { + "status": error.code, + "body": error.read().decode(), + "link": error.headers.get("Link"), + } + ) + request = urllib.request.Request( + root + "/search?q=rust&per_page=1", + headers={"Authorization": f"token {token}"}, + ) + with urllib.request.urlopen(request, timeout=30) as response: + valid = { + "body": json.loads(response.read()), + "link": response.headers.get("Link"), + } + return json.dumps({"denied": results, "valid": valid}) + + with native_endpoint_server() as port: + profile.endpoints[0].port = port + with ( + imported_provider_profile( + stub, profile=profile, source=f"{profile_id}.yaml" + ), + provider( + stub, + name=f"{profile_id}-provider", + provider_type=profile_id, + credentials={"API_TOKEN": secret}, + profile_workspace="default", + ) as attached_provider, + ): + spec = datamodel_pb2.SandboxSpec( + policy=_default_policy(), providers=[attached_provider] + ) + with sandbox(spec=spec, delete_on_exit=True) as sb: + result = sb.exec_python( + probe_locations, + args=("host.openshell.internal", port), + timeout_seconds=180, + ) + assert result.exit_code == 0, result.stderr + payload = json.loads(result.stdout) + for denied in payload["denied"]: + assert denied["status"] == 403, denied + assert "credential_placement_mismatch" in denied["body"] + assert secret not in denied["body"] + assert denied["link"] is None + assert payload["valid"]["body"]["authorization"] == f"token {secret}" + assert "per_page=1&page=2" in payload["valid"]["link"] + assert secret not in payload["valid"]["link"] + + def test_imported_anthropic_profile_allows_native_endpoint_with_attached_provider( sandbox: Callable[..., Sandbox], sandbox_client: SandboxClient, diff --git a/proto/openshell.proto b/proto/openshell.proto index 44d5ed81ee..e4febb4bf1 100644 --- a/proto/openshell.proto +++ b/proto/openshell.proto @@ -2676,6 +2676,9 @@ message GetSandboxProviderEnvironmentRequest { // metadata. Gateways withhold credentials that require this behavior when // the capability is absent. bool supports_stable_placeholder_environment_keys = 3; + // The supervisor enforces credential-specific request locations. Gateways + // withhold static credential material when this capability is absent. + bool supports_static_credential_placement = 4; } // One network endpoint at which a static provider credential may be resolved. @@ -2685,7 +2688,19 @@ message StaticCredentialEndpointBinding { string path = 3; } -// Endpoint allowlist for one static provider credential environment variable. +// Authorized request location for one static credential. Missing or unknown +// locations must never authorize substitution. Signing-only material may be +// accessed only by the supervisor-owned request signer. +message StaticCredentialPlacement { + oneof location { + string header_name = 1; + string query_param = 2; + string path_template = 3; + bool signing_only = 4; + } +} + +// Endpoint and request-location authorization for one static credential. message StaticCredentialBinding { repeated StaticCredentialEndpointBinding endpoints = 1; // Stable identity of the provider credential that produced this binding. @@ -2695,9 +2710,10 @@ message StaticCredentialBinding { // Opaque gateway-issued handle for a stable credential lifecycle. When // non-empty, supervisors keep the workload placeholder stable across value // updates and replace only the resolver value. The handle changes when the - // sandbox, provider, credential key, endpoint authorization, or an applicable - // refresh authorization epoch changes. + // sandbox, provider, credential key, endpoint or placement authorization, or + // an applicable refresh authorization epoch changes. string workload_credential_handle = 3; + StaticCredentialPlacement placement = 4; } // Polling projection of ProviderEnvironmentSnapshot. The parallel maps below @@ -3150,6 +3166,9 @@ message SupervisorHello { // ConfigUpdate payloads, and answers each with its result and admission. // Gateways push configuration only to supervisors that set this. bool supports_config_push = 7; + // Required for pushed static credential material. Older supervisors fall + // back to polling, which withholds material without this capability. + bool supports_static_credential_placement = 8; } // Gateway accepts the supervisor session. diff --git a/providers/codex.yaml b/providers/codex.yaml index bafc5bd063..1f9278f8f3 100644 --- a/providers/codex.yaml +++ b/providers/codex.yaml @@ -33,17 +33,24 @@ credentials: description: Codex OAuth access token env_vars: [CODEX_AUTH_ACCESS_TOKEN] required: true + auth_style: bearer + header_name: authorization - name: refresh_token description: Codex OAuth refresh token env_vars: [CODEX_AUTH_REFRESH_TOKEN] required: true + # OAuth refresh uses a request body. Static body placement is unsupported, + # so this credential is withheld rather than granted arbitrary placement. - name: account_id description: Codex account identifier env_vars: [CODEX_AUTH_ACCOUNT_ID] required: true + auth_style: header + header_name: chatgpt-account-id - name: id_token description: Codex OAuth ID token env_vars: [CODEX_AUTH_ID_TOKEN] + # Local token inspection has no HTTP placement; this value is withheld. discovery: credentials: [access_token, refresh_token, account_id, id_token] endpoints: diff --git a/sdk/go/proto/openshellv1/openshell.pb.go b/sdk/go/proto/openshellv1/openshell.pb.go index f180617bf6..0db14027d8 100644 --- a/sdk/go/proto/openshellv1/openshell.pb.go +++ b/sdk/go/proto/openshellv1/openshell.pb.go @@ -11335,8 +11335,11 @@ type GetSandboxProviderEnvironmentRequest struct { // metadata. Gateways withhold credentials that require this behavior when // the capability is absent. SupportsStablePlaceholderEnvironmentKeys bool `protobuf:"varint,3,opt,name=supports_stable_placeholder_environment_keys,json=supportsStablePlaceholderEnvironmentKeys,proto3" json:"supports_stable_placeholder_environment_keys,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + // The supervisor enforces credential-specific request locations. Gateways + // withhold static credential material when this capability is absent. + SupportsStaticCredentialPlacement bool `protobuf:"varint,4,opt,name=supports_static_credential_placement,json=supportsStaticCredentialPlacement,proto3" json:"supports_static_credential_placement,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *GetSandboxProviderEnvironmentRequest) Reset() { @@ -11390,6 +11393,13 @@ func (x *GetSandboxProviderEnvironmentRequest) GetSupportsStablePlaceholderEnvir return false } +func (x *GetSandboxProviderEnvironmentRequest) GetSupportsStaticCredentialPlacement() bool { + if x != nil { + return x.SupportsStaticCredentialPlacement + } + return false +} + // One network endpoint at which a static provider credential may be resolved. type StaticCredentialEndpointBinding struct { state protoimpl.MessageState `protogen:"open.v1"` @@ -11451,7 +11461,124 @@ func (x *StaticCredentialEndpointBinding) GetPath() string { return "" } -// Endpoint allowlist for one static provider credential environment variable. +// Authorized request location for one static credential. Missing or unknown +// locations must never authorize substitution. Signing-only material may be +// accessed only by the supervisor-owned request signer. +type StaticCredentialPlacement struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Types that are valid to be assigned to Location: + // + // *StaticCredentialPlacement_HeaderName + // *StaticCredentialPlacement_QueryParam + // *StaticCredentialPlacement_PathTemplate + // *StaticCredentialPlacement_SigningOnly + Location isStaticCredentialPlacement_Location `protobuf_oneof:"location"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *StaticCredentialPlacement) Reset() { + *x = StaticCredentialPlacement{} + mi := &file_openshell_proto_msgTypes[139] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *StaticCredentialPlacement) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*StaticCredentialPlacement) ProtoMessage() {} + +func (x *StaticCredentialPlacement) ProtoReflect() protoreflect.Message { + mi := &file_openshell_proto_msgTypes[139] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use StaticCredentialPlacement.ProtoReflect.Descriptor instead. +func (*StaticCredentialPlacement) Descriptor() ([]byte, []int) { + return file_openshell_proto_rawDescGZIP(), []int{139} +} + +func (x *StaticCredentialPlacement) GetLocation() isStaticCredentialPlacement_Location { + if x != nil { + return x.Location + } + return nil +} + +func (x *StaticCredentialPlacement) GetHeaderName() string { + if x != nil { + if x, ok := x.Location.(*StaticCredentialPlacement_HeaderName); ok { + return x.HeaderName + } + } + return "" +} + +func (x *StaticCredentialPlacement) GetQueryParam() string { + if x != nil { + if x, ok := x.Location.(*StaticCredentialPlacement_QueryParam); ok { + return x.QueryParam + } + } + return "" +} + +func (x *StaticCredentialPlacement) GetPathTemplate() string { + if x != nil { + if x, ok := x.Location.(*StaticCredentialPlacement_PathTemplate); ok { + return x.PathTemplate + } + } + return "" +} + +func (x *StaticCredentialPlacement) GetSigningOnly() bool { + if x != nil { + if x, ok := x.Location.(*StaticCredentialPlacement_SigningOnly); ok { + return x.SigningOnly + } + } + return false +} + +type isStaticCredentialPlacement_Location interface { + isStaticCredentialPlacement_Location() +} + +type StaticCredentialPlacement_HeaderName struct { + HeaderName string `protobuf:"bytes,1,opt,name=header_name,json=headerName,proto3,oneof"` +} + +type StaticCredentialPlacement_QueryParam struct { + QueryParam string `protobuf:"bytes,2,opt,name=query_param,json=queryParam,proto3,oneof"` +} + +type StaticCredentialPlacement_PathTemplate struct { + PathTemplate string `protobuf:"bytes,3,opt,name=path_template,json=pathTemplate,proto3,oneof"` +} + +type StaticCredentialPlacement_SigningOnly struct { + SigningOnly bool `protobuf:"varint,4,opt,name=signing_only,json=signingOnly,proto3,oneof"` +} + +func (*StaticCredentialPlacement_HeaderName) isStaticCredentialPlacement_Location() {} + +func (*StaticCredentialPlacement_QueryParam) isStaticCredentialPlacement_Location() {} + +func (*StaticCredentialPlacement_PathTemplate) isStaticCredentialPlacement_Location() {} + +func (*StaticCredentialPlacement_SigningOnly) isStaticCredentialPlacement_Location() {} + +// Endpoint and request-location authorization for one static credential. type StaticCredentialBinding struct { state protoimpl.MessageState `protogen:"open.v1"` Endpoints []*StaticCredentialEndpointBinding `protobuf:"bytes,1,rep,name=endpoints,proto3" json:"endpoints,omitempty"` @@ -11462,16 +11589,17 @@ type StaticCredentialBinding struct { // Opaque gateway-issued handle for a stable credential lifecycle. When // non-empty, supervisors keep the workload placeholder stable across value // updates and replace only the resolver value. The handle changes when the - // sandbox, provider, credential key, endpoint authorization, or an applicable - // refresh authorization epoch changes. - WorkloadCredentialHandle string `protobuf:"bytes,3,opt,name=workload_credential_handle,json=workloadCredentialHandle,proto3" json:"workload_credential_handle,omitempty"` + // sandbox, provider, credential key, endpoint or placement authorization, or + // an applicable refresh authorization epoch changes. + WorkloadCredentialHandle string `protobuf:"bytes,3,opt,name=workload_credential_handle,json=workloadCredentialHandle,proto3" json:"workload_credential_handle,omitempty"` + Placement *StaticCredentialPlacement `protobuf:"bytes,4,opt,name=placement,proto3" json:"placement,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } func (x *StaticCredentialBinding) Reset() { *x = StaticCredentialBinding{} - mi := &file_openshell_proto_msgTypes[139] + mi := &file_openshell_proto_msgTypes[140] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11483,7 +11611,7 @@ func (x *StaticCredentialBinding) String() string { func (*StaticCredentialBinding) ProtoMessage() {} func (x *StaticCredentialBinding) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[139] + mi := &file_openshell_proto_msgTypes[140] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11496,7 +11624,7 @@ func (x *StaticCredentialBinding) ProtoReflect() protoreflect.Message { // Deprecated: Use StaticCredentialBinding.ProtoReflect.Descriptor instead. func (*StaticCredentialBinding) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{139} + return file_openshell_proto_rawDescGZIP(), []int{140} } func (x *StaticCredentialBinding) GetEndpoints() []*StaticCredentialEndpointBinding { @@ -11520,6 +11648,13 @@ func (x *StaticCredentialBinding) GetWorkloadCredentialHandle() string { return "" } +func (x *StaticCredentialBinding) GetPlacement() *StaticCredentialPlacement { + if x != nil { + return x.Placement + } + return nil +} + // Polling projection of ProviderEnvironmentSnapshot. The parallel maps below // are keyed by the same environment variable names. Removed with the polling // RPCs; new provider environment fields belong on the snapshot first. @@ -11566,7 +11701,7 @@ type GetSandboxProviderEnvironmentResponse struct { func (x *GetSandboxProviderEnvironmentResponse) Reset() { *x = GetSandboxProviderEnvironmentResponse{} - mi := &file_openshell_proto_msgTypes[140] + mi := &file_openshell_proto_msgTypes[141] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11578,7 +11713,7 @@ func (x *GetSandboxProviderEnvironmentResponse) String() string { func (*GetSandboxProviderEnvironmentResponse) ProtoMessage() {} func (x *GetSandboxProviderEnvironmentResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[140] + mi := &file_openshell_proto_msgTypes[141] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11591,7 +11726,7 @@ func (x *GetSandboxProviderEnvironmentResponse) ProtoReflect() protoreflect.Mess // Deprecated: Use GetSandboxProviderEnvironmentResponse.ProtoReflect.Descriptor instead. func (*GetSandboxProviderEnvironmentResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{140} + return file_openshell_proto_rawDescGZIP(), []int{141} } func (x *GetSandboxProviderEnvironmentResponse) GetEnvironment() map[string]string { @@ -11700,7 +11835,7 @@ type ProviderEnvironmentValue struct { func (x *ProviderEnvironmentValue) Reset() { *x = ProviderEnvironmentValue{} - mi := &file_openshell_proto_msgTypes[141] + mi := &file_openshell_proto_msgTypes[142] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11712,7 +11847,7 @@ func (x *ProviderEnvironmentValue) String() string { func (*ProviderEnvironmentValue) ProtoMessage() {} func (x *ProviderEnvironmentValue) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[141] + mi := &file_openshell_proto_msgTypes[142] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11725,7 +11860,7 @@ func (x *ProviderEnvironmentValue) ProtoReflect() protoreflect.Message { // Deprecated: Use ProviderEnvironmentValue.ProtoReflect.Descriptor instead. func (*ProviderEnvironmentValue) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{141} + return file_openshell_proto_rawDescGZIP(), []int{142} } func (x *ProviderEnvironmentValue) GetName() string { @@ -11791,7 +11926,7 @@ type ProviderEnvironmentSnapshot struct { func (x *ProviderEnvironmentSnapshot) Reset() { *x = ProviderEnvironmentSnapshot{} - mi := &file_openshell_proto_msgTypes[142] + mi := &file_openshell_proto_msgTypes[143] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11803,7 +11938,7 @@ func (x *ProviderEnvironmentSnapshot) String() string { func (*ProviderEnvironmentSnapshot) ProtoMessage() {} func (x *ProviderEnvironmentSnapshot) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[142] + mi := &file_openshell_proto_msgTypes[143] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11816,7 +11951,7 @@ func (x *ProviderEnvironmentSnapshot) ProtoReflect() protoreflect.Message { // Deprecated: Use ProviderEnvironmentSnapshot.ProtoReflect.Descriptor instead. func (*ProviderEnvironmentSnapshot) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{142} + return file_openshell_proto_rawDescGZIP(), []int{143} } func (x *ProviderEnvironmentSnapshot) GetProviderEnvRevision() uint64 { @@ -11885,7 +12020,7 @@ type ExchangeProviderSubjectTokenRequest struct { func (x *ExchangeProviderSubjectTokenRequest) Reset() { *x = ExchangeProviderSubjectTokenRequest{} - mi := &file_openshell_proto_msgTypes[143] + mi := &file_openshell_proto_msgTypes[144] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11897,7 +12032,7 @@ func (x *ExchangeProviderSubjectTokenRequest) String() string { func (*ExchangeProviderSubjectTokenRequest) ProtoMessage() {} func (x *ExchangeProviderSubjectTokenRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[143] + mi := &file_openshell_proto_msgTypes[144] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11910,7 +12045,7 @@ func (x *ExchangeProviderSubjectTokenRequest) ProtoReflect() protoreflect.Messag // Deprecated: Use ExchangeProviderSubjectTokenRequest.ProtoReflect.Descriptor instead. func (*ExchangeProviderSubjectTokenRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{143} + return file_openshell_proto_rawDescGZIP(), []int{144} } func (x *ExchangeProviderSubjectTokenRequest) GetSandboxId() string { @@ -11952,7 +12087,7 @@ type ExchangeProviderSubjectTokenResponse struct { func (x *ExchangeProviderSubjectTokenResponse) Reset() { *x = ExchangeProviderSubjectTokenResponse{} - mi := &file_openshell_proto_msgTypes[144] + mi := &file_openshell_proto_msgTypes[145] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11964,7 +12099,7 @@ func (x *ExchangeProviderSubjectTokenResponse) String() string { func (*ExchangeProviderSubjectTokenResponse) ProtoMessage() {} func (x *ExchangeProviderSubjectTokenResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[144] + mi := &file_openshell_proto_msgTypes[145] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11977,7 +12112,7 @@ func (x *ExchangeProviderSubjectTokenResponse) ProtoReflect() protoreflect.Messa // Deprecated: Use ExchangeProviderSubjectTokenResponse.ProtoReflect.Descriptor instead. func (*ExchangeProviderSubjectTokenResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{144} + return file_openshell_proto_rawDescGZIP(), []int{145} } func (x *ExchangeProviderSubjectTokenResponse) GetAccessToken() string { @@ -12051,7 +12186,7 @@ type UpdateConfigRequest struct { func (x *UpdateConfigRequest) Reset() { *x = UpdateConfigRequest{} - mi := &file_openshell_proto_msgTypes[145] + mi := &file_openshell_proto_msgTypes[146] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12063,7 +12198,7 @@ func (x *UpdateConfigRequest) String() string { func (*UpdateConfigRequest) ProtoMessage() {} func (x *UpdateConfigRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[145] + mi := &file_openshell_proto_msgTypes[146] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12076,7 +12211,7 @@ func (x *UpdateConfigRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateConfigRequest.ProtoReflect.Descriptor instead. func (*UpdateConfigRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{145} + return file_openshell_proto_rawDescGZIP(), []int{146} } func (x *UpdateConfigRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -12173,7 +12308,7 @@ type PolicyMergeOperation struct { func (x *PolicyMergeOperation) Reset() { *x = PolicyMergeOperation{} - mi := &file_openshell_proto_msgTypes[146] + mi := &file_openshell_proto_msgTypes[147] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12185,7 +12320,7 @@ func (x *PolicyMergeOperation) String() string { func (*PolicyMergeOperation) ProtoMessage() {} func (x *PolicyMergeOperation) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[146] + mi := &file_openshell_proto_msgTypes[147] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12198,7 +12333,7 @@ func (x *PolicyMergeOperation) ProtoReflect() protoreflect.Message { // Deprecated: Use PolicyMergeOperation.ProtoReflect.Descriptor instead. func (*PolicyMergeOperation) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{146} + return file_openshell_proto_rawDescGZIP(), []int{147} } func (x *PolicyMergeOperation) GetOperation() isPolicyMergeOperation_Operation { @@ -12312,7 +12447,7 @@ type AddNetworkRule struct { func (x *AddNetworkRule) Reset() { *x = AddNetworkRule{} - mi := &file_openshell_proto_msgTypes[147] + mi := &file_openshell_proto_msgTypes[148] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12324,7 +12459,7 @@ func (x *AddNetworkRule) String() string { func (*AddNetworkRule) ProtoMessage() {} func (x *AddNetworkRule) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[147] + mi := &file_openshell_proto_msgTypes[148] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12337,7 +12472,7 @@ func (x *AddNetworkRule) ProtoReflect() protoreflect.Message { // Deprecated: Use AddNetworkRule.ProtoReflect.Descriptor instead. func (*AddNetworkRule) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{147} + return file_openshell_proto_rawDescGZIP(), []int{148} } func (x *AddNetworkRule) GetRuleName() string { @@ -12365,7 +12500,7 @@ type RemoveNetworkEndpoint struct { func (x *RemoveNetworkEndpoint) Reset() { *x = RemoveNetworkEndpoint{} - mi := &file_openshell_proto_msgTypes[148] + mi := &file_openshell_proto_msgTypes[149] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12377,7 +12512,7 @@ func (x *RemoveNetworkEndpoint) String() string { func (*RemoveNetworkEndpoint) ProtoMessage() {} func (x *RemoveNetworkEndpoint) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[148] + mi := &file_openshell_proto_msgTypes[149] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12390,7 +12525,7 @@ func (x *RemoveNetworkEndpoint) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveNetworkEndpoint.ProtoReflect.Descriptor instead. func (*RemoveNetworkEndpoint) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{148} + return file_openshell_proto_rawDescGZIP(), []int{149} } func (x *RemoveNetworkEndpoint) GetRuleName() string { @@ -12423,7 +12558,7 @@ type RemoveNetworkRule struct { func (x *RemoveNetworkRule) Reset() { *x = RemoveNetworkRule{} - mi := &file_openshell_proto_msgTypes[149] + mi := &file_openshell_proto_msgTypes[150] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12435,7 +12570,7 @@ func (x *RemoveNetworkRule) String() string { func (*RemoveNetworkRule) ProtoMessage() {} func (x *RemoveNetworkRule) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[149] + mi := &file_openshell_proto_msgTypes[150] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12448,7 +12583,7 @@ func (x *RemoveNetworkRule) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveNetworkRule.ProtoReflect.Descriptor instead. func (*RemoveNetworkRule) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{149} + return file_openshell_proto_rawDescGZIP(), []int{150} } func (x *RemoveNetworkRule) GetRuleName() string { @@ -12477,7 +12612,7 @@ type L7RuleTarget struct { func (x *L7RuleTarget) Reset() { *x = L7RuleTarget{} - mi := &file_openshell_proto_msgTypes[150] + mi := &file_openshell_proto_msgTypes[151] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12489,7 +12624,7 @@ func (x *L7RuleTarget) String() string { func (*L7RuleTarget) ProtoMessage() {} func (x *L7RuleTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[150] + mi := &file_openshell_proto_msgTypes[151] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12502,7 +12637,7 @@ func (x *L7RuleTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use L7RuleTarget.ProtoReflect.Descriptor instead. func (*L7RuleTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{150} + return file_openshell_proto_rawDescGZIP(), []int{151} } func (x *L7RuleTarget) GetRuleName() string { @@ -12557,7 +12692,7 @@ type AddDenyRules struct { func (x *AddDenyRules) Reset() { *x = AddDenyRules{} - mi := &file_openshell_proto_msgTypes[151] + mi := &file_openshell_proto_msgTypes[152] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12569,7 +12704,7 @@ func (x *AddDenyRules) String() string { func (*AddDenyRules) ProtoMessage() {} func (x *AddDenyRules) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[151] + mi := &file_openshell_proto_msgTypes[152] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12582,7 +12717,7 @@ func (x *AddDenyRules) ProtoReflect() protoreflect.Message { // Deprecated: Use AddDenyRules.ProtoReflect.Descriptor instead. func (*AddDenyRules) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{151} + return file_openshell_proto_rawDescGZIP(), []int{152} } func (x *AddDenyRules) GetDenyRules() []*sandboxv1.L7DenyRule { @@ -12609,7 +12744,7 @@ type AddAllowRules struct { func (x *AddAllowRules) Reset() { *x = AddAllowRules{} - mi := &file_openshell_proto_msgTypes[152] + mi := &file_openshell_proto_msgTypes[153] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12621,7 +12756,7 @@ func (x *AddAllowRules) String() string { func (*AddAllowRules) ProtoMessage() {} func (x *AddAllowRules) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[152] + mi := &file_openshell_proto_msgTypes[153] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12634,7 +12769,7 @@ func (x *AddAllowRules) ProtoReflect() protoreflect.Message { // Deprecated: Use AddAllowRules.ProtoReflect.Descriptor instead. func (*AddAllowRules) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{152} + return file_openshell_proto_rawDescGZIP(), []int{153} } func (x *AddAllowRules) GetRules() []*sandboxv1.L7Rule { @@ -12661,7 +12796,7 @@ type RemoveNetworkBinary struct { func (x *RemoveNetworkBinary) Reset() { *x = RemoveNetworkBinary{} - mi := &file_openshell_proto_msgTypes[153] + mi := &file_openshell_proto_msgTypes[154] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12673,7 +12808,7 @@ func (x *RemoveNetworkBinary) String() string { func (*RemoveNetworkBinary) ProtoMessage() {} func (x *RemoveNetworkBinary) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[153] + mi := &file_openshell_proto_msgTypes[154] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12686,7 +12821,7 @@ func (x *RemoveNetworkBinary) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveNetworkBinary.ProtoReflect.Descriptor instead. func (*RemoveNetworkBinary) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{153} + return file_openshell_proto_rawDescGZIP(), []int{154} } func (x *RemoveNetworkBinary) GetRuleName() string { @@ -12722,7 +12857,7 @@ type UpdateConfigResponse struct { func (x *UpdateConfigResponse) Reset() { *x = UpdateConfigResponse{} - mi := &file_openshell_proto_msgTypes[154] + mi := &file_openshell_proto_msgTypes[155] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12734,7 +12869,7 @@ func (x *UpdateConfigResponse) String() string { func (*UpdateConfigResponse) ProtoMessage() {} func (x *UpdateConfigResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[154] + mi := &file_openshell_proto_msgTypes[155] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12747,7 +12882,7 @@ func (x *UpdateConfigResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateConfigResponse.ProtoReflect.Descriptor instead. func (*UpdateConfigResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{154} + return file_openshell_proto_rawDescGZIP(), []int{155} } func (x *UpdateConfigResponse) GetVersion() uint32 { @@ -12801,7 +12936,7 @@ type GetSandboxPolicyStatusRequest struct { func (x *GetSandboxPolicyStatusRequest) Reset() { *x = GetSandboxPolicyStatusRequest{} - mi := &file_openshell_proto_msgTypes[155] + mi := &file_openshell_proto_msgTypes[156] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12813,7 +12948,7 @@ func (x *GetSandboxPolicyStatusRequest) String() string { func (*GetSandboxPolicyStatusRequest) ProtoMessage() {} func (x *GetSandboxPolicyStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[155] + mi := &file_openshell_proto_msgTypes[156] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12826,7 +12961,7 @@ func (x *GetSandboxPolicyStatusRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetSandboxPolicyStatusRequest.ProtoReflect.Descriptor instead. func (*GetSandboxPolicyStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{155} + return file_openshell_proto_rawDescGZIP(), []int{156} } func (x *GetSandboxPolicyStatusRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -12870,7 +13005,7 @@ type GetSandboxPolicyStatusResponse struct { func (x *GetSandboxPolicyStatusResponse) Reset() { *x = GetSandboxPolicyStatusResponse{} - mi := &file_openshell_proto_msgTypes[156] + mi := &file_openshell_proto_msgTypes[157] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12882,7 +13017,7 @@ func (x *GetSandboxPolicyStatusResponse) String() string { func (*GetSandboxPolicyStatusResponse) ProtoMessage() {} func (x *GetSandboxPolicyStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[156] + mi := &file_openshell_proto_msgTypes[157] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12895,7 +13030,7 @@ func (x *GetSandboxPolicyStatusResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetSandboxPolicyStatusResponse.ProtoReflect.Descriptor instead. func (*GetSandboxPolicyStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{156} + return file_openshell_proto_rawDescGZIP(), []int{157} } func (x *GetSandboxPolicyStatusResponse) GetRevision() *SandboxPolicyRevision { @@ -12932,7 +13067,7 @@ type ListSandboxPoliciesRequest struct { func (x *ListSandboxPoliciesRequest) Reset() { *x = ListSandboxPoliciesRequest{} - mi := &file_openshell_proto_msgTypes[157] + mi := &file_openshell_proto_msgTypes[158] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12944,7 +13079,7 @@ func (x *ListSandboxPoliciesRequest) String() string { func (*ListSandboxPoliciesRequest) ProtoMessage() {} func (x *ListSandboxPoliciesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[157] + mi := &file_openshell_proto_msgTypes[158] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12957,7 +13092,7 @@ func (x *ListSandboxPoliciesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListSandboxPoliciesRequest.ProtoReflect.Descriptor instead. func (*ListSandboxPoliciesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{157} + return file_openshell_proto_rawDescGZIP(), []int{158} } func (x *ListSandboxPoliciesRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -13009,7 +13144,7 @@ type ListSandboxPoliciesResponse struct { func (x *ListSandboxPoliciesResponse) Reset() { *x = ListSandboxPoliciesResponse{} - mi := &file_openshell_proto_msgTypes[158] + mi := &file_openshell_proto_msgTypes[159] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13021,7 +13156,7 @@ func (x *ListSandboxPoliciesResponse) String() string { func (*ListSandboxPoliciesResponse) ProtoMessage() {} func (x *ListSandboxPoliciesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[158] + mi := &file_openshell_proto_msgTypes[159] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13034,7 +13169,7 @@ func (x *ListSandboxPoliciesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListSandboxPoliciesResponse.ProtoReflect.Descriptor instead. func (*ListSandboxPoliciesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{158} + return file_openshell_proto_rawDescGZIP(), []int{159} } func (x *ListSandboxPoliciesResponse) GetRevisions() []*SandboxPolicyRevision { @@ -13068,7 +13203,7 @@ type ReportPolicyStatusRequest struct { func (x *ReportPolicyStatusRequest) Reset() { *x = ReportPolicyStatusRequest{} - mi := &file_openshell_proto_msgTypes[159] + mi := &file_openshell_proto_msgTypes[160] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13080,7 +13215,7 @@ func (x *ReportPolicyStatusRequest) String() string { func (*ReportPolicyStatusRequest) ProtoMessage() {} func (x *ReportPolicyStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[159] + mi := &file_openshell_proto_msgTypes[160] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13093,7 +13228,7 @@ func (x *ReportPolicyStatusRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportPolicyStatusRequest.ProtoReflect.Descriptor instead. func (*ReportPolicyStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{159} + return file_openshell_proto_rawDescGZIP(), []int{160} } func (x *ReportPolicyStatusRequest) GetSandboxId() string { @@ -13133,7 +13268,7 @@ type ReportPolicyStatusResponse struct { func (x *ReportPolicyStatusResponse) Reset() { *x = ReportPolicyStatusResponse{} - mi := &file_openshell_proto_msgTypes[160] + mi := &file_openshell_proto_msgTypes[161] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13145,7 +13280,7 @@ func (x *ReportPolicyStatusResponse) String() string { func (*ReportPolicyStatusResponse) ProtoMessage() {} func (x *ReportPolicyStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[160] + mi := &file_openshell_proto_msgTypes[161] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13158,7 +13293,7 @@ func (x *ReportPolicyStatusResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportPolicyStatusResponse.ProtoReflect.Descriptor instead. func (*ReportPolicyStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{160} + return file_openshell_proto_rawDescGZIP(), []int{161} } type SandboxConfigurationAdmission struct { @@ -13176,7 +13311,7 @@ type SandboxConfigurationAdmission struct { func (x *SandboxConfigurationAdmission) Reset() { *x = SandboxConfigurationAdmission{} - mi := &file_openshell_proto_msgTypes[161] + mi := &file_openshell_proto_msgTypes[162] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13188,7 +13323,7 @@ func (x *SandboxConfigurationAdmission) String() string { func (*SandboxConfigurationAdmission) ProtoMessage() {} func (x *SandboxConfigurationAdmission) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[161] + mi := &file_openshell_proto_msgTypes[162] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13201,7 +13336,7 @@ func (x *SandboxConfigurationAdmission) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxConfigurationAdmission.ProtoReflect.Descriptor instead. func (*SandboxConfigurationAdmission) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{161} + return file_openshell_proto_rawDescGZIP(), []int{162} } func (x *SandboxConfigurationAdmission) GetInstanceId() string { @@ -13265,7 +13400,7 @@ type ReportSandboxConfigurationRequest struct { func (x *ReportSandboxConfigurationRequest) Reset() { *x = ReportSandboxConfigurationRequest{} - mi := &file_openshell_proto_msgTypes[162] + mi := &file_openshell_proto_msgTypes[163] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13277,7 +13412,7 @@ func (x *ReportSandboxConfigurationRequest) String() string { func (*ReportSandboxConfigurationRequest) ProtoMessage() {} func (x *ReportSandboxConfigurationRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[162] + mi := &file_openshell_proto_msgTypes[163] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13290,7 +13425,7 @@ func (x *ReportSandboxConfigurationRequest) ProtoReflect() protoreflect.Message // Deprecated: Use ReportSandboxConfigurationRequest.ProtoReflect.Descriptor instead. func (*ReportSandboxConfigurationRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{162} + return file_openshell_proto_rawDescGZIP(), []int{163} } func (x *ReportSandboxConfigurationRequest) GetSandboxId() string { @@ -13322,7 +13457,7 @@ type ReportSandboxConfigurationResponse struct { func (x *ReportSandboxConfigurationResponse) Reset() { *x = ReportSandboxConfigurationResponse{} - mi := &file_openshell_proto_msgTypes[163] + mi := &file_openshell_proto_msgTypes[164] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13334,7 +13469,7 @@ func (x *ReportSandboxConfigurationResponse) String() string { func (*ReportSandboxConfigurationResponse) ProtoMessage() {} func (x *ReportSandboxConfigurationResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[163] + mi := &file_openshell_proto_msgTypes[164] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13347,7 +13482,7 @@ func (x *ReportSandboxConfigurationResponse) ProtoReflect() protoreflect.Message // Deprecated: Use ReportSandboxConfigurationResponse.ProtoReflect.Descriptor instead. func (*ReportSandboxConfigurationResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{163} + return file_openshell_proto_rawDescGZIP(), []int{164} } // A versioned policy revision with metadata. @@ -13380,7 +13515,7 @@ type SandboxPolicyRevision struct { func (x *SandboxPolicyRevision) Reset() { *x = SandboxPolicyRevision{} - mi := &file_openshell_proto_msgTypes[164] + mi := &file_openshell_proto_msgTypes[165] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13392,7 +13527,7 @@ func (x *SandboxPolicyRevision) String() string { func (*SandboxPolicyRevision) ProtoMessage() {} func (x *SandboxPolicyRevision) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[164] + mi := &file_openshell_proto_msgTypes[165] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13405,7 +13540,7 @@ func (x *SandboxPolicyRevision) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxPolicyRevision.ProtoReflect.Descriptor instead. func (*SandboxPolicyRevision) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{164} + return file_openshell_proto_rawDescGZIP(), []int{165} } func (x *SandboxPolicyRevision) GetVersion() uint32 { @@ -13485,7 +13620,7 @@ type GetSandboxLogsRequest struct { func (x *GetSandboxLogsRequest) Reset() { *x = GetSandboxLogsRequest{} - mi := &file_openshell_proto_msgTypes[165] + mi := &file_openshell_proto_msgTypes[166] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13497,7 +13632,7 @@ func (x *GetSandboxLogsRequest) String() string { func (*GetSandboxLogsRequest) ProtoMessage() {} func (x *GetSandboxLogsRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[165] + mi := &file_openshell_proto_msgTypes[166] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13510,7 +13645,7 @@ func (x *GetSandboxLogsRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetSandboxLogsRequest.ProtoReflect.Descriptor instead. func (*GetSandboxLogsRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{165} + return file_openshell_proto_rawDescGZIP(), []int{166} } func (x *GetSandboxLogsRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -13568,7 +13703,7 @@ type PushSandboxLogsRequest struct { func (x *PushSandboxLogsRequest) Reset() { *x = PushSandboxLogsRequest{} - mi := &file_openshell_proto_msgTypes[166] + mi := &file_openshell_proto_msgTypes[167] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13580,7 +13715,7 @@ func (x *PushSandboxLogsRequest) String() string { func (*PushSandboxLogsRequest) ProtoMessage() {} func (x *PushSandboxLogsRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[166] + mi := &file_openshell_proto_msgTypes[167] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13593,7 +13728,7 @@ func (x *PushSandboxLogsRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use PushSandboxLogsRequest.ProtoReflect.Descriptor instead. func (*PushSandboxLogsRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{166} + return file_openshell_proto_rawDescGZIP(), []int{167} } func (x *PushSandboxLogsRequest) GetSandboxId() string { @@ -13619,7 +13754,7 @@ type PushSandboxLogsResponse struct { func (x *PushSandboxLogsResponse) Reset() { *x = PushSandboxLogsResponse{} - mi := &file_openshell_proto_msgTypes[167] + mi := &file_openshell_proto_msgTypes[168] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13631,7 +13766,7 @@ func (x *PushSandboxLogsResponse) String() string { func (*PushSandboxLogsResponse) ProtoMessage() {} func (x *PushSandboxLogsResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[167] + mi := &file_openshell_proto_msgTypes[168] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13644,7 +13779,7 @@ func (x *PushSandboxLogsResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use PushSandboxLogsResponse.ProtoReflect.Descriptor instead. func (*PushSandboxLogsResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{167} + return file_openshell_proto_rawDescGZIP(), []int{168} } // Get sandbox logs response. @@ -13660,7 +13795,7 @@ type GetSandboxLogsResponse struct { func (x *GetSandboxLogsResponse) Reset() { *x = GetSandboxLogsResponse{} - mi := &file_openshell_proto_msgTypes[168] + mi := &file_openshell_proto_msgTypes[169] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13672,7 +13807,7 @@ func (x *GetSandboxLogsResponse) String() string { func (*GetSandboxLogsResponse) ProtoMessage() {} func (x *GetSandboxLogsResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[168] + mi := &file_openshell_proto_msgTypes[169] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13685,7 +13820,7 @@ func (x *GetSandboxLogsResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetSandboxLogsResponse.ProtoReflect.Descriptor instead. func (*GetSandboxLogsResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{168} + return file_openshell_proto_rawDescGZIP(), []int{169} } func (x *GetSandboxLogsResponse) GetLogs() []*SandboxLogLine { @@ -13719,7 +13854,7 @@ type SupervisorMessage struct { func (x *SupervisorMessage) Reset() { *x = SupervisorMessage{} - mi := &file_openshell_proto_msgTypes[169] + mi := &file_openshell_proto_msgTypes[170] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13731,7 +13866,7 @@ func (x *SupervisorMessage) String() string { func (*SupervisorMessage) ProtoMessage() {} func (x *SupervisorMessage) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[169] + mi := &file_openshell_proto_msgTypes[170] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13744,7 +13879,7 @@ func (x *SupervisorMessage) ProtoReflect() protoreflect.Message { // Deprecated: Use SupervisorMessage.ProtoReflect.Descriptor instead. func (*SupervisorMessage) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{169} + return file_openshell_proto_rawDescGZIP(), []int{170} } func (x *SupervisorMessage) GetPayload() isSupervisorMessage_Payload { @@ -13852,7 +13987,7 @@ type GatewayMessage struct { func (x *GatewayMessage) Reset() { *x = GatewayMessage{} - mi := &file_openshell_proto_msgTypes[170] + mi := &file_openshell_proto_msgTypes[171] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13864,7 +13999,7 @@ func (x *GatewayMessage) String() string { func (*GatewayMessage) ProtoMessage() {} func (x *GatewayMessage) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[170] + mi := &file_openshell_proto_msgTypes[171] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13877,7 +14012,7 @@ func (x *GatewayMessage) ProtoReflect() protoreflect.Message { // Deprecated: Use GatewayMessage.ProtoReflect.Descriptor instead. func (*GatewayMessage) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{170} + return file_openshell_proto_rawDescGZIP(), []int{171} } func (x *GatewayMessage) GetPayload() isGatewayMessage_Payload { @@ -14021,13 +14156,16 @@ type SupervisorHello struct { // ConfigUpdate payloads, and answers each with its result and admission. // Gateways push configuration only to supervisors that set this. SupportsConfigPush bool `protobuf:"varint,7,opt,name=supports_config_push,json=supportsConfigPush,proto3" json:"supports_config_push,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + // Required for pushed static credential material. Older supervisors fall + // back to polling, which withholds material without this capability. + SupportsStaticCredentialPlacement bool `protobuf:"varint,8,opt,name=supports_static_credential_placement,json=supportsStaticCredentialPlacement,proto3" json:"supports_static_credential_placement,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *SupervisorHello) Reset() { *x = SupervisorHello{} - mi := &file_openshell_proto_msgTypes[171] + mi := &file_openshell_proto_msgTypes[172] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14039,7 +14177,7 @@ func (x *SupervisorHello) String() string { func (*SupervisorHello) ProtoMessage() {} func (x *SupervisorHello) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[171] + mi := &file_openshell_proto_msgTypes[172] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14052,7 +14190,7 @@ func (x *SupervisorHello) ProtoReflect() protoreflect.Message { // Deprecated: Use SupervisorHello.ProtoReflect.Descriptor instead. func (*SupervisorHello) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{171} + return file_openshell_proto_rawDescGZIP(), []int{172} } func (x *SupervisorHello) GetSandboxId() string { @@ -14104,6 +14242,13 @@ func (x *SupervisorHello) GetSupportsConfigPush() bool { return false } +func (x *SupervisorHello) GetSupportsStaticCredentialPlacement() bool { + if x != nil { + return x.SupportsStaticCredentialPlacement + } + return false +} + // Gateway accepts the supervisor session. type SessionAccepted struct { state protoimpl.MessageState `protogen:"open.v1"` @@ -14125,7 +14270,7 @@ type SessionAccepted struct { func (x *SessionAccepted) Reset() { *x = SessionAccepted{} - mi := &file_openshell_proto_msgTypes[172] + mi := &file_openshell_proto_msgTypes[173] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14137,7 +14282,7 @@ func (x *SessionAccepted) String() string { func (*SessionAccepted) ProtoMessage() {} func (x *SessionAccepted) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[172] + mi := &file_openshell_proto_msgTypes[173] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14150,7 +14295,7 @@ func (x *SessionAccepted) ProtoReflect() protoreflect.Message { // Deprecated: Use SessionAccepted.ProtoReflect.Descriptor instead. func (*SessionAccepted) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{172} + return file_openshell_proto_rawDescGZIP(), []int{173} } func (x *SessionAccepted) GetSessionId() string { @@ -14199,7 +14344,7 @@ type ConfigUpdate struct { func (x *ConfigUpdate) Reset() { *x = ConfigUpdate{} - mi := &file_openshell_proto_msgTypes[173] + mi := &file_openshell_proto_msgTypes[174] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14211,7 +14356,7 @@ func (x *ConfigUpdate) String() string { func (*ConfigUpdate) ProtoMessage() {} func (x *ConfigUpdate) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[173] + mi := &file_openshell_proto_msgTypes[174] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14224,7 +14369,7 @@ func (x *ConfigUpdate) ProtoReflect() protoreflect.Message { // Deprecated: Use ConfigUpdate.ProtoReflect.Descriptor instead. func (*ConfigUpdate) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{173} + return file_openshell_proto_rawDescGZIP(), []int{174} } func (x *ConfigUpdate) GetUpdateId() string { @@ -14261,7 +14406,7 @@ type ConfigApplyFailure struct { func (x *ConfigApplyFailure) Reset() { *x = ConfigApplyFailure{} - mi := &file_openshell_proto_msgTypes[174] + mi := &file_openshell_proto_msgTypes[175] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14273,7 +14418,7 @@ func (x *ConfigApplyFailure) String() string { func (*ConfigApplyFailure) ProtoMessage() {} func (x *ConfigApplyFailure) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[174] + mi := &file_openshell_proto_msgTypes[175] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14286,7 +14431,7 @@ func (x *ConfigApplyFailure) ProtoReflect() protoreflect.Message { // Deprecated: Use ConfigApplyFailure.ProtoReflect.Descriptor instead. func (*ConfigApplyFailure) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{174} + return file_openshell_proto_rawDescGZIP(), []int{175} } func (x *ConfigApplyFailure) GetCode() string { @@ -14330,7 +14475,7 @@ type ConfigUpdateResult struct { func (x *ConfigUpdateResult) Reset() { *x = ConfigUpdateResult{} - mi := &file_openshell_proto_msgTypes[175] + mi := &file_openshell_proto_msgTypes[176] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14342,7 +14487,7 @@ func (x *ConfigUpdateResult) String() string { func (*ConfigUpdateResult) ProtoMessage() {} func (x *ConfigUpdateResult) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[175] + mi := &file_openshell_proto_msgTypes[176] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14355,7 +14500,7 @@ func (x *ConfigUpdateResult) ProtoReflect() protoreflect.Message { // Deprecated: Use ConfigUpdateResult.ProtoReflect.Descriptor instead. func (*ConfigUpdateResult) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{175} + return file_openshell_proto_rawDescGZIP(), []int{176} } func (x *ConfigUpdateResult) GetUpdateId() string { @@ -14406,7 +14551,7 @@ type PolicyLoadResult struct { func (x *PolicyLoadResult) Reset() { *x = PolicyLoadResult{} - mi := &file_openshell_proto_msgTypes[176] + mi := &file_openshell_proto_msgTypes[177] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14418,7 +14563,7 @@ func (x *PolicyLoadResult) String() string { func (*PolicyLoadResult) ProtoMessage() {} func (x *PolicyLoadResult) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[176] + mi := &file_openshell_proto_msgTypes[177] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14431,7 +14576,7 @@ func (x *PolicyLoadResult) ProtoReflect() protoreflect.Message { // Deprecated: Use PolicyLoadResult.ProtoReflect.Descriptor instead. func (*PolicyLoadResult) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{176} + return file_openshell_proto_rawDescGZIP(), []int{177} } func (x *PolicyLoadResult) GetVersion() uint32 { @@ -14466,7 +14611,7 @@ type SessionRejected struct { func (x *SessionRejected) Reset() { *x = SessionRejected{} - mi := &file_openshell_proto_msgTypes[177] + mi := &file_openshell_proto_msgTypes[178] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14478,7 +14623,7 @@ func (x *SessionRejected) String() string { func (*SessionRejected) ProtoMessage() {} func (x *SessionRejected) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[177] + mi := &file_openshell_proto_msgTypes[178] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14491,7 +14636,7 @@ func (x *SessionRejected) ProtoReflect() protoreflect.Message { // Deprecated: Use SessionRejected.ProtoReflect.Descriptor instead. func (*SessionRejected) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{177} + return file_openshell_proto_rawDescGZIP(), []int{178} } func (x *SessionRejected) GetReason() string { @@ -14520,7 +14665,7 @@ type SessionRedirect struct { func (x *SessionRedirect) Reset() { *x = SessionRedirect{} - mi := &file_openshell_proto_msgTypes[178] + mi := &file_openshell_proto_msgTypes[179] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14532,7 +14677,7 @@ func (x *SessionRedirect) String() string { func (*SessionRedirect) ProtoMessage() {} func (x *SessionRedirect) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[178] + mi := &file_openshell_proto_msgTypes[179] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14545,7 +14690,7 @@ func (x *SessionRedirect) ProtoReflect() protoreflect.Message { // Deprecated: Use SessionRedirect.ProtoReflect.Descriptor instead. func (*SessionRedirect) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{178} + return file_openshell_proto_rawDescGZIP(), []int{179} } func (x *SessionRedirect) GetPeerEndpoint() string { @@ -14571,7 +14716,7 @@ type SupervisorHeartbeat struct { func (x *SupervisorHeartbeat) Reset() { *x = SupervisorHeartbeat{} - mi := &file_openshell_proto_msgTypes[179] + mi := &file_openshell_proto_msgTypes[180] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14583,7 +14728,7 @@ func (x *SupervisorHeartbeat) String() string { func (*SupervisorHeartbeat) ProtoMessage() {} func (x *SupervisorHeartbeat) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[179] + mi := &file_openshell_proto_msgTypes[180] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14596,7 +14741,7 @@ func (x *SupervisorHeartbeat) ProtoReflect() protoreflect.Message { // Deprecated: Use SupervisorHeartbeat.ProtoReflect.Descriptor instead. func (*SupervisorHeartbeat) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{179} + return file_openshell_proto_rawDescGZIP(), []int{180} } // Gateway heartbeat. @@ -14608,7 +14753,7 @@ type GatewayHeartbeat struct { func (x *GatewayHeartbeat) Reset() { *x = GatewayHeartbeat{} - mi := &file_openshell_proto_msgTypes[180] + mi := &file_openshell_proto_msgTypes[181] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14620,7 +14765,7 @@ func (x *GatewayHeartbeat) String() string { func (*GatewayHeartbeat) ProtoMessage() {} func (x *GatewayHeartbeat) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[180] + mi := &file_openshell_proto_msgTypes[181] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14633,7 +14778,7 @@ func (x *GatewayHeartbeat) ProtoReflect() protoreflect.Message { // Deprecated: Use GatewayHeartbeat.ProtoReflect.Descriptor instead. func (*GatewayHeartbeat) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{180} + return file_openshell_proto_rawDescGZIP(), []int{181} } // Terminal result reported before the supervisor shuts down. A successful RPC @@ -14650,7 +14795,7 @@ type ReportMainProcessExitRequest struct { func (x *ReportMainProcessExitRequest) Reset() { *x = ReportMainProcessExitRequest{} - mi := &file_openshell_proto_msgTypes[181] + mi := &file_openshell_proto_msgTypes[182] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14662,7 +14807,7 @@ func (x *ReportMainProcessExitRequest) String() string { func (*ReportMainProcessExitRequest) ProtoMessage() {} func (x *ReportMainProcessExitRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[181] + mi := &file_openshell_proto_msgTypes[182] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14675,7 +14820,7 @@ func (x *ReportMainProcessExitRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportMainProcessExitRequest.ProtoReflect.Descriptor instead. func (*ReportMainProcessExitRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{181} + return file_openshell_proto_rawDescGZIP(), []int{182} } func (x *ReportMainProcessExitRequest) GetSandboxId() string { @@ -14707,7 +14852,7 @@ type ReportMainProcessExitResponse struct { func (x *ReportMainProcessExitResponse) Reset() { *x = ReportMainProcessExitResponse{} - mi := &file_openshell_proto_msgTypes[182] + mi := &file_openshell_proto_msgTypes[183] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14719,7 +14864,7 @@ func (x *ReportMainProcessExitResponse) String() string { func (*ReportMainProcessExitResponse) ProtoMessage() {} func (x *ReportMainProcessExitResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[182] + mi := &file_openshell_proto_msgTypes[183] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14732,7 +14877,7 @@ func (x *ReportMainProcessExitResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportMainProcessExitResponse.ProtoReflect.Descriptor instead. func (*ReportMainProcessExitResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{182} + return file_openshell_proto_rawDescGZIP(), []int{183} } // Terminal-delivery completion reported after all expected foreground SSH @@ -14747,7 +14892,7 @@ type FinalizeMainProcessExitRequest struct { func (x *FinalizeMainProcessExitRequest) Reset() { *x = FinalizeMainProcessExitRequest{} - mi := &file_openshell_proto_msgTypes[183] + mi := &file_openshell_proto_msgTypes[184] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14759,7 +14904,7 @@ func (x *FinalizeMainProcessExitRequest) String() string { func (*FinalizeMainProcessExitRequest) ProtoMessage() {} func (x *FinalizeMainProcessExitRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[183] + mi := &file_openshell_proto_msgTypes[184] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14772,7 +14917,7 @@ func (x *FinalizeMainProcessExitRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use FinalizeMainProcessExitRequest.ProtoReflect.Descriptor instead. func (*FinalizeMainProcessExitRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{183} + return file_openshell_proto_rawDescGZIP(), []int{184} } func (x *FinalizeMainProcessExitRequest) GetSandboxId() string { @@ -14797,7 +14942,7 @@ type FinalizeMainProcessExitResponse struct { func (x *FinalizeMainProcessExitResponse) Reset() { *x = FinalizeMainProcessExitResponse{} - mi := &file_openshell_proto_msgTypes[184] + mi := &file_openshell_proto_msgTypes[185] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14809,7 +14954,7 @@ func (x *FinalizeMainProcessExitResponse) String() string { func (*FinalizeMainProcessExitResponse) ProtoMessage() {} func (x *FinalizeMainProcessExitResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[184] + mi := &file_openshell_proto_msgTypes[185] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14822,7 +14967,7 @@ func (x *FinalizeMainProcessExitResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use FinalizeMainProcessExitResponse.ProtoReflect.Descriptor instead. func (*FinalizeMainProcessExitResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{184} + return file_openshell_proto_rawDescGZIP(), []int{185} } // Gateway requests the supervisor to open a relay channel. @@ -14851,7 +14996,7 @@ type RelayOpen struct { func (x *RelayOpen) Reset() { *x = RelayOpen{} - mi := &file_openshell_proto_msgTypes[185] + mi := &file_openshell_proto_msgTypes[186] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14863,7 +15008,7 @@ func (x *RelayOpen) String() string { func (*RelayOpen) ProtoMessage() {} func (x *RelayOpen) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[185] + mi := &file_openshell_proto_msgTypes[186] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14876,7 +15021,7 @@ func (x *RelayOpen) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayOpen.ProtoReflect.Descriptor instead. func (*RelayOpen) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{185} + return file_openshell_proto_rawDescGZIP(), []int{186} } func (x *RelayOpen) GetChannelId() string { @@ -14943,7 +15088,7 @@ type SshRelayTarget struct { func (x *SshRelayTarget) Reset() { *x = SshRelayTarget{} - mi := &file_openshell_proto_msgTypes[186] + mi := &file_openshell_proto_msgTypes[187] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14955,7 +15100,7 @@ func (x *SshRelayTarget) String() string { func (*SshRelayTarget) ProtoMessage() {} func (x *SshRelayTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[186] + mi := &file_openshell_proto_msgTypes[187] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14968,7 +15113,7 @@ func (x *SshRelayTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use SshRelayTarget.ProtoReflect.Descriptor instead. func (*SshRelayTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{186} + return file_openshell_proto_rawDescGZIP(), []int{187} } // TCP target dialed by the supervisor from inside the sandbox. @@ -14984,7 +15129,7 @@ type TcpRelayTarget struct { func (x *TcpRelayTarget) Reset() { *x = TcpRelayTarget{} - mi := &file_openshell_proto_msgTypes[187] + mi := &file_openshell_proto_msgTypes[188] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14996,7 +15141,7 @@ func (x *TcpRelayTarget) String() string { func (*TcpRelayTarget) ProtoMessage() {} func (x *TcpRelayTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[187] + mi := &file_openshell_proto_msgTypes[188] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15009,7 +15154,7 @@ func (x *TcpRelayTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use TcpRelayTarget.ProtoReflect.Descriptor instead. func (*TcpRelayTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{187} + return file_openshell_proto_rawDescGZIP(), []int{188} } func (x *TcpRelayTarget) GetHost() string { @@ -15037,7 +15182,7 @@ type RelayInit struct { func (x *RelayInit) Reset() { *x = RelayInit{} - mi := &file_openshell_proto_msgTypes[188] + mi := &file_openshell_proto_msgTypes[189] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15049,7 +15194,7 @@ func (x *RelayInit) String() string { func (*RelayInit) ProtoMessage() {} func (x *RelayInit) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[188] + mi := &file_openshell_proto_msgTypes[189] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15062,7 +15207,7 @@ func (x *RelayInit) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayInit.ProtoReflect.Descriptor instead. func (*RelayInit) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{188} + return file_openshell_proto_rawDescGZIP(), []int{189} } func (x *RelayInit) GetChannelId() string { @@ -15089,7 +15234,7 @@ type RelayFrame struct { func (x *RelayFrame) Reset() { *x = RelayFrame{} - mi := &file_openshell_proto_msgTypes[189] + mi := &file_openshell_proto_msgTypes[190] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15101,7 +15246,7 @@ func (x *RelayFrame) String() string { func (*RelayFrame) ProtoMessage() {} func (x *RelayFrame) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[189] + mi := &file_openshell_proto_msgTypes[190] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15114,7 +15259,7 @@ func (x *RelayFrame) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayFrame.ProtoReflect.Descriptor instead. func (*RelayFrame) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{189} + return file_openshell_proto_rawDescGZIP(), []int{190} } func (x *RelayFrame) GetPayload() isRelayFrame_Payload { @@ -15174,7 +15319,7 @@ type PeerRelayInit struct { func (x *PeerRelayInit) Reset() { *x = PeerRelayInit{} - mi := &file_openshell_proto_msgTypes[190] + mi := &file_openshell_proto_msgTypes[191] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15186,7 +15331,7 @@ func (x *PeerRelayInit) String() string { func (*PeerRelayInit) ProtoMessage() {} func (x *PeerRelayInit) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[190] + mi := &file_openshell_proto_msgTypes[191] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15199,7 +15344,7 @@ func (x *PeerRelayInit) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerRelayInit.ProtoReflect.Descriptor instead. func (*PeerRelayInit) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{190} + return file_openshell_proto_rawDescGZIP(), []int{191} } func (x *PeerRelayInit) GetSandboxId() string { @@ -15237,7 +15382,7 @@ type PeerRelayFrame struct { func (x *PeerRelayFrame) Reset() { *x = PeerRelayFrame{} - mi := &file_openshell_proto_msgTypes[191] + mi := &file_openshell_proto_msgTypes[192] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15249,7 +15394,7 @@ func (x *PeerRelayFrame) String() string { func (*PeerRelayFrame) ProtoMessage() {} func (x *PeerRelayFrame) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[191] + mi := &file_openshell_proto_msgTypes[192] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15262,7 +15407,7 @@ func (x *PeerRelayFrame) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerRelayFrame.ProtoReflect.Descriptor instead. func (*PeerRelayFrame) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{191} + return file_openshell_proto_rawDescGZIP(), []int{192} } func (x *PeerRelayFrame) GetPayload() isPeerRelayFrame_Payload { @@ -15317,7 +15462,7 @@ type PeerConfigSandboxTarget struct { func (x *PeerConfigSandboxTarget) Reset() { *x = PeerConfigSandboxTarget{} - mi := &file_openshell_proto_msgTypes[192] + mi := &file_openshell_proto_msgTypes[193] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15329,7 +15474,7 @@ func (x *PeerConfigSandboxTarget) String() string { func (*PeerConfigSandboxTarget) ProtoMessage() {} func (x *PeerConfigSandboxTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[192] + mi := &file_openshell_proto_msgTypes[193] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15342,7 +15487,7 @@ func (x *PeerConfigSandboxTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerConfigSandboxTarget.ProtoReflect.Descriptor instead. func (*PeerConfigSandboxTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{192} + return file_openshell_proto_rawDescGZIP(), []int{193} } func (x *PeerConfigSandboxTarget) GetSandboxId() string { @@ -15370,7 +15515,7 @@ type PeerConfigProviderTarget struct { func (x *PeerConfigProviderTarget) Reset() { *x = PeerConfigProviderTarget{} - mi := &file_openshell_proto_msgTypes[193] + mi := &file_openshell_proto_msgTypes[194] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15382,7 +15527,7 @@ func (x *PeerConfigProviderTarget) String() string { func (*PeerConfigProviderTarget) ProtoMessage() {} func (x *PeerConfigProviderTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[193] + mi := &file_openshell_proto_msgTypes[194] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15395,7 +15540,7 @@ func (x *PeerConfigProviderTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerConfigProviderTarget.ProtoReflect.Descriptor instead. func (*PeerConfigProviderTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{193} + return file_openshell_proto_rawDescGZIP(), []int{194} } func (x *PeerConfigProviderTarget) GetWorkspace() string { @@ -15427,7 +15572,7 @@ type PeerNotifyConfigUpdateRequest struct { func (x *PeerNotifyConfigUpdateRequest) Reset() { *x = PeerNotifyConfigUpdateRequest{} - mi := &file_openshell_proto_msgTypes[194] + mi := &file_openshell_proto_msgTypes[195] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15439,7 +15584,7 @@ func (x *PeerNotifyConfigUpdateRequest) String() string { func (*PeerNotifyConfigUpdateRequest) ProtoMessage() {} func (x *PeerNotifyConfigUpdateRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[194] + mi := &file_openshell_proto_msgTypes[195] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15452,7 +15597,7 @@ func (x *PeerNotifyConfigUpdateRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerNotifyConfigUpdateRequest.ProtoReflect.Descriptor instead. func (*PeerNotifyConfigUpdateRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{194} + return file_openshell_proto_rawDescGZIP(), []int{195} } func (x *PeerNotifyConfigUpdateRequest) GetScope() isPeerNotifyConfigUpdateRequest_Scope { @@ -15536,7 +15681,7 @@ type PeerNotifyConfigUpdateResponse struct { func (x *PeerNotifyConfigUpdateResponse) Reset() { *x = PeerNotifyConfigUpdateResponse{} - mi := &file_openshell_proto_msgTypes[195] + mi := &file_openshell_proto_msgTypes[196] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15548,7 +15693,7 @@ func (x *PeerNotifyConfigUpdateResponse) String() string { func (*PeerNotifyConfigUpdateResponse) ProtoMessage() {} func (x *PeerNotifyConfigUpdateResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[195] + mi := &file_openshell_proto_msgTypes[196] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15561,7 +15706,7 @@ func (x *PeerNotifyConfigUpdateResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerNotifyConfigUpdateResponse.ProtoReflect.Descriptor instead. func (*PeerNotifyConfigUpdateResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{195} + return file_openshell_proto_rawDescGZIP(), []int{196} } func (x *PeerNotifyConfigUpdateResponse) GetStaleOwner() bool { @@ -15586,7 +15731,7 @@ type RelayOpenResult struct { func (x *RelayOpenResult) Reset() { *x = RelayOpenResult{} - mi := &file_openshell_proto_msgTypes[196] + mi := &file_openshell_proto_msgTypes[197] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15598,7 +15743,7 @@ func (x *RelayOpenResult) String() string { func (*RelayOpenResult) ProtoMessage() {} func (x *RelayOpenResult) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[196] + mi := &file_openshell_proto_msgTypes[197] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15611,7 +15756,7 @@ func (x *RelayOpenResult) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayOpenResult.ProtoReflect.Descriptor instead. func (*RelayOpenResult) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{196} + return file_openshell_proto_rawDescGZIP(), []int{197} } func (x *RelayOpenResult) GetChannelId() string { @@ -15648,7 +15793,7 @@ type RelayClose struct { func (x *RelayClose) Reset() { *x = RelayClose{} - mi := &file_openshell_proto_msgTypes[197] + mi := &file_openshell_proto_msgTypes[198] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15660,7 +15805,7 @@ func (x *RelayClose) String() string { func (*RelayClose) ProtoMessage() {} func (x *RelayClose) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[197] + mi := &file_openshell_proto_msgTypes[198] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15673,7 +15818,7 @@ func (x *RelayClose) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayClose.ProtoReflect.Descriptor instead. func (*RelayClose) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{197} + return file_openshell_proto_rawDescGZIP(), []int{198} } func (x *RelayClose) GetChannelId() string { @@ -15707,7 +15852,7 @@ type L7RequestSample struct { func (x *L7RequestSample) Reset() { *x = L7RequestSample{} - mi := &file_openshell_proto_msgTypes[198] + mi := &file_openshell_proto_msgTypes[199] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15719,7 +15864,7 @@ func (x *L7RequestSample) String() string { func (*L7RequestSample) ProtoMessage() {} func (x *L7RequestSample) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[198] + mi := &file_openshell_proto_msgTypes[199] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15732,7 +15877,7 @@ func (x *L7RequestSample) ProtoReflect() protoreflect.Message { // Deprecated: Use L7RequestSample.ProtoReflect.Descriptor instead. func (*L7RequestSample) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{198} + return file_openshell_proto_rawDescGZIP(), []int{199} } func (x *L7RequestSample) GetMethod() string { @@ -15806,7 +15951,7 @@ type DenialSummary struct { func (x *DenialSummary) Reset() { *x = DenialSummary{} - mi := &file_openshell_proto_msgTypes[199] + mi := &file_openshell_proto_msgTypes[200] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15818,7 +15963,7 @@ func (x *DenialSummary) String() string { func (*DenialSummary) ProtoMessage() {} func (x *DenialSummary) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[199] + mi := &file_openshell_proto_msgTypes[200] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15831,7 +15976,7 @@ func (x *DenialSummary) ProtoReflect() protoreflect.Message { // Deprecated: Use DenialSummary.ProtoReflect.Descriptor instead. func (*DenialSummary) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{199} + return file_openshell_proto_rawDescGZIP(), []int{200} } func (x *DenialSummary) GetSandboxId() string { @@ -15966,7 +16111,7 @@ type DenialGroupCount struct { func (x *DenialGroupCount) Reset() { *x = DenialGroupCount{} - mi := &file_openshell_proto_msgTypes[200] + mi := &file_openshell_proto_msgTypes[201] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15978,7 +16123,7 @@ func (x *DenialGroupCount) String() string { func (*DenialGroupCount) ProtoMessage() {} func (x *DenialGroupCount) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[200] + mi := &file_openshell_proto_msgTypes[201] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15991,7 +16136,7 @@ func (x *DenialGroupCount) ProtoReflect() protoreflect.Message { // Deprecated: Use DenialGroupCount.ProtoReflect.Descriptor instead. func (*DenialGroupCount) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{200} + return file_openshell_proto_rawDescGZIP(), []int{201} } func (x *DenialGroupCount) GetDenyGroup() string { @@ -16024,7 +16169,7 @@ type NetworkActivitySummary struct { func (x *NetworkActivitySummary) Reset() { *x = NetworkActivitySummary{} - mi := &file_openshell_proto_msgTypes[201] + mi := &file_openshell_proto_msgTypes[202] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16036,7 +16181,7 @@ func (x *NetworkActivitySummary) String() string { func (*NetworkActivitySummary) ProtoMessage() {} func (x *NetworkActivitySummary) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[201] + mi := &file_openshell_proto_msgTypes[202] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16049,7 +16194,7 @@ func (x *NetworkActivitySummary) ProtoReflect() protoreflect.Message { // Deprecated: Use NetworkActivitySummary.ProtoReflect.Descriptor instead. func (*NetworkActivitySummary) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{201} + return file_openshell_proto_rawDescGZIP(), []int{202} } func (x *NetworkActivitySummary) GetNetworkActivityCount() uint32 { @@ -16137,7 +16282,7 @@ type PolicyChunk struct { func (x *PolicyChunk) Reset() { *x = PolicyChunk{} - mi := &file_openshell_proto_msgTypes[202] + mi := &file_openshell_proto_msgTypes[203] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16149,7 +16294,7 @@ func (x *PolicyChunk) String() string { func (*PolicyChunk) ProtoMessage() {} func (x *PolicyChunk) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[202] + mi := &file_openshell_proto_msgTypes[203] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16162,7 +16307,7 @@ func (x *PolicyChunk) ProtoReflect() protoreflect.Message { // Deprecated: Use PolicyChunk.ProtoReflect.Descriptor instead. func (*PolicyChunk) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{202} + return file_openshell_proto_rawDescGZIP(), []int{203} } func (x *PolicyChunk) GetId() string { @@ -16350,7 +16495,7 @@ type DraftPolicyUpdate struct { func (x *DraftPolicyUpdate) Reset() { *x = DraftPolicyUpdate{} - mi := &file_openshell_proto_msgTypes[203] + mi := &file_openshell_proto_msgTypes[204] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16362,7 +16507,7 @@ func (x *DraftPolicyUpdate) String() string { func (*DraftPolicyUpdate) ProtoMessage() {} func (x *DraftPolicyUpdate) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[203] + mi := &file_openshell_proto_msgTypes[204] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16375,7 +16520,7 @@ func (x *DraftPolicyUpdate) ProtoReflect() protoreflect.Message { // Deprecated: Use DraftPolicyUpdate.ProtoReflect.Descriptor instead. func (*DraftPolicyUpdate) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{203} + return file_openshell_proto_rawDescGZIP(), []int{204} } func (x *DraftPolicyUpdate) GetDraftVersion() uint64 { @@ -16434,7 +16579,7 @@ type SubmitPolicyAnalysisRequest struct { func (x *SubmitPolicyAnalysisRequest) Reset() { *x = SubmitPolicyAnalysisRequest{} - mi := &file_openshell_proto_msgTypes[204] + mi := &file_openshell_proto_msgTypes[205] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16446,7 +16591,7 @@ func (x *SubmitPolicyAnalysisRequest) String() string { func (*SubmitPolicyAnalysisRequest) ProtoMessage() {} func (x *SubmitPolicyAnalysisRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[204] + mi := &file_openshell_proto_msgTypes[205] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16459,7 +16604,7 @@ func (x *SubmitPolicyAnalysisRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use SubmitPolicyAnalysisRequest.ProtoReflect.Descriptor instead. func (*SubmitPolicyAnalysisRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{204} + return file_openshell_proto_rawDescGZIP(), []int{205} } func (x *SubmitPolicyAnalysisRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -16522,7 +16667,7 @@ type SubmitPolicyAnalysisResponse struct { func (x *SubmitPolicyAnalysisResponse) Reset() { *x = SubmitPolicyAnalysisResponse{} - mi := &file_openshell_proto_msgTypes[205] + mi := &file_openshell_proto_msgTypes[206] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16534,7 +16679,7 @@ func (x *SubmitPolicyAnalysisResponse) String() string { func (*SubmitPolicyAnalysisResponse) ProtoMessage() {} func (x *SubmitPolicyAnalysisResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[205] + mi := &file_openshell_proto_msgTypes[206] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16547,7 +16692,7 @@ func (x *SubmitPolicyAnalysisResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use SubmitPolicyAnalysisResponse.ProtoReflect.Descriptor instead. func (*SubmitPolicyAnalysisResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{205} + return file_openshell_proto_rawDescGZIP(), []int{206} } func (x *SubmitPolicyAnalysisResponse) GetAcceptedChunks() uint32 { @@ -16592,7 +16737,7 @@ type GetDraftPolicyRequest struct { func (x *GetDraftPolicyRequest) Reset() { *x = GetDraftPolicyRequest{} - mi := &file_openshell_proto_msgTypes[206] + mi := &file_openshell_proto_msgTypes[207] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16604,7 +16749,7 @@ func (x *GetDraftPolicyRequest) String() string { func (*GetDraftPolicyRequest) ProtoMessage() {} func (x *GetDraftPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[206] + mi := &file_openshell_proto_msgTypes[207] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16617,7 +16762,7 @@ func (x *GetDraftPolicyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDraftPolicyRequest.ProtoReflect.Descriptor instead. func (*GetDraftPolicyRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{206} + return file_openshell_proto_rawDescGZIP(), []int{207} } func (x *GetDraftPolicyRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -16657,7 +16802,7 @@ type GetDraftPolicyResponse struct { func (x *GetDraftPolicyResponse) Reset() { *x = GetDraftPolicyResponse{} - mi := &file_openshell_proto_msgTypes[207] + mi := &file_openshell_proto_msgTypes[208] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16669,7 +16814,7 @@ func (x *GetDraftPolicyResponse) String() string { func (*GetDraftPolicyResponse) ProtoMessage() {} func (x *GetDraftPolicyResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[207] + mi := &file_openshell_proto_msgTypes[208] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16682,7 +16827,7 @@ func (x *GetDraftPolicyResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDraftPolicyResponse.ProtoReflect.Descriptor instead. func (*GetDraftPolicyResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{207} + return file_openshell_proto_rawDescGZIP(), []int{208} } func (x *GetDraftPolicyResponse) GetChunks() []*PolicyChunk { @@ -16733,7 +16878,7 @@ type ApproveDraftChunkRequest struct { func (x *ApproveDraftChunkRequest) Reset() { *x = ApproveDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[208] + mi := &file_openshell_proto_msgTypes[209] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16745,7 +16890,7 @@ func (x *ApproveDraftChunkRequest) String() string { func (*ApproveDraftChunkRequest) ProtoMessage() {} func (x *ApproveDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[208] + mi := &file_openshell_proto_msgTypes[209] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16758,7 +16903,7 @@ func (x *ApproveDraftChunkRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ApproveDraftChunkRequest.ProtoReflect.Descriptor instead. func (*ApproveDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{208} + return file_openshell_proto_rawDescGZIP(), []int{209} } func (x *ApproveDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -16808,7 +16953,7 @@ type ApproveDraftChunkResponse struct { func (x *ApproveDraftChunkResponse) Reset() { *x = ApproveDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[209] + mi := &file_openshell_proto_msgTypes[210] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16820,7 +16965,7 @@ func (x *ApproveDraftChunkResponse) String() string { func (*ApproveDraftChunkResponse) ProtoMessage() {} func (x *ApproveDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[209] + mi := &file_openshell_proto_msgTypes[210] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16833,7 +16978,7 @@ func (x *ApproveDraftChunkResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ApproveDraftChunkResponse.ProtoReflect.Descriptor instead. func (*ApproveDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{209} + return file_openshell_proto_rawDescGZIP(), []int{210} } func (x *ApproveDraftChunkResponse) GetPolicyVersion() uint32 { @@ -16869,7 +17014,7 @@ type RejectDraftChunkRequest struct { func (x *RejectDraftChunkRequest) Reset() { *x = RejectDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[210] + mi := &file_openshell_proto_msgTypes[211] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16881,7 +17026,7 @@ func (x *RejectDraftChunkRequest) String() string { func (*RejectDraftChunkRequest) ProtoMessage() {} func (x *RejectDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[210] + mi := &file_openshell_proto_msgTypes[211] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16894,7 +17039,7 @@ func (x *RejectDraftChunkRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RejectDraftChunkRequest.ProtoReflect.Descriptor instead. func (*RejectDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{210} + return file_openshell_proto_rawDescGZIP(), []int{211} } func (x *RejectDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -16940,7 +17085,7 @@ type RejectDraftChunkResponse struct { func (x *RejectDraftChunkResponse) Reset() { *x = RejectDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[211] + mi := &file_openshell_proto_msgTypes[212] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16952,7 +17097,7 @@ func (x *RejectDraftChunkResponse) String() string { func (*RejectDraftChunkResponse) ProtoMessage() {} func (x *RejectDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[211] + mi := &file_openshell_proto_msgTypes[212] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16965,7 +17110,7 @@ func (x *RejectDraftChunkResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RejectDraftChunkResponse.ProtoReflect.Descriptor instead. func (*RejectDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{211} + return file_openshell_proto_rawDescGZIP(), []int{212} } // Approve all pending chunks. @@ -16979,7 +17124,7 @@ type DraftChunkApproval struct { func (x *DraftChunkApproval) Reset() { *x = DraftChunkApproval{} - mi := &file_openshell_proto_msgTypes[212] + mi := &file_openshell_proto_msgTypes[213] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16991,7 +17136,7 @@ func (x *DraftChunkApproval) String() string { func (*DraftChunkApproval) ProtoMessage() {} func (x *DraftChunkApproval) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[212] + mi := &file_openshell_proto_msgTypes[213] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17004,7 +17149,7 @@ func (x *DraftChunkApproval) ProtoReflect() protoreflect.Message { // Deprecated: Use DraftChunkApproval.ProtoReflect.Descriptor instead. func (*DraftChunkApproval) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{212} + return file_openshell_proto_rawDescGZIP(), []int{213} } func (x *DraftChunkApproval) GetChunkId() string { @@ -17040,7 +17185,7 @@ type ApproveAllDraftChunksRequest struct { func (x *ApproveAllDraftChunksRequest) Reset() { *x = ApproveAllDraftChunksRequest{} - mi := &file_openshell_proto_msgTypes[213] + mi := &file_openshell_proto_msgTypes[214] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17052,7 +17197,7 @@ func (x *ApproveAllDraftChunksRequest) String() string { func (*ApproveAllDraftChunksRequest) ProtoMessage() {} func (x *ApproveAllDraftChunksRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[213] + mi := &file_openshell_proto_msgTypes[214] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17065,7 +17210,7 @@ func (x *ApproveAllDraftChunksRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ApproveAllDraftChunksRequest.ProtoReflect.Descriptor instead. func (*ApproveAllDraftChunksRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{213} + return file_openshell_proto_rawDescGZIP(), []int{214} } func (x *ApproveAllDraftChunksRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17120,7 +17265,7 @@ type ApproveAllDraftChunksResponse struct { func (x *ApproveAllDraftChunksResponse) Reset() { *x = ApproveAllDraftChunksResponse{} - mi := &file_openshell_proto_msgTypes[214] + mi := &file_openshell_proto_msgTypes[215] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17132,7 +17277,7 @@ func (x *ApproveAllDraftChunksResponse) String() string { func (*ApproveAllDraftChunksResponse) ProtoMessage() {} func (x *ApproveAllDraftChunksResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[214] + mi := &file_openshell_proto_msgTypes[215] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17145,7 +17290,7 @@ func (x *ApproveAllDraftChunksResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ApproveAllDraftChunksResponse.ProtoReflect.Descriptor instead. func (*ApproveAllDraftChunksResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{214} + return file_openshell_proto_rawDescGZIP(), []int{215} } func (x *ApproveAllDraftChunksResponse) GetPolicyVersion() uint32 { @@ -17195,7 +17340,7 @@ type EditDraftChunkRequest struct { func (x *EditDraftChunkRequest) Reset() { *x = EditDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[215] + mi := &file_openshell_proto_msgTypes[216] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17207,7 +17352,7 @@ func (x *EditDraftChunkRequest) String() string { func (*EditDraftChunkRequest) ProtoMessage() {} func (x *EditDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[215] + mi := &file_openshell_proto_msgTypes[216] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17220,7 +17365,7 @@ func (x *EditDraftChunkRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use EditDraftChunkRequest.ProtoReflect.Descriptor instead. func (*EditDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{215} + return file_openshell_proto_rawDescGZIP(), []int{216} } func (x *EditDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17266,7 +17411,7 @@ type EditDraftChunkResponse struct { func (x *EditDraftChunkResponse) Reset() { *x = EditDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[216] + mi := &file_openshell_proto_msgTypes[217] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17278,7 +17423,7 @@ func (x *EditDraftChunkResponse) String() string { func (*EditDraftChunkResponse) ProtoMessage() {} func (x *EditDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[216] + mi := &file_openshell_proto_msgTypes[217] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17291,7 +17436,7 @@ func (x *EditDraftChunkResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use EditDraftChunkResponse.ProtoReflect.Descriptor instead. func (*EditDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{216} + return file_openshell_proto_rawDescGZIP(), []int{217} } // Reverse an approval (remove merged rule from active policy). @@ -17311,7 +17456,7 @@ type UndoDraftChunkRequest struct { func (x *UndoDraftChunkRequest) Reset() { *x = UndoDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[217] + mi := &file_openshell_proto_msgTypes[218] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17323,7 +17468,7 @@ func (x *UndoDraftChunkRequest) String() string { func (*UndoDraftChunkRequest) ProtoMessage() {} func (x *UndoDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[217] + mi := &file_openshell_proto_msgTypes[218] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17336,7 +17481,7 @@ func (x *UndoDraftChunkRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UndoDraftChunkRequest.ProtoReflect.Descriptor instead. func (*UndoDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{217} + return file_openshell_proto_rawDescGZIP(), []int{218} } func (x *UndoDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17379,7 +17524,7 @@ type UndoDraftChunkResponse struct { func (x *UndoDraftChunkResponse) Reset() { *x = UndoDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[218] + mi := &file_openshell_proto_msgTypes[219] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17391,7 +17536,7 @@ func (x *UndoDraftChunkResponse) String() string { func (*UndoDraftChunkResponse) ProtoMessage() {} func (x *UndoDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[218] + mi := &file_openshell_proto_msgTypes[219] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17404,7 +17549,7 @@ func (x *UndoDraftChunkResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use UndoDraftChunkResponse.ProtoReflect.Descriptor instead. func (*UndoDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{218} + return file_openshell_proto_rawDescGZIP(), []int{219} } func (x *UndoDraftChunkResponse) GetPolicyVersion() uint32 { @@ -17436,7 +17581,7 @@ type ClearDraftChunksRequest struct { func (x *ClearDraftChunksRequest) Reset() { *x = ClearDraftChunksRequest{} - mi := &file_openshell_proto_msgTypes[219] + mi := &file_openshell_proto_msgTypes[220] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17448,7 +17593,7 @@ func (x *ClearDraftChunksRequest) String() string { func (*ClearDraftChunksRequest) ProtoMessage() {} func (x *ClearDraftChunksRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[219] + mi := &file_openshell_proto_msgTypes[220] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17461,7 +17606,7 @@ func (x *ClearDraftChunksRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ClearDraftChunksRequest.ProtoReflect.Descriptor instead. func (*ClearDraftChunksRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{219} + return file_openshell_proto_rawDescGZIP(), []int{220} } func (x *ClearDraftChunksRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17495,7 +17640,7 @@ type ClearDraftChunksResponse struct { func (x *ClearDraftChunksResponse) Reset() { *x = ClearDraftChunksResponse{} - mi := &file_openshell_proto_msgTypes[220] + mi := &file_openshell_proto_msgTypes[221] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17507,7 +17652,7 @@ func (x *ClearDraftChunksResponse) String() string { func (*ClearDraftChunksResponse) ProtoMessage() {} func (x *ClearDraftChunksResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[220] + mi := &file_openshell_proto_msgTypes[221] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17520,7 +17665,7 @@ func (x *ClearDraftChunksResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ClearDraftChunksResponse.ProtoReflect.Descriptor instead. func (*ClearDraftChunksResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{220} + return file_openshell_proto_rawDescGZIP(), []int{221} } func (x *ClearDraftChunksResponse) GetChunksCleared() uint32 { @@ -17542,7 +17687,7 @@ type GetDraftHistoryRequest struct { func (x *GetDraftHistoryRequest) Reset() { *x = GetDraftHistoryRequest{} - mi := &file_openshell_proto_msgTypes[221] + mi := &file_openshell_proto_msgTypes[222] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17554,7 +17699,7 @@ func (x *GetDraftHistoryRequest) String() string { func (*GetDraftHistoryRequest) ProtoMessage() {} func (x *GetDraftHistoryRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[221] + mi := &file_openshell_proto_msgTypes[222] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17567,7 +17712,7 @@ func (x *GetDraftHistoryRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDraftHistoryRequest.ProtoReflect.Descriptor instead. func (*GetDraftHistoryRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{221} + return file_openshell_proto_rawDescGZIP(), []int{222} } func (x *GetDraftHistoryRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17601,7 +17746,7 @@ type DraftHistoryEntry struct { func (x *DraftHistoryEntry) Reset() { *x = DraftHistoryEntry{} - mi := &file_openshell_proto_msgTypes[222] + mi := &file_openshell_proto_msgTypes[223] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17613,7 +17758,7 @@ func (x *DraftHistoryEntry) String() string { func (*DraftHistoryEntry) ProtoMessage() {} func (x *DraftHistoryEntry) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[222] + mi := &file_openshell_proto_msgTypes[223] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17626,7 +17771,7 @@ func (x *DraftHistoryEntry) ProtoReflect() protoreflect.Message { // Deprecated: Use DraftHistoryEntry.ProtoReflect.Descriptor instead. func (*DraftHistoryEntry) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{222} + return file_openshell_proto_rawDescGZIP(), []int{223} } func (x *DraftHistoryEntry) GetEventTime() *timestamppb.Timestamp { @@ -17667,7 +17812,7 @@ type GetDraftHistoryResponse struct { func (x *GetDraftHistoryResponse) Reset() { *x = GetDraftHistoryResponse{} - mi := &file_openshell_proto_msgTypes[223] + mi := &file_openshell_proto_msgTypes[224] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17679,7 +17824,7 @@ func (x *GetDraftHistoryResponse) String() string { func (*GetDraftHistoryResponse) ProtoMessage() {} func (x *GetDraftHistoryResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[223] + mi := &file_openshell_proto_msgTypes[224] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17692,7 +17837,7 @@ func (x *GetDraftHistoryResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDraftHistoryResponse.ProtoReflect.Descriptor instead. func (*GetDraftHistoryResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{223} + return file_openshell_proto_rawDescGZIP(), []int{224} } func (x *GetDraftHistoryResponse) GetEntries() []*DraftHistoryEntry { @@ -17717,7 +17862,7 @@ type CreateWorkspaceRequest struct { func (x *CreateWorkspaceRequest) Reset() { *x = CreateWorkspaceRequest{} - mi := &file_openshell_proto_msgTypes[224] + mi := &file_openshell_proto_msgTypes[225] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17729,7 +17874,7 @@ func (x *CreateWorkspaceRequest) String() string { func (*CreateWorkspaceRequest) ProtoMessage() {} func (x *CreateWorkspaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[224] + mi := &file_openshell_proto_msgTypes[225] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17742,7 +17887,7 @@ func (x *CreateWorkspaceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateWorkspaceRequest.ProtoReflect.Descriptor instead. func (*CreateWorkspaceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{224} + return file_openshell_proto_rawDescGZIP(), []int{225} } func (x *CreateWorkspaceRequest) GetName() string { @@ -17776,7 +17921,7 @@ type CreateWorkspaceResponse struct { func (x *CreateWorkspaceResponse) Reset() { *x = CreateWorkspaceResponse{} - mi := &file_openshell_proto_msgTypes[225] + mi := &file_openshell_proto_msgTypes[226] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17788,7 +17933,7 @@ func (x *CreateWorkspaceResponse) String() string { func (*CreateWorkspaceResponse) ProtoMessage() {} func (x *CreateWorkspaceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[225] + mi := &file_openshell_proto_msgTypes[226] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17801,7 +17946,7 @@ func (x *CreateWorkspaceResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateWorkspaceResponse.ProtoReflect.Descriptor instead. func (*CreateWorkspaceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{225} + return file_openshell_proto_rawDescGZIP(), []int{226} } func (x *CreateWorkspaceResponse) GetWorkspace() *datamodelv1.Workspace { @@ -17822,7 +17967,7 @@ type GetWorkspaceRequest struct { func (x *GetWorkspaceRequest) Reset() { *x = GetWorkspaceRequest{} - mi := &file_openshell_proto_msgTypes[226] + mi := &file_openshell_proto_msgTypes[227] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17834,7 +17979,7 @@ func (x *GetWorkspaceRequest) String() string { func (*GetWorkspaceRequest) ProtoMessage() {} func (x *GetWorkspaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[226] + mi := &file_openshell_proto_msgTypes[227] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17847,7 +17992,7 @@ func (x *GetWorkspaceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetWorkspaceRequest.ProtoReflect.Descriptor instead. func (*GetWorkspaceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{226} + return file_openshell_proto_rawDescGZIP(), []int{227} } func (x *GetWorkspaceRequest) GetName() string { @@ -17867,7 +18012,7 @@ type GetWorkspaceResponse struct { func (x *GetWorkspaceResponse) Reset() { *x = GetWorkspaceResponse{} - mi := &file_openshell_proto_msgTypes[227] + mi := &file_openshell_proto_msgTypes[228] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17879,7 +18024,7 @@ func (x *GetWorkspaceResponse) String() string { func (*GetWorkspaceResponse) ProtoMessage() {} func (x *GetWorkspaceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[227] + mi := &file_openshell_proto_msgTypes[228] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17892,7 +18037,7 @@ func (x *GetWorkspaceResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetWorkspaceResponse.ProtoReflect.Descriptor instead. func (*GetWorkspaceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{227} + return file_openshell_proto_rawDescGZIP(), []int{228} } func (x *GetWorkspaceResponse) GetWorkspace() *datamodelv1.Workspace { @@ -17919,7 +18064,7 @@ type ListWorkspacesRequest struct { func (x *ListWorkspacesRequest) Reset() { *x = ListWorkspacesRequest{} - mi := &file_openshell_proto_msgTypes[228] + mi := &file_openshell_proto_msgTypes[229] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17931,7 +18076,7 @@ func (x *ListWorkspacesRequest) String() string { func (*ListWorkspacesRequest) ProtoMessage() {} func (x *ListWorkspacesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[228] + mi := &file_openshell_proto_msgTypes[229] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17944,7 +18089,7 @@ func (x *ListWorkspacesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkspacesRequest.ProtoReflect.Descriptor instead. func (*ListWorkspacesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{228} + return file_openshell_proto_rawDescGZIP(), []int{229} } func (x *ListWorkspacesRequest) GetPageSize() int32 { @@ -17980,7 +18125,7 @@ type ListWorkspacesResponse struct { func (x *ListWorkspacesResponse) Reset() { *x = ListWorkspacesResponse{} - mi := &file_openshell_proto_msgTypes[229] + mi := &file_openshell_proto_msgTypes[230] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17992,7 +18137,7 @@ func (x *ListWorkspacesResponse) String() string { func (*ListWorkspacesResponse) ProtoMessage() {} func (x *ListWorkspacesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[229] + mi := &file_openshell_proto_msgTypes[230] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18005,7 +18150,7 @@ func (x *ListWorkspacesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkspacesResponse.ProtoReflect.Descriptor instead. func (*ListWorkspacesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{229} + return file_openshell_proto_rawDescGZIP(), []int{230} } func (x *ListWorkspacesResponse) GetWorkspaces() []*datamodelv1.Workspace { @@ -18036,7 +18181,7 @@ type DeleteWorkspaceRequest struct { func (x *DeleteWorkspaceRequest) Reset() { *x = DeleteWorkspaceRequest{} - mi := &file_openshell_proto_msgTypes[230] + mi := &file_openshell_proto_msgTypes[231] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18048,7 +18193,7 @@ func (x *DeleteWorkspaceRequest) String() string { func (*DeleteWorkspaceRequest) ProtoMessage() {} func (x *DeleteWorkspaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[230] + mi := &file_openshell_proto_msgTypes[231] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18061,7 +18206,7 @@ func (x *DeleteWorkspaceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteWorkspaceRequest.ProtoReflect.Descriptor instead. func (*DeleteWorkspaceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{230} + return file_openshell_proto_rawDescGZIP(), []int{231} } func (x *DeleteWorkspaceRequest) GetName() string { @@ -18095,7 +18240,7 @@ type DeleteWorkspaceResponse struct { func (x *DeleteWorkspaceResponse) Reset() { *x = DeleteWorkspaceResponse{} - mi := &file_openshell_proto_msgTypes[231] + mi := &file_openshell_proto_msgTypes[232] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18107,7 +18252,7 @@ func (x *DeleteWorkspaceResponse) String() string { func (*DeleteWorkspaceResponse) ProtoMessage() {} func (x *DeleteWorkspaceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[231] + mi := &file_openshell_proto_msgTypes[232] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18120,7 +18265,7 @@ func (x *DeleteWorkspaceResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteWorkspaceResponse.ProtoReflect.Descriptor instead. func (*DeleteWorkspaceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{231} + return file_openshell_proto_rawDescGZIP(), []int{232} } func (x *DeleteWorkspaceResponse) GetOutcome() DeletionOutcome { @@ -18144,7 +18289,7 @@ type WorkspaceMember struct { func (x *WorkspaceMember) Reset() { *x = WorkspaceMember{} - mi := &file_openshell_proto_msgTypes[232] + mi := &file_openshell_proto_msgTypes[233] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18156,7 +18301,7 @@ func (x *WorkspaceMember) String() string { func (*WorkspaceMember) ProtoMessage() {} func (x *WorkspaceMember) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[232] + mi := &file_openshell_proto_msgTypes[233] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18169,7 +18314,7 @@ func (x *WorkspaceMember) ProtoReflect() protoreflect.Message { // Deprecated: Use WorkspaceMember.ProtoReflect.Descriptor instead. func (*WorkspaceMember) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{232} + return file_openshell_proto_rawDescGZIP(), []int{233} } func (x *WorkspaceMember) GetMetadata() *datamodelv1.ObjectMeta { @@ -18210,7 +18355,7 @@ type AddWorkspaceMemberRequest struct { func (x *AddWorkspaceMemberRequest) Reset() { *x = AddWorkspaceMemberRequest{} - mi := &file_openshell_proto_msgTypes[233] + mi := &file_openshell_proto_msgTypes[234] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18222,7 +18367,7 @@ func (x *AddWorkspaceMemberRequest) String() string { func (*AddWorkspaceMemberRequest) ProtoMessage() {} func (x *AddWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[233] + mi := &file_openshell_proto_msgTypes[234] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18235,7 +18380,7 @@ func (x *AddWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use AddWorkspaceMemberRequest.ProtoReflect.Descriptor instead. func (*AddWorkspaceMemberRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{233} + return file_openshell_proto_rawDescGZIP(), []int{234} } func (x *AddWorkspaceMemberRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -18276,7 +18421,7 @@ type AddWorkspaceMemberResponse struct { func (x *AddWorkspaceMemberResponse) Reset() { *x = AddWorkspaceMemberResponse{} - mi := &file_openshell_proto_msgTypes[234] + mi := &file_openshell_proto_msgTypes[235] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18288,7 +18433,7 @@ func (x *AddWorkspaceMemberResponse) String() string { func (*AddWorkspaceMemberResponse) ProtoMessage() {} func (x *AddWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[234] + mi := &file_openshell_proto_msgTypes[235] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18301,7 +18446,7 @@ func (x *AddWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use AddWorkspaceMemberResponse.ProtoReflect.Descriptor instead. func (*AddWorkspaceMemberResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{234} + return file_openshell_proto_rawDescGZIP(), []int{235} } func (x *AddWorkspaceMemberResponse) GetMember() *WorkspaceMember { @@ -18327,7 +18472,7 @@ type RemoveWorkspaceMemberRequest struct { func (x *RemoveWorkspaceMemberRequest) Reset() { *x = RemoveWorkspaceMemberRequest{} - mi := &file_openshell_proto_msgTypes[235] + mi := &file_openshell_proto_msgTypes[236] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18339,7 +18484,7 @@ func (x *RemoveWorkspaceMemberRequest) String() string { func (*RemoveWorkspaceMemberRequest) ProtoMessage() {} func (x *RemoveWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[235] + mi := &file_openshell_proto_msgTypes[236] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18352,7 +18497,7 @@ func (x *RemoveWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveWorkspaceMemberRequest.ProtoReflect.Descriptor instead. func (*RemoveWorkspaceMemberRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{235} + return file_openshell_proto_rawDescGZIP(), []int{236} } func (x *RemoveWorkspaceMemberRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -18393,7 +18538,7 @@ type RemoveWorkspaceMemberResponse struct { func (x *RemoveWorkspaceMemberResponse) Reset() { *x = RemoveWorkspaceMemberResponse{} - mi := &file_openshell_proto_msgTypes[236] + mi := &file_openshell_proto_msgTypes[237] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18405,7 +18550,7 @@ func (x *RemoveWorkspaceMemberResponse) String() string { func (*RemoveWorkspaceMemberResponse) ProtoMessage() {} func (x *RemoveWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[236] + mi := &file_openshell_proto_msgTypes[237] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18418,7 +18563,7 @@ func (x *RemoveWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveWorkspaceMemberResponse.ProtoReflect.Descriptor instead. func (*RemoveWorkspaceMemberResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{236} + return file_openshell_proto_rawDescGZIP(), []int{237} } func (x *RemoveWorkspaceMemberResponse) GetOutcome() DeletionOutcome { @@ -18445,7 +18590,7 @@ type ListWorkspaceMembersRequest struct { func (x *ListWorkspaceMembersRequest) Reset() { *x = ListWorkspaceMembersRequest{} - mi := &file_openshell_proto_msgTypes[237] + mi := &file_openshell_proto_msgTypes[238] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18457,7 +18602,7 @@ func (x *ListWorkspaceMembersRequest) String() string { func (*ListWorkspaceMembersRequest) ProtoMessage() {} func (x *ListWorkspaceMembersRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[237] + mi := &file_openshell_proto_msgTypes[238] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18470,7 +18615,7 @@ func (x *ListWorkspaceMembersRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkspaceMembersRequest.ProtoReflect.Descriptor instead. func (*ListWorkspaceMembersRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{237} + return file_openshell_proto_rawDescGZIP(), []int{238} } func (x *ListWorkspaceMembersRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -18506,7 +18651,7 @@ type ListWorkspaceMembersResponse struct { func (x *ListWorkspaceMembersResponse) Reset() { *x = ListWorkspaceMembersResponse{} - mi := &file_openshell_proto_msgTypes[238] + mi := &file_openshell_proto_msgTypes[239] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18518,7 +18663,7 @@ func (x *ListWorkspaceMembersResponse) String() string { func (*ListWorkspaceMembersResponse) ProtoMessage() {} func (x *ListWorkspaceMembersResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[238] + mi := &file_openshell_proto_msgTypes[239] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18531,7 +18676,7 @@ func (x *ListWorkspaceMembersResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkspaceMembersResponse.ProtoReflect.Descriptor instead. func (*ListWorkspaceMembersResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{238} + return file_openshell_proto_rawDescGZIP(), []int{239} } func (x *ListWorkspaceMembersResponse) GetMembers() []*WorkspaceMember { @@ -18566,7 +18711,7 @@ type ExtensionServiceCredential struct { func (x *ExtensionServiceCredential) Reset() { *x = ExtensionServiceCredential{} - mi := &file_openshell_proto_msgTypes[239] + mi := &file_openshell_proto_msgTypes[240] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18578,7 +18723,7 @@ func (x *ExtensionServiceCredential) String() string { func (*ExtensionServiceCredential) ProtoMessage() {} func (x *ExtensionServiceCredential) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[239] + mi := &file_openshell_proto_msgTypes[240] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18591,7 +18736,7 @@ func (x *ExtensionServiceCredential) ProtoReflect() protoreflect.Message { // Deprecated: Use ExtensionServiceCredential.ProtoReflect.Descriptor instead. func (*ExtensionServiceCredential) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{239} + return file_openshell_proto_rawDescGZIP(), []int{240} } func (x *ExtensionServiceCredential) GetServiceName() string { @@ -18631,7 +18776,7 @@ type EndpointObservation struct { func (x *EndpointObservation) Reset() { *x = EndpointObservation{} - mi := &file_openshell_proto_msgTypes[240] + mi := &file_openshell_proto_msgTypes[241] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18643,7 +18788,7 @@ func (x *EndpointObservation) String() string { func (*EndpointObservation) ProtoMessage() {} func (x *EndpointObservation) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[240] + mi := &file_openshell_proto_msgTypes[241] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18656,7 +18801,7 @@ func (x *EndpointObservation) ProtoReflect() protoreflect.Message { // Deprecated: Use EndpointObservation.ProtoReflect.Descriptor instead. func (*EndpointObservation) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{240} + return file_openshell_proto_rawDescGZIP(), []int{241} } func (x *EndpointObservation) GetEndpointId() string { @@ -18709,7 +18854,7 @@ type ReportEndpointStatusRequest struct { func (x *ReportEndpointStatusRequest) Reset() { *x = ReportEndpointStatusRequest{} - mi := &file_openshell_proto_msgTypes[241] + mi := &file_openshell_proto_msgTypes[242] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18721,7 +18866,7 @@ func (x *ReportEndpointStatusRequest) String() string { func (*ReportEndpointStatusRequest) ProtoMessage() {} func (x *ReportEndpointStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[241] + mi := &file_openshell_proto_msgTypes[242] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18734,7 +18879,7 @@ func (x *ReportEndpointStatusRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportEndpointStatusRequest.ProtoReflect.Descriptor instead. func (*ReportEndpointStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{241} + return file_openshell_proto_rawDescGZIP(), []int{242} } func (x *ReportEndpointStatusRequest) GetSandboxId() string { @@ -18803,7 +18948,7 @@ type TokenGrantStatus struct { func (x *TokenGrantStatus) Reset() { *x = TokenGrantStatus{} - mi := &file_openshell_proto_msgTypes[242] + mi := &file_openshell_proto_msgTypes[243] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18815,7 +18960,7 @@ func (x *TokenGrantStatus) String() string { func (*TokenGrantStatus) ProtoMessage() {} func (x *TokenGrantStatus) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[242] + mi := &file_openshell_proto_msgTypes[243] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18828,7 +18973,7 @@ func (x *TokenGrantStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use TokenGrantStatus.ProtoReflect.Descriptor instead. func (*TokenGrantStatus) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{242} + return file_openshell_proto_rawDescGZIP(), []int{243} } func (x *TokenGrantStatus) GetLastFailure() *TokenGrantFailureObservation { @@ -18855,7 +19000,7 @@ type TokenGrantFailureObservation struct { func (x *TokenGrantFailureObservation) Reset() { *x = TokenGrantFailureObservation{} - mi := &file_openshell_proto_msgTypes[243] + mi := &file_openshell_proto_msgTypes[244] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18867,7 +19012,7 @@ func (x *TokenGrantFailureObservation) String() string { func (*TokenGrantFailureObservation) ProtoMessage() {} func (x *TokenGrantFailureObservation) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[243] + mi := &file_openshell_proto_msgTypes[244] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18880,7 +19025,7 @@ func (x *TokenGrantFailureObservation) ProtoReflect() protoreflect.Message { // Deprecated: Use TokenGrantFailureObservation.ProtoReflect.Descriptor instead. func (*TokenGrantFailureObservation) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{243} + return file_openshell_proto_rawDescGZIP(), []int{244} } func (x *TokenGrantFailureObservation) GetDestinationHost() string { @@ -18913,7 +19058,7 @@ type ReportEndpointStatusResponse struct { func (x *ReportEndpointStatusResponse) Reset() { *x = ReportEndpointStatusResponse{} - mi := &file_openshell_proto_msgTypes[244] + mi := &file_openshell_proto_msgTypes[245] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18925,7 +19070,7 @@ func (x *ReportEndpointStatusResponse) String() string { func (*ReportEndpointStatusResponse) ProtoMessage() {} func (x *ReportEndpointStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[244] + mi := &file_openshell_proto_msgTypes[245] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18938,7 +19083,7 @@ func (x *ReportEndpointStatusResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportEndpointStatusResponse.ProtoReflect.Descriptor instead. func (*ReportEndpointStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{244} + return file_openshell_proto_rawDescGZIP(), []int{245} } // A configured endpoint and its last accepted network result in one record. @@ -18972,7 +19117,7 @@ type EndpointStatus struct { func (x *EndpointStatus) Reset() { *x = EndpointStatus{} - mi := &file_openshell_proto_msgTypes[245] + mi := &file_openshell_proto_msgTypes[246] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18984,7 +19129,7 @@ func (x *EndpointStatus) String() string { func (*EndpointStatus) ProtoMessage() {} func (x *EndpointStatus) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[245] + mi := &file_openshell_proto_msgTypes[246] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18997,7 +19142,7 @@ func (x *EndpointStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use EndpointStatus.ProtoReflect.Descriptor instead. func (*EndpointStatus) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{245} + return file_openshell_proto_rawDescGZIP(), []int{246} } func (x *EndpointStatus) GetEndpointId() string { @@ -19092,7 +19237,7 @@ type SandboxProvisioning struct { func (x *SandboxProvisioning) Reset() { *x = SandboxProvisioning{} - mi := &file_openshell_proto_msgTypes[246] + mi := &file_openshell_proto_msgTypes[247] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19104,7 +19249,7 @@ func (x *SandboxProvisioning) String() string { func (*SandboxProvisioning) ProtoMessage() {} func (x *SandboxProvisioning) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[246] + mi := &file_openshell_proto_msgTypes[247] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19117,7 +19262,7 @@ func (x *SandboxProvisioning) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxProvisioning.ProtoReflect.Descriptor instead. func (*SandboxProvisioning) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{246} + return file_openshell_proto_rawDescGZIP(), []int{247} } func (x *SandboxProvisioning) GetAttemptId() string { @@ -19240,7 +19385,7 @@ type SandboxServiceExposure struct { func (x *SandboxServiceExposure) Reset() { *x = SandboxServiceExposure{} - mi := &file_openshell_proto_msgTypes[247] + mi := &file_openshell_proto_msgTypes[248] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19252,7 +19397,7 @@ func (x *SandboxServiceExposure) String() string { func (*SandboxServiceExposure) ProtoMessage() {} func (x *SandboxServiceExposure) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[247] + mi := &file_openshell_proto_msgTypes[248] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19265,7 +19410,7 @@ func (x *SandboxServiceExposure) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxServiceExposure.ProtoReflect.Descriptor instead. func (*SandboxServiceExposure) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{247} + return file_openshell_proto_rawDescGZIP(), []int{248} } func (x *SandboxServiceExposure) GetService() string { @@ -19319,7 +19464,7 @@ type EndpointFailure struct { func (x *EndpointFailure) Reset() { *x = EndpointFailure{} - mi := &file_openshell_proto_msgTypes[248] + mi := &file_openshell_proto_msgTypes[249] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19331,7 +19476,7 @@ func (x *EndpointFailure) String() string { func (*EndpointFailure) ProtoMessage() {} func (x *EndpointFailure) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[248] + mi := &file_openshell_proto_msgTypes[249] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19344,7 +19489,7 @@ func (x *EndpointFailure) ProtoReflect() protoreflect.Message { // Deprecated: Use EndpointFailure.ProtoReflect.Descriptor instead. func (*EndpointFailure) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{248} + return file_openshell_proto_rawDescGZIP(), []int{249} } func (x *EndpointFailure) GetDomain() EndpointFailureDomain { @@ -20209,20 +20354,31 @@ const file_openshell_proto_rawDesc = "" + "\n" + "request_id\x18\x04 \x01(\tR\trequestId\"g\n" + "\x1dDeleteProviderProfileResponse\x127\n" + - "\aoutcome\x18\x02 \x01(\x0e2\x1d.openshell.v1.DeletionOutcomeR\aoutcomeJ\x04\b\x01\x10\x02R\adeleted\"\xf4\x01\n" + + "\aoutcome\x18\x02 \x01(\x0e2\x1d.openshell.v1.DeletionOutcomeR\aoutcomeJ\x04\b\x01\x10\x02R\adeleted\"\xc5\x02\n" + "$GetSandboxProviderEnvironmentRequest\x12\x1d\n" + "\n" + "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12M\n" + "#supports_static_credential_bindings\x18\x02 \x01(\bR supportsStaticCredentialBindings\x12^\n" + - ",supports_stable_placeholder_environment_keys\x18\x03 \x01(\bR(supportsStablePlaceholderEnvironmentKeys\"]\n" + + ",supports_stable_placeholder_environment_keys\x18\x03 \x01(\bR(supportsStablePlaceholderEnvironmentKeys\x12O\n" + + "$supports_static_credential_placement\x18\x04 \x01(\bR!supportsStaticCredentialPlacement\"]\n" + "\x1fStaticCredentialEndpointBinding\x12\x12\n" + "\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" + "\x04port\x18\x02 \x01(\rR\x04port\x12\x12\n" + - "\x04path\x18\x03 \x01(\tR\x04path\"\xd5\x01\n" + + "\x04path\x18\x03 \x01(\tR\x04path\"\xb9\x01\n" + + "\x19StaticCredentialPlacement\x12!\n" + + "\vheader_name\x18\x01 \x01(\tH\x00R\n" + + "headerName\x12!\n" + + "\vquery_param\x18\x02 \x01(\tH\x00R\n" + + "queryParam\x12%\n" + + "\rpath_template\x18\x03 \x01(\tH\x00R\fpathTemplate\x12#\n" + + "\fsigning_only\x18\x04 \x01(\bH\x00R\vsigningOnlyB\n" + + "\n" + + "\blocation\"\x9c\x02\n" + "\x17StaticCredentialBinding\x12K\n" + "\tendpoints\x18\x01 \x03(\v2-.openshell.v1.StaticCredentialEndpointBindingR\tendpoints\x12/\n" + "\x13credential_identity\x18\x02 \x01(\tR\x12credentialIdentity\x12<\n" + - "\x1aworkload_credential_handle\x18\x03 \x01(\tR\x18workloadCredentialHandle\"\xc9\f\n" + + "\x1aworkload_credential_handle\x18\x03 \x01(\tR\x18workloadCredentialHandle\x12E\n" + + "\tplacement\x18\x04 \x01(\v2'.openshell.v1.StaticCredentialPlacementR\tplacement\"\xc9\f\n" + "%GetSandboxProviderEnvironmentResponse\x12l\n" + "\venvironment\x18\x01 \x03(\v2D.openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntryB\x04\x88\xb5\x18\x01R\venvironment\x122\n" + "\x15provider_env_revision\x18\x02 \x01(\x04R\x13providerEnvRevision\x12\x92\x01\n" + @@ -20448,7 +20604,7 @@ const file_openshell_proto_rawDesc = "" + "relayClose\x12J\n" + "\x10session_redirect\x18\x06 \x01(\v2\x1d.openshell.v1.SessionRedirectH\x00R\x0fsessionRedirect\x12A\n" + "\rconfig_update\x18\a \x01(\v2\x1a.openshell.v1.ConfigUpdateH\x00R\fconfigUpdateB\t\n" + - "\apayload\"\xca\x02\n" + + "\apayload\"\x9b\x03\n" + "\x0fSupervisorHello\x12\x1d\n" + "\n" + "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1f\n" + @@ -20460,7 +20616,8 @@ const file_openshell_proto_rawDesc = "" + "redirected\x18\x05 \x01(\bR\n" + "redirected\x12:\n" + "\x19supports_session_redirect\x18\x06 \x01(\bR\x17supportsSessionRedirect\x120\n" + - "\x14supports_config_push\x18\a \x01(\bR\x12supportsConfigPush\"\x83\x02\n" + + "\x14supports_config_push\x18\a \x01(\bR\x12supportsConfigPush\x12O\n" + + "$supports_static_credential_placement\x18\b \x01(\bR!supportsStaticCredentialPlacement\"\x83\x02\n" + "\x0fSessionAccepted\x12\x1d\n" + "\n" + "session_id\x18\x01 \x01(\tR\tsessionId\x128\n" + @@ -21201,7 +21358,7 @@ func file_openshell_proto_rawDescGZIP() []byte { } var file_openshell_proto_enumTypes = make([]protoimpl.EnumInfo, 22) -var file_openshell_proto_msgTypes = make([]protoimpl.MessageInfo, 275) +var file_openshell_proto_msgTypes = make([]protoimpl.MessageInfo, 276) var file_openshell_proto_goTypes = []any{ (ExtensionKind)(0), // 0: openshell.v1.ExtensionKind (SandboxPhase)(0), // 1: openshell.v1.SandboxPhase @@ -21364,168 +21521,169 @@ var file_openshell_proto_goTypes = []any{ (*DeleteProviderProfileResponse)(nil), // 158: openshell.v1.DeleteProviderProfileResponse (*GetSandboxProviderEnvironmentRequest)(nil), // 159: openshell.v1.GetSandboxProviderEnvironmentRequest (*StaticCredentialEndpointBinding)(nil), // 160: openshell.v1.StaticCredentialEndpointBinding - (*StaticCredentialBinding)(nil), // 161: openshell.v1.StaticCredentialBinding - (*GetSandboxProviderEnvironmentResponse)(nil), // 162: openshell.v1.GetSandboxProviderEnvironmentResponse - (*ProviderEnvironmentValue)(nil), // 163: openshell.v1.ProviderEnvironmentValue - (*ProviderEnvironmentSnapshot)(nil), // 164: openshell.v1.ProviderEnvironmentSnapshot - (*ExchangeProviderSubjectTokenRequest)(nil), // 165: openshell.v1.ExchangeProviderSubjectTokenRequest - (*ExchangeProviderSubjectTokenResponse)(nil), // 166: openshell.v1.ExchangeProviderSubjectTokenResponse - (*UpdateConfigRequest)(nil), // 167: openshell.v1.UpdateConfigRequest - (*PolicyMergeOperation)(nil), // 168: openshell.v1.PolicyMergeOperation - (*AddNetworkRule)(nil), // 169: openshell.v1.AddNetworkRule - (*RemoveNetworkEndpoint)(nil), // 170: openshell.v1.RemoveNetworkEndpoint - (*RemoveNetworkRule)(nil), // 171: openshell.v1.RemoveNetworkRule - (*L7RuleTarget)(nil), // 172: openshell.v1.L7RuleTarget - (*AddDenyRules)(nil), // 173: openshell.v1.AddDenyRules - (*AddAllowRules)(nil), // 174: openshell.v1.AddAllowRules - (*RemoveNetworkBinary)(nil), // 175: openshell.v1.RemoveNetworkBinary - (*UpdateConfigResponse)(nil), // 176: openshell.v1.UpdateConfigResponse - (*GetSandboxPolicyStatusRequest)(nil), // 177: openshell.v1.GetSandboxPolicyStatusRequest - (*GetSandboxPolicyStatusResponse)(nil), // 178: openshell.v1.GetSandboxPolicyStatusResponse - (*ListSandboxPoliciesRequest)(nil), // 179: openshell.v1.ListSandboxPoliciesRequest - (*ListSandboxPoliciesResponse)(nil), // 180: openshell.v1.ListSandboxPoliciesResponse - (*ReportPolicyStatusRequest)(nil), // 181: openshell.v1.ReportPolicyStatusRequest - (*ReportPolicyStatusResponse)(nil), // 182: openshell.v1.ReportPolicyStatusResponse - (*SandboxConfigurationAdmission)(nil), // 183: openshell.v1.SandboxConfigurationAdmission - (*ReportSandboxConfigurationRequest)(nil), // 184: openshell.v1.ReportSandboxConfigurationRequest - (*ReportSandboxConfigurationResponse)(nil), // 185: openshell.v1.ReportSandboxConfigurationResponse - (*SandboxPolicyRevision)(nil), // 186: openshell.v1.SandboxPolicyRevision - (*GetSandboxLogsRequest)(nil), // 187: openshell.v1.GetSandboxLogsRequest - (*PushSandboxLogsRequest)(nil), // 188: openshell.v1.PushSandboxLogsRequest - (*PushSandboxLogsResponse)(nil), // 189: openshell.v1.PushSandboxLogsResponse - (*GetSandboxLogsResponse)(nil), // 190: openshell.v1.GetSandboxLogsResponse - (*SupervisorMessage)(nil), // 191: openshell.v1.SupervisorMessage - (*GatewayMessage)(nil), // 192: openshell.v1.GatewayMessage - (*SupervisorHello)(nil), // 193: openshell.v1.SupervisorHello - (*SessionAccepted)(nil), // 194: openshell.v1.SessionAccepted - (*ConfigUpdate)(nil), // 195: openshell.v1.ConfigUpdate - (*ConfigApplyFailure)(nil), // 196: openshell.v1.ConfigApplyFailure - (*ConfigUpdateResult)(nil), // 197: openshell.v1.ConfigUpdateResult - (*PolicyLoadResult)(nil), // 198: openshell.v1.PolicyLoadResult - (*SessionRejected)(nil), // 199: openshell.v1.SessionRejected - (*SessionRedirect)(nil), // 200: openshell.v1.SessionRedirect - (*SupervisorHeartbeat)(nil), // 201: openshell.v1.SupervisorHeartbeat - (*GatewayHeartbeat)(nil), // 202: openshell.v1.GatewayHeartbeat - (*ReportMainProcessExitRequest)(nil), // 203: openshell.v1.ReportMainProcessExitRequest - (*ReportMainProcessExitResponse)(nil), // 204: openshell.v1.ReportMainProcessExitResponse - (*FinalizeMainProcessExitRequest)(nil), // 205: openshell.v1.FinalizeMainProcessExitRequest - (*FinalizeMainProcessExitResponse)(nil), // 206: openshell.v1.FinalizeMainProcessExitResponse - (*RelayOpen)(nil), // 207: openshell.v1.RelayOpen - (*SshRelayTarget)(nil), // 208: openshell.v1.SshRelayTarget - (*TcpRelayTarget)(nil), // 209: openshell.v1.TcpRelayTarget - (*RelayInit)(nil), // 210: openshell.v1.RelayInit - (*RelayFrame)(nil), // 211: openshell.v1.RelayFrame - (*PeerRelayInit)(nil), // 212: openshell.v1.PeerRelayInit - (*PeerRelayFrame)(nil), // 213: openshell.v1.PeerRelayFrame - (*PeerConfigSandboxTarget)(nil), // 214: openshell.v1.PeerConfigSandboxTarget - (*PeerConfigProviderTarget)(nil), // 215: openshell.v1.PeerConfigProviderTarget - (*PeerNotifyConfigUpdateRequest)(nil), // 216: openshell.v1.PeerNotifyConfigUpdateRequest - (*PeerNotifyConfigUpdateResponse)(nil), // 217: openshell.v1.PeerNotifyConfigUpdateResponse - (*RelayOpenResult)(nil), // 218: openshell.v1.RelayOpenResult - (*RelayClose)(nil), // 219: openshell.v1.RelayClose - (*L7RequestSample)(nil), // 220: openshell.v1.L7RequestSample - (*DenialSummary)(nil), // 221: openshell.v1.DenialSummary - (*DenialGroupCount)(nil), // 222: openshell.v1.DenialGroupCount - (*NetworkActivitySummary)(nil), // 223: openshell.v1.NetworkActivitySummary - (*PolicyChunk)(nil), // 224: openshell.v1.PolicyChunk - (*DraftPolicyUpdate)(nil), // 225: openshell.v1.DraftPolicyUpdate - (*SubmitPolicyAnalysisRequest)(nil), // 226: openshell.v1.SubmitPolicyAnalysisRequest - (*SubmitPolicyAnalysisResponse)(nil), // 227: openshell.v1.SubmitPolicyAnalysisResponse - (*GetDraftPolicyRequest)(nil), // 228: openshell.v1.GetDraftPolicyRequest - (*GetDraftPolicyResponse)(nil), // 229: openshell.v1.GetDraftPolicyResponse - (*ApproveDraftChunkRequest)(nil), // 230: openshell.v1.ApproveDraftChunkRequest - (*ApproveDraftChunkResponse)(nil), // 231: openshell.v1.ApproveDraftChunkResponse - (*RejectDraftChunkRequest)(nil), // 232: openshell.v1.RejectDraftChunkRequest - (*RejectDraftChunkResponse)(nil), // 233: openshell.v1.RejectDraftChunkResponse - (*DraftChunkApproval)(nil), // 234: openshell.v1.DraftChunkApproval - (*ApproveAllDraftChunksRequest)(nil), // 235: openshell.v1.ApproveAllDraftChunksRequest - (*ApproveAllDraftChunksResponse)(nil), // 236: openshell.v1.ApproveAllDraftChunksResponse - (*EditDraftChunkRequest)(nil), // 237: openshell.v1.EditDraftChunkRequest - (*EditDraftChunkResponse)(nil), // 238: openshell.v1.EditDraftChunkResponse - (*UndoDraftChunkRequest)(nil), // 239: openshell.v1.UndoDraftChunkRequest - (*UndoDraftChunkResponse)(nil), // 240: openshell.v1.UndoDraftChunkResponse - (*ClearDraftChunksRequest)(nil), // 241: openshell.v1.ClearDraftChunksRequest - (*ClearDraftChunksResponse)(nil), // 242: openshell.v1.ClearDraftChunksResponse - (*GetDraftHistoryRequest)(nil), // 243: openshell.v1.GetDraftHistoryRequest - (*DraftHistoryEntry)(nil), // 244: openshell.v1.DraftHistoryEntry - (*GetDraftHistoryResponse)(nil), // 245: openshell.v1.GetDraftHistoryResponse - (*CreateWorkspaceRequest)(nil), // 246: openshell.v1.CreateWorkspaceRequest - (*CreateWorkspaceResponse)(nil), // 247: openshell.v1.CreateWorkspaceResponse - (*GetWorkspaceRequest)(nil), // 248: openshell.v1.GetWorkspaceRequest - (*GetWorkspaceResponse)(nil), // 249: openshell.v1.GetWorkspaceResponse - (*ListWorkspacesRequest)(nil), // 250: openshell.v1.ListWorkspacesRequest - (*ListWorkspacesResponse)(nil), // 251: openshell.v1.ListWorkspacesResponse - (*DeleteWorkspaceRequest)(nil), // 252: openshell.v1.DeleteWorkspaceRequest - (*DeleteWorkspaceResponse)(nil), // 253: openshell.v1.DeleteWorkspaceResponse - (*WorkspaceMember)(nil), // 254: openshell.v1.WorkspaceMember - (*AddWorkspaceMemberRequest)(nil), // 255: openshell.v1.AddWorkspaceMemberRequest - (*AddWorkspaceMemberResponse)(nil), // 256: openshell.v1.AddWorkspaceMemberResponse - (*RemoveWorkspaceMemberRequest)(nil), // 257: openshell.v1.RemoveWorkspaceMemberRequest - (*RemoveWorkspaceMemberResponse)(nil), // 258: openshell.v1.RemoveWorkspaceMemberResponse - (*ListWorkspaceMembersRequest)(nil), // 259: openshell.v1.ListWorkspaceMembersRequest - (*ListWorkspaceMembersResponse)(nil), // 260: openshell.v1.ListWorkspaceMembersResponse - (*ExtensionServiceCredential)(nil), // 261: openshell.v1.ExtensionServiceCredential - (*EndpointObservation)(nil), // 262: openshell.v1.EndpointObservation - (*ReportEndpointStatusRequest)(nil), // 263: openshell.v1.ReportEndpointStatusRequest - (*TokenGrantStatus)(nil), // 264: openshell.v1.TokenGrantStatus - (*TokenGrantFailureObservation)(nil), // 265: openshell.v1.TokenGrantFailureObservation - (*ReportEndpointStatusResponse)(nil), // 266: openshell.v1.ReportEndpointStatusResponse - (*EndpointStatus)(nil), // 267: openshell.v1.EndpointStatus - (*SandboxProvisioning)(nil), // 268: openshell.v1.SandboxProvisioning - (*SandboxServiceExposure)(nil), // 269: openshell.v1.SandboxServiceExposure - (*EndpointFailure)(nil), // 270: openshell.v1.EndpointFailure - nil, // 271: openshell.v1.SandboxSpec.EnvironmentEntry - nil, // 272: openshell.v1.SandboxTemplate.LabelsEntry - nil, // 273: openshell.v1.SandboxTemplate.AnnotationsEntry - nil, // 274: openshell.v1.SandboxTemplate.EnvironmentEntry - nil, // 275: openshell.v1.SandboxWorkloadConfig.EnvironmentEntry - nil, // 276: openshell.v1.PlatformEvent.MetadataEntry - nil, // 277: openshell.v1.CreateSandboxRequest.LabelsEntry - nil, // 278: openshell.v1.CreateSandboxRequest.AnnotationsEntry - nil, // 279: openshell.v1.SandboxResponse.ServiceUrlsEntry - nil, // 280: openshell.v1.ExecSandboxRequest.EnvironmentEntry - nil, // 281: openshell.v1.SandboxLogLine.FieldsEntry - nil, // 282: openshell.v1.GetProviderCredentialsResponse.CredentialsEntry - nil, // 283: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry - nil, // 284: openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry - nil, // 285: openshell.v1.ProviderProfile.AnnotationsEntry - nil, // 286: openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry - nil, // 287: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry - nil, // 288: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry - nil, // 289: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry - nil, // 290: openshell.v1.GetSandboxProviderEnvironmentResponse.FilesEntry - nil, // 291: openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry - nil, // 292: openshell.v1.ProviderEnvironmentSnapshot.FilesEntry - nil, // 293: openshell.v1.UpdateConfigRequest.AnnotationsEntry - nil, // 294: openshell.v1.UpdateConfigResponse.AnnotationsEntry - nil, // 295: openshell.v1.SandboxPolicyRevision.ProvenanceEntry - nil, // 296: openshell.v1.CreateWorkspaceRequest.LabelsEntry - (*timestamppb.Timestamp)(nil), // 297: google.protobuf.Timestamp - (*datamodelv1.ObjectMeta)(nil), // 298: openshell.datamodel.v1.ObjectMeta - (*sandboxv1.SandboxPolicy)(nil), // 299: openshell.sandbox.v1.SandboxPolicy - (*structpb.Struct)(nil), // 300: google.protobuf.Struct - (*durationpb.Duration)(nil), // 301: google.protobuf.Duration - (*datamodelv1.WorkspaceSelector)(nil), // 302: openshell.datamodel.v1.WorkspaceSelector - (*datamodelv1.Provider)(nil), // 303: openshell.datamodel.v1.Provider - (sandboxv1.PolicySource)(0), // 304: openshell.sandbox.v1.PolicySource - (*sandboxv1.NetworkEndpoint)(nil), // 305: openshell.sandbox.v1.NetworkEndpoint - (*sandboxv1.NetworkBinary)(nil), // 306: openshell.sandbox.v1.NetworkBinary - (*sandboxv1.SettingValue)(nil), // 307: openshell.sandbox.v1.SettingValue - (*sandboxv1.NetworkPolicyRule)(nil), // 308: openshell.sandbox.v1.NetworkPolicyRule - (*sandboxv1.L7DenyRule)(nil), // 309: openshell.sandbox.v1.L7DenyRule - (*sandboxv1.L7Rule)(nil), // 310: openshell.sandbox.v1.L7Rule - (*sandboxv1.SandboxConfigSnapshot)(nil), // 311: openshell.sandbox.v1.SandboxConfigSnapshot - (*datamodelv1.Workspace)(nil), // 312: openshell.datamodel.v1.Workspace - (*sandboxv1.GetSandboxConfigRequest)(nil), // 313: openshell.sandbox.v1.GetSandboxConfigRequest - (*sandboxv1.GetGatewayConfigRequest)(nil), // 314: openshell.sandbox.v1.GetGatewayConfigRequest - (*sandboxv1.GetSandboxConfigResponse)(nil), // 315: openshell.sandbox.v1.GetSandboxConfigResponse - (*sandboxv1.GetGatewayConfigResponse)(nil), // 316: openshell.sandbox.v1.GetGatewayConfigResponse + (*StaticCredentialPlacement)(nil), // 161: openshell.v1.StaticCredentialPlacement + (*StaticCredentialBinding)(nil), // 162: openshell.v1.StaticCredentialBinding + (*GetSandboxProviderEnvironmentResponse)(nil), // 163: openshell.v1.GetSandboxProviderEnvironmentResponse + (*ProviderEnvironmentValue)(nil), // 164: openshell.v1.ProviderEnvironmentValue + (*ProviderEnvironmentSnapshot)(nil), // 165: openshell.v1.ProviderEnvironmentSnapshot + (*ExchangeProviderSubjectTokenRequest)(nil), // 166: openshell.v1.ExchangeProviderSubjectTokenRequest + (*ExchangeProviderSubjectTokenResponse)(nil), // 167: openshell.v1.ExchangeProviderSubjectTokenResponse + (*UpdateConfigRequest)(nil), // 168: openshell.v1.UpdateConfigRequest + (*PolicyMergeOperation)(nil), // 169: openshell.v1.PolicyMergeOperation + (*AddNetworkRule)(nil), // 170: openshell.v1.AddNetworkRule + (*RemoveNetworkEndpoint)(nil), // 171: openshell.v1.RemoveNetworkEndpoint + (*RemoveNetworkRule)(nil), // 172: openshell.v1.RemoveNetworkRule + (*L7RuleTarget)(nil), // 173: openshell.v1.L7RuleTarget + (*AddDenyRules)(nil), // 174: openshell.v1.AddDenyRules + (*AddAllowRules)(nil), // 175: openshell.v1.AddAllowRules + (*RemoveNetworkBinary)(nil), // 176: openshell.v1.RemoveNetworkBinary + (*UpdateConfigResponse)(nil), // 177: openshell.v1.UpdateConfigResponse + (*GetSandboxPolicyStatusRequest)(nil), // 178: openshell.v1.GetSandboxPolicyStatusRequest + (*GetSandboxPolicyStatusResponse)(nil), // 179: openshell.v1.GetSandboxPolicyStatusResponse + (*ListSandboxPoliciesRequest)(nil), // 180: openshell.v1.ListSandboxPoliciesRequest + (*ListSandboxPoliciesResponse)(nil), // 181: openshell.v1.ListSandboxPoliciesResponse + (*ReportPolicyStatusRequest)(nil), // 182: openshell.v1.ReportPolicyStatusRequest + (*ReportPolicyStatusResponse)(nil), // 183: openshell.v1.ReportPolicyStatusResponse + (*SandboxConfigurationAdmission)(nil), // 184: openshell.v1.SandboxConfigurationAdmission + (*ReportSandboxConfigurationRequest)(nil), // 185: openshell.v1.ReportSandboxConfigurationRequest + (*ReportSandboxConfigurationResponse)(nil), // 186: openshell.v1.ReportSandboxConfigurationResponse + (*SandboxPolicyRevision)(nil), // 187: openshell.v1.SandboxPolicyRevision + (*GetSandboxLogsRequest)(nil), // 188: openshell.v1.GetSandboxLogsRequest + (*PushSandboxLogsRequest)(nil), // 189: openshell.v1.PushSandboxLogsRequest + (*PushSandboxLogsResponse)(nil), // 190: openshell.v1.PushSandboxLogsResponse + (*GetSandboxLogsResponse)(nil), // 191: openshell.v1.GetSandboxLogsResponse + (*SupervisorMessage)(nil), // 192: openshell.v1.SupervisorMessage + (*GatewayMessage)(nil), // 193: openshell.v1.GatewayMessage + (*SupervisorHello)(nil), // 194: openshell.v1.SupervisorHello + (*SessionAccepted)(nil), // 195: openshell.v1.SessionAccepted + (*ConfigUpdate)(nil), // 196: openshell.v1.ConfigUpdate + (*ConfigApplyFailure)(nil), // 197: openshell.v1.ConfigApplyFailure + (*ConfigUpdateResult)(nil), // 198: openshell.v1.ConfigUpdateResult + (*PolicyLoadResult)(nil), // 199: openshell.v1.PolicyLoadResult + (*SessionRejected)(nil), // 200: openshell.v1.SessionRejected + (*SessionRedirect)(nil), // 201: openshell.v1.SessionRedirect + (*SupervisorHeartbeat)(nil), // 202: openshell.v1.SupervisorHeartbeat + (*GatewayHeartbeat)(nil), // 203: openshell.v1.GatewayHeartbeat + (*ReportMainProcessExitRequest)(nil), // 204: openshell.v1.ReportMainProcessExitRequest + (*ReportMainProcessExitResponse)(nil), // 205: openshell.v1.ReportMainProcessExitResponse + (*FinalizeMainProcessExitRequest)(nil), // 206: openshell.v1.FinalizeMainProcessExitRequest + (*FinalizeMainProcessExitResponse)(nil), // 207: openshell.v1.FinalizeMainProcessExitResponse + (*RelayOpen)(nil), // 208: openshell.v1.RelayOpen + (*SshRelayTarget)(nil), // 209: openshell.v1.SshRelayTarget + (*TcpRelayTarget)(nil), // 210: openshell.v1.TcpRelayTarget + (*RelayInit)(nil), // 211: openshell.v1.RelayInit + (*RelayFrame)(nil), // 212: openshell.v1.RelayFrame + (*PeerRelayInit)(nil), // 213: openshell.v1.PeerRelayInit + (*PeerRelayFrame)(nil), // 214: openshell.v1.PeerRelayFrame + (*PeerConfigSandboxTarget)(nil), // 215: openshell.v1.PeerConfigSandboxTarget + (*PeerConfigProviderTarget)(nil), // 216: openshell.v1.PeerConfigProviderTarget + (*PeerNotifyConfigUpdateRequest)(nil), // 217: openshell.v1.PeerNotifyConfigUpdateRequest + (*PeerNotifyConfigUpdateResponse)(nil), // 218: openshell.v1.PeerNotifyConfigUpdateResponse + (*RelayOpenResult)(nil), // 219: openshell.v1.RelayOpenResult + (*RelayClose)(nil), // 220: openshell.v1.RelayClose + (*L7RequestSample)(nil), // 221: openshell.v1.L7RequestSample + (*DenialSummary)(nil), // 222: openshell.v1.DenialSummary + (*DenialGroupCount)(nil), // 223: openshell.v1.DenialGroupCount + (*NetworkActivitySummary)(nil), // 224: openshell.v1.NetworkActivitySummary + (*PolicyChunk)(nil), // 225: openshell.v1.PolicyChunk + (*DraftPolicyUpdate)(nil), // 226: openshell.v1.DraftPolicyUpdate + (*SubmitPolicyAnalysisRequest)(nil), // 227: openshell.v1.SubmitPolicyAnalysisRequest + (*SubmitPolicyAnalysisResponse)(nil), // 228: openshell.v1.SubmitPolicyAnalysisResponse + (*GetDraftPolicyRequest)(nil), // 229: openshell.v1.GetDraftPolicyRequest + (*GetDraftPolicyResponse)(nil), // 230: openshell.v1.GetDraftPolicyResponse + (*ApproveDraftChunkRequest)(nil), // 231: openshell.v1.ApproveDraftChunkRequest + (*ApproveDraftChunkResponse)(nil), // 232: openshell.v1.ApproveDraftChunkResponse + (*RejectDraftChunkRequest)(nil), // 233: openshell.v1.RejectDraftChunkRequest + (*RejectDraftChunkResponse)(nil), // 234: openshell.v1.RejectDraftChunkResponse + (*DraftChunkApproval)(nil), // 235: openshell.v1.DraftChunkApproval + (*ApproveAllDraftChunksRequest)(nil), // 236: openshell.v1.ApproveAllDraftChunksRequest + (*ApproveAllDraftChunksResponse)(nil), // 237: openshell.v1.ApproveAllDraftChunksResponse + (*EditDraftChunkRequest)(nil), // 238: openshell.v1.EditDraftChunkRequest + (*EditDraftChunkResponse)(nil), // 239: openshell.v1.EditDraftChunkResponse + (*UndoDraftChunkRequest)(nil), // 240: openshell.v1.UndoDraftChunkRequest + (*UndoDraftChunkResponse)(nil), // 241: openshell.v1.UndoDraftChunkResponse + (*ClearDraftChunksRequest)(nil), // 242: openshell.v1.ClearDraftChunksRequest + (*ClearDraftChunksResponse)(nil), // 243: openshell.v1.ClearDraftChunksResponse + (*GetDraftHistoryRequest)(nil), // 244: openshell.v1.GetDraftHistoryRequest + (*DraftHistoryEntry)(nil), // 245: openshell.v1.DraftHistoryEntry + (*GetDraftHistoryResponse)(nil), // 246: openshell.v1.GetDraftHistoryResponse + (*CreateWorkspaceRequest)(nil), // 247: openshell.v1.CreateWorkspaceRequest + (*CreateWorkspaceResponse)(nil), // 248: openshell.v1.CreateWorkspaceResponse + (*GetWorkspaceRequest)(nil), // 249: openshell.v1.GetWorkspaceRequest + (*GetWorkspaceResponse)(nil), // 250: openshell.v1.GetWorkspaceResponse + (*ListWorkspacesRequest)(nil), // 251: openshell.v1.ListWorkspacesRequest + (*ListWorkspacesResponse)(nil), // 252: openshell.v1.ListWorkspacesResponse + (*DeleteWorkspaceRequest)(nil), // 253: openshell.v1.DeleteWorkspaceRequest + (*DeleteWorkspaceResponse)(nil), // 254: openshell.v1.DeleteWorkspaceResponse + (*WorkspaceMember)(nil), // 255: openshell.v1.WorkspaceMember + (*AddWorkspaceMemberRequest)(nil), // 256: openshell.v1.AddWorkspaceMemberRequest + (*AddWorkspaceMemberResponse)(nil), // 257: openshell.v1.AddWorkspaceMemberResponse + (*RemoveWorkspaceMemberRequest)(nil), // 258: openshell.v1.RemoveWorkspaceMemberRequest + (*RemoveWorkspaceMemberResponse)(nil), // 259: openshell.v1.RemoveWorkspaceMemberResponse + (*ListWorkspaceMembersRequest)(nil), // 260: openshell.v1.ListWorkspaceMembersRequest + (*ListWorkspaceMembersResponse)(nil), // 261: openshell.v1.ListWorkspaceMembersResponse + (*ExtensionServiceCredential)(nil), // 262: openshell.v1.ExtensionServiceCredential + (*EndpointObservation)(nil), // 263: openshell.v1.EndpointObservation + (*ReportEndpointStatusRequest)(nil), // 264: openshell.v1.ReportEndpointStatusRequest + (*TokenGrantStatus)(nil), // 265: openshell.v1.TokenGrantStatus + (*TokenGrantFailureObservation)(nil), // 266: openshell.v1.TokenGrantFailureObservation + (*ReportEndpointStatusResponse)(nil), // 267: openshell.v1.ReportEndpointStatusResponse + (*EndpointStatus)(nil), // 268: openshell.v1.EndpointStatus + (*SandboxProvisioning)(nil), // 269: openshell.v1.SandboxProvisioning + (*SandboxServiceExposure)(nil), // 270: openshell.v1.SandboxServiceExposure + (*EndpointFailure)(nil), // 271: openshell.v1.EndpointFailure + nil, // 272: openshell.v1.SandboxSpec.EnvironmentEntry + nil, // 273: openshell.v1.SandboxTemplate.LabelsEntry + nil, // 274: openshell.v1.SandboxTemplate.AnnotationsEntry + nil, // 275: openshell.v1.SandboxTemplate.EnvironmentEntry + nil, // 276: openshell.v1.SandboxWorkloadConfig.EnvironmentEntry + nil, // 277: openshell.v1.PlatformEvent.MetadataEntry + nil, // 278: openshell.v1.CreateSandboxRequest.LabelsEntry + nil, // 279: openshell.v1.CreateSandboxRequest.AnnotationsEntry + nil, // 280: openshell.v1.SandboxResponse.ServiceUrlsEntry + nil, // 281: openshell.v1.ExecSandboxRequest.EnvironmentEntry + nil, // 282: openshell.v1.SandboxLogLine.FieldsEntry + nil, // 283: openshell.v1.GetProviderCredentialsResponse.CredentialsEntry + nil, // 284: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry + nil, // 285: openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry + nil, // 286: openshell.v1.ProviderProfile.AnnotationsEntry + nil, // 287: openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry + nil, // 288: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry + nil, // 289: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry + nil, // 290: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry + nil, // 291: openshell.v1.GetSandboxProviderEnvironmentResponse.FilesEntry + nil, // 292: openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry + nil, // 293: openshell.v1.ProviderEnvironmentSnapshot.FilesEntry + nil, // 294: openshell.v1.UpdateConfigRequest.AnnotationsEntry + nil, // 295: openshell.v1.UpdateConfigResponse.AnnotationsEntry + nil, // 296: openshell.v1.SandboxPolicyRevision.ProvenanceEntry + nil, // 297: openshell.v1.CreateWorkspaceRequest.LabelsEntry + (*timestamppb.Timestamp)(nil), // 298: google.protobuf.Timestamp + (*datamodelv1.ObjectMeta)(nil), // 299: openshell.datamodel.v1.ObjectMeta + (*sandboxv1.SandboxPolicy)(nil), // 300: openshell.sandbox.v1.SandboxPolicy + (*structpb.Struct)(nil), // 301: google.protobuf.Struct + (*durationpb.Duration)(nil), // 302: google.protobuf.Duration + (*datamodelv1.WorkspaceSelector)(nil), // 303: openshell.datamodel.v1.WorkspaceSelector + (*datamodelv1.Provider)(nil), // 304: openshell.datamodel.v1.Provider + (sandboxv1.PolicySource)(0), // 305: openshell.sandbox.v1.PolicySource + (*sandboxv1.NetworkEndpoint)(nil), // 306: openshell.sandbox.v1.NetworkEndpoint + (*sandboxv1.NetworkBinary)(nil), // 307: openshell.sandbox.v1.NetworkBinary + (*sandboxv1.SettingValue)(nil), // 308: openshell.sandbox.v1.SettingValue + (*sandboxv1.NetworkPolicyRule)(nil), // 309: openshell.sandbox.v1.NetworkPolicyRule + (*sandboxv1.L7DenyRule)(nil), // 310: openshell.sandbox.v1.L7DenyRule + (*sandboxv1.L7Rule)(nil), // 311: openshell.sandbox.v1.L7Rule + (*sandboxv1.SandboxConfigSnapshot)(nil), // 312: openshell.sandbox.v1.SandboxConfigSnapshot + (*datamodelv1.Workspace)(nil), // 313: openshell.datamodel.v1.Workspace + (*sandboxv1.GetSandboxConfigRequest)(nil), // 314: openshell.sandbox.v1.GetSandboxConfigRequest + (*sandboxv1.GetGatewayConfigRequest)(nil), // 315: openshell.sandbox.v1.GetGatewayConfigRequest + (*sandboxv1.GetSandboxConfigResponse)(nil), // 316: openshell.sandbox.v1.GetSandboxConfigResponse + (*sandboxv1.GetGatewayConfigResponse)(nil), // 317: openshell.sandbox.v1.GetGatewayConfigResponse } var file_openshell_proto_depIdxs = []int32{ - 297, // 0: openshell.v1.IssueSandboxTokenResponse.expiration_time:type_name -> google.protobuf.Timestamp - 297, // 1: openshell.v1.RefreshSandboxTokenResponse.expiration_time:type_name -> google.protobuf.Timestamp - 261, // 2: openshell.v1.RefreshSandboxTokenResponse.extension_credentials:type_name -> openshell.v1.ExtensionServiceCredential - 297, // 3: openshell.v1.RefreshSandboxTokenResponse.sandbox_expiration_time:type_name -> google.protobuf.Timestamp + 298, // 0: openshell.v1.IssueSandboxTokenResponse.expiration_time:type_name -> google.protobuf.Timestamp + 298, // 1: openshell.v1.RefreshSandboxTokenResponse.expiration_time:type_name -> google.protobuf.Timestamp + 262, // 2: openshell.v1.RefreshSandboxTokenResponse.extension_credentials:type_name -> openshell.v1.ExtensionServiceCredential + 298, // 3: openshell.v1.RefreshSandboxTokenResponse.sandbox_expiration_time:type_name -> google.protobuf.Timestamp 14, // 4: openshell.v1.HealthResponse.status:type_name -> openshell.v1.ServiceStatus 14, // 5: openshell.v1.GetGatewayInfoResponse.status:type_name -> openshell.v1.ServiceStatus 33, // 6: openshell.v1.GetGatewayInfoResponse.compute_drivers:type_name -> openshell.v1.ComputeDriverInfo @@ -21536,524 +21694,525 @@ var file_openshell_proto_depIdxs = []int32{ 36, // 11: openshell.v1.ResourceCapabilities.cpu:type_name -> openshell.v1.CpuResourceCapabilities 37, // 12: openshell.v1.ResourceCapabilities.memory:type_name -> openshell.v1.MemoryResourceCapabilities 38, // 13: openshell.v1.ResourceCapabilities.gpu:type_name -> openshell.v1.GpuResourceCapabilities - 298, // 14: openshell.v1.Sandbox.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 299, // 14: openshell.v1.Sandbox.metadata:type_name -> openshell.datamodel.v1.ObjectMeta 40, // 15: openshell.v1.Sandbox.spec:type_name -> openshell.v1.SandboxSpec 51, // 16: openshell.v1.Sandbox.status:type_name -> openshell.v1.SandboxStatus 50, // 17: openshell.v1.Sandbox.created_from_workload_template:type_name -> openshell.v1.SandboxWorkloadTemplateProvenance - 271, // 18: openshell.v1.SandboxSpec.environment:type_name -> openshell.v1.SandboxSpec.EnvironmentEntry + 272, // 18: openshell.v1.SandboxSpec.environment:type_name -> openshell.v1.SandboxSpec.EnvironmentEntry 43, // 19: openshell.v1.SandboxSpec.template:type_name -> openshell.v1.SandboxTemplate - 299, // 20: openshell.v1.SandboxSpec.policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 300, // 20: openshell.v1.SandboxSpec.policy:type_name -> openshell.sandbox.v1.SandboxPolicy 41, // 21: openshell.v1.SandboxSpec.resource_requirements:type_name -> openshell.v1.ResourceRequirements 17, // 22: openshell.v1.SandboxSpec.restart_policy:type_name -> openshell.v1.SandboxRestartPolicy 42, // 23: openshell.v1.ResourceRequirements.gpu:type_name -> openshell.v1.GpuResourceRequirements - 272, // 24: openshell.v1.SandboxTemplate.labels:type_name -> openshell.v1.SandboxTemplate.LabelsEntry - 273, // 25: openshell.v1.SandboxTemplate.annotations:type_name -> openshell.v1.SandboxTemplate.AnnotationsEntry - 274, // 26: openshell.v1.SandboxTemplate.environment:type_name -> openshell.v1.SandboxTemplate.EnvironmentEntry - 300, // 27: openshell.v1.SandboxTemplate.resources:type_name -> google.protobuf.Struct - 300, // 28: openshell.v1.SandboxTemplate.driver_config:type_name -> google.protobuf.Struct - 298, // 29: openshell.v1.SandboxWorkloadTemplate.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 273, // 24: openshell.v1.SandboxTemplate.labels:type_name -> openshell.v1.SandboxTemplate.LabelsEntry + 274, // 25: openshell.v1.SandboxTemplate.annotations:type_name -> openshell.v1.SandboxTemplate.AnnotationsEntry + 275, // 26: openshell.v1.SandboxTemplate.environment:type_name -> openshell.v1.SandboxTemplate.EnvironmentEntry + 301, // 27: openshell.v1.SandboxTemplate.resources:type_name -> google.protobuf.Struct + 301, // 28: openshell.v1.SandboxTemplate.driver_config:type_name -> google.protobuf.Struct + 299, // 29: openshell.v1.SandboxWorkloadTemplate.metadata:type_name -> openshell.datamodel.v1.ObjectMeta 45, // 30: openshell.v1.SandboxWorkloadTemplate.spec:type_name -> openshell.v1.SandboxWorkloadTemplateSpec 46, // 31: openshell.v1.SandboxWorkloadTemplateSpec.workload:type_name -> openshell.v1.SandboxWorkloadConfig - 300, // 32: openshell.v1.SandboxWorkloadTemplateSpec.driver_config:type_name -> google.protobuf.Struct + 301, // 32: openshell.v1.SandboxWorkloadTemplateSpec.driver_config:type_name -> google.protobuf.Struct 48, // 33: openshell.v1.SandboxWorkloadTemplateSpec.desired_service_level:type_name -> openshell.v1.SandboxServiceLevel - 275, // 34: openshell.v1.SandboxWorkloadConfig.environment:type_name -> openshell.v1.SandboxWorkloadConfig.EnvironmentEntry + 276, // 34: openshell.v1.SandboxWorkloadConfig.environment:type_name -> openshell.v1.SandboxWorkloadConfig.EnvironmentEntry 47, // 35: openshell.v1.SandboxWorkloadConfig.resources:type_name -> openshell.v1.SandboxResources 42, // 36: openshell.v1.SandboxResources.gpu:type_name -> openshell.v1.GpuResourceRequirements 49, // 37: openshell.v1.SandboxServiceLevel.startup:type_name -> openshell.v1.SandboxStartup - 301, // 38: openshell.v1.SandboxStartup.ready_within:type_name -> google.protobuf.Duration + 302, // 38: openshell.v1.SandboxStartup.ready_within:type_name -> google.protobuf.Duration 52, // 39: openshell.v1.SandboxStatus.conditions:type_name -> openshell.v1.SandboxCondition 1, // 40: openshell.v1.SandboxStatus.phase:type_name -> openshell.v1.SandboxPhase - 267, // 41: openshell.v1.SandboxStatus.endpoint_statuses:type_name -> openshell.v1.EndpointStatus - 183, // 42: openshell.v1.SandboxStatus.configuration_admission:type_name -> openshell.v1.SandboxConfigurationAdmission - 268, // 43: openshell.v1.SandboxStatus.provisioning:type_name -> openshell.v1.SandboxProvisioning - 297, // 44: openshell.v1.SandboxStatus.next_restart_time:type_name -> google.protobuf.Timestamp - 297, // 45: openshell.v1.SandboxStatus.main_process_started_time:type_name -> google.protobuf.Timestamp - 265, // 46: openshell.v1.SandboxStatus.last_token_grant_failure:type_name -> openshell.v1.TokenGrantFailureObservation - 297, // 47: openshell.v1.SandboxCondition.transition_time:type_name -> google.protobuf.Timestamp - 297, // 48: openshell.v1.PlatformEvent.event_time:type_name -> google.protobuf.Timestamp - 276, // 49: openshell.v1.PlatformEvent.metadata:type_name -> openshell.v1.PlatformEvent.MetadataEntry - 302, // 50: openshell.v1.CreateSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 268, // 41: openshell.v1.SandboxStatus.endpoint_statuses:type_name -> openshell.v1.EndpointStatus + 184, // 42: openshell.v1.SandboxStatus.configuration_admission:type_name -> openshell.v1.SandboxConfigurationAdmission + 269, // 43: openshell.v1.SandboxStatus.provisioning:type_name -> openshell.v1.SandboxProvisioning + 298, // 44: openshell.v1.SandboxStatus.next_restart_time:type_name -> google.protobuf.Timestamp + 298, // 45: openshell.v1.SandboxStatus.main_process_started_time:type_name -> google.protobuf.Timestamp + 266, // 46: openshell.v1.SandboxStatus.last_token_grant_failure:type_name -> openshell.v1.TokenGrantFailureObservation + 298, // 47: openshell.v1.SandboxCondition.transition_time:type_name -> google.protobuf.Timestamp + 298, // 48: openshell.v1.PlatformEvent.event_time:type_name -> google.protobuf.Timestamp + 277, // 49: openshell.v1.PlatformEvent.metadata:type_name -> openshell.v1.PlatformEvent.MetadataEntry + 303, // 50: openshell.v1.CreateSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 40, // 51: openshell.v1.CreateSandboxRequest.spec:type_name -> openshell.v1.SandboxSpec - 277, // 52: openshell.v1.CreateSandboxRequest.labels:type_name -> openshell.v1.CreateSandboxRequest.LabelsEntry - 278, // 53: openshell.v1.CreateSandboxRequest.annotations:type_name -> openshell.v1.CreateSandboxRequest.AnnotationsEntry - 269, // 54: openshell.v1.CreateSandboxRequest.service_exposures:type_name -> openshell.v1.SandboxServiceExposure - 302, // 55: openshell.v1.CreateSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 278, // 52: openshell.v1.CreateSandboxRequest.labels:type_name -> openshell.v1.CreateSandboxRequest.LabelsEntry + 279, // 53: openshell.v1.CreateSandboxRequest.annotations:type_name -> openshell.v1.CreateSandboxRequest.AnnotationsEntry + 270, // 54: openshell.v1.CreateSandboxRequest.service_exposures:type_name -> openshell.v1.SandboxServiceExposure + 303, // 55: openshell.v1.CreateSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 44, // 56: openshell.v1.CreateSandboxTemplateRequest.template:type_name -> openshell.v1.SandboxWorkloadTemplate - 302, // 57: openshell.v1.GetSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 302, // 58: openshell.v1.ListSandboxTemplatesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 302, // 59: openshell.v1.DeleteSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 57: openshell.v1.GetSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 58: openshell.v1.ListSandboxTemplatesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 59: openshell.v1.DeleteSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 44, // 60: openshell.v1.SandboxTemplateResponse.template:type_name -> openshell.v1.SandboxWorkloadTemplate 44, // 61: openshell.v1.ListSandboxTemplatesResponse.templates:type_name -> openshell.v1.SandboxWorkloadTemplate 18, // 62: openshell.v1.DeleteSandboxTemplateResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 302, // 63: openshell.v1.BeginRootfsTarStagingRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 297, // 64: openshell.v1.BeginRootfsTarStagingResponse.expiration_time:type_name -> google.protobuf.Timestamp - 302, // 65: openshell.v1.GetSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 302, // 66: openshell.v1.ListSandboxesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 302, // 67: openshell.v1.ListSandboxProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 302, // 68: openshell.v1.AttachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 302, // 69: openshell.v1.DetachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 302, // 70: openshell.v1.DeleteSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 302, // 71: openshell.v1.StopSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 302, // 72: openshell.v1.StartSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 63: openshell.v1.BeginRootfsTarStagingRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 298, // 64: openshell.v1.BeginRootfsTarStagingResponse.expiration_time:type_name -> google.protobuf.Timestamp + 303, // 65: openshell.v1.GetSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 66: openshell.v1.ListSandboxesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 67: openshell.v1.ListSandboxProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 68: openshell.v1.AttachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 69: openshell.v1.DetachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 70: openshell.v1.DeleteSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 71: openshell.v1.StopSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 72: openshell.v1.StartSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 39, // 73: openshell.v1.SandboxResponse.sandbox:type_name -> openshell.v1.Sandbox - 279, // 74: openshell.v1.SandboxResponse.service_urls:type_name -> openshell.v1.SandboxResponse.ServiceUrlsEntry + 280, // 74: openshell.v1.SandboxResponse.service_urls:type_name -> openshell.v1.SandboxResponse.ServiceUrlsEntry 39, // 75: openshell.v1.ListSandboxesResponse.sandboxes:type_name -> openshell.v1.Sandbox - 303, // 76: openshell.v1.ListSandboxProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider + 304, // 76: openshell.v1.ListSandboxProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider 39, // 77: openshell.v1.AttachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox 81, // 78: openshell.v1.AttachSandboxProviderResponse.receipt:type_name -> openshell.v1.ProviderMutationReceipt 39, // 79: openshell.v1.DetachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox 81, // 80: openshell.v1.DetachSandboxProviderResponse.receipt:type_name -> openshell.v1.ProviderMutationReceipt 79, // 81: openshell.v1.ConfigSnapshotRevision.sandbox_config:type_name -> openshell.v1.SandboxConfigRevision 77, // 82: openshell.v1.ConfigSnapshotRevision.provider_target:type_name -> openshell.v1.ProviderDesiredIdentity - 304, // 83: openshell.v1.SandboxConfigRevision.policy_source:type_name -> openshell.sandbox.v1.PolicySource + 305, // 83: openshell.v1.SandboxConfigRevision.policy_source:type_name -> openshell.sandbox.v1.PolicySource 5, // 84: openshell.v1.ConfigUpdateOperation.component:type_name -> openshell.v1.ConfigComponent 78, // 85: openshell.v1.ConfigUpdateOperation.target_revision:type_name -> openshell.v1.ConfigSnapshotRevision 7, // 86: openshell.v1.ConfigUpdateOperation.state:type_name -> openshell.v1.ConfigUpdateOperationState 6, // 87: openshell.v1.ConfigUpdateOperation.outcome:type_name -> openshell.v1.ConfigApplyOutcome - 297, // 88: openshell.v1.ConfigUpdateOperation.created_time:type_name -> google.protobuf.Timestamp - 297, // 89: openshell.v1.ConfigUpdateOperation.updated_time:type_name -> google.protobuf.Timestamp - 297, // 90: openshell.v1.ConfigUpdateOperation.completed_time:type_name -> google.protobuf.Timestamp + 298, // 88: openshell.v1.ConfigUpdateOperation.created_time:type_name -> google.protobuf.Timestamp + 298, // 89: openshell.v1.ConfigUpdateOperation.updated_time:type_name -> google.protobuf.Timestamp + 298, // 90: openshell.v1.ConfigUpdateOperation.completed_time:type_name -> google.protobuf.Timestamp 2, // 91: openshell.v1.ProviderMutationReceipt.kind:type_name -> openshell.v1.ProviderMutationKind 77, // 92: openshell.v1.ProviderMutationReceipt.desired:type_name -> openshell.v1.ProviderDesiredIdentity - 297, // 93: openshell.v1.ProviderMutationReceipt.persisted_time:type_name -> google.protobuf.Timestamp + 298, // 93: openshell.v1.ProviderMutationReceipt.persisted_time:type_name -> google.protobuf.Timestamp 4, // 94: openshell.v1.ProviderReadinessObservation.reason:type_name -> openshell.v1.ProviderReadinessReason 81, // 95: openshell.v1.ProviderReadinessStatus.receipt:type_name -> openshell.v1.ProviderMutationReceipt 3, // 96: openshell.v1.ProviderReadinessStatus.state:type_name -> openshell.v1.ProviderReadinessState 4, // 97: openshell.v1.ProviderReadinessStatus.reason:type_name -> openshell.v1.ProviderReadinessReason 82, // 98: openshell.v1.ProviderReadinessStatus.observed:type_name -> openshell.v1.ProviderReadinessObservation - 297, // 99: openshell.v1.ProviderReadinessStatus.observed_time:type_name -> google.protobuf.Timestamp - 297, // 100: openshell.v1.ProviderReadinessStatus.evaluated_time:type_name -> google.protobuf.Timestamp + 298, // 99: openshell.v1.ProviderReadinessStatus.observed_time:type_name -> google.protobuf.Timestamp + 298, // 100: openshell.v1.ProviderReadinessStatus.evaluated_time:type_name -> google.protobuf.Timestamp 80, // 101: openshell.v1.ProviderReadinessStatus.operation:type_name -> openshell.v1.ConfigUpdateOperation - 302, // 102: openshell.v1.GetSandboxProviderStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 102: openshell.v1.GetSandboxProviderStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 83, // 103: openshell.v1.GetSandboxProviderStatusResponse.status:type_name -> openshell.v1.ProviderReadinessStatus 82, // 104: openshell.v1.ReportProviderReadinessRequest.observation:type_name -> openshell.v1.ProviderReadinessObservation - 301, // 105: openshell.v1.ReportProviderReadinessResponse.report_interval:type_name -> google.protobuf.Duration - 301, // 106: openshell.v1.ReportProviderReadinessResponse.observation_ttl:type_name -> google.protobuf.Duration + 302, // 105: openshell.v1.ReportProviderReadinessResponse.report_interval:type_name -> google.protobuf.Duration + 302, // 106: openshell.v1.ReportProviderReadinessResponse.observation_ttl:type_name -> google.protobuf.Duration 18, // 107: openshell.v1.DeleteSandboxResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 302, // 108: openshell.v1.CreateSshSessionRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 297, // 109: openshell.v1.CreateSshSessionResponse.expiration_time:type_name -> google.protobuf.Timestamp - 302, // 110: openshell.v1.ExposeServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 108: openshell.v1.CreateSshSessionRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 298, // 109: openshell.v1.CreateSshSessionResponse.expiration_time:type_name -> google.protobuf.Timestamp + 303, // 110: openshell.v1.ExposeServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 20, // 111: openshell.v1.ExposeServiceRequest.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode - 302, // 112: openshell.v1.GetServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 302, // 113: openshell.v1.ListServicesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 112: openshell.v1.GetServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 113: openshell.v1.ListServicesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 98, // 114: openshell.v1.ListServicesResponse.services:type_name -> openshell.v1.ServiceEndpointResponse - 302, // 115: openshell.v1.DeleteServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 115: openshell.v1.DeleteServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 18, // 116: openshell.v1.DeleteServiceResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 298, // 117: openshell.v1.ServiceEndpoint.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 299, // 117: openshell.v1.ServiceEndpoint.metadata:type_name -> openshell.datamodel.v1.ObjectMeta 20, // 118: openshell.v1.ServiceEndpoint.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode 97, // 119: openshell.v1.ServiceEndpointResponse.endpoint:type_name -> openshell.v1.ServiceEndpoint 18, // 120: openshell.v1.RevokeSshSessionResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 302, // 121: openshell.v1.ExecSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 280, // 122: openshell.v1.ExecSandboxRequest.environment:type_name -> openshell.v1.ExecSandboxRequest.EnvironmentEntry - 301, // 123: openshell.v1.ExecSandboxRequest.execution_timeout:type_name -> google.protobuf.Duration + 303, // 121: openshell.v1.ExecSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 281, // 122: openshell.v1.ExecSandboxRequest.environment:type_name -> openshell.v1.ExecSandboxRequest.EnvironmentEntry + 302, // 123: openshell.v1.ExecSandboxRequest.execution_timeout:type_name -> google.protobuf.Duration 102, // 124: openshell.v1.ExecSandboxEvent.stdout:type_name -> openshell.v1.ExecSandboxStdout 103, // 125: openshell.v1.ExecSandboxEvent.stderr:type_name -> openshell.v1.ExecSandboxStderr 104, // 126: openshell.v1.ExecSandboxEvent.exit:type_name -> openshell.v1.ExecSandboxExit - 208, // 127: openshell.v1.TcpForwardInit.ssh:type_name -> openshell.v1.SshRelayTarget - 209, // 128: openshell.v1.TcpForwardInit.tcp:type_name -> openshell.v1.TcpRelayTarget + 209, // 127: openshell.v1.TcpForwardInit.ssh:type_name -> openshell.v1.SshRelayTarget + 210, // 128: openshell.v1.TcpForwardInit.tcp:type_name -> openshell.v1.TcpRelayTarget 106, // 129: openshell.v1.TcpForwardFrame.init:type_name -> openshell.v1.TcpForwardInit 101, // 130: openshell.v1.ExecSandboxInput.start:type_name -> openshell.v1.ExecSandboxRequest 109, // 131: openshell.v1.ExecSandboxInput.resize:type_name -> openshell.v1.ExecSandboxWindowResize - 298, // 132: openshell.v1.SshSession.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 297, // 133: openshell.v1.SshSession.expiration_time:type_name -> google.protobuf.Timestamp - 302, // 134: openshell.v1.WatchSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 297, // 135: openshell.v1.WatchSandboxRequest.since_time:type_name -> google.protobuf.Timestamp + 299, // 132: openshell.v1.SshSession.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 298, // 133: openshell.v1.SshSession.expiration_time:type_name -> google.protobuf.Timestamp + 303, // 134: openshell.v1.WatchSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 298, // 135: openshell.v1.WatchSandboxRequest.since_time:type_name -> google.protobuf.Timestamp 39, // 136: openshell.v1.SandboxStreamEvent.sandbox:type_name -> openshell.v1.Sandbox 113, // 137: openshell.v1.SandboxStreamEvent.log:type_name -> openshell.v1.SandboxLogLine 53, // 138: openshell.v1.SandboxStreamEvent.event:type_name -> openshell.v1.PlatformEvent 114, // 139: openshell.v1.SandboxStreamEvent.warning:type_name -> openshell.v1.SandboxStreamWarning - 225, // 140: openshell.v1.SandboxStreamEvent.draft_policy_update:type_name -> openshell.v1.DraftPolicyUpdate - 297, // 141: openshell.v1.SandboxLogLine.event_time:type_name -> google.protobuf.Timestamp - 281, // 142: openshell.v1.SandboxLogLine.fields:type_name -> openshell.v1.SandboxLogLine.FieldsEntry - 302, // 143: openshell.v1.CreateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 144: openshell.v1.CreateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider - 302, // 145: openshell.v1.GetProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 302, // 146: openshell.v1.GetProviderCredentialsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 301, // 147: openshell.v1.GetProviderCredentialsRequest.minimum_remaining_lifetime:type_name -> google.protobuf.Duration - 297, // 148: openshell.v1.ProviderCredentialValue.expiration_time:type_name -> google.protobuf.Timestamp - 282, // 149: openshell.v1.GetProviderCredentialsResponse.credentials:type_name -> openshell.v1.GetProviderCredentialsResponse.CredentialsEntry - 302, // 150: openshell.v1.ListProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 302, // 151: openshell.v1.UpdateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 152: openshell.v1.UpdateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider - 283, // 153: openshell.v1.UpdateProviderRequest.credential_expiration_times:type_name -> openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry - 302, // 154: openshell.v1.DeleteProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 155: openshell.v1.ProviderResponse.provider:type_name -> openshell.datamodel.v1.Provider + 226, // 140: openshell.v1.SandboxStreamEvent.draft_policy_update:type_name -> openshell.v1.DraftPolicyUpdate + 298, // 141: openshell.v1.SandboxLogLine.event_time:type_name -> google.protobuf.Timestamp + 282, // 142: openshell.v1.SandboxLogLine.fields:type_name -> openshell.v1.SandboxLogLine.FieldsEntry + 303, // 143: openshell.v1.CreateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 304, // 144: openshell.v1.CreateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider + 303, // 145: openshell.v1.GetProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 146: openshell.v1.GetProviderCredentialsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 147: openshell.v1.GetProviderCredentialsRequest.minimum_remaining_lifetime:type_name -> google.protobuf.Duration + 298, // 148: openshell.v1.ProviderCredentialValue.expiration_time:type_name -> google.protobuf.Timestamp + 283, // 149: openshell.v1.GetProviderCredentialsResponse.credentials:type_name -> openshell.v1.GetProviderCredentialsResponse.CredentialsEntry + 303, // 150: openshell.v1.ListProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 151: openshell.v1.UpdateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 304, // 152: openshell.v1.UpdateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider + 284, // 153: openshell.v1.UpdateProviderRequest.credential_expiration_times:type_name -> openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry + 303, // 154: openshell.v1.DeleteProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 304, // 155: openshell.v1.ProviderResponse.provider:type_name -> openshell.datamodel.v1.Provider 81, // 156: openshell.v1.ProviderResponse.target_receipts:type_name -> openshell.v1.ProviderMutationReceipt - 303, // 157: openshell.v1.ListProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider - 302, // 158: openshell.v1.ListProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 302, // 159: openshell.v1.GetProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 304, // 157: openshell.v1.ListProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider + 303, // 158: openshell.v1.ListProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 159: openshell.v1.GetProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 146, // 160: openshell.v1.ProviderProfileImportItem.profile:type_name -> openshell.v1.ProviderProfile - 301, // 161: openshell.v1.ProviderCredentialTokenGrant.cache_ttl:type_name -> google.protobuf.Duration + 302, // 161: openshell.v1.ProviderCredentialTokenGrant.cache_ttl:type_name -> google.protobuf.Duration 129, // 162: openshell.v1.ProviderCredentialTokenGrant.audience_overrides:type_name -> openshell.v1.ProviderCredentialTokenGrantAudienceOverride 8, // 163: openshell.v1.ProviderCredentialTokenGrant.grant_type:type_name -> openshell.v1.ProviderCredentialTokenGrantType 130, // 164: openshell.v1.ProviderCredentialTokenGrant.subject_token:type_name -> openshell.v1.ProviderCredentialTokenGrantSubjectToken 135, // 165: openshell.v1.ProviderProfileCredential.refresh:type_name -> openshell.v1.ProviderCredentialRefresh 131, // 166: openshell.v1.ProviderProfileCredential.token_grant:type_name -> openshell.v1.ProviderCredentialTokenGrant 9, // 167: openshell.v1.ProviderCredentialRefresh.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 301, // 168: openshell.v1.ProviderCredentialRefresh.refresh_before:type_name -> google.protobuf.Duration - 301, // 169: openshell.v1.ProviderCredentialRefresh.max_lifetime:type_name -> google.protobuf.Duration + 302, // 168: openshell.v1.ProviderCredentialRefresh.refresh_before:type_name -> google.protobuf.Duration + 302, // 169: openshell.v1.ProviderCredentialRefresh.max_lifetime:type_name -> google.protobuf.Duration 133, // 170: openshell.v1.ProviderCredentialRefresh.material:type_name -> openshell.v1.ProviderCredentialRefreshMaterial 134, // 171: openshell.v1.ProviderCredentialRefresh.additional_outputs:type_name -> openshell.v1.ProviderCredentialRefreshOutput 9, // 172: openshell.v1.ProviderCredentialRefreshStatus.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 297, // 173: openshell.v1.ProviderCredentialRefreshStatus.expiration_time:type_name -> google.protobuf.Timestamp - 297, // 174: openshell.v1.ProviderCredentialRefreshStatus.next_refresh_time:type_name -> google.protobuf.Timestamp - 297, // 175: openshell.v1.ProviderCredentialRefreshStatus.last_refresh_time:type_name -> google.protobuf.Timestamp + 298, // 173: openshell.v1.ProviderCredentialRefreshStatus.expiration_time:type_name -> google.protobuf.Timestamp + 298, // 174: openshell.v1.ProviderCredentialRefreshStatus.next_refresh_time:type_name -> google.protobuf.Timestamp + 298, // 175: openshell.v1.ProviderCredentialRefreshStatus.last_refresh_time:type_name -> google.protobuf.Timestamp 16, // 176: openshell.v1.ProviderCredentialRefreshStatus.recovery_action:type_name -> openshell.v1.ProviderCredentialRefreshRecoveryAction - 297, // 177: openshell.v1.ProviderCredentialRefreshStatus.last_error_time:type_name -> google.protobuf.Timestamp - 302, // 178: openshell.v1.GetProviderRefreshStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 298, // 177: openshell.v1.ProviderCredentialRefreshStatus.last_error_time:type_name -> google.protobuf.Timestamp + 303, // 178: openshell.v1.GetProviderRefreshStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 136, // 179: openshell.v1.GetProviderRefreshStatusResponse.credentials:type_name -> openshell.v1.ProviderCredentialRefreshStatus - 302, // 180: openshell.v1.ConfigureProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 180: openshell.v1.ConfigureProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 9, // 181: openshell.v1.ConfigureProviderRefreshRequest.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 284, // 182: openshell.v1.ConfigureProviderRefreshRequest.material:type_name -> openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry - 297, // 183: openshell.v1.ConfigureProviderRefreshRequest.expiration_time:type_name -> google.protobuf.Timestamp + 285, // 182: openshell.v1.ConfigureProviderRefreshRequest.material:type_name -> openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry + 298, // 183: openshell.v1.ConfigureProviderRefreshRequest.expiration_time:type_name -> google.protobuf.Timestamp 136, // 184: openshell.v1.ConfigureProviderRefreshResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus - 302, // 185: openshell.v1.RotateProviderCredentialRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 185: openshell.v1.RotateProviderCredentialRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 136, // 186: openshell.v1.RotateProviderCredentialResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus - 302, // 187: openshell.v1.DeleteProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 187: openshell.v1.DeleteProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 18, // 188: openshell.v1.DeleteProviderRefreshResponse.outcome:type_name -> openshell.v1.DeletionOutcome 10, // 189: openshell.v1.ProviderProfile.category:type_name -> openshell.v1.ProviderProfileCategory 132, // 190: openshell.v1.ProviderProfile.credentials:type_name -> openshell.v1.ProviderProfileCredential - 305, // 191: openshell.v1.ProviderProfile.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint - 306, // 192: openshell.v1.ProviderProfile.binaries:type_name -> openshell.sandbox.v1.NetworkBinary + 306, // 191: openshell.v1.ProviderProfile.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint + 307, // 192: openshell.v1.ProviderProfile.binaries:type_name -> openshell.sandbox.v1.NetworkBinary 137, // 193: openshell.v1.ProviderProfile.discovery:type_name -> openshell.v1.ProviderProfileDiscovery - 285, // 194: openshell.v1.ProviderProfile.annotations:type_name -> openshell.v1.ProviderProfile.AnnotationsEntry + 286, // 194: openshell.v1.ProviderProfile.annotations:type_name -> openshell.v1.ProviderProfile.AnnotationsEntry 147, // 195: openshell.v1.ProviderProfile.files:type_name -> openshell.v1.ProviderProfileFile 146, // 196: openshell.v1.ProviderProfileResponse.profile:type_name -> openshell.v1.ProviderProfile 146, // 197: openshell.v1.ListProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile - 302, // 198: openshell.v1.ImportProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 198: openshell.v1.ImportProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 127, // 199: openshell.v1.ImportProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem 128, // 200: openshell.v1.ImportProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic 146, // 201: openshell.v1.ImportProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile - 302, // 202: openshell.v1.UpdateProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 202: openshell.v1.UpdateProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 127, // 203: openshell.v1.UpdateProviderProfilesRequest.profile:type_name -> openshell.v1.ProviderProfileImportItem 128, // 204: openshell.v1.UpdateProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic 146, // 205: openshell.v1.UpdateProviderProfilesResponse.profile:type_name -> openshell.v1.ProviderProfile - 302, // 206: openshell.v1.LintProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 206: openshell.v1.LintProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 127, // 207: openshell.v1.LintProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem 128, // 208: openshell.v1.LintProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic 18, // 209: openshell.v1.DeleteProviderResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 302, // 210: openshell.v1.DeleteProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 210: openshell.v1.DeleteProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 18, // 211: openshell.v1.DeleteProviderProfileResponse.outcome:type_name -> openshell.v1.DeletionOutcome 160, // 212: openshell.v1.StaticCredentialBinding.endpoints:type_name -> openshell.v1.StaticCredentialEndpointBinding - 286, // 213: openshell.v1.GetSandboxProviderEnvironmentResponse.environment:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry - 287, // 214: openshell.v1.GetSandboxProviderEnvironmentResponse.credential_expiration_times:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry - 288, // 215: openshell.v1.GetSandboxProviderEnvironmentResponse.dynamic_credentials:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry - 289, // 216: openshell.v1.GetSandboxProviderEnvironmentResponse.static_credential_bindings:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry - 4, // 217: openshell.v1.GetSandboxProviderEnvironmentResponse.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason - 290, // 218: openshell.v1.GetSandboxProviderEnvironmentResponse.files:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.FilesEntry - 11, // 219: openshell.v1.ProviderEnvironmentValue.classification:type_name -> openshell.v1.ProviderEnvironmentValueClassification - 161, // 220: openshell.v1.ProviderEnvironmentValue.static_credential_binding:type_name -> openshell.v1.StaticCredentialBinding - 297, // 221: openshell.v1.ProviderEnvironmentValue.expiration_time:type_name -> google.protobuf.Timestamp - 163, // 222: openshell.v1.ProviderEnvironmentSnapshot.values:type_name -> openshell.v1.ProviderEnvironmentValue - 291, // 223: openshell.v1.ProviderEnvironmentSnapshot.dynamic_credentials:type_name -> openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry - 4, // 224: openshell.v1.ProviderEnvironmentSnapshot.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason - 292, // 225: openshell.v1.ProviderEnvironmentSnapshot.files:type_name -> openshell.v1.ProviderEnvironmentSnapshot.FilesEntry - 301, // 226: openshell.v1.ExchangeProviderSubjectTokenResponse.expires_after:type_name -> google.protobuf.Duration - 302, // 227: openshell.v1.UpdateConfigRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 299, // 228: openshell.v1.UpdateConfigRequest.policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 307, // 229: openshell.v1.UpdateConfigRequest.setting_value:type_name -> openshell.sandbox.v1.SettingValue - 168, // 230: openshell.v1.UpdateConfigRequest.merge_operations:type_name -> openshell.v1.PolicyMergeOperation - 293, // 231: openshell.v1.UpdateConfigRequest.annotations:type_name -> openshell.v1.UpdateConfigRequest.AnnotationsEntry - 169, // 232: openshell.v1.PolicyMergeOperation.add_rule:type_name -> openshell.v1.AddNetworkRule - 170, // 233: openshell.v1.PolicyMergeOperation.remove_endpoint:type_name -> openshell.v1.RemoveNetworkEndpoint - 171, // 234: openshell.v1.PolicyMergeOperation.remove_rule:type_name -> openshell.v1.RemoveNetworkRule - 173, // 235: openshell.v1.PolicyMergeOperation.add_deny_rules:type_name -> openshell.v1.AddDenyRules - 174, // 236: openshell.v1.PolicyMergeOperation.add_allow_rules:type_name -> openshell.v1.AddAllowRules - 175, // 237: openshell.v1.PolicyMergeOperation.remove_binary:type_name -> openshell.v1.RemoveNetworkBinary - 308, // 238: openshell.v1.AddNetworkRule.rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 306, // 239: openshell.v1.L7RuleTarget.binaries:type_name -> openshell.sandbox.v1.NetworkBinary - 309, // 240: openshell.v1.AddDenyRules.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule - 172, // 241: openshell.v1.AddDenyRules.target:type_name -> openshell.v1.L7RuleTarget - 310, // 242: openshell.v1.AddAllowRules.rules:type_name -> openshell.sandbox.v1.L7Rule - 172, // 243: openshell.v1.AddAllowRules.target:type_name -> openshell.v1.L7RuleTarget - 294, // 244: openshell.v1.UpdateConfigResponse.annotations:type_name -> openshell.v1.UpdateConfigResponse.AnnotationsEntry - 302, // 245: openshell.v1.GetSandboxPolicyStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 186, // 246: openshell.v1.GetSandboxPolicyStatusResponse.revision:type_name -> openshell.v1.SandboxPolicyRevision - 302, // 247: openshell.v1.ListSandboxPoliciesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 186, // 248: openshell.v1.ListSandboxPoliciesResponse.revisions:type_name -> openshell.v1.SandboxPolicyRevision - 13, // 249: openshell.v1.ReportPolicyStatusRequest.status:type_name -> openshell.v1.PolicyStatus - 12, // 250: openshell.v1.SandboxConfigurationAdmission.state:type_name -> openshell.v1.ConfigurationAdmissionState - 183, // 251: openshell.v1.ReportSandboxConfigurationRequest.admission:type_name -> openshell.v1.SandboxConfigurationAdmission - 13, // 252: openshell.v1.SandboxPolicyRevision.status:type_name -> openshell.v1.PolicyStatus - 297, // 253: openshell.v1.SandboxPolicyRevision.created_time:type_name -> google.protobuf.Timestamp - 297, // 254: openshell.v1.SandboxPolicyRevision.loaded_time:type_name -> google.protobuf.Timestamp - 299, // 255: openshell.v1.SandboxPolicyRevision.policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 295, // 256: openshell.v1.SandboxPolicyRevision.provenance:type_name -> openshell.v1.SandboxPolicyRevision.ProvenanceEntry - 302, // 257: openshell.v1.GetSandboxLogsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 297, // 258: openshell.v1.GetSandboxLogsRequest.since_time:type_name -> google.protobuf.Timestamp - 113, // 259: openshell.v1.PushSandboxLogsRequest.logs:type_name -> openshell.v1.SandboxLogLine - 113, // 260: openshell.v1.GetSandboxLogsResponse.logs:type_name -> openshell.v1.SandboxLogLine - 193, // 261: openshell.v1.SupervisorMessage.hello:type_name -> openshell.v1.SupervisorHello - 201, // 262: openshell.v1.SupervisorMessage.heartbeat:type_name -> openshell.v1.SupervisorHeartbeat - 218, // 263: openshell.v1.SupervisorMessage.relay_open_result:type_name -> openshell.v1.RelayOpenResult - 219, // 264: openshell.v1.SupervisorMessage.relay_close:type_name -> openshell.v1.RelayClose - 197, // 265: openshell.v1.SupervisorMessage.config_update_result:type_name -> openshell.v1.ConfigUpdateResult - 194, // 266: openshell.v1.GatewayMessage.session_accepted:type_name -> openshell.v1.SessionAccepted - 199, // 267: openshell.v1.GatewayMessage.session_rejected:type_name -> openshell.v1.SessionRejected - 202, // 268: openshell.v1.GatewayMessage.heartbeat:type_name -> openshell.v1.GatewayHeartbeat - 207, // 269: openshell.v1.GatewayMessage.relay_open:type_name -> openshell.v1.RelayOpen - 219, // 270: openshell.v1.GatewayMessage.relay_close:type_name -> openshell.v1.RelayClose - 200, // 271: openshell.v1.GatewayMessage.session_redirect:type_name -> openshell.v1.SessionRedirect - 195, // 272: openshell.v1.GatewayMessage.config_update:type_name -> openshell.v1.ConfigUpdate - 195, // 273: openshell.v1.SessionAccepted.bootstrap:type_name -> openshell.v1.ConfigUpdate - 301, // 274: openshell.v1.SessionAccepted.heartbeat_interval:type_name -> google.protobuf.Duration - 311, // 275: openshell.v1.ConfigUpdate.sandbox_config:type_name -> openshell.sandbox.v1.SandboxConfigSnapshot - 164, // 276: openshell.v1.ConfigUpdate.provider_environment:type_name -> openshell.v1.ProviderEnvironmentSnapshot - 6, // 277: openshell.v1.ConfigUpdateResult.outcome:type_name -> openshell.v1.ConfigApplyOutcome - 196, // 278: openshell.v1.ConfigUpdateResult.failure:type_name -> openshell.v1.ConfigApplyFailure - 183, // 279: openshell.v1.ConfigUpdateResult.admission:type_name -> openshell.v1.SandboxConfigurationAdmission - 198, // 280: openshell.v1.ConfigUpdateResult.policy_load:type_name -> openshell.v1.PolicyLoadResult - 208, // 281: openshell.v1.RelayOpen.ssh:type_name -> openshell.v1.SshRelayTarget - 209, // 282: openshell.v1.RelayOpen.tcp:type_name -> openshell.v1.TcpRelayTarget - 210, // 283: openshell.v1.RelayFrame.init:type_name -> openshell.v1.RelayInit - 207, // 284: openshell.v1.PeerRelayInit.relay_open:type_name -> openshell.v1.RelayOpen - 212, // 285: openshell.v1.PeerRelayFrame.init:type_name -> openshell.v1.PeerRelayInit - 214, // 286: openshell.v1.PeerNotifyConfigUpdateRequest.sandbox:type_name -> openshell.v1.PeerConfigSandboxTarget - 215, // 287: openshell.v1.PeerNotifyConfigUpdateRequest.provider:type_name -> openshell.v1.PeerConfigProviderTarget - 297, // 288: openshell.v1.DenialSummary.first_seen_time:type_name -> google.protobuf.Timestamp - 297, // 289: openshell.v1.DenialSummary.last_seen_time:type_name -> google.protobuf.Timestamp - 220, // 290: openshell.v1.DenialSummary.l7_request_samples:type_name -> openshell.v1.L7RequestSample - 222, // 291: openshell.v1.NetworkActivitySummary.denials_by_group:type_name -> openshell.v1.DenialGroupCount - 308, // 292: openshell.v1.PolicyChunk.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 297, // 293: openshell.v1.PolicyChunk.created_time:type_name -> google.protobuf.Timestamp - 297, // 294: openshell.v1.PolicyChunk.decided_time:type_name -> google.protobuf.Timestamp - 297, // 295: openshell.v1.PolicyChunk.first_seen_time:type_name -> google.protobuf.Timestamp - 297, // 296: openshell.v1.PolicyChunk.last_seen_time:type_name -> google.protobuf.Timestamp - 299, // 297: openshell.v1.PolicyChunk.current_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 299, // 298: openshell.v1.PolicyChunk.candidate_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 302, // 299: openshell.v1.SubmitPolicyAnalysisRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 221, // 300: openshell.v1.SubmitPolicyAnalysisRequest.summaries:type_name -> openshell.v1.DenialSummary - 224, // 301: openshell.v1.SubmitPolicyAnalysisRequest.proposed_chunks:type_name -> openshell.v1.PolicyChunk - 223, // 302: openshell.v1.SubmitPolicyAnalysisRequest.network_activity_summaries:type_name -> openshell.v1.NetworkActivitySummary - 302, // 303: openshell.v1.GetDraftPolicyRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 224, // 304: openshell.v1.GetDraftPolicyResponse.chunks:type_name -> openshell.v1.PolicyChunk - 297, // 305: openshell.v1.GetDraftPolicyResponse.last_analyzed_time:type_name -> google.protobuf.Timestamp - 302, // 306: openshell.v1.ApproveDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 302, // 307: openshell.v1.RejectDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 302, // 308: openshell.v1.ApproveAllDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 234, // 309: openshell.v1.ApproveAllDraftChunksRequest.approvals:type_name -> openshell.v1.DraftChunkApproval - 302, // 310: openshell.v1.EditDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 308, // 311: openshell.v1.EditDraftChunkRequest.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 302, // 312: openshell.v1.UndoDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 302, // 313: openshell.v1.ClearDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 302, // 314: openshell.v1.GetDraftHistoryRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 297, // 315: openshell.v1.DraftHistoryEntry.event_time:type_name -> google.protobuf.Timestamp - 244, // 316: openshell.v1.GetDraftHistoryResponse.entries:type_name -> openshell.v1.DraftHistoryEntry - 296, // 317: openshell.v1.CreateWorkspaceRequest.labels:type_name -> openshell.v1.CreateWorkspaceRequest.LabelsEntry - 312, // 318: openshell.v1.CreateWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace - 312, // 319: openshell.v1.GetWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace - 312, // 320: openshell.v1.ListWorkspacesResponse.workspaces:type_name -> openshell.datamodel.v1.Workspace - 18, // 321: openshell.v1.DeleteWorkspaceResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 298, // 322: openshell.v1.WorkspaceMember.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 15, // 323: openshell.v1.WorkspaceMember.role:type_name -> openshell.v1.WorkspaceRole - 302, // 324: openshell.v1.AddWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 15, // 325: openshell.v1.AddWorkspaceMemberRequest.role:type_name -> openshell.v1.WorkspaceRole - 254, // 326: openshell.v1.AddWorkspaceMemberResponse.member:type_name -> openshell.v1.WorkspaceMember - 302, // 327: openshell.v1.RemoveWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 18, // 328: openshell.v1.RemoveWorkspaceMemberResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 302, // 329: openshell.v1.ListWorkspaceMembersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 254, // 330: openshell.v1.ListWorkspaceMembersResponse.members:type_name -> openshell.v1.WorkspaceMember - 297, // 331: openshell.v1.ExtensionServiceCredential.expiration_time:type_name -> google.protobuf.Timestamp - 19, // 332: openshell.v1.EndpointObservation.result:type_name -> openshell.v1.EndpointResult - 270, // 333: openshell.v1.EndpointObservation.failure:type_name -> openshell.v1.EndpointFailure - 262, // 334: openshell.v1.ReportEndpointStatusRequest.observations:type_name -> openshell.v1.EndpointObservation - 264, // 335: openshell.v1.ReportEndpointStatusRequest.token_grant_status:type_name -> openshell.v1.TokenGrantStatus - 265, // 336: openshell.v1.TokenGrantStatus.last_failure:type_name -> openshell.v1.TokenGrantFailureObservation - 270, // 337: openshell.v1.TokenGrantFailureObservation.failure:type_name -> openshell.v1.EndpointFailure - 19, // 338: openshell.v1.EndpointStatus.last_result:type_name -> openshell.v1.EndpointResult - 297, // 339: openshell.v1.EndpointStatus.last_reported_time:type_name -> google.protobuf.Timestamp - 270, // 340: openshell.v1.EndpointStatus.last_failure:type_name -> openshell.v1.EndpointFailure - 297, // 341: openshell.v1.SandboxProvisioning.configuration_change_time:type_name -> google.protobuf.Timestamp - 297, // 342: openshell.v1.SandboxProvisioning.first_rejection_time:type_name -> google.protobuf.Timestamp - 297, // 343: openshell.v1.SandboxProvisioning.deadline:type_name -> google.protobuf.Timestamp - 297, // 344: openshell.v1.SandboxProvisioning.timeout_time:type_name -> google.protobuf.Timestamp - 297, // 345: openshell.v1.SandboxProvisioning.cleanup_completed_time:type_name -> google.protobuf.Timestamp - 297, // 346: openshell.v1.SandboxProvisioning.cleanup_retry_time:type_name -> google.protobuf.Timestamp - 297, // 347: openshell.v1.SandboxProvisioning.attachment_change_time:type_name -> google.protobuf.Timestamp - 297, // 348: openshell.v1.SandboxProvisioning.preparation_deadline:type_name -> google.protobuf.Timestamp - 297, // 349: openshell.v1.SandboxProvisioning.admission_start_time:type_name -> google.protobuf.Timestamp - 20, // 350: openshell.v1.SandboxServiceExposure.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode - 21, // 351: openshell.v1.EndpointFailure.domain:type_name -> openshell.v1.EndpointFailureDomain - 16, // 352: openshell.v1.EndpointFailure.recovery_action:type_name -> openshell.v1.ProviderCredentialRefreshRecoveryAction - 118, // 353: openshell.v1.GetProviderCredentialsResponse.CredentialsEntry.value:type_name -> openshell.v1.ProviderCredentialValue - 297, // 354: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp - 297, // 355: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp - 132, // 356: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential - 161, // 357: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry.value:type_name -> openshell.v1.StaticCredentialBinding - 132, // 358: openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential - 26, // 359: openshell.v1.OpenShell.Health:input_type -> openshell.v1.HealthRequest - 28, // 360: openshell.v1.OpenShell.GetCurrentUser:input_type -> openshell.v1.GetCurrentUserRequest - 30, // 361: openshell.v1.OpenShell.GetGatewayInfo:input_type -> openshell.v1.GetGatewayInfoRequest - 54, // 362: openshell.v1.OpenShell.CreateSandbox:input_type -> openshell.v1.CreateSandboxRequest - 62, // 363: openshell.v1.OpenShell.BeginRootfsTarStaging:input_type -> openshell.v1.BeginRootfsTarStagingRequest - 64, // 364: openshell.v1.OpenShell.GetSandbox:input_type -> openshell.v1.GetSandboxRequest - 65, // 365: openshell.v1.OpenShell.ListSandboxes:input_type -> openshell.v1.ListSandboxesRequest - 55, // 366: openshell.v1.OpenShell.CreateSandboxTemplate:input_type -> openshell.v1.CreateSandboxTemplateRequest - 56, // 367: openshell.v1.OpenShell.GetSandboxTemplate:input_type -> openshell.v1.GetSandboxTemplateRequest - 57, // 368: openshell.v1.OpenShell.ListSandboxTemplates:input_type -> openshell.v1.ListSandboxTemplatesRequest - 58, // 369: openshell.v1.OpenShell.DeleteSandboxTemplate:input_type -> openshell.v1.DeleteSandboxTemplateRequest - 66, // 370: openshell.v1.OpenShell.ListSandboxProviders:input_type -> openshell.v1.ListSandboxProvidersRequest - 67, // 371: openshell.v1.OpenShell.AttachSandboxProvider:input_type -> openshell.v1.AttachSandboxProviderRequest - 68, // 372: openshell.v1.OpenShell.DetachSandboxProvider:input_type -> openshell.v1.DetachSandboxProviderRequest - 84, // 373: openshell.v1.OpenShell.GetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest - 69, // 374: openshell.v1.OpenShell.DeleteSandbox:input_type -> openshell.v1.DeleteSandboxRequest - 70, // 375: openshell.v1.OpenShell.StopSandbox:input_type -> openshell.v1.StopSandboxRequest - 71, // 376: openshell.v1.OpenShell.StartSandbox:input_type -> openshell.v1.StartSandboxRequest - 89, // 377: openshell.v1.OpenShell.CreateSshSession:input_type -> openshell.v1.CreateSshSessionRequest - 91, // 378: openshell.v1.OpenShell.ExposeService:input_type -> openshell.v1.ExposeServiceRequest - 92, // 379: openshell.v1.OpenShell.GetService:input_type -> openshell.v1.GetServiceRequest - 93, // 380: openshell.v1.OpenShell.ListServices:input_type -> openshell.v1.ListServicesRequest - 95, // 381: openshell.v1.OpenShell.DeleteService:input_type -> openshell.v1.DeleteServiceRequest - 99, // 382: openshell.v1.OpenShell.RevokeSshSession:input_type -> openshell.v1.RevokeSshSessionRequest - 101, // 383: openshell.v1.OpenShell.ExecSandbox:input_type -> openshell.v1.ExecSandboxRequest - 107, // 384: openshell.v1.OpenShell.ForwardTcp:input_type -> openshell.v1.TcpForwardFrame - 108, // 385: openshell.v1.OpenShell.ExecSandboxInteractive:input_type -> openshell.v1.ExecSandboxInput - 115, // 386: openshell.v1.OpenShell.CreateProvider:input_type -> openshell.v1.CreateProviderRequest - 116, // 387: openshell.v1.OpenShell.GetProvider:input_type -> openshell.v1.GetProviderRequest - 117, // 388: openshell.v1.OpenShell.GetProviderCredentials:input_type -> openshell.v1.GetProviderCredentialsRequest - 120, // 389: openshell.v1.OpenShell.ListProviders:input_type -> openshell.v1.ListProvidersRequest - 125, // 390: openshell.v1.OpenShell.ListProviderProfiles:input_type -> openshell.v1.ListProviderProfilesRequest - 126, // 391: openshell.v1.OpenShell.GetProviderProfile:input_type -> openshell.v1.GetProviderProfileRequest - 150, // 392: openshell.v1.OpenShell.ImportProviderProfiles:input_type -> openshell.v1.ImportProviderProfilesRequest - 152, // 393: openshell.v1.OpenShell.UpdateProviderProfiles:input_type -> openshell.v1.UpdateProviderProfilesRequest - 154, // 394: openshell.v1.OpenShell.LintProviderProfiles:input_type -> openshell.v1.LintProviderProfilesRequest - 121, // 395: openshell.v1.OpenShell.UpdateProvider:input_type -> openshell.v1.UpdateProviderRequest - 138, // 396: openshell.v1.OpenShell.GetProviderRefreshStatus:input_type -> openshell.v1.GetProviderRefreshStatusRequest - 140, // 397: openshell.v1.OpenShell.ConfigureProviderRefresh:input_type -> openshell.v1.ConfigureProviderRefreshRequest - 142, // 398: openshell.v1.OpenShell.RotateProviderCredential:input_type -> openshell.v1.RotateProviderCredentialRequest - 144, // 399: openshell.v1.OpenShell.DeleteProviderRefresh:input_type -> openshell.v1.DeleteProviderRefreshRequest - 122, // 400: openshell.v1.OpenShell.DeleteProvider:input_type -> openshell.v1.DeleteProviderRequest - 157, // 401: openshell.v1.OpenShell.DeleteProviderProfile:input_type -> openshell.v1.DeleteProviderProfileRequest - 313, // 402: openshell.v1.OpenShell.GetSandboxConfig:input_type -> openshell.sandbox.v1.GetSandboxConfigRequest - 314, // 403: openshell.v1.OpenShell.GetGatewayConfig:input_type -> openshell.sandbox.v1.GetGatewayConfigRequest - 167, // 404: openshell.v1.OpenShell.UpdateConfig:input_type -> openshell.v1.UpdateConfigRequest - 177, // 405: openshell.v1.OpenShell.GetSandboxPolicyStatus:input_type -> openshell.v1.GetSandboxPolicyStatusRequest - 179, // 406: openshell.v1.OpenShell.ListSandboxPolicies:input_type -> openshell.v1.ListSandboxPoliciesRequest - 181, // 407: openshell.v1.OpenShell.ReportPolicyStatus:input_type -> openshell.v1.ReportPolicyStatusRequest - 263, // 408: openshell.v1.OpenShell.ReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest - 86, // 409: openshell.v1.OpenShell.ReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest - 184, // 410: openshell.v1.OpenShell.ReportSandboxConfiguration:input_type -> openshell.v1.ReportSandboxConfigurationRequest - 159, // 411: openshell.v1.OpenShell.GetSandboxProviderEnvironment:input_type -> openshell.v1.GetSandboxProviderEnvironmentRequest - 165, // 412: openshell.v1.OpenShell.ExchangeProviderSubjectToken:input_type -> openshell.v1.ExchangeProviderSubjectTokenRequest - 187, // 413: openshell.v1.OpenShell.GetSandboxLogs:input_type -> openshell.v1.GetSandboxLogsRequest - 188, // 414: openshell.v1.OpenShell.PushSandboxLogs:input_type -> openshell.v1.PushSandboxLogsRequest - 191, // 415: openshell.v1.OpenShell.ConnectSupervisor:input_type -> openshell.v1.SupervisorMessage - 203, // 416: openshell.v1.OpenShell.ReportMainProcessExit:input_type -> openshell.v1.ReportMainProcessExitRequest - 205, // 417: openshell.v1.OpenShell.FinalizeMainProcessExit:input_type -> openshell.v1.FinalizeMainProcessExitRequest - 211, // 418: openshell.v1.OpenShell.RelayStream:input_type -> openshell.v1.RelayFrame - 213, // 419: openshell.v1.OpenShell.PeerRelay:input_type -> openshell.v1.PeerRelayFrame - 86, // 420: openshell.v1.OpenShell.PeerReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest - 263, // 421: openshell.v1.OpenShell.PeerReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest - 84, // 422: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest - 216, // 423: openshell.v1.OpenShell.PeerNotifyConfigUpdate:input_type -> openshell.v1.PeerNotifyConfigUpdateRequest - 111, // 424: openshell.v1.OpenShell.WatchSandbox:input_type -> openshell.v1.WatchSandboxRequest - 226, // 425: openshell.v1.OpenShell.SubmitPolicyAnalysis:input_type -> openshell.v1.SubmitPolicyAnalysisRequest - 228, // 426: openshell.v1.OpenShell.GetDraftPolicy:input_type -> openshell.v1.GetDraftPolicyRequest - 230, // 427: openshell.v1.OpenShell.ApproveDraftChunk:input_type -> openshell.v1.ApproveDraftChunkRequest - 232, // 428: openshell.v1.OpenShell.RejectDraftChunk:input_type -> openshell.v1.RejectDraftChunkRequest - 235, // 429: openshell.v1.OpenShell.ApproveAllDraftChunks:input_type -> openshell.v1.ApproveAllDraftChunksRequest - 237, // 430: openshell.v1.OpenShell.EditDraftChunk:input_type -> openshell.v1.EditDraftChunkRequest - 239, // 431: openshell.v1.OpenShell.UndoDraftChunk:input_type -> openshell.v1.UndoDraftChunkRequest - 241, // 432: openshell.v1.OpenShell.ClearDraftChunks:input_type -> openshell.v1.ClearDraftChunksRequest - 243, // 433: openshell.v1.OpenShell.GetDraftHistory:input_type -> openshell.v1.GetDraftHistoryRequest - 22, // 434: openshell.v1.OpenShell.IssueSandboxToken:input_type -> openshell.v1.IssueSandboxTokenRequest - 24, // 435: openshell.v1.OpenShell.RefreshSandboxToken:input_type -> openshell.v1.RefreshSandboxTokenRequest - 246, // 436: openshell.v1.OpenShell.CreateWorkspace:input_type -> openshell.v1.CreateWorkspaceRequest - 248, // 437: openshell.v1.OpenShell.GetWorkspace:input_type -> openshell.v1.GetWorkspaceRequest - 250, // 438: openshell.v1.OpenShell.ListWorkspaces:input_type -> openshell.v1.ListWorkspacesRequest - 252, // 439: openshell.v1.OpenShell.DeleteWorkspace:input_type -> openshell.v1.DeleteWorkspaceRequest - 255, // 440: openshell.v1.OpenShell.AddWorkspaceMember:input_type -> openshell.v1.AddWorkspaceMemberRequest - 257, // 441: openshell.v1.OpenShell.RemoveWorkspaceMember:input_type -> openshell.v1.RemoveWorkspaceMemberRequest - 259, // 442: openshell.v1.OpenShell.ListWorkspaceMembers:input_type -> openshell.v1.ListWorkspaceMembersRequest - 27, // 443: openshell.v1.OpenShell.Health:output_type -> openshell.v1.HealthResponse - 29, // 444: openshell.v1.OpenShell.GetCurrentUser:output_type -> openshell.v1.GetCurrentUserResponse - 31, // 445: openshell.v1.OpenShell.GetGatewayInfo:output_type -> openshell.v1.GetGatewayInfoResponse - 72, // 446: openshell.v1.OpenShell.CreateSandbox:output_type -> openshell.v1.SandboxResponse - 63, // 447: openshell.v1.OpenShell.BeginRootfsTarStaging:output_type -> openshell.v1.BeginRootfsTarStagingResponse - 72, // 448: openshell.v1.OpenShell.GetSandbox:output_type -> openshell.v1.SandboxResponse - 73, // 449: openshell.v1.OpenShell.ListSandboxes:output_type -> openshell.v1.ListSandboxesResponse - 59, // 450: openshell.v1.OpenShell.CreateSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse - 59, // 451: openshell.v1.OpenShell.GetSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse - 60, // 452: openshell.v1.OpenShell.ListSandboxTemplates:output_type -> openshell.v1.ListSandboxTemplatesResponse - 61, // 453: openshell.v1.OpenShell.DeleteSandboxTemplate:output_type -> openshell.v1.DeleteSandboxTemplateResponse - 74, // 454: openshell.v1.OpenShell.ListSandboxProviders:output_type -> openshell.v1.ListSandboxProvidersResponse - 75, // 455: openshell.v1.OpenShell.AttachSandboxProvider:output_type -> openshell.v1.AttachSandboxProviderResponse - 76, // 456: openshell.v1.OpenShell.DetachSandboxProvider:output_type -> openshell.v1.DetachSandboxProviderResponse - 85, // 457: openshell.v1.OpenShell.GetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse - 88, // 458: openshell.v1.OpenShell.DeleteSandbox:output_type -> openshell.v1.DeleteSandboxResponse - 72, // 459: openshell.v1.OpenShell.StopSandbox:output_type -> openshell.v1.SandboxResponse - 72, // 460: openshell.v1.OpenShell.StartSandbox:output_type -> openshell.v1.SandboxResponse - 90, // 461: openshell.v1.OpenShell.CreateSshSession:output_type -> openshell.v1.CreateSshSessionResponse - 98, // 462: openshell.v1.OpenShell.ExposeService:output_type -> openshell.v1.ServiceEndpointResponse - 98, // 463: openshell.v1.OpenShell.GetService:output_type -> openshell.v1.ServiceEndpointResponse - 94, // 464: openshell.v1.OpenShell.ListServices:output_type -> openshell.v1.ListServicesResponse - 96, // 465: openshell.v1.OpenShell.DeleteService:output_type -> openshell.v1.DeleteServiceResponse - 100, // 466: openshell.v1.OpenShell.RevokeSshSession:output_type -> openshell.v1.RevokeSshSessionResponse - 105, // 467: openshell.v1.OpenShell.ExecSandbox:output_type -> openshell.v1.ExecSandboxEvent - 107, // 468: openshell.v1.OpenShell.ForwardTcp:output_type -> openshell.v1.TcpForwardFrame - 105, // 469: openshell.v1.OpenShell.ExecSandboxInteractive:output_type -> openshell.v1.ExecSandboxEvent - 123, // 470: openshell.v1.OpenShell.CreateProvider:output_type -> openshell.v1.ProviderResponse - 123, // 471: openshell.v1.OpenShell.GetProvider:output_type -> openshell.v1.ProviderResponse - 119, // 472: openshell.v1.OpenShell.GetProviderCredentials:output_type -> openshell.v1.GetProviderCredentialsResponse - 124, // 473: openshell.v1.OpenShell.ListProviders:output_type -> openshell.v1.ListProvidersResponse - 149, // 474: openshell.v1.OpenShell.ListProviderProfiles:output_type -> openshell.v1.ListProviderProfilesResponse - 148, // 475: openshell.v1.OpenShell.GetProviderProfile:output_type -> openshell.v1.ProviderProfileResponse - 151, // 476: openshell.v1.OpenShell.ImportProviderProfiles:output_type -> openshell.v1.ImportProviderProfilesResponse - 153, // 477: openshell.v1.OpenShell.UpdateProviderProfiles:output_type -> openshell.v1.UpdateProviderProfilesResponse - 155, // 478: openshell.v1.OpenShell.LintProviderProfiles:output_type -> openshell.v1.LintProviderProfilesResponse - 123, // 479: openshell.v1.OpenShell.UpdateProvider:output_type -> openshell.v1.ProviderResponse - 139, // 480: openshell.v1.OpenShell.GetProviderRefreshStatus:output_type -> openshell.v1.GetProviderRefreshStatusResponse - 141, // 481: openshell.v1.OpenShell.ConfigureProviderRefresh:output_type -> openshell.v1.ConfigureProviderRefreshResponse - 143, // 482: openshell.v1.OpenShell.RotateProviderCredential:output_type -> openshell.v1.RotateProviderCredentialResponse - 145, // 483: openshell.v1.OpenShell.DeleteProviderRefresh:output_type -> openshell.v1.DeleteProviderRefreshResponse - 156, // 484: openshell.v1.OpenShell.DeleteProvider:output_type -> openshell.v1.DeleteProviderResponse - 158, // 485: openshell.v1.OpenShell.DeleteProviderProfile:output_type -> openshell.v1.DeleteProviderProfileResponse - 315, // 486: openshell.v1.OpenShell.GetSandboxConfig:output_type -> openshell.sandbox.v1.GetSandboxConfigResponse - 316, // 487: openshell.v1.OpenShell.GetGatewayConfig:output_type -> openshell.sandbox.v1.GetGatewayConfigResponse - 176, // 488: openshell.v1.OpenShell.UpdateConfig:output_type -> openshell.v1.UpdateConfigResponse - 178, // 489: openshell.v1.OpenShell.GetSandboxPolicyStatus:output_type -> openshell.v1.GetSandboxPolicyStatusResponse - 180, // 490: openshell.v1.OpenShell.ListSandboxPolicies:output_type -> openshell.v1.ListSandboxPoliciesResponse - 182, // 491: openshell.v1.OpenShell.ReportPolicyStatus:output_type -> openshell.v1.ReportPolicyStatusResponse - 266, // 492: openshell.v1.OpenShell.ReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse - 87, // 493: openshell.v1.OpenShell.ReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse - 185, // 494: openshell.v1.OpenShell.ReportSandboxConfiguration:output_type -> openshell.v1.ReportSandboxConfigurationResponse - 162, // 495: openshell.v1.OpenShell.GetSandboxProviderEnvironment:output_type -> openshell.v1.GetSandboxProviderEnvironmentResponse - 166, // 496: openshell.v1.OpenShell.ExchangeProviderSubjectToken:output_type -> openshell.v1.ExchangeProviderSubjectTokenResponse - 190, // 497: openshell.v1.OpenShell.GetSandboxLogs:output_type -> openshell.v1.GetSandboxLogsResponse - 189, // 498: openshell.v1.OpenShell.PushSandboxLogs:output_type -> openshell.v1.PushSandboxLogsResponse - 192, // 499: openshell.v1.OpenShell.ConnectSupervisor:output_type -> openshell.v1.GatewayMessage - 204, // 500: openshell.v1.OpenShell.ReportMainProcessExit:output_type -> openshell.v1.ReportMainProcessExitResponse - 206, // 501: openshell.v1.OpenShell.FinalizeMainProcessExit:output_type -> openshell.v1.FinalizeMainProcessExitResponse - 211, // 502: openshell.v1.OpenShell.RelayStream:output_type -> openshell.v1.RelayFrame - 213, // 503: openshell.v1.OpenShell.PeerRelay:output_type -> openshell.v1.PeerRelayFrame - 87, // 504: openshell.v1.OpenShell.PeerReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse - 266, // 505: openshell.v1.OpenShell.PeerReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse - 85, // 506: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse - 217, // 507: openshell.v1.OpenShell.PeerNotifyConfigUpdate:output_type -> openshell.v1.PeerNotifyConfigUpdateResponse - 112, // 508: openshell.v1.OpenShell.WatchSandbox:output_type -> openshell.v1.SandboxStreamEvent - 227, // 509: openshell.v1.OpenShell.SubmitPolicyAnalysis:output_type -> openshell.v1.SubmitPolicyAnalysisResponse - 229, // 510: openshell.v1.OpenShell.GetDraftPolicy:output_type -> openshell.v1.GetDraftPolicyResponse - 231, // 511: openshell.v1.OpenShell.ApproveDraftChunk:output_type -> openshell.v1.ApproveDraftChunkResponse - 233, // 512: openshell.v1.OpenShell.RejectDraftChunk:output_type -> openshell.v1.RejectDraftChunkResponse - 236, // 513: openshell.v1.OpenShell.ApproveAllDraftChunks:output_type -> openshell.v1.ApproveAllDraftChunksResponse - 238, // 514: openshell.v1.OpenShell.EditDraftChunk:output_type -> openshell.v1.EditDraftChunkResponse - 240, // 515: openshell.v1.OpenShell.UndoDraftChunk:output_type -> openshell.v1.UndoDraftChunkResponse - 242, // 516: openshell.v1.OpenShell.ClearDraftChunks:output_type -> openshell.v1.ClearDraftChunksResponse - 245, // 517: openshell.v1.OpenShell.GetDraftHistory:output_type -> openshell.v1.GetDraftHistoryResponse - 23, // 518: openshell.v1.OpenShell.IssueSandboxToken:output_type -> openshell.v1.IssueSandboxTokenResponse - 25, // 519: openshell.v1.OpenShell.RefreshSandboxToken:output_type -> openshell.v1.RefreshSandboxTokenResponse - 247, // 520: openshell.v1.OpenShell.CreateWorkspace:output_type -> openshell.v1.CreateWorkspaceResponse - 249, // 521: openshell.v1.OpenShell.GetWorkspace:output_type -> openshell.v1.GetWorkspaceResponse - 251, // 522: openshell.v1.OpenShell.ListWorkspaces:output_type -> openshell.v1.ListWorkspacesResponse - 253, // 523: openshell.v1.OpenShell.DeleteWorkspace:output_type -> openshell.v1.DeleteWorkspaceResponse - 256, // 524: openshell.v1.OpenShell.AddWorkspaceMember:output_type -> openshell.v1.AddWorkspaceMemberResponse - 258, // 525: openshell.v1.OpenShell.RemoveWorkspaceMember:output_type -> openshell.v1.RemoveWorkspaceMemberResponse - 260, // 526: openshell.v1.OpenShell.ListWorkspaceMembers:output_type -> openshell.v1.ListWorkspaceMembersResponse - 443, // [443:527] is the sub-list for method output_type - 359, // [359:443] is the sub-list for method input_type - 359, // [359:359] is the sub-list for extension type_name - 359, // [359:359] is the sub-list for extension extendee - 0, // [0:359] is the sub-list for field type_name + 161, // 213: openshell.v1.StaticCredentialBinding.placement:type_name -> openshell.v1.StaticCredentialPlacement + 287, // 214: openshell.v1.GetSandboxProviderEnvironmentResponse.environment:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry + 288, // 215: openshell.v1.GetSandboxProviderEnvironmentResponse.credential_expiration_times:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry + 289, // 216: openshell.v1.GetSandboxProviderEnvironmentResponse.dynamic_credentials:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry + 290, // 217: openshell.v1.GetSandboxProviderEnvironmentResponse.static_credential_bindings:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry + 4, // 218: openshell.v1.GetSandboxProviderEnvironmentResponse.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason + 291, // 219: openshell.v1.GetSandboxProviderEnvironmentResponse.files:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.FilesEntry + 11, // 220: openshell.v1.ProviderEnvironmentValue.classification:type_name -> openshell.v1.ProviderEnvironmentValueClassification + 162, // 221: openshell.v1.ProviderEnvironmentValue.static_credential_binding:type_name -> openshell.v1.StaticCredentialBinding + 298, // 222: openshell.v1.ProviderEnvironmentValue.expiration_time:type_name -> google.protobuf.Timestamp + 164, // 223: openshell.v1.ProviderEnvironmentSnapshot.values:type_name -> openshell.v1.ProviderEnvironmentValue + 292, // 224: openshell.v1.ProviderEnvironmentSnapshot.dynamic_credentials:type_name -> openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry + 4, // 225: openshell.v1.ProviderEnvironmentSnapshot.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason + 293, // 226: openshell.v1.ProviderEnvironmentSnapshot.files:type_name -> openshell.v1.ProviderEnvironmentSnapshot.FilesEntry + 302, // 227: openshell.v1.ExchangeProviderSubjectTokenResponse.expires_after:type_name -> google.protobuf.Duration + 303, // 228: openshell.v1.UpdateConfigRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 300, // 229: openshell.v1.UpdateConfigRequest.policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 308, // 230: openshell.v1.UpdateConfigRequest.setting_value:type_name -> openshell.sandbox.v1.SettingValue + 169, // 231: openshell.v1.UpdateConfigRequest.merge_operations:type_name -> openshell.v1.PolicyMergeOperation + 294, // 232: openshell.v1.UpdateConfigRequest.annotations:type_name -> openshell.v1.UpdateConfigRequest.AnnotationsEntry + 170, // 233: openshell.v1.PolicyMergeOperation.add_rule:type_name -> openshell.v1.AddNetworkRule + 171, // 234: openshell.v1.PolicyMergeOperation.remove_endpoint:type_name -> openshell.v1.RemoveNetworkEndpoint + 172, // 235: openshell.v1.PolicyMergeOperation.remove_rule:type_name -> openshell.v1.RemoveNetworkRule + 174, // 236: openshell.v1.PolicyMergeOperation.add_deny_rules:type_name -> openshell.v1.AddDenyRules + 175, // 237: openshell.v1.PolicyMergeOperation.add_allow_rules:type_name -> openshell.v1.AddAllowRules + 176, // 238: openshell.v1.PolicyMergeOperation.remove_binary:type_name -> openshell.v1.RemoveNetworkBinary + 309, // 239: openshell.v1.AddNetworkRule.rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule + 307, // 240: openshell.v1.L7RuleTarget.binaries:type_name -> openshell.sandbox.v1.NetworkBinary + 310, // 241: openshell.v1.AddDenyRules.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule + 173, // 242: openshell.v1.AddDenyRules.target:type_name -> openshell.v1.L7RuleTarget + 311, // 243: openshell.v1.AddAllowRules.rules:type_name -> openshell.sandbox.v1.L7Rule + 173, // 244: openshell.v1.AddAllowRules.target:type_name -> openshell.v1.L7RuleTarget + 295, // 245: openshell.v1.UpdateConfigResponse.annotations:type_name -> openshell.v1.UpdateConfigResponse.AnnotationsEntry + 303, // 246: openshell.v1.GetSandboxPolicyStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 187, // 247: openshell.v1.GetSandboxPolicyStatusResponse.revision:type_name -> openshell.v1.SandboxPolicyRevision + 303, // 248: openshell.v1.ListSandboxPoliciesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 187, // 249: openshell.v1.ListSandboxPoliciesResponse.revisions:type_name -> openshell.v1.SandboxPolicyRevision + 13, // 250: openshell.v1.ReportPolicyStatusRequest.status:type_name -> openshell.v1.PolicyStatus + 12, // 251: openshell.v1.SandboxConfigurationAdmission.state:type_name -> openshell.v1.ConfigurationAdmissionState + 184, // 252: openshell.v1.ReportSandboxConfigurationRequest.admission:type_name -> openshell.v1.SandboxConfigurationAdmission + 13, // 253: openshell.v1.SandboxPolicyRevision.status:type_name -> openshell.v1.PolicyStatus + 298, // 254: openshell.v1.SandboxPolicyRevision.created_time:type_name -> google.protobuf.Timestamp + 298, // 255: openshell.v1.SandboxPolicyRevision.loaded_time:type_name -> google.protobuf.Timestamp + 300, // 256: openshell.v1.SandboxPolicyRevision.policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 296, // 257: openshell.v1.SandboxPolicyRevision.provenance:type_name -> openshell.v1.SandboxPolicyRevision.ProvenanceEntry + 303, // 258: openshell.v1.GetSandboxLogsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 298, // 259: openshell.v1.GetSandboxLogsRequest.since_time:type_name -> google.protobuf.Timestamp + 113, // 260: openshell.v1.PushSandboxLogsRequest.logs:type_name -> openshell.v1.SandboxLogLine + 113, // 261: openshell.v1.GetSandboxLogsResponse.logs:type_name -> openshell.v1.SandboxLogLine + 194, // 262: openshell.v1.SupervisorMessage.hello:type_name -> openshell.v1.SupervisorHello + 202, // 263: openshell.v1.SupervisorMessage.heartbeat:type_name -> openshell.v1.SupervisorHeartbeat + 219, // 264: openshell.v1.SupervisorMessage.relay_open_result:type_name -> openshell.v1.RelayOpenResult + 220, // 265: openshell.v1.SupervisorMessage.relay_close:type_name -> openshell.v1.RelayClose + 198, // 266: openshell.v1.SupervisorMessage.config_update_result:type_name -> openshell.v1.ConfigUpdateResult + 195, // 267: openshell.v1.GatewayMessage.session_accepted:type_name -> openshell.v1.SessionAccepted + 200, // 268: openshell.v1.GatewayMessage.session_rejected:type_name -> openshell.v1.SessionRejected + 203, // 269: openshell.v1.GatewayMessage.heartbeat:type_name -> openshell.v1.GatewayHeartbeat + 208, // 270: openshell.v1.GatewayMessage.relay_open:type_name -> openshell.v1.RelayOpen + 220, // 271: openshell.v1.GatewayMessage.relay_close:type_name -> openshell.v1.RelayClose + 201, // 272: openshell.v1.GatewayMessage.session_redirect:type_name -> openshell.v1.SessionRedirect + 196, // 273: openshell.v1.GatewayMessage.config_update:type_name -> openshell.v1.ConfigUpdate + 196, // 274: openshell.v1.SessionAccepted.bootstrap:type_name -> openshell.v1.ConfigUpdate + 302, // 275: openshell.v1.SessionAccepted.heartbeat_interval:type_name -> google.protobuf.Duration + 312, // 276: openshell.v1.ConfigUpdate.sandbox_config:type_name -> openshell.sandbox.v1.SandboxConfigSnapshot + 165, // 277: openshell.v1.ConfigUpdate.provider_environment:type_name -> openshell.v1.ProviderEnvironmentSnapshot + 6, // 278: openshell.v1.ConfigUpdateResult.outcome:type_name -> openshell.v1.ConfigApplyOutcome + 197, // 279: openshell.v1.ConfigUpdateResult.failure:type_name -> openshell.v1.ConfigApplyFailure + 184, // 280: openshell.v1.ConfigUpdateResult.admission:type_name -> openshell.v1.SandboxConfigurationAdmission + 199, // 281: openshell.v1.ConfigUpdateResult.policy_load:type_name -> openshell.v1.PolicyLoadResult + 209, // 282: openshell.v1.RelayOpen.ssh:type_name -> openshell.v1.SshRelayTarget + 210, // 283: openshell.v1.RelayOpen.tcp:type_name -> openshell.v1.TcpRelayTarget + 211, // 284: openshell.v1.RelayFrame.init:type_name -> openshell.v1.RelayInit + 208, // 285: openshell.v1.PeerRelayInit.relay_open:type_name -> openshell.v1.RelayOpen + 213, // 286: openshell.v1.PeerRelayFrame.init:type_name -> openshell.v1.PeerRelayInit + 215, // 287: openshell.v1.PeerNotifyConfigUpdateRequest.sandbox:type_name -> openshell.v1.PeerConfigSandboxTarget + 216, // 288: openshell.v1.PeerNotifyConfigUpdateRequest.provider:type_name -> openshell.v1.PeerConfigProviderTarget + 298, // 289: openshell.v1.DenialSummary.first_seen_time:type_name -> google.protobuf.Timestamp + 298, // 290: openshell.v1.DenialSummary.last_seen_time:type_name -> google.protobuf.Timestamp + 221, // 291: openshell.v1.DenialSummary.l7_request_samples:type_name -> openshell.v1.L7RequestSample + 223, // 292: openshell.v1.NetworkActivitySummary.denials_by_group:type_name -> openshell.v1.DenialGroupCount + 309, // 293: openshell.v1.PolicyChunk.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule + 298, // 294: openshell.v1.PolicyChunk.created_time:type_name -> google.protobuf.Timestamp + 298, // 295: openshell.v1.PolicyChunk.decided_time:type_name -> google.protobuf.Timestamp + 298, // 296: openshell.v1.PolicyChunk.first_seen_time:type_name -> google.protobuf.Timestamp + 298, // 297: openshell.v1.PolicyChunk.last_seen_time:type_name -> google.protobuf.Timestamp + 300, // 298: openshell.v1.PolicyChunk.current_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 300, // 299: openshell.v1.PolicyChunk.candidate_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 303, // 300: openshell.v1.SubmitPolicyAnalysisRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 222, // 301: openshell.v1.SubmitPolicyAnalysisRequest.summaries:type_name -> openshell.v1.DenialSummary + 225, // 302: openshell.v1.SubmitPolicyAnalysisRequest.proposed_chunks:type_name -> openshell.v1.PolicyChunk + 224, // 303: openshell.v1.SubmitPolicyAnalysisRequest.network_activity_summaries:type_name -> openshell.v1.NetworkActivitySummary + 303, // 304: openshell.v1.GetDraftPolicyRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 225, // 305: openshell.v1.GetDraftPolicyResponse.chunks:type_name -> openshell.v1.PolicyChunk + 298, // 306: openshell.v1.GetDraftPolicyResponse.last_analyzed_time:type_name -> google.protobuf.Timestamp + 303, // 307: openshell.v1.ApproveDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 308: openshell.v1.RejectDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 309: openshell.v1.ApproveAllDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 235, // 310: openshell.v1.ApproveAllDraftChunksRequest.approvals:type_name -> openshell.v1.DraftChunkApproval + 303, // 311: openshell.v1.EditDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 309, // 312: openshell.v1.EditDraftChunkRequest.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule + 303, // 313: openshell.v1.UndoDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 314: openshell.v1.ClearDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 315: openshell.v1.GetDraftHistoryRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 298, // 316: openshell.v1.DraftHistoryEntry.event_time:type_name -> google.protobuf.Timestamp + 245, // 317: openshell.v1.GetDraftHistoryResponse.entries:type_name -> openshell.v1.DraftHistoryEntry + 297, // 318: openshell.v1.CreateWorkspaceRequest.labels:type_name -> openshell.v1.CreateWorkspaceRequest.LabelsEntry + 313, // 319: openshell.v1.CreateWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace + 313, // 320: openshell.v1.GetWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace + 313, // 321: openshell.v1.ListWorkspacesResponse.workspaces:type_name -> openshell.datamodel.v1.Workspace + 18, // 322: openshell.v1.DeleteWorkspaceResponse.outcome:type_name -> openshell.v1.DeletionOutcome + 299, // 323: openshell.v1.WorkspaceMember.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 15, // 324: openshell.v1.WorkspaceMember.role:type_name -> openshell.v1.WorkspaceRole + 303, // 325: openshell.v1.AddWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 15, // 326: openshell.v1.AddWorkspaceMemberRequest.role:type_name -> openshell.v1.WorkspaceRole + 255, // 327: openshell.v1.AddWorkspaceMemberResponse.member:type_name -> openshell.v1.WorkspaceMember + 303, // 328: openshell.v1.RemoveWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 18, // 329: openshell.v1.RemoveWorkspaceMemberResponse.outcome:type_name -> openshell.v1.DeletionOutcome + 303, // 330: openshell.v1.ListWorkspaceMembersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 255, // 331: openshell.v1.ListWorkspaceMembersResponse.members:type_name -> openshell.v1.WorkspaceMember + 298, // 332: openshell.v1.ExtensionServiceCredential.expiration_time:type_name -> google.protobuf.Timestamp + 19, // 333: openshell.v1.EndpointObservation.result:type_name -> openshell.v1.EndpointResult + 271, // 334: openshell.v1.EndpointObservation.failure:type_name -> openshell.v1.EndpointFailure + 263, // 335: openshell.v1.ReportEndpointStatusRequest.observations:type_name -> openshell.v1.EndpointObservation + 265, // 336: openshell.v1.ReportEndpointStatusRequest.token_grant_status:type_name -> openshell.v1.TokenGrantStatus + 266, // 337: openshell.v1.TokenGrantStatus.last_failure:type_name -> openshell.v1.TokenGrantFailureObservation + 271, // 338: openshell.v1.TokenGrantFailureObservation.failure:type_name -> openshell.v1.EndpointFailure + 19, // 339: openshell.v1.EndpointStatus.last_result:type_name -> openshell.v1.EndpointResult + 298, // 340: openshell.v1.EndpointStatus.last_reported_time:type_name -> google.protobuf.Timestamp + 271, // 341: openshell.v1.EndpointStatus.last_failure:type_name -> openshell.v1.EndpointFailure + 298, // 342: openshell.v1.SandboxProvisioning.configuration_change_time:type_name -> google.protobuf.Timestamp + 298, // 343: openshell.v1.SandboxProvisioning.first_rejection_time:type_name -> google.protobuf.Timestamp + 298, // 344: openshell.v1.SandboxProvisioning.deadline:type_name -> google.protobuf.Timestamp + 298, // 345: openshell.v1.SandboxProvisioning.timeout_time:type_name -> google.protobuf.Timestamp + 298, // 346: openshell.v1.SandboxProvisioning.cleanup_completed_time:type_name -> google.protobuf.Timestamp + 298, // 347: openshell.v1.SandboxProvisioning.cleanup_retry_time:type_name -> google.protobuf.Timestamp + 298, // 348: openshell.v1.SandboxProvisioning.attachment_change_time:type_name -> google.protobuf.Timestamp + 298, // 349: openshell.v1.SandboxProvisioning.preparation_deadline:type_name -> google.protobuf.Timestamp + 298, // 350: openshell.v1.SandboxProvisioning.admission_start_time:type_name -> google.protobuf.Timestamp + 20, // 351: openshell.v1.SandboxServiceExposure.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode + 21, // 352: openshell.v1.EndpointFailure.domain:type_name -> openshell.v1.EndpointFailureDomain + 16, // 353: openshell.v1.EndpointFailure.recovery_action:type_name -> openshell.v1.ProviderCredentialRefreshRecoveryAction + 118, // 354: openshell.v1.GetProviderCredentialsResponse.CredentialsEntry.value:type_name -> openshell.v1.ProviderCredentialValue + 298, // 355: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp + 298, // 356: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp + 132, // 357: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential + 162, // 358: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry.value:type_name -> openshell.v1.StaticCredentialBinding + 132, // 359: openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential + 26, // 360: openshell.v1.OpenShell.Health:input_type -> openshell.v1.HealthRequest + 28, // 361: openshell.v1.OpenShell.GetCurrentUser:input_type -> openshell.v1.GetCurrentUserRequest + 30, // 362: openshell.v1.OpenShell.GetGatewayInfo:input_type -> openshell.v1.GetGatewayInfoRequest + 54, // 363: openshell.v1.OpenShell.CreateSandbox:input_type -> openshell.v1.CreateSandboxRequest + 62, // 364: openshell.v1.OpenShell.BeginRootfsTarStaging:input_type -> openshell.v1.BeginRootfsTarStagingRequest + 64, // 365: openshell.v1.OpenShell.GetSandbox:input_type -> openshell.v1.GetSandboxRequest + 65, // 366: openshell.v1.OpenShell.ListSandboxes:input_type -> openshell.v1.ListSandboxesRequest + 55, // 367: openshell.v1.OpenShell.CreateSandboxTemplate:input_type -> openshell.v1.CreateSandboxTemplateRequest + 56, // 368: openshell.v1.OpenShell.GetSandboxTemplate:input_type -> openshell.v1.GetSandboxTemplateRequest + 57, // 369: openshell.v1.OpenShell.ListSandboxTemplates:input_type -> openshell.v1.ListSandboxTemplatesRequest + 58, // 370: openshell.v1.OpenShell.DeleteSandboxTemplate:input_type -> openshell.v1.DeleteSandboxTemplateRequest + 66, // 371: openshell.v1.OpenShell.ListSandboxProviders:input_type -> openshell.v1.ListSandboxProvidersRequest + 67, // 372: openshell.v1.OpenShell.AttachSandboxProvider:input_type -> openshell.v1.AttachSandboxProviderRequest + 68, // 373: openshell.v1.OpenShell.DetachSandboxProvider:input_type -> openshell.v1.DetachSandboxProviderRequest + 84, // 374: openshell.v1.OpenShell.GetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest + 69, // 375: openshell.v1.OpenShell.DeleteSandbox:input_type -> openshell.v1.DeleteSandboxRequest + 70, // 376: openshell.v1.OpenShell.StopSandbox:input_type -> openshell.v1.StopSandboxRequest + 71, // 377: openshell.v1.OpenShell.StartSandbox:input_type -> openshell.v1.StartSandboxRequest + 89, // 378: openshell.v1.OpenShell.CreateSshSession:input_type -> openshell.v1.CreateSshSessionRequest + 91, // 379: openshell.v1.OpenShell.ExposeService:input_type -> openshell.v1.ExposeServiceRequest + 92, // 380: openshell.v1.OpenShell.GetService:input_type -> openshell.v1.GetServiceRequest + 93, // 381: openshell.v1.OpenShell.ListServices:input_type -> openshell.v1.ListServicesRequest + 95, // 382: openshell.v1.OpenShell.DeleteService:input_type -> openshell.v1.DeleteServiceRequest + 99, // 383: openshell.v1.OpenShell.RevokeSshSession:input_type -> openshell.v1.RevokeSshSessionRequest + 101, // 384: openshell.v1.OpenShell.ExecSandbox:input_type -> openshell.v1.ExecSandboxRequest + 107, // 385: openshell.v1.OpenShell.ForwardTcp:input_type -> openshell.v1.TcpForwardFrame + 108, // 386: openshell.v1.OpenShell.ExecSandboxInteractive:input_type -> openshell.v1.ExecSandboxInput + 115, // 387: openshell.v1.OpenShell.CreateProvider:input_type -> openshell.v1.CreateProviderRequest + 116, // 388: openshell.v1.OpenShell.GetProvider:input_type -> openshell.v1.GetProviderRequest + 117, // 389: openshell.v1.OpenShell.GetProviderCredentials:input_type -> openshell.v1.GetProviderCredentialsRequest + 120, // 390: openshell.v1.OpenShell.ListProviders:input_type -> openshell.v1.ListProvidersRequest + 125, // 391: openshell.v1.OpenShell.ListProviderProfiles:input_type -> openshell.v1.ListProviderProfilesRequest + 126, // 392: openshell.v1.OpenShell.GetProviderProfile:input_type -> openshell.v1.GetProviderProfileRequest + 150, // 393: openshell.v1.OpenShell.ImportProviderProfiles:input_type -> openshell.v1.ImportProviderProfilesRequest + 152, // 394: openshell.v1.OpenShell.UpdateProviderProfiles:input_type -> openshell.v1.UpdateProviderProfilesRequest + 154, // 395: openshell.v1.OpenShell.LintProviderProfiles:input_type -> openshell.v1.LintProviderProfilesRequest + 121, // 396: openshell.v1.OpenShell.UpdateProvider:input_type -> openshell.v1.UpdateProviderRequest + 138, // 397: openshell.v1.OpenShell.GetProviderRefreshStatus:input_type -> openshell.v1.GetProviderRefreshStatusRequest + 140, // 398: openshell.v1.OpenShell.ConfigureProviderRefresh:input_type -> openshell.v1.ConfigureProviderRefreshRequest + 142, // 399: openshell.v1.OpenShell.RotateProviderCredential:input_type -> openshell.v1.RotateProviderCredentialRequest + 144, // 400: openshell.v1.OpenShell.DeleteProviderRefresh:input_type -> openshell.v1.DeleteProviderRefreshRequest + 122, // 401: openshell.v1.OpenShell.DeleteProvider:input_type -> openshell.v1.DeleteProviderRequest + 157, // 402: openshell.v1.OpenShell.DeleteProviderProfile:input_type -> openshell.v1.DeleteProviderProfileRequest + 314, // 403: openshell.v1.OpenShell.GetSandboxConfig:input_type -> openshell.sandbox.v1.GetSandboxConfigRequest + 315, // 404: openshell.v1.OpenShell.GetGatewayConfig:input_type -> openshell.sandbox.v1.GetGatewayConfigRequest + 168, // 405: openshell.v1.OpenShell.UpdateConfig:input_type -> openshell.v1.UpdateConfigRequest + 178, // 406: openshell.v1.OpenShell.GetSandboxPolicyStatus:input_type -> openshell.v1.GetSandboxPolicyStatusRequest + 180, // 407: openshell.v1.OpenShell.ListSandboxPolicies:input_type -> openshell.v1.ListSandboxPoliciesRequest + 182, // 408: openshell.v1.OpenShell.ReportPolicyStatus:input_type -> openshell.v1.ReportPolicyStatusRequest + 264, // 409: openshell.v1.OpenShell.ReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest + 86, // 410: openshell.v1.OpenShell.ReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest + 185, // 411: openshell.v1.OpenShell.ReportSandboxConfiguration:input_type -> openshell.v1.ReportSandboxConfigurationRequest + 159, // 412: openshell.v1.OpenShell.GetSandboxProviderEnvironment:input_type -> openshell.v1.GetSandboxProviderEnvironmentRequest + 166, // 413: openshell.v1.OpenShell.ExchangeProviderSubjectToken:input_type -> openshell.v1.ExchangeProviderSubjectTokenRequest + 188, // 414: openshell.v1.OpenShell.GetSandboxLogs:input_type -> openshell.v1.GetSandboxLogsRequest + 189, // 415: openshell.v1.OpenShell.PushSandboxLogs:input_type -> openshell.v1.PushSandboxLogsRequest + 192, // 416: openshell.v1.OpenShell.ConnectSupervisor:input_type -> openshell.v1.SupervisorMessage + 204, // 417: openshell.v1.OpenShell.ReportMainProcessExit:input_type -> openshell.v1.ReportMainProcessExitRequest + 206, // 418: openshell.v1.OpenShell.FinalizeMainProcessExit:input_type -> openshell.v1.FinalizeMainProcessExitRequest + 212, // 419: openshell.v1.OpenShell.RelayStream:input_type -> openshell.v1.RelayFrame + 214, // 420: openshell.v1.OpenShell.PeerRelay:input_type -> openshell.v1.PeerRelayFrame + 86, // 421: openshell.v1.OpenShell.PeerReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest + 264, // 422: openshell.v1.OpenShell.PeerReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest + 84, // 423: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest + 217, // 424: openshell.v1.OpenShell.PeerNotifyConfigUpdate:input_type -> openshell.v1.PeerNotifyConfigUpdateRequest + 111, // 425: openshell.v1.OpenShell.WatchSandbox:input_type -> openshell.v1.WatchSandboxRequest + 227, // 426: openshell.v1.OpenShell.SubmitPolicyAnalysis:input_type -> openshell.v1.SubmitPolicyAnalysisRequest + 229, // 427: openshell.v1.OpenShell.GetDraftPolicy:input_type -> openshell.v1.GetDraftPolicyRequest + 231, // 428: openshell.v1.OpenShell.ApproveDraftChunk:input_type -> openshell.v1.ApproveDraftChunkRequest + 233, // 429: openshell.v1.OpenShell.RejectDraftChunk:input_type -> openshell.v1.RejectDraftChunkRequest + 236, // 430: openshell.v1.OpenShell.ApproveAllDraftChunks:input_type -> openshell.v1.ApproveAllDraftChunksRequest + 238, // 431: openshell.v1.OpenShell.EditDraftChunk:input_type -> openshell.v1.EditDraftChunkRequest + 240, // 432: openshell.v1.OpenShell.UndoDraftChunk:input_type -> openshell.v1.UndoDraftChunkRequest + 242, // 433: openshell.v1.OpenShell.ClearDraftChunks:input_type -> openshell.v1.ClearDraftChunksRequest + 244, // 434: openshell.v1.OpenShell.GetDraftHistory:input_type -> openshell.v1.GetDraftHistoryRequest + 22, // 435: openshell.v1.OpenShell.IssueSandboxToken:input_type -> openshell.v1.IssueSandboxTokenRequest + 24, // 436: openshell.v1.OpenShell.RefreshSandboxToken:input_type -> openshell.v1.RefreshSandboxTokenRequest + 247, // 437: openshell.v1.OpenShell.CreateWorkspace:input_type -> openshell.v1.CreateWorkspaceRequest + 249, // 438: openshell.v1.OpenShell.GetWorkspace:input_type -> openshell.v1.GetWorkspaceRequest + 251, // 439: openshell.v1.OpenShell.ListWorkspaces:input_type -> openshell.v1.ListWorkspacesRequest + 253, // 440: openshell.v1.OpenShell.DeleteWorkspace:input_type -> openshell.v1.DeleteWorkspaceRequest + 256, // 441: openshell.v1.OpenShell.AddWorkspaceMember:input_type -> openshell.v1.AddWorkspaceMemberRequest + 258, // 442: openshell.v1.OpenShell.RemoveWorkspaceMember:input_type -> openshell.v1.RemoveWorkspaceMemberRequest + 260, // 443: openshell.v1.OpenShell.ListWorkspaceMembers:input_type -> openshell.v1.ListWorkspaceMembersRequest + 27, // 444: openshell.v1.OpenShell.Health:output_type -> openshell.v1.HealthResponse + 29, // 445: openshell.v1.OpenShell.GetCurrentUser:output_type -> openshell.v1.GetCurrentUserResponse + 31, // 446: openshell.v1.OpenShell.GetGatewayInfo:output_type -> openshell.v1.GetGatewayInfoResponse + 72, // 447: openshell.v1.OpenShell.CreateSandbox:output_type -> openshell.v1.SandboxResponse + 63, // 448: openshell.v1.OpenShell.BeginRootfsTarStaging:output_type -> openshell.v1.BeginRootfsTarStagingResponse + 72, // 449: openshell.v1.OpenShell.GetSandbox:output_type -> openshell.v1.SandboxResponse + 73, // 450: openshell.v1.OpenShell.ListSandboxes:output_type -> openshell.v1.ListSandboxesResponse + 59, // 451: openshell.v1.OpenShell.CreateSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse + 59, // 452: openshell.v1.OpenShell.GetSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse + 60, // 453: openshell.v1.OpenShell.ListSandboxTemplates:output_type -> openshell.v1.ListSandboxTemplatesResponse + 61, // 454: openshell.v1.OpenShell.DeleteSandboxTemplate:output_type -> openshell.v1.DeleteSandboxTemplateResponse + 74, // 455: openshell.v1.OpenShell.ListSandboxProviders:output_type -> openshell.v1.ListSandboxProvidersResponse + 75, // 456: openshell.v1.OpenShell.AttachSandboxProvider:output_type -> openshell.v1.AttachSandboxProviderResponse + 76, // 457: openshell.v1.OpenShell.DetachSandboxProvider:output_type -> openshell.v1.DetachSandboxProviderResponse + 85, // 458: openshell.v1.OpenShell.GetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse + 88, // 459: openshell.v1.OpenShell.DeleteSandbox:output_type -> openshell.v1.DeleteSandboxResponse + 72, // 460: openshell.v1.OpenShell.StopSandbox:output_type -> openshell.v1.SandboxResponse + 72, // 461: openshell.v1.OpenShell.StartSandbox:output_type -> openshell.v1.SandboxResponse + 90, // 462: openshell.v1.OpenShell.CreateSshSession:output_type -> openshell.v1.CreateSshSessionResponse + 98, // 463: openshell.v1.OpenShell.ExposeService:output_type -> openshell.v1.ServiceEndpointResponse + 98, // 464: openshell.v1.OpenShell.GetService:output_type -> openshell.v1.ServiceEndpointResponse + 94, // 465: openshell.v1.OpenShell.ListServices:output_type -> openshell.v1.ListServicesResponse + 96, // 466: openshell.v1.OpenShell.DeleteService:output_type -> openshell.v1.DeleteServiceResponse + 100, // 467: openshell.v1.OpenShell.RevokeSshSession:output_type -> openshell.v1.RevokeSshSessionResponse + 105, // 468: openshell.v1.OpenShell.ExecSandbox:output_type -> openshell.v1.ExecSandboxEvent + 107, // 469: openshell.v1.OpenShell.ForwardTcp:output_type -> openshell.v1.TcpForwardFrame + 105, // 470: openshell.v1.OpenShell.ExecSandboxInteractive:output_type -> openshell.v1.ExecSandboxEvent + 123, // 471: openshell.v1.OpenShell.CreateProvider:output_type -> openshell.v1.ProviderResponse + 123, // 472: openshell.v1.OpenShell.GetProvider:output_type -> openshell.v1.ProviderResponse + 119, // 473: openshell.v1.OpenShell.GetProviderCredentials:output_type -> openshell.v1.GetProviderCredentialsResponse + 124, // 474: openshell.v1.OpenShell.ListProviders:output_type -> openshell.v1.ListProvidersResponse + 149, // 475: openshell.v1.OpenShell.ListProviderProfiles:output_type -> openshell.v1.ListProviderProfilesResponse + 148, // 476: openshell.v1.OpenShell.GetProviderProfile:output_type -> openshell.v1.ProviderProfileResponse + 151, // 477: openshell.v1.OpenShell.ImportProviderProfiles:output_type -> openshell.v1.ImportProviderProfilesResponse + 153, // 478: openshell.v1.OpenShell.UpdateProviderProfiles:output_type -> openshell.v1.UpdateProviderProfilesResponse + 155, // 479: openshell.v1.OpenShell.LintProviderProfiles:output_type -> openshell.v1.LintProviderProfilesResponse + 123, // 480: openshell.v1.OpenShell.UpdateProvider:output_type -> openshell.v1.ProviderResponse + 139, // 481: openshell.v1.OpenShell.GetProviderRefreshStatus:output_type -> openshell.v1.GetProviderRefreshStatusResponse + 141, // 482: openshell.v1.OpenShell.ConfigureProviderRefresh:output_type -> openshell.v1.ConfigureProviderRefreshResponse + 143, // 483: openshell.v1.OpenShell.RotateProviderCredential:output_type -> openshell.v1.RotateProviderCredentialResponse + 145, // 484: openshell.v1.OpenShell.DeleteProviderRefresh:output_type -> openshell.v1.DeleteProviderRefreshResponse + 156, // 485: openshell.v1.OpenShell.DeleteProvider:output_type -> openshell.v1.DeleteProviderResponse + 158, // 486: openshell.v1.OpenShell.DeleteProviderProfile:output_type -> openshell.v1.DeleteProviderProfileResponse + 316, // 487: openshell.v1.OpenShell.GetSandboxConfig:output_type -> openshell.sandbox.v1.GetSandboxConfigResponse + 317, // 488: openshell.v1.OpenShell.GetGatewayConfig:output_type -> openshell.sandbox.v1.GetGatewayConfigResponse + 177, // 489: openshell.v1.OpenShell.UpdateConfig:output_type -> openshell.v1.UpdateConfigResponse + 179, // 490: openshell.v1.OpenShell.GetSandboxPolicyStatus:output_type -> openshell.v1.GetSandboxPolicyStatusResponse + 181, // 491: openshell.v1.OpenShell.ListSandboxPolicies:output_type -> openshell.v1.ListSandboxPoliciesResponse + 183, // 492: openshell.v1.OpenShell.ReportPolicyStatus:output_type -> openshell.v1.ReportPolicyStatusResponse + 267, // 493: openshell.v1.OpenShell.ReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse + 87, // 494: openshell.v1.OpenShell.ReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse + 186, // 495: openshell.v1.OpenShell.ReportSandboxConfiguration:output_type -> openshell.v1.ReportSandboxConfigurationResponse + 163, // 496: openshell.v1.OpenShell.GetSandboxProviderEnvironment:output_type -> openshell.v1.GetSandboxProviderEnvironmentResponse + 167, // 497: openshell.v1.OpenShell.ExchangeProviderSubjectToken:output_type -> openshell.v1.ExchangeProviderSubjectTokenResponse + 191, // 498: openshell.v1.OpenShell.GetSandboxLogs:output_type -> openshell.v1.GetSandboxLogsResponse + 190, // 499: openshell.v1.OpenShell.PushSandboxLogs:output_type -> openshell.v1.PushSandboxLogsResponse + 193, // 500: openshell.v1.OpenShell.ConnectSupervisor:output_type -> openshell.v1.GatewayMessage + 205, // 501: openshell.v1.OpenShell.ReportMainProcessExit:output_type -> openshell.v1.ReportMainProcessExitResponse + 207, // 502: openshell.v1.OpenShell.FinalizeMainProcessExit:output_type -> openshell.v1.FinalizeMainProcessExitResponse + 212, // 503: openshell.v1.OpenShell.RelayStream:output_type -> openshell.v1.RelayFrame + 214, // 504: openshell.v1.OpenShell.PeerRelay:output_type -> openshell.v1.PeerRelayFrame + 87, // 505: openshell.v1.OpenShell.PeerReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse + 267, // 506: openshell.v1.OpenShell.PeerReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse + 85, // 507: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse + 218, // 508: openshell.v1.OpenShell.PeerNotifyConfigUpdate:output_type -> openshell.v1.PeerNotifyConfigUpdateResponse + 112, // 509: openshell.v1.OpenShell.WatchSandbox:output_type -> openshell.v1.SandboxStreamEvent + 228, // 510: openshell.v1.OpenShell.SubmitPolicyAnalysis:output_type -> openshell.v1.SubmitPolicyAnalysisResponse + 230, // 511: openshell.v1.OpenShell.GetDraftPolicy:output_type -> openshell.v1.GetDraftPolicyResponse + 232, // 512: openshell.v1.OpenShell.ApproveDraftChunk:output_type -> openshell.v1.ApproveDraftChunkResponse + 234, // 513: openshell.v1.OpenShell.RejectDraftChunk:output_type -> openshell.v1.RejectDraftChunkResponse + 237, // 514: openshell.v1.OpenShell.ApproveAllDraftChunks:output_type -> openshell.v1.ApproveAllDraftChunksResponse + 239, // 515: openshell.v1.OpenShell.EditDraftChunk:output_type -> openshell.v1.EditDraftChunkResponse + 241, // 516: openshell.v1.OpenShell.UndoDraftChunk:output_type -> openshell.v1.UndoDraftChunkResponse + 243, // 517: openshell.v1.OpenShell.ClearDraftChunks:output_type -> openshell.v1.ClearDraftChunksResponse + 246, // 518: openshell.v1.OpenShell.GetDraftHistory:output_type -> openshell.v1.GetDraftHistoryResponse + 23, // 519: openshell.v1.OpenShell.IssueSandboxToken:output_type -> openshell.v1.IssueSandboxTokenResponse + 25, // 520: openshell.v1.OpenShell.RefreshSandboxToken:output_type -> openshell.v1.RefreshSandboxTokenResponse + 248, // 521: openshell.v1.OpenShell.CreateWorkspace:output_type -> openshell.v1.CreateWorkspaceResponse + 250, // 522: openshell.v1.OpenShell.GetWorkspace:output_type -> openshell.v1.GetWorkspaceResponse + 252, // 523: openshell.v1.OpenShell.ListWorkspaces:output_type -> openshell.v1.ListWorkspacesResponse + 254, // 524: openshell.v1.OpenShell.DeleteWorkspace:output_type -> openshell.v1.DeleteWorkspaceResponse + 257, // 525: openshell.v1.OpenShell.AddWorkspaceMember:output_type -> openshell.v1.AddWorkspaceMemberResponse + 259, // 526: openshell.v1.OpenShell.RemoveWorkspaceMember:output_type -> openshell.v1.RemoveWorkspaceMemberResponse + 261, // 527: openshell.v1.OpenShell.ListWorkspaceMembers:output_type -> openshell.v1.ListWorkspaceMembersResponse + 444, // [444:528] is the sub-list for method output_type + 360, // [360:444] is the sub-list for method input_type + 360, // [360:360] is the sub-list for extension type_name + 360, // [360:360] is the sub-list for extension extendee + 0, // [0:360] is the sub-list for field type_name } func init() { file_openshell_proto_init() } @@ -22094,7 +22253,13 @@ func file_openshell_proto_init() { (*SandboxStreamEvent_Warning)(nil), (*SandboxStreamEvent_DraftPolicyUpdate)(nil), } - file_openshell_proto_msgTypes[146].OneofWrappers = []any{ + file_openshell_proto_msgTypes[139].OneofWrappers = []any{ + (*StaticCredentialPlacement_HeaderName)(nil), + (*StaticCredentialPlacement_QueryParam)(nil), + (*StaticCredentialPlacement_PathTemplate)(nil), + (*StaticCredentialPlacement_SigningOnly)(nil), + } + file_openshell_proto_msgTypes[147].OneofWrappers = []any{ (*PolicyMergeOperation_AddRule)(nil), (*PolicyMergeOperation_RemoveEndpoint)(nil), (*PolicyMergeOperation_RemoveRule)(nil), @@ -22102,15 +22267,15 @@ func file_openshell_proto_init() { (*PolicyMergeOperation_AddAllowRules)(nil), (*PolicyMergeOperation_RemoveBinary)(nil), } - file_openshell_proto_msgTypes[150].OneofWrappers = []any{} - file_openshell_proto_msgTypes[169].OneofWrappers = []any{ + file_openshell_proto_msgTypes[151].OneofWrappers = []any{} + file_openshell_proto_msgTypes[170].OneofWrappers = []any{ (*SupervisorMessage_Hello)(nil), (*SupervisorMessage_Heartbeat)(nil), (*SupervisorMessage_RelayOpenResult)(nil), (*SupervisorMessage_RelayClose)(nil), (*SupervisorMessage_ConfigUpdateResult)(nil), } - file_openshell_proto_msgTypes[170].OneofWrappers = []any{ + file_openshell_proto_msgTypes[171].OneofWrappers = []any{ (*GatewayMessage_SessionAccepted)(nil), (*GatewayMessage_SessionRejected)(nil), (*GatewayMessage_Heartbeat)(nil), @@ -22119,32 +22284,32 @@ func file_openshell_proto_init() { (*GatewayMessage_SessionRedirect)(nil), (*GatewayMessage_ConfigUpdate)(nil), } - file_openshell_proto_msgTypes[185].OneofWrappers = []any{ + file_openshell_proto_msgTypes[186].OneofWrappers = []any{ (*RelayOpen_Ssh)(nil), (*RelayOpen_Tcp)(nil), } - file_openshell_proto_msgTypes[189].OneofWrappers = []any{ + file_openshell_proto_msgTypes[190].OneofWrappers = []any{ (*RelayFrame_Init)(nil), (*RelayFrame_Data)(nil), } - file_openshell_proto_msgTypes[191].OneofWrappers = []any{ + file_openshell_proto_msgTypes[192].OneofWrappers = []any{ (*PeerRelayFrame_Init)(nil), (*PeerRelayFrame_Data)(nil), } - file_openshell_proto_msgTypes[194].OneofWrappers = []any{ + file_openshell_proto_msgTypes[195].OneofWrappers = []any{ (*PeerNotifyConfigUpdateRequest_Sandbox)(nil), (*PeerNotifyConfigUpdateRequest_Workspace)(nil), (*PeerNotifyConfigUpdateRequest_AllConnected)(nil), (*PeerNotifyConfigUpdateRequest_Provider)(nil), } - file_openshell_proto_msgTypes[248].OneofWrappers = []any{} + file_openshell_proto_msgTypes[249].OneofWrappers = []any{} type x struct{} out := protoimpl.TypeBuilder{ File: protoimpl.DescBuilder{ GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_openshell_proto_rawDesc), len(file_openshell_proto_rawDesc)), NumEnums: 22, - NumMessages: 275, + NumMessages: 276, NumExtensions: 0, NumServices: 1, }, diff --git a/skills/debug-inference/SKILL.md b/skills/debug-inference/SKILL.md index 50937104a1..cd051f8332 100644 --- a/skills/debug-inference/SKILL.md +++ b/skills/debug-inference/SKILL.md @@ -103,8 +103,9 @@ inference request using the provider's documented API shape. | A retired managed endpoint fails DNS resolution | Client still uses the removed managed endpoint | Configure the provider's native base URL and attach an endpoint-bearing provider profile | | Direct request is denied | Missing attachment, endpoint policy, HTTP rule, or binary authorization | Inspect the attached provider profile and sandbox effective policy | | `credential_endpoint_mismatch` | Credential profile does not authorize the request recipient | Correct the host/port/path or import a narrowly scoped profile for the intended endpoint | +| `credential_placement_mismatch` | A credential placeholder is outside its declared header, query parameter, or path slot | Match the profile's declared placement. Body and WebSocket rewrite flags do not override credential placement. | | `request_authority_mismatch` | HTTP authority differs from the CONNECT destination | Use the same host and effective port in both authorities | -| Credential variable is absent | Provider was not attached when this process launched, or profiles collide on a key | Attach the provider and launch a new process; resolve duplicate keys explicitly | +| Credential variable is absent | Provider was not attached when this process launched, profiles collide on a key, or placement metadata is missing | Check provider readiness and placement metadata, then launch a new process; resolve duplicate keys explicitly. Older supervisors require an upgrade before receiving static credentials. | | Upstream rejects the model or body | Client relied on removed model/request rewriting | Configure the real model and provider-native request format in the application | | `127.0.0.1` works on the host but not in the sandbox | Loopback refers to different runtime | Use `host.openshell.internal` or another gateway-reachable endpoint and profile | | Host-local request times out | Server bind address, gateway topology, or host firewall blocks container-to-host traffic | Verify the listener and permit only the required gateway network path and port | diff --git a/skills/openshell-cli/SKILL.md b/skills/openshell-cli/SKILL.md index 84e6d65a2c..fa6aa978cd 100644 --- a/skills/openshell-cli/SKILL.md +++ b/skills/openshell-cli/SKILL.md @@ -150,6 +150,13 @@ when a placeholder is present but requests receive `credential_endpoint_mismatch`. A profileless static provider fails closed because the gateway cannot construct a binding. +Static credentials also require declared placement. A +`credential_placement_mismatch` means the placeholder is outside its permitted +header, query parameter, or path-template slot. Match the profile instead of +broadening network policy or enabling body/WebSocket rewriting. Missing placement +metadata or an older supervisor can cause `CredentialsWithheld`; inspect provider +readiness, correct the profile, and upgrade the supervisor before retrying. + When an inspected request receives `request_authority_mismatch`, compare its HTTP authority with the CONNECT tunnel endpoint. The host and effective port must match. For a tunnel to `api.example.com:8443`, send From 8531c4b4fd8f4080d9b41499a2517e4612ef19df Mon Sep 17 00:00:00 2001 From: John Myers <9696606+johntmyers@users.noreply.github.com> Date: Fri, 23 Oct 2026 14:53:31 -0700 Subject: [PATCH 2/2] fix(providers): enforce placement using existing credential metadata Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com> --- crates/openshell-core/README.md | 25 +- crates/openshell-core/src/grpc_client.rs | 8 - .../src/provider_credentials.rs | 780 +++---- crates/openshell-core/src/secrets.rs | 32 +- crates/openshell-core/src/secrets_body.rs | 7 - crates/openshell-providers/src/profiles.rs | 7 - crates/openshell-server/README.md | 21 +- .../src/config_delivery/mod.rs | 42 +- crates/openshell-server/src/grpc/mod.rs | 5 +- crates/openshell-server/src/grpc/policy.rs | 109 +- .../src/grpc/policy/endpoint_status_tests.rs | 2 - crates/openshell-server/src/grpc/provider.rs | 588 ++--- .../src/grpc/provider_readiness_tests.rs | 1 - crates/openshell-server/src/storage_proto.rs | 6 +- .../src/supervisor_session.rs | 26 +- crates/openshell-supervisor-network/README.md | 10 +- .../src/google_cloud_metadata.rs | 7 - .../src/l7/relay.rs | 249 +- .../src/l7/rest.rs | 3 - .../src/l7/websocket.rs | 103 +- .../openshell-supervisor-network/src/proxy.rs | 21 - .../src/test_support.rs | 23 +- .../src/supervisor_session.rs | 1 - .../src/config_runtime.rs | 43 +- crates/openshell-supervisor/src/lib.rs | 73 +- docs/how-it-works/policies/network-rules.mdx | 6 +- docs/how-it-works/policies/schema.mdx | 4 +- docs/how-it-works/providers/overview.mdx | 18 +- docs/how-it-works/providers/profiles.mdx | 56 +- e2e/python/test_sandbox_providers.py | 36 +- proto/openshell.proto | 34 +- providers/codex.yaml | 3 - sdk/go/proto/openshellv1/openshell.pb.go | 2060 ++++++++--------- skills/debug-inference/SKILL.md | 4 +- skills/openshell-cli/SKILL.md | 14 +- 35 files changed, 1984 insertions(+), 2443 deletions(-) diff --git a/crates/openshell-core/README.md b/crates/openshell-core/README.md index d1c5153651..4e5177cd34 100644 --- a/crates/openshell-core/README.md +++ b/crates/openshell-core/README.md @@ -60,19 +60,18 @@ behavior here, then consume it from the gateway, sandbox, and router. ## Static Credential Resolution -Static credential bindings carry both an endpoint boundary and a placement -boundary. `provider_credentials` compiles them together and preserves placement -when creating a request-scoped resolver. Request rewriting supplies the actual -header name, query key, or path slot before resolving each reference. Missing or -unsupported placement fails closed. - -Header placement authorizes a header name independently of authentication -scheme. Basic authentication applies the same check before resolving decoded -references. Body and WebSocket rewriting cannot override a credential's declared -placement. Signing-only material uses the supervisor's trusted signing path. - -Placement changes are authorization changes: retained references and stable -handles must not retain access to the previous placement. +Static credential bindings retain endpoint authorization. The gateway includes +static `ProviderProfileCredential` auth metadata in the existing runtime +credential map under `static-env:`. Provider state extracts those entries +before storing dynamic token grants and compiles placement locally alongside the +matching static binding. Missing metadata preserves legacy endpoint-scoped +substitution; malformed reserved metadata fails closed atomically. + +Request rewriting supplies the actual header name, query key, or path slot. +Header authorization is independent of authentication scheme, including Basic. +Explicit body/WebSocket rewrite policies and trusted signing retain their +existing permissions. Existing placeholder and stable-handle derivation remain +unchanged. Protobuf message shapes and service interfaces remain unchanged. ## Middleware Contracts diff --git a/crates/openshell-core/src/grpc_client.rs b/crates/openshell-core/src/grpc_client.rs index 26ba139ca0..3a13ed88e5 100644 --- a/crates/openshell-core/src/grpc_client.rs +++ b/crates/openshell-core/src/grpc_client.rs @@ -1317,7 +1317,6 @@ pub async fn fetch_provider_environment_with_stable_placeholders( .get_sandbox_provider_environment(GetSandboxProviderEnvironmentRequest { sandbox_id: sandbox_id.to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, }) .await @@ -1387,13 +1386,6 @@ mod provider_environment_tests { path: "/v1/**".to_string(), }], credential_identity: "provider:TOKEN".to_string(), - placement: Some(crate::proto::StaticCredentialPlacement { - location: Some( - crate::proto::static_credential_placement::Location::HeaderName( - "authorization".into(), - ), - ), - }), ..Default::default() }, )]), diff --git a/crates/openshell-core/src/provider_credentials.rs b/crates/openshell-core/src/provider_credentials.rs index d6c33a09fd..99c52b4e55 100644 --- a/crates/openshell-core/src/provider_credentials.rs +++ b/crates/openshell-core/src/provider_credentials.rs @@ -61,8 +61,7 @@ struct ProviderCredentialStateInner { #[derive(Debug)] struct StaticCredentialIdentityEpoch { - credential_identity: String, - placement: CredentialPlacement, + identity: String, revisions: Arc>, } @@ -99,6 +98,29 @@ impl fmt::Display for StaticCredentialBindingError { impl std::error::Error for StaticCredentialBindingError {} +/// Reserved entries in the existing credential map carry static placement only. +pub const STATIC_CREDENTIAL_METADATA_PREFIX: &str = "static-env:"; + +const CREDENTIAL_PATH_SLOT: &str = "{credential}"; + +fn split_static_credential_metadata( + credentials: HashMap, +) -> ( + HashMap, + HashMap, +) { + let mut metadata = HashMap::new(); + let mut grants = HashMap::new(); + for (key, credential) in credentials { + if let Some(env_key) = key.strip_prefix(STATIC_CREDENTIAL_METADATA_PREFIX) { + metadata.insert(env_key.to_string(), credential); + } else { + grants.insert(key, credential); + } + } + (metadata, grants) +} + impl ProviderCredentialState { pub fn from_environment( revision: u64, @@ -106,6 +128,7 @@ impl ProviderCredentialState { credential_expires_at_ms: HashMap, dynamic_credentials: HashMap, ) -> Self { + let (_, dynamic_credentials) = split_static_credential_metadata(dynamic_credentials); let (child_env, generation_resolver, current_resolver) = SecretResolver::from_provider_env_for_current_revision( env, @@ -175,11 +198,14 @@ impl ProviderCredentialState { non_secret_environment_keys: Vec, stable_placeholder_environment_keys: Vec, ) -> Result { + let (placement_metadata, dynamic_credentials) = + split_static_credential_metadata(dynamic_credentials); let static_credential_bindings = compile_static_credential_bindings( &env, static_credential_bindings, &non_secret_environment_keys, &stable_placeholder_environment_keys, + &placement_metadata, )?; let stable_handles = static_credential_stable_handles(&static_credential_bindings); let (child_env, generation_resolver, current_resolver) = @@ -407,10 +433,7 @@ impl ProviderCredentialState { inner .static_credential_bindings .get(*key) - .is_some_and(|binding| { - binding.credential_identity == epoch.credential_identity - && binding.placement == epoch.placement - }) + .is_some_and(|binding| binding.credential_identity == epoch.identity) }) .map(|(key, epoch)| (key.clone(), epoch.revisions.clone())) .collect(), @@ -425,10 +448,7 @@ impl ProviderCredentialState { && inner .static_credential_bindings .get(*key) - .is_some_and(|binding| { - binding.credential_identity == epoch.credential_identity - && binding.placement == epoch.placement - }) + .is_some_and(|binding| binding.credential_identity == epoch.identity) }) .map(|(key, epoch)| (key.clone(), epoch.revisions.clone())) .collect(); @@ -724,6 +744,7 @@ impl ProviderCredentialState { credential_expires_at_ms: HashMap, dynamic_credentials: HashMap, ) -> usize { + let (_, dynamic_credentials) = split_static_credential_metadata(dynamic_credentials); let (mut child_env, generation_resolver, current_resolver) = SecretResolver::from_provider_env_for_current_revision( env, @@ -804,11 +825,14 @@ impl ProviderCredentialState { non_secret_environment_keys: Vec, stable_placeholder_environment_keys: Vec, ) -> Result { + let (placement_metadata, dynamic_credentials) = + split_static_credential_metadata(dynamic_credentials); let static_credential_bindings = match compile_static_credential_bindings( &env, static_credential_bindings, &non_secret_environment_keys, &stable_placeholder_environment_keys, + &placement_metadata, ) { Ok(bindings) => bindings, Err(error) => { @@ -969,6 +993,7 @@ impl ProviderCredentialState { .expect("provider credential state poisoned"); let dynamic_credentials = dynamic_credentials.unwrap_or_else(|| inner.current.dynamic_credentials.clone()); + let (_, dynamic_credentials) = split_static_credential_metadata(dynamic_credentials); inner.current = Arc::new(ProviderCredentialSnapshot { installation_id: uuid::Uuid::new_v4().to_string(), revision, @@ -989,7 +1014,22 @@ fn compile_static_credential_bindings( bindings: HashMap, non_secret_environment_keys: &[String], stable_placeholder_environment_keys: &[String], + placement_metadata: &HashMap, ) -> Result, StaticCredentialBindingError> { + for (key, metadata) in placement_metadata { + if !env.contains_key(key) + || !bindings.contains_key(key) + || metadata.env_vars.len() != 1 + || metadata.env_vars[0] != *key + || metadata.token_grant.is_some() + || metadata.refresh.is_some() + || !metadata.token_grant_owners.is_empty() + { + return Err(binding_error( + "static credential placement metadata does not match delivered credentials", + )); + } + } let non_secret_keys = non_secret_environment_keys .iter() .cloned() @@ -1086,6 +1126,10 @@ fn compile_static_credential_bindings( bindings .into_iter() .map(|(key, binding)| { + let placement = placement_metadata.get(&key).map_or( + Ok(CredentialPlacement::Legacy), + compile_credential_placement, + )?; let endpoints = binding .endpoints .into_iter() @@ -1095,7 +1139,7 @@ fn compile_static_credential_bindings( key, CompiledStaticCredentialBinding { endpoints, - placement: compile_credential_placement(binding.placement)?, + placement, credential_identity: binding.credential_identity, workload_credential_handle: binding.workload_credential_handle, }, @@ -1105,35 +1149,46 @@ fn compile_static_credential_bindings( } fn compile_credential_placement( - placement: Option, + metadata: &crate::proto::ProviderProfileCredential, ) -> Result { - use crate::proto::static_credential_placement::Location; - match placement.and_then(|placement| placement.location) { - Some(Location::HeaderName(name)) - if !name.is_empty() - && name + let placement = match metadata.auth_style.trim().to_ascii_lowercase().as_str() { + "basic" => CredentialPlacement::Header("authorization".into()), + "header" | "bearer" + if !metadata.header_name.trim().is_empty() + && metadata + .header_name + .trim() .bytes() .all(|b| b.is_ascii_alphanumeric() || b"!#$%&'*+-.^_`|~".contains(&b)) => { - Ok(CredentialPlacement::Header(name.to_ascii_lowercase())) + CredentialPlacement::Header(metadata.header_name.trim().to_ascii_lowercase()) } - Some(Location::QueryParam(name)) - if !name.is_empty() && !name.chars().any(|c| c.is_control() || "&=#?".contains(c)) => + "query" + if !metadata.query_param.trim().is_empty() + && !metadata + .query_param + .chars() + .any(|c| c.is_control() || "&=#?".contains(c)) => { - Ok(CredentialPlacement::QueryParam(name)) + CredentialPlacement::QueryParam(metadata.query_param.trim().to_string()) } - Some(Location::PathTemplate(template)) - if template.starts_with('/') - && template.matches("{credential}").count() == 1 - && !template.chars().any(|c| c.is_control() || "?#".contains(c)) => + "path" + if metadata.path_template.starts_with('/') + && metadata.path_template.matches(CREDENTIAL_PATH_SLOT).count() == 1 + && !metadata + .path_template + .chars() + .any(|c| c.is_control() || "?#".contains(c)) => { - Ok(CredentialPlacement::PathTemplate(template)) + CredentialPlacement::PathTemplate(metadata.path_template.clone()) } - Some(Location::SigningOnly(true)) => Ok(CredentialPlacement::SigningOnly), - _ => Err(binding_error( - "static credential binding has missing or invalid credential placement", - )), - } + _ => { + return Err(binding_error( + "static credential placement metadata has an invalid request location", + )); + } + }; + Ok(placement) } fn compile_static_credential_endpoint( @@ -1151,15 +1206,10 @@ fn compile_static_credential_endpoint( fn static_credential_identities( bindings: &HashMap, -) -> HashMap<&str, (&str, &CredentialPlacement)> { +) -> HashMap<&str, &str> { bindings .iter() - .map(|(key, binding)| { - ( - key.as_str(), - (binding.credential_identity.as_str(), &binding.placement), - ) - }) + .map(|(key, binding)| (key.as_str(), binding.credential_identity.as_str())) .collect() } @@ -1195,25 +1245,18 @@ fn update_static_credential_identity_epochs( continue; } match epochs.get_mut(key) { - Some(epoch) - if epoch.credential_identity == binding.credential_identity - && epoch.placement == binding.placement => - { + Some(epoch) if epoch.identity == binding.credential_identity => { Arc::make_mut(&mut epoch.revisions).insert(revision); } Some(epoch) => { - epoch - .credential_identity - .clone_from(&binding.credential_identity); - epoch.placement.clone_from(&binding.placement); + epoch.identity.clone_from(&binding.credential_identity); epoch.revisions = Arc::new(HashSet::from([revision])); } None => { epochs.insert( key.clone(), StaticCredentialIdentityEpoch { - credential_identity: binding.credential_identity.clone(), - placement: binding.placement.clone(), + identity: binding.credential_identity.clone(), revisions: Arc::new(HashSet::from([revision])), }, ); @@ -1430,96 +1473,176 @@ mod tests { }], credential_identity: "provider-a:API_KEY".to_string(), workload_credential_handle: String::new(), - placement: Some(crate::proto::StaticCredentialPlacement { - location: Some( - crate::proto::static_credential_placement::Location::HeaderName( - "Authorization".into(), - ), - ), - }), } } + fn stable_binding(host: &str, port: u32, path: &str, handle: &str) -> StaticCredentialBinding { + let mut binding = binding(host, port, path); + binding.credential_identity = format!("refresh:{handle}"); + binding.workload_credential_handle = handle.to_string(); + binding + } + + fn placement_metadata(style: &str) -> HashMap { + HashMap::from([( + format!("{STATIC_CREDENTIAL_METADATA_PREFIX}API_KEY"), + crate::proto::ProviderProfileCredential { + name: "api_key".into(), + env_vars: vec!["API_KEY".into()], + auth_style: style.into(), + header_name: "Authorization".into(), + query_param: "api_key".into(), + path_template: "/v1/{credential}/events".into(), + ..Default::default() + }, + )]) + } + #[test] - fn missing_or_unknown_credential_placement_is_rejected() { - for placement in [ - None, - Some(crate::proto::StaticCredentialPlacement { location: None }), - Some(crate::proto::StaticCredentialPlacement { - location: Some( - crate::proto::static_credential_placement::Location::SigningOnly(false), - ), - }), - ] { - let mut metadata = binding("api.example.com", 443, "/**"); - metadata.placement = placement; + fn static_metadata_infers_locations_without_becoming_a_token_grant() { + for style in ["bearer", "header", "basic", "query", "path"] { + let state = ProviderCredentialState::from_bound_environment( + 7, + HashMap::from([("API_KEY".into(), "synthetic".into())]), + HashMap::new(), + placement_metadata(style), + HashMap::from([("API_KEY".into(), binding("api.example.com", 443, "/**"))]), + vec![], + ) + .unwrap(); + assert!(state.snapshot().dynamic_credentials.is_empty()); + let reference = state.snapshot().child_env["API_KEY"].clone(); + let resolver = state + .resolver_for_endpoint("api.example.com", 443, "/v1/chat") + .unwrap(); assert!( - ProviderCredentialState::from_bound_environment( - 1, - HashMap::from([("API_KEY".into(), "secret".into())]), - HashMap::new(), - HashMap::new(), - HashMap::from([("API_KEY".into(), metadata)]), - vec![] - ) - .is_err() + resolver + .rewrite_header_value_for_name("X-Reflect", &reference) + .is_err() + ); + let header = resolver.rewrite_header_value_for_name("Authorization", &reference); + let query = crate::secrets::rewrite_target_for_eval( + &format!("/v1/chat?api_key={reference}"), + &resolver, + ); + let path = crate::secrets::rewrite_target_for_eval( + &format!("/v1/{reference}/events"), + &resolver, + ); + assert_eq!( + header.is_ok(), + matches!(style, "bearer" | "header" | "basic") ); + assert_eq!(query.is_ok(), style == "query"); + assert_eq!(path.is_ok(), style == "path"); } } #[test] - fn changed_placement_revokes_old_revision_even_with_reused_identity() { - let original = binding("api.example.com", 443, "/**"); - let state = ProviderCredentialState::from_bound_environment( - 1, - HashMap::from([("API_KEY".into(), "secret".into())]), - HashMap::new(), - HashMap::new(), - HashMap::from([("API_KEY".into(), original.clone())]), - vec![], - ) - .unwrap(); - let old_token = state.snapshot().child_env["API_KEY"].clone(); - let mut replacement = original; - replacement.placement = Some(crate::proto::StaticCredentialPlacement { - location: Some( - crate::proto::static_credential_placement::Location::QueryParam("api_key".into()), - ), - }); - state - .install_bound_environment( - 2, - HashMap::from([("API_KEY".into(), "replacement".into())]), + fn malformed_static_metadata_revokes_static_material_and_preserves_real_grants() { + for malformed in 0..6 { + let state = ProviderCredentialState::from_bound_environment( + 7, + HashMap::from([("API_KEY".into(), "synthetic".into())]), HashMap::new(), HashMap::new(), - HashMap::from([("API_KEY".into(), replacement)]), + HashMap::from([("API_KEY".into(), binding("api.example.com", 443, "/**"))]), vec![], ) .unwrap(); - let resolver = state - .resolver_for_endpoint("api.example.com", 443, "/search") - .unwrap(); - let query = resolver.with_request_location( - crate::secrets::RequestCredentialLocation::QueryParam("api_key".into()), - ); - assert_eq!(query.resolve_placeholder(&old_token), None); - assert_eq!( - query.resolve_placeholder(&state.snapshot().child_env["API_KEY"]), - Some("replacement") - ); - assert!( - resolver - .rewrite_header_value_for_name("Authorization", &old_token) - .unwrap_err() - .is_placement_mismatch() - ); + let mut metadata = placement_metadata("header"); + let key = format!("{STATIC_CREDENTIAL_METADATA_PREFIX}API_KEY"); + let value = metadata.get_mut(&key).unwrap(); + match malformed { + 0 => value.env_vars = vec!["OTHER".into()], + 1 => { + value.token_grant = Some(crate::proto::ProviderCredentialTokenGrant::default()); + } + 2 => value.refresh = Some(crate::proto::ProviderCredentialRefresh::default()), + 3 => value.token_grant_owners = vec!["owner".into()], + 4 => value.auth_style = "unsupported".into(), + 5 => { + let value = metadata.remove(&key).unwrap(); + metadata.insert(format!("{STATIC_CREDENTIAL_METADATA_PREFIX}OTHER"), value); + } + _ => unreachable!(), + } + metadata.insert( + "real-grant".into(), + crate::proto::ProviderProfileCredential { + token_grant: Some(crate::proto::ProviderCredentialTokenGrant::default()), + ..Default::default() + }, + ); + assert!( + state + .install_bound_environment( + 8, + HashMap::from([("API_KEY".into(), "replacement".into())]), + HashMap::new(), + metadata, + HashMap::from([("API_KEY".into(), binding("api.example.com", 443, "/**"))]), + vec![], + ) + .is_err() + ); + assert!(state.snapshot().child_env.is_empty()); + assert_eq!(state.snapshot().dynamic_credentials.len(), 1); + assert!( + state + .snapshot() + .dynamic_credentials + .contains_key("real-grant") + ); + } } - fn stable_binding(host: &str, port: u32, path: &str, handle: &str) -> StaticCredentialBinding { - let mut binding = binding(host, port, path); - binding.credential_identity = format!("refresh:{handle}"); - binding.workload_credential_handle = handle.to_string(); - binding + #[test] + fn stable_references_survive_metadata_arrival_and_use_the_current_location() { + let handle = "a".repeat(64); + let bindings = HashMap::from([( + "API_KEY".into(), + stable_binding("api.example.com", 443, "/**", &handle), + )]); + let state = ProviderCredentialState::from_bound_environment_with_stable_placeholders( + 7, + HashMap::from([("API_KEY".into(), "synthetic".into())]), + HashMap::new(), + HashMap::new(), + bindings.clone(), + vec![], + vec!["API_KEY".into()], + ) + .unwrap(); + let reference = state.snapshot().child_env["API_KEY"].clone(); + for style in [None, Some("header"), Some("query"), None] { + state + .install_bound_environment_with_stable_placeholders( + 8, + HashMap::from([("API_KEY".into(), "synthetic".into())]), + HashMap::new(), + style.map_or_else(HashMap::new, placement_metadata), + bindings.clone(), + vec![], + vec!["API_KEY".into()], + ) + .unwrap(); + assert_eq!(state.snapshot().child_env["API_KEY"], reference); + let resolver = state + .resolver_for_endpoint("api.example.com", 443, "/v1/chat") + .unwrap(); + let query = crate::secrets::rewrite_target_for_eval( + &format!("/v1/chat?api_key={reference}"), + &resolver, + ); + assert_eq!(query.is_ok(), style != Some("header")); + assert_eq!( + resolver + .rewrite_header_value_for_name("Authorization", &reference) + .is_ok(), + style != Some("query") + ); + } } fn assert_binding_validation_error( @@ -1528,9 +1651,14 @@ mod tests { non_secret_environment_keys: Vec, expected: &str, ) { - let error = - compile_static_credential_bindings(&env, bindings, &non_secret_environment_keys, &[]) - .expect_err("malformed provider metadata must fail validation"); + let error = compile_static_credential_bindings( + &env, + bindings, + &non_secret_environment_keys, + &[], + &HashMap::new(), + ) + .expect_err("malformed provider metadata must fail validation"); assert_eq!(error.to_string(), expected); } @@ -1629,14 +1757,7 @@ mod tests { let allowed = state .resolver_for_endpoint("api.example.com", 443, "/v1/messages?stream=true") .expect("resolver"); - assert_eq!( - allowed - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder(placeholder), - Some("secret") - ); + assert_eq!(allowed.resolve_placeholder(placeholder), Some("secret")); for (host, port, path) in [ ("example.com", 443, "/v1/messages"), @@ -1647,7 +1768,7 @@ mod tests { .resolver_for_endpoint(host, port, path) .expect("resolver"); let error = denied - .rewrite_header_value_for_name("Authorization", placeholder) + .rewrite_header_value(placeholder) .expect_err("endpoint mismatch must fail closed"); assert!(error.is_endpoint_mismatch(), "{host}:{port}{path}"); } @@ -1686,28 +1807,16 @@ mod tests { .resolver_for_endpoint("tools.example.com", 443, "/mcp/local") .expect("endpoint resolver"); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder(&stable_placeholder), + resolver.resolve_placeholder(&stable_placeholder), Some("old") ); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:ORDINARY_TOKEN"), + resolver.resolve_placeholder("openshell:resolve:env:ORDINARY_TOKEN"), None, "ordinary endpoint-bound credentials remain revision scoped" ); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v1_ORDINARY_TOKEN"), + resolver.resolve_placeholder("openshell:resolve:env:v1_ORDINARY_TOKEN"), Some("ordinary") ); @@ -1735,28 +1844,16 @@ mod tests { .resolver_for_endpoint("tools.example.com", 443, "/mcp/local") .expect("refreshed endpoint resolver"); assert_eq!( - refreshed - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder(&stable_placeholder), + refreshed.resolve_placeholder(&stable_placeholder), Some("new") ); assert_eq!( - refreshed - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:EXTERNAL_ASSERTION"), + refreshed.resolve_placeholder("openshell:resolve:env:EXTERNAL_ASSERTION"), None, "an identityless current-name alias must remain unavailable" ); assert_eq!( - refreshed - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:ORDINARY_TOKEN"), + refreshed.resolve_placeholder("openshell:resolve:env:ORDINARY_TOKEN"), None ); @@ -1779,20 +1876,12 @@ mod tests { .resolver_for_endpoint("tools.example.com", 443, "/mcp/local") .expect("replacement endpoint resolver"); assert_eq!( - replacement - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder(&stable_placeholder), + replacement.resolve_placeholder(&stable_placeholder), None, "a placeholder issued for an earlier provider identity must be revoked" ); assert_eq!( - replacement - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder(&state.snapshot().child_env["EXTERNAL_ASSERTION"]), + replacement.resolve_placeholder(&state.snapshot().child_env["EXTERNAL_ASSERTION"]), Some("replacement") ); } @@ -1846,26 +1935,16 @@ mod tests { .resolver_for_endpoint("api.example.com", 443, "/v1/chat/completions") .expect("authorized endpoint resolver"); assert!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder(&original) + resolver.resolve_placeholder(&original) == Some(format!("synthetic-{revision}").as_str()) ); assert!( resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) .resolve_placeholder("openshell:resolve:env:API_KEY") .is_none() ); assert!( resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) .resolve_placeholder("openshell:resolve:env:v1_API_KEY") .is_none() ); @@ -1887,9 +1966,6 @@ mod tests { reconstructed .resolver_for_endpoint("api.example.com", 443, "/v1/chat/completions") .expect("reconstructed resolver") - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) .resolve_placeholder(&original) == Some("synthetic-13") ); @@ -1901,11 +1977,7 @@ mod tests { let resolver = reconstructed .resolver_for_endpoint(host, port, path) .expect("endpoint-scoped resolver"); - assert!( - resolver - .rewrite_header_value_for_name("Authorization", &original) - .is_err() - ); + assert!(resolver.rewrite_header_value(&original).is_err()); } // Current-value expiry must not fall back to a previously valid value. @@ -1923,14 +1995,7 @@ mod tests { let resolver = reconstructed .resolver_for_endpoint("api.example.com", 443, "/v1/chat/completions") .expect("expired resolver"); - assert!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder(&original) - .is_none() - ); + assert!(resolver.resolve_placeholder(&original).is_none()); // An activated detach removes the current binding and all authority for // a still-running process, even when it retains its original reference. @@ -1949,12 +2014,7 @@ mod tests { assert!( state .resolver_for_endpoint("api.example.com", 443, "/v1/chat/completions") - .is_none_or(|resolver| resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder(&original) - .is_none()) + .is_none_or(|resolver| resolver.resolve_placeholder(&original).is_none()) ); } @@ -2081,19 +2141,11 @@ mod tests { .resolver_for_endpoint("a.example.com", 443, "/a/check") .expect("endpoint A resolver"); assert_eq!( - resolver_a - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v7_KEY_A"), + resolver_a.resolve_placeholder("openshell:resolve:env:v7_KEY_A"), Some("secret-a") ); assert_eq!( - resolver_a - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v7_KEY_B"), + resolver_a.resolve_placeholder("openshell:resolve:env:v7_KEY_B"), None, "credential B must not resolve at endpoint A" ); @@ -2102,19 +2154,11 @@ mod tests { .resolver_for_endpoint("b.example.com", 443, "/b/check") .expect("endpoint B resolver"); assert_eq!( - resolver_b - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v7_KEY_B"), + resolver_b.resolve_placeholder("openshell:resolve:env:v7_KEY_B"), Some("secret-b") ); assert_eq!( - resolver_b - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v7_KEY_A"), + resolver_b.resolve_placeholder("openshell:resolve:env:v7_KEY_A"), None, "credential A must not resolve at endpoint B" ); @@ -2153,11 +2197,7 @@ mod tests { .resolver_for_endpoint("new.example.com", 443, "/v2/messages") .expect("replacement endpoint resolver"); assert_eq!( - replacement - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v2_API_KEY"), + replacement.resolve_placeholder("openshell:resolve:env:v2_API_KEY"), Some("new") ); @@ -2165,7 +2205,7 @@ mod tests { .resolver_for_endpoint("old.example.com", 443, "/v1/messages") .expect("restricted resolver"); let error = removed - .rewrite_header_value_for_name("Authorization", "openshell:resolve:env:v2_API_KEY") + .rewrite_header_value("openshell:resolve:env:v2_API_KEY") .expect_err("replaced endpoint binding must no longer authorize the credential"); assert!(error.is_endpoint_mismatch()); } @@ -2193,14 +2233,7 @@ mod tests { &format!("/bot{placeholder}/sendMessage?stream=true"), ) .expect("syntax-redacted path should select the binding"); - assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder(placeholder), - Some("secret") - ); + assert_eq!(resolver.resolve_placeholder(placeholder), Some("secret")); } #[test] @@ -2226,11 +2259,7 @@ mod tests { ) .expect("syntax-redacted alias path should select the binding"); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v7_API_KEY"), + resolver.resolve_placeholder("openshell:resolve:env:v7_API_KEY"), Some("secret") ); } @@ -2277,11 +2306,7 @@ mod tests { .resolver_for_endpoint("unrelated.example", 1234, "/") .expect("resolver"); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v3_GCP_PROJECT_ID"), + resolver.resolve_placeholder("openshell:resolve:env:v3_GCP_PROJECT_ID"), Some("project") ); } @@ -2336,11 +2361,7 @@ mod tests { .resolver_for_endpoint("api.example.com", 443, "/v1") .expect("resolver"); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v1_API_KEY"), + resolver.resolve_placeholder("openshell:resolve:env:v1_API_KEY"), Some("recovered"), "a metadata failure must not permanently strand placeholders from the same provider identity" ); @@ -2392,11 +2413,7 @@ mod tests { .resolver_for_endpoint("api.example.com", 443, "/v1") .expect("resolver"); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v1_API_KEY"), + resolver.resolve_placeholder("openshell:resolve:env:v1_API_KEY"), Some("new"), "the running process placeholder should recover against the current same-identity secret" ); @@ -2435,19 +2452,11 @@ mod tests { .resolver_for_endpoint("api.example.com", 443, "/v1") .expect("resolver"); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v1_API_KEY"), + resolver.resolve_placeholder("openshell:resolve:env:v1_API_KEY"), Some("old") ); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v2_API_KEY"), + resolver.resolve_placeholder("openshell:resolve:env:v2_API_KEY"), Some("new") ); } @@ -2478,9 +2487,6 @@ mod tests { state .resolver_for_endpoint("api.example.com", 443, "/v1") .expect("resolver") - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) .resolve_placeholder(&workload_placeholder), None, "the expired access token must fail closed" @@ -2489,10 +2495,7 @@ mod tests { state .resolver_for_endpoint("api.example.com", 443, "/v1") .expect("resolver") - .rewrite_header_value_for_name( - "Authorization", - &format!("Bearer {}", jwt_alias(&workload_placeholder)) - ) + .rewrite_header_value(&format!("Bearer {}", jwt_alias(&workload_placeholder))) .is_err(), "wrapping a placeholder must not bypass access-token expiry" ); @@ -2513,28 +2516,17 @@ mod tests { .resolver_for_endpoint("api.example.com", 443, "/v1") .expect("resolver"); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder(&workload_placeholder), + resolver.resolve_placeholder(&workload_placeholder), Some("current") ); assert_eq!( resolver - .rewrite_header_value_for_name( - "Authorization", - &format!("Bearer {}", jwt_alias(&workload_placeholder)) - ) + .rewrite_header_value(&format!("Bearer {}", jwt_alias(&workload_placeholder))) .expect("refresh updates the JWT alias"), Some("Bearer current".to_string()) ); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v2_API_KEY"), + resolver.resolve_placeholder("openshell:resolve:env:v2_API_KEY"), None, "refresh-managed credentials must not expose revision aliases" ); @@ -2576,9 +2568,6 @@ mod tests { state .resolver_for_endpoint("api.example.com", 443, "/v1") .expect("resolver") - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) .resolve_placeholder(&workload_placeholder), Some(token.as_str()) ); @@ -2611,9 +2600,6 @@ mod tests { reconstructed .resolver_for_endpoint("api.example.com", 443, "/v1") .expect("resolver") - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) .resolve_placeholder(&workload_placeholder), Some("token-14") ); @@ -2621,10 +2607,7 @@ mod tests { reconstructed .resolver_for_endpoint("api.example.com", 443, "/v1") .expect("resolver") - .rewrite_header_value_for_name( - "Authorization", - &format!("Bearer {}", jwt_alias(&workload_placeholder)) - ) + .rewrite_header_value(&format!("Bearer {}", jwt_alias(&workload_placeholder))) .expect("the JWT alias survives supervisor reconstruction"), Some("Bearer token-14".to_string()) ); @@ -2665,20 +2648,10 @@ mod tests { let current = state .resolver_for_endpoint("new.example.com", 443, "/v2/messages") .expect("current resolver"); - assert_eq!( - current - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder(&old_placeholder), - None - ); + assert_eq!(current.resolve_placeholder(&old_placeholder), None); assert!( current - .rewrite_header_value_for_name( - "Authorization", - &format!("Bearer {}", jwt_alias(&old_placeholder)) - ) + .rewrite_header_value(&format!("Bearer {}", jwt_alias(&old_placeholder))) .is_err(), "a JWT alias must not carry a revoked identity into the new epoch" ); @@ -2689,34 +2662,27 @@ mod tests { ] { assert!( current - .rewrite_header_value_for_name("Authorization", &format!("Bearer {alias}")) + .rewrite_header_value(&format!("Bearer {alias}")) .is_err(), "identityless and malformed JWT aliases must fail closed" ); } assert_eq!( - current - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder(&state.snapshot().child_env["API_KEY"]), + current.resolve_placeholder(&state.snapshot().child_env["API_KEY"]), Some("new") ); let wrong_endpoint = state .resolver_for_endpoint("old.example.com", 443, "/v1/messages") .expect("endpoint-scoped resolver"); let error = wrong_endpoint - .rewrite_header_value_for_name("Authorization", &state.snapshot().child_env["API_KEY"]) + .rewrite_header_value(&state.snapshot().child_env["API_KEY"]) .expect_err("new handle must not resolve at the old endpoint"); assert!(error.is_endpoint_mismatch()); let error = wrong_endpoint - .rewrite_header_value_for_name( - "Authorization", - &format!( - "Bearer {}", - jwt_alias(&state.snapshot().child_env["API_KEY"]) - ), - ) + .rewrite_header_value(&format!( + "Bearer {}", + jwt_alias(&state.snapshot().child_env["API_KEY"]) + )) .expect_err("JWT wrapping preserves endpoint authorization"); assert!(error.is_endpoint_mismatch()); } @@ -2761,11 +2727,7 @@ mod tests { .resolver_for_endpoint("api.example.com", 443, "/v2/inference") .expect("resolver"); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v50_API_KEY"), + resolver.resolve_placeholder("openshell:resolve:env:v50_API_KEY"), Some("secret-6"), "an aged-out placeholder may use the current secret across revisions in both numeric directions while its provider identity is unchanged" ); @@ -2807,50 +2769,35 @@ mod tests { .resolver_for_endpoint("b.example.com", 443, "/v1") .expect("resolver"); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder(&format!("openshell:resolve:env:v{}_API_KEY", u64::MAX)), + resolver.resolve_placeholder(&format!("openshell:resolve:env:v{}_API_KEY", u64::MAX)), None, "an opaque revision from another provider identity must fail closed even when it is numerically greater" ); assert!( resolver - .rewrite_header_value_for_name( - "Authorization", - &format!( - "Bearer {}", - jwt_alias(&format!("openshell:resolve:env:v{}_API_KEY", u64::MAX)) - ) - ) + .rewrite_header_value(&format!( + "Bearer {}", + jwt_alias(&format!("openshell:resolve:env:v{}_API_KEY", u64::MAX)) + )) .is_err(), "a JWT alias must not resolve a replacement provider's credential" ); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:API_KEY"), + resolver.resolve_placeholder("openshell:resolve:env:API_KEY"), None, "an identityless canonical placeholder must not resolve a replacement provider" ); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("vendor-OPENSHELL-RESOLVE-ENV-API_KEY"), + resolver.resolve_placeholder("vendor-OPENSHELL-RESOLVE-ENV-API_KEY"), None, "an identityless provider alias must not resolve a replacement provider" ); - assert!( + assert_eq!( resolver .resolve_current_env_key_checked("API_KEY", "trusted-transform") - .unwrap_err() - .is_placement_mismatch(), - "trusted signing cannot unwrap a header-bound credential" + .expect("binding authorizes the endpoint"), + Some("provider-b-secret"), + "trusted supervisor transforms may select the current bound credential by key" ); } @@ -2884,29 +2831,17 @@ mod tests { .resolver_for_endpoint("b.example.com", 443, "/v1") .expect("resolver"); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v1_API_KEY"), + resolver.resolve_placeholder("openshell:resolve:env:v1_API_KEY"), None, "a placeholder issued before detach must not resolve to a replacement provider" ); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:API_KEY"), + resolver.resolve_placeholder("openshell:resolve:env:API_KEY"), None, "an identityless canonical placeholder must not cross a failed refresh into a replacement identity" ); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("vendor-OPENSHELL-RESOLVE-ENV-API_KEY"), + resolver.resolve_placeholder("vendor-OPENSHELL-RESOLVE-ENV-API_KEY"), None, "an identityless provider alias must not cross a failed refresh into a replacement identity" ); @@ -2950,20 +2885,12 @@ mod tests { .resolver_for_endpoint("a.example.com", 443, "/v1") .expect("resolver"); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v1_API_KEY"), + resolver.resolve_placeholder("openshell:resolve:env:v1_API_KEY"), None, "a successful empty environment represents detach and must invalidate old membership" ); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v4_API_KEY"), + resolver.resolve_placeholder("openshell:resolve:env:v4_API_KEY"), Some("reattached") ); } @@ -2996,35 +2923,19 @@ mod tests { let resolver = state.resolver().expect("resolver"); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), + resolver.resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), Some("old") ); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v11_GITHUB_TOKEN"), + resolver.resolve_placeholder("openshell:resolve:env:v11_GITHUB_TOKEN"), Some("new") ); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:GITHUB_TOKEN"), + resolver.resolve_placeholder("openshell:resolve:env:GITHUB_TOKEN"), Some("new") ); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("provider-OPENSHELL-RESOLVE-ENV-GITHUB_TOKEN"), + resolver.resolve_placeholder("provider-OPENSHELL-RESOLVE-ENV-GITHUB_TOKEN"), Some("new") ); } @@ -3043,27 +2954,15 @@ mod tests { assert!(state.snapshot().child_env.is_empty()); let resolver = state.resolver().expect("old resolver retained"); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), + resolver.resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), Some("old") ); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:GITHUB_TOKEN"), + resolver.resolve_placeholder("openshell:resolve:env:GITHUB_TOKEN"), None ); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("provider-OPENSHELL-RESOLVE-ENV-GITHUB_TOKEN"), + resolver.resolve_placeholder("provider-OPENSHELL-RESOLVE-ENV-GITHUB_TOKEN"), None ); } @@ -3093,19 +2992,11 @@ mod tests { let resolver = state.resolver().expect("resolver"); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), + resolver.resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), None ); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v11_GITHUB_TOKEN"), + resolver.resolve_placeholder("openshell:resolve:env:v11_GITHUB_TOKEN"), Some("new") ); } @@ -3469,19 +3360,11 @@ mod tests { .resolver_for_endpoint("api.example.com", 443, "/") .unwrap(); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder(&old_placeholder), + resolver.resolve_placeholder(&old_placeholder), Some("first-secret") ); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder(&live.snapshot().child_env["API_KEY"]), + resolver.resolve_placeholder(&live.snapshot().child_env["API_KEY"]), Some("second-secret"), ); } @@ -3540,14 +3423,7 @@ mod tests { let resolver = observer .resolver_for_endpoint("api.example.com", 443, "/") .unwrap(); - assert!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder(&old_placeholder) - .is_none() - ); + assert!(resolver.resolve_placeholder(&old_placeholder).is_none()); } #[test] @@ -3712,11 +3588,7 @@ mod tests { let resolver = state.resolver().expect("resolver"); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), + resolver.resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), Some("new-19") ); } @@ -3741,11 +3613,7 @@ mod tests { let resolver = state.resolver().expect("retained resolver"); assert_eq!( - resolver - .with_request_location(crate::secrets::RequestCredentialLocation::Header( - "Authorization".into() - )) - .resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), + resolver.resolve_placeholder("openshell:resolve:env:v10_GITHUB_TOKEN"), None ); } diff --git a/crates/openshell-core/src/secrets.rs b/crates/openshell-core/src/secrets.rs index 235d04361c..6241186631 100644 --- a/crates/openshell-core/src/secrets.rs +++ b/crates/openshell-core/src/secrets.rs @@ -193,10 +193,11 @@ pub struct RewriteTargetResult { /// Credential-specific destinations authorized by the provider profile. #[derive(Debug, Clone, PartialEq, Eq)] pub enum CredentialPlacement { + /// Historical substitution behavior when no placement metadata is delivered. + Legacy, Header(String), QueryParam(String), PathTemplate(String), - SigningOnly, } /// The actual destination of a workload-provided credential placeholder. @@ -477,6 +478,13 @@ impl SecretResolver { return true; }; match (placement, self.request_location.as_ref()) { + (CredentialPlacement::Legacy, _) + | ( + CredentialPlacement::Header(_) + | CredentialPlacement::QueryParam(_) + | CredentialPlacement::PathTemplate(_), + Some(RequestCredentialLocation::Body | RequestCredentialLocation::WebSocket), + ) => true, ( CredentialPlacement::Header(expected), Some(RequestCredentialLocation::Header(actual)), @@ -604,16 +612,6 @@ impl SecretResolver { reason: UnresolvedPlaceholderReason::EndpointMismatch, }); } - if self - .placements - .get(key) - .is_some_and(|placement| !matches!(placement, CredentialPlacement::SigningOnly)) - { - return Err(UnresolvedPlaceholderError { - location, - reason: UnresolvedPlaceholderReason::PlacementMismatch, - }); - } let placeholder = placeholder_for_env_key(key); Ok(self .by_placeholder @@ -1667,17 +1665,17 @@ mod tests { .unwrap_err() .is_placement_mismatch() ); - assert!( + assert_eq!( resolver .rewrite_text_placeholders(&mut token.to_string(), "body") - .unwrap_err() - .is_placement_mismatch() + .unwrap(), + 1 ); - assert!( + assert_eq!( resolver .rewrite_websocket_text_placeholders(&mut token.to_string()) - .unwrap_err() - .is_placement_mismatch() + .unwrap(), + 1 ); assert!(resolver.resolve_placeholder(token).is_none()); let basic = base64::engine::general_purpose::STANDARD.encode(format!("user:{token}")); diff --git a/crates/openshell-core/src/secrets_body.rs b/crates/openshell-core/src/secrets_body.rs index 27e2e3fc94..c9464f8e50 100644 --- a/crates/openshell-core/src/secrets_body.rs +++ b/crates/openshell-core/src/secrets_body.rs @@ -352,13 +352,6 @@ mod tests { HashMap::from([( "KEY".into(), StaticCredentialBinding { - placement: Some(crate::proto::StaticCredentialPlacement { - location: Some( - crate::proto::static_credential_placement::Location::HeaderName( - "Authorization".into(), - ), - ), - }), credential_identity: "provider".into(), workload_credential_handle: handle, endpoints: vec![StaticCredentialEndpointBinding { diff --git a/crates/openshell-providers/src/profiles.rs b/crates/openshell-providers/src/profiles.rs index fa8ad7ef62..e289d4b80d 100644 --- a/crates/openshell-providers/src/profiles.rs +++ b/crates/openshell-providers/src/profiles.rs @@ -3936,13 +3936,6 @@ credentials: use openshell_core::provider_credentials::ProviderCredentialState; use openshell_core::secrets::body::BodyPlaceholderGuard; let binding = |profile: &ProviderTypeProfile| StaticCredentialBinding { - placement: Some(openshell_core::proto::StaticCredentialPlacement { - location: Some( - openshell_core::proto::static_credential_placement::Location::HeaderName( - profile.credentials[0].header_name.clone(), - ), - ), - }), credential_identity: profile.id.clone(), workload_credential_handle: String::new(), endpoints: profile diff --git a/crates/openshell-server/README.md b/crates/openshell-server/README.md index 68b661ab05..8f61d62116 100644 --- a/crates/openshell-server/README.md +++ b/crates/openshell-server/README.md @@ -20,15 +20,18 @@ authorize the new one. ## Static credential delivery -Provider environment entries carry placement from the owning credential's -profile declaration. The gateway withholds individual entries without usable -placement and reports `CredentialsWithheld`. Placement participates in both -ordinary credential identity and stable handle derivation, so changing it -revokes incompatible retained workload references. - -Polling supervisors must advertise placement enforcement before receiving static -material. Configuration push requires the same capability for the entire session; -older supervisors fall back to polling and its credential withholding checks. +Existing polling and configuration-push environments keep their original wire +shape, delivery behavior, identities, and stable-handle derivation. The gateway +adds placement-only `ProviderProfileCredential` entries to the existing runtime +credential map under `static-env:`, for actually delivered static keys. +Entries are matched to their owning provider binding and contain no token grant, +refresh configuration, or credential values. The supervisor infers enforcement +from the auth metadata; the gateway does not enforce placement. + +Older supervisors ignore entries without token grants. An older gateway omits +these entries, so newer supervisors retain legacy behavior. Metadata travels in +the same captured environment snapshot; no separate service, capability gate, +or additional lookup is needed. ## Operator credential export diff --git a/crates/openshell-server/src/config_delivery/mod.rs b/crates/openshell-server/src/config_delivery/mod.rs index cf5cc929c0..dbf5fe86d5 100644 --- a/crates/openshell-server/src/config_delivery/mod.rs +++ b/crates/openshell-server/src/config_delivery/mod.rs @@ -1735,34 +1735,24 @@ mod tests { #[tokio::test] async fn legacy_supervisor_keeps_polling_when_gateway_push_is_enabled() { - for features in [ - StreamFeatures::Legacy, - StreamFeatures::ApplyWithoutPlacement, - ] { - let state = push_state().await; - put_provider(&state, "github").await; - put_sandbox(&state, "legacy-sandbox", &["github"]).await; - let mut harness = connect_supervisor_stream(&state, "legacy-sandbox", features) + let state = push_state().await; + put_sandbox(&state, "legacy-sandbox", &[]).await; + let mut harness = + connect_supervisor_stream(&state, "legacy-sandbox", StreamFeatures::Legacy) .await .unwrap(); - let first = harness.inbound.message().await.unwrap().unwrap(); - let Some(gateway_message::Payload::SessionAccepted(accepted)) = first.payload else { - panic!("expected SessionAccepted"); - }; - assert!(!accepted.config_push_enabled); - assert!(accepted.bootstrap.is_none()); - assert!(!has_recipient(&state, "legacy-sandbox")); - // Rotating protected material must not deliver it later on this stream. - put_provider_with_token(&state, "github", Some("synthetic-rotated")).await; - publish_provider(&state, "default", "github"); - publish_sandbox(&state, "legacy-sandbox"); - publish_all_connected(&state); - assert!( - next_update(&mut harness, Duration::from_millis(100)) - .await - .is_none() - ); - } + let first = harness.inbound.message().await.unwrap().unwrap(); + let Some(gateway_message::Payload::SessionAccepted(accepted)) = first.payload else { + panic!("expected SessionAccepted"); + }; + assert!(accepted.bootstrap.is_none()); + publish_sandbox(&state, "legacy-sandbox"); + publish_all_connected(&state); + assert!( + next_update(&mut harness, Duration::from_millis(100)) + .await + .is_none() + ); } #[tokio::test] diff --git a/crates/openshell-server/src/grpc/mod.rs b/crates/openshell-server/src/grpc/mod.rs index 4e22a42c7b..0368025348 100644 --- a/crates/openshell-server/src/grpc/mod.rs +++ b/crates/openshell-server/src/grpc/mod.rs @@ -1021,8 +1021,6 @@ pub mod test_support { pub enum StreamFeatures { /// Predates streamed configuration and keeps polling. Legacy, - /// Supports config push but predates static credential placement. - ApplyWithoutPlacement, /// Applies and acknowledges streamed configuration. Apply, } @@ -1086,8 +1084,7 @@ pub mod test_support { payload: Some(supervisor_message::Payload::Hello(SupervisorHello { sandbox_id: sandbox_id.into(), instance_id: "instance".into(), - supports_config_push: features != StreamFeatures::Legacy, - supports_static_credential_placement: features == StreamFeatures::Apply, + supports_config_push: features == StreamFeatures::Apply, connection_epoch, supports_provider_readiness: false, redirected: false, diff --git a/crates/openshell-server/src/grpc/policy.rs b/crates/openshell-server/src/grpc/policy.rs index e2ea82822a..716e63f17a 100644 --- a/crates/openshell-server/src/grpc/policy.rs +++ b/crates/openshell-server/src/grpc/policy.rs @@ -3804,8 +3804,7 @@ pub(super) async fn handle_get_sandbox_provider_environment( request: Request, ) -> Result, Status> { let sandbox_id = request.get_ref().sandbox_id.clone(); - let supports_static_credential_bindings = request.get_ref().supports_static_credential_bindings - && request.get_ref().supports_static_credential_placement; + let supports_static_credential_bindings = request.get_ref().supports_static_credential_bindings; let supports_stable_placeholder_environment_keys = request .get_ref() .supports_stable_placeholder_environment_keys; @@ -4027,6 +4026,18 @@ pub async fn build_provider_environment_snapshot_from_inputs( .clear(); } + // Add request metadata only after token-grant owner composition and all + // static value filtering, so it describes this exact atomic snapshot. + let static_request_metadata = super::provider::static_credential_request_metadata( + &sandbox_id, + provider_profile_catalog, + provider_records, + &provider_environment, + )?; + provider_environment + .dynamic_credentials + .extend(static_request_metadata); + info!( sandbox_id = %sandbox_id, provider_count = provider_names.len(), @@ -12174,7 +12185,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-snapshot-consistency".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -12186,13 +12196,27 @@ mod tests { environment.provider_env_revision, second.provider_env_revision ); - assert_eq!(environment.dynamic_credentials.len(), 2); - assert!(environment.dynamic_credentials.values().all(|credential| { - credential - .token_grant - .as_ref() - .is_some_and(|grant| grant.token_endpoint.contains("revision-b")) - })); + let grants = environment + .dynamic_credentials + .values() + .filter_map(|credential| credential.token_grant.as_ref()) + .collect::>(); + assert_eq!(grants.len(), 2); + assert!( + grants + .iter() + .all(|grant| grant.token_endpoint.contains("revision-b")) + ); + assert!( + environment + .dynamic_credentials + .iter() + .filter(|(key, _)| key.starts_with( + openshell_core::provider_credentials::STATIC_CREDENTIAL_METADATA_PREFIX + )) + .all(|(_, credential)| credential.token_grant.is_none() + && credential.token_grant_owners.is_empty()) + ); handle_submit_policy_analysis( &state, @@ -14019,7 +14043,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-provider-env".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14033,7 +14056,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-provider-env".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14107,7 +14129,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-files-and-credentials".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: false, })), ) @@ -14156,7 +14177,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-static-ready".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: false, })), ) @@ -14211,29 +14231,24 @@ mod tests { .await .unwrap(); - for (supports_bindings, supports_placement) in - [(false, false), (true, false), (false, true)] - { - let response = handle_get_sandbox_provider_environment( - &state, - with_user(Request::new(GetSandboxProviderEnvironmentRequest { - sandbox_id: "sb-legacy-provider-env".to_string(), - supports_static_credential_bindings: supports_bindings, - supports_static_credential_placement: supports_placement, - supports_stable_placeholder_environment_keys: false, - })), - ) - .await - .unwrap() - .into_inner(); + let response = handle_get_sandbox_provider_environment( + &state, + with_user(Request::new(GetSandboxProviderEnvironmentRequest { + sandbox_id: "sb-legacy-provider-env".to_string(), + supports_static_credential_bindings: false, + supports_stable_placeholder_environment_keys: false, + })), + ) + .await + .unwrap() + .into_inner(); - assert!(!response.environment.contains_key("GITHUB_TOKEN")); - assert!(response.static_credential_bindings.is_empty()); - assert_eq!( - response.readiness_reason, - ProviderReadinessReason::UnsupportedSupervisor as i32 - ); - } + assert!(!response.environment.contains_key("GITHUB_TOKEN")); + assert!(response.static_credential_bindings.is_empty()); + assert_eq!( + response.readiness_reason, + ProviderReadinessReason::UnsupportedSupervisor as i32 + ); } #[tokio::test] @@ -14266,7 +14281,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-unbound-provider-env".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14320,8 +14334,6 @@ mod tests { credentials: vec![openshell_core::proto::ProviderProfileCredential { name: "cloud_token".to_string(), env_vars: vec!["CLOUD_TOKEN".to_string()], - auth_style: "bearer".to_string(), - header_name: "authorization".to_string(), stable_placeholder: true, ..Default::default() }], @@ -14384,7 +14396,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-policy-binding".to_string(), supports_static_credential_bindings: supports_bindings, - supports_static_credential_placement: supports_bindings, supports_stable_placeholder_environment_keys: supports_stable, })), ) @@ -14429,7 +14440,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-policy-binding".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14508,7 +14518,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-policy-binding".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14575,7 +14584,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-policy-binding".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14673,7 +14681,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-mixed-provider-env".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14783,7 +14790,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-token-exchange-subject".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14852,7 +14858,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-provider-revision".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -14893,7 +14898,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-provider-revision".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -15213,7 +15217,7 @@ mod tests { .static_credential_bindings .get("GITHUB_TOKEN") .map(|binding| binding.credential_identity.as_str()), - Some("provider-identity-a:GITHUB_TOKEN:0a0d617574686f72697a6174696f6e") + Some("provider-identity-a:GITHUB_TOKEN") ); assert_eq!(first_environment.dynamic_credentials.len(), 1); assert!( @@ -15255,7 +15259,7 @@ mod tests { .static_credential_bindings .get("GITHUB_TOKEN") .map(|binding| binding.credential_identity.as_str()), - Some("provider-identity-b:GITHUB_TOKEN:0a0d617574686f72697a6174696f6e") + Some("provider-identity-b:GITHUB_TOKEN") ); assert_eq!(replacement_environment.dynamic_credentials.len(), 1); assert!( @@ -15517,7 +15521,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-attach-lifecycle".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -15552,7 +15555,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-attach-lifecycle".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -15595,7 +15597,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-attach-lifecycle".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -15701,7 +15702,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-attach-lifecycle".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -15739,7 +15739,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-attach-lifecycle".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -15781,7 +15780,6 @@ mod tests { with_user(Request::new(GetSandboxProviderEnvironmentRequest { sandbox_id: "sb-attach-lifecycle".to_string(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, })), ) @@ -25520,7 +25518,6 @@ mod tests { non_member_request(GetSandboxProviderEnvironmentRequest { sandbox_id: "sandbox-other".into(), supports_static_credential_bindings: true, - supports_static_credential_placement: true, supports_stable_placeholder_environment_keys: true, }), ) diff --git a/crates/openshell-server/src/grpc/policy/endpoint_status_tests.rs b/crates/openshell-server/src/grpc/policy/endpoint_status_tests.rs index b4b76e0543..eb36132fa2 100644 --- a/crates/openshell-server/src/grpc/policy/endpoint_status_tests.rs +++ b/crates/openshell-server/src/grpc/policy/endpoint_status_tests.rs @@ -1947,7 +1947,6 @@ async fn replacement_reset_timeout_invalidates_superseded_evidence() { redirected: false, supports_session_redirect: false, supports_config_push: false, - supports_static_credential_placement: false, })), }; let error = gateway_client(Arc::clone(&state)) @@ -2022,7 +2021,6 @@ async fn replacement_reset_retry_does_not_hold_gateway_shutdown() { redirected: false, supports_session_redirect: false, supports_config_push: false, - supports_static_credential_placement: false, })), }; let error = gateway_client(Arc::clone(&state)) diff --git a/crates/openshell-server/src/grpc/provider.rs b/crates/openshell-server/src/grpc/provider.rs index 14d12d8e82..731d3d88b0 100644 --- a/crates/openshell-server/src/grpc/provider.rs +++ b/crates/openshell-server/src/grpc/provider.rs @@ -27,7 +27,7 @@ use openshell_core::proto::{ CredentialHandle, Provider, ProviderCredentialRefreshStrategy, ProviderCredentialTokenGrantAudienceOverride, ProviderCredentialTokenGrantType, ProviderProfile, ProviderProfileCredential, Sandbox, StaticCredentialBinding, - StaticCredentialEndpointBinding, StaticCredentialPlacement, static_credential_placement, + StaticCredentialEndpointBinding, }; use openshell_core::telemetry::{ LifecycleOperation, ProviderProfile as TelemetryProviderProfile, TelemetryOutcome, @@ -44,7 +44,6 @@ use super::{MAX_MAP_KEY_LEN, MAX_MAP_VALUE_LEN, MAX_PROVIDER_CONFIG_ENTRIES}; const GATEWAY_SPIFFE_WORKLOAD_API_SOCKET: &str = "OPENSHELL_GATEWAY_SPIFFE_WORKLOAD_API_SOCKET"; const EXTERNAL_STABLE_PLACEHOLDER_EPOCH: &str = "external-stable-placeholder-v1"; -const CREDENTIAL_PATH_SLOT: &str = "{credential}"; // --------------------------------------------------------------------------- // CRUD helpers @@ -1265,10 +1264,6 @@ pub(super) async fn resolve_provider_environment_from_records_with_policy_bindin }; let has_no_usable_endpoint = effective_endpoints.is_some_and(Vec::is_empty); let refresh_epochs = refresh_authorization_epochs_by_key(record)?; - let placements = profile - .as_ref() - .map(static_credential_placements) - .unwrap_or_default(); for (key, value) in &provider.credentials { if accepted_stored_credential_keys @@ -1309,13 +1304,6 @@ pub(super) async fn resolve_provider_environment_from_records_with_policy_bindin openshell_core::proto::ProviderReadinessReason::CredentialsWithheld; continue; } - let Some(placement) = placements.get(key) else { - warn!(provider_name = %name, key = %key, - "withholding credential: declare auth_style and its request location in the provider profile"); - readiness_reason = - openshell_core::proto::ProviderReadinessReason::CredentialsWithheld; - continue; - }; let expires_at_ms = provider .credential_expiration_times .get(key) @@ -1352,7 +1340,6 @@ pub(super) async fn resolve_provider_environment_from_records_with_policy_bindin record, key, endpoints, - placement, refresh_epochs.get(key).map(String::as_str), profile_stable_placeholder_keys.contains(key), ), @@ -1414,13 +1401,6 @@ pub(super) async fn resolve_provider_environment_from_records_with_policy_bindin openshell_core::proto::ProviderReadinessReason::CredentialsWithheld; continue; } - let Some(placement) = placements.get(&key) else { - warn!(provider_name = %name, key = %key, - "withholding credential: declare auth_style and its request location in the provider profile"); - readiness_reason = - openshell_core::proto::ProviderReadinessReason::CredentialsWithheld; - continue; - }; if let Some(expires_at_ms) = resolved_refs.expires_at_ms.get(&key).copied() { expires.entry(key.clone()).or_insert(expires_at_ms); } @@ -1439,7 +1419,6 @@ pub(super) async fn resolve_provider_environment_from_records_with_policy_bindin record, &key, endpoints, - placement, refresh_epochs.get(&key).map(String::as_str), profile_stable_placeholder_keys.contains(&key), ), @@ -1553,6 +1532,104 @@ pub(super) async fn resolve_provider_environment_from_records_with_policy_bindin }) } +/// Copy authored request metadata for static values that survived snapshot +/// filtering. The reserved namespace keeps it separate from endpoint token grants; +/// older supervisors ignore entries without `token_grant` before parsing selectors. +pub(super) fn static_credential_request_metadata( + sandbox_id: &str, + catalog: &EffectiveProviderProfileCatalog, + records: &[ProviderEnvironmentRecord], + environment: &ProviderEnvironment, +) -> Result, Status> { + use openshell_core::provider_credentials::STATIC_CREDENTIAL_METADATA_PREFIX; + let mut metadata = HashMap::new(); + for record in records { + let provider = &record.provider; + let Some(profile) = get_provider_type_profile_for_scope( + catalog, + &provider.r#type, + &provider.profile_workspace, + ) else { + continue; + }; + let refresh_epochs = refresh_authorization_epochs_by_key(record)?; + for credential in &profile.credentials { + if !has_usable_static_request_metadata( + &credential.auth_style, + &credential.header_name, + &credential.query_param, + &credential.path_template, + ) { + continue; + } + for key in credential.accepted_stored_keys() { + if !environment.environment.contains_key(key) + || !environment.static_credential_keys.contains(key) + { + continue; + } + let Some(baseline) = environment.static_credential_bindings.get(key) else { + continue; + }; + // A later optional declaration with the same environment key + // must not override metadata belonging to the actual owner. + let expected = static_credential_binding( + Some(sandbox_id), + record, + key, + &baseline.endpoints, + refresh_epochs.get(key).map(String::as_str), + credential.stable_placeholder, + ); + if expected != *baseline { + continue; + } + metadata.insert( + format!("{STATIC_CREDENTIAL_METADATA_PREFIX}{key}"), + ProviderProfileCredential { + name: credential.name.clone(), + env_vars: vec![key.to_string()], + auth_style: credential.auth_style.clone(), + header_name: credential.header_name.clone(), + query_param: credential.query_param.clone(), + path_template: credential.path_template.clone(), + ..Default::default() + }, + ); + } + } + } + Ok(metadata) +} + +const CREDENTIAL_PATH_SLOT: &str = "{credential}"; + +fn has_usable_static_request_metadata( + auth_style: &str, + header_name: &str, + query_param: &str, + path_template: &str, +) -> bool { + match auth_style.trim().to_ascii_lowercase().as_str() { + "basic" => true, + "header" | "bearer" => header_name.trim().parse::().is_ok(), + "query" => { + !query_param.trim().is_empty() + && !query_param + .chars() + .any(|c| c.is_control() || "&=#?".contains(c)) + } + "path" => { + path_template.starts_with('/') + && path_template.matches(CREDENTIAL_PATH_SLOT).count() == 1 + && !path_template + .chars() + .any(|c| c.is_control() || "?#".contains(c)) + } + _ => false, + } +} + fn refresh_authorization_epochs_by_key( record: &ProviderEnvironmentRecord, ) -> Result, Status> { @@ -1586,92 +1663,11 @@ fn refresh_authorization_epochs_by_key( Ok(epochs) } -/// Resolve only profile-declared request locations. Empty metadata never grants -/// permission to use an arbitrary HTTP location. AWS signing uses only the -/// canonical signer keys and an authoritative signing/STS declaration. -fn static_credential_placements( - profile: &ProviderTypeProfile, -) -> HashMap { - use static_credential_placement::Location; - let uses_signer = profile.endpoints.iter().any(|endpoint| { - matches!( - endpoint.credential_signing.as_str(), - "sigv4" | "sigv4:body" | "sigv4:no_body" - ) - }) || profile.credentials.iter().any(|credential| { - credential.refresh.as_ref().is_some_and(|refresh| { - refresh.strategy == ProviderCredentialRefreshStrategy::AwsStsAssumeRole - }) - }); - let mut placements = HashMap::new(); - for credential in &profile.credentials { - let location = match credential.auth_style.trim().to_ascii_lowercase().as_str() { - "basic" => Some(Location::HeaderName("authorization".into())), - "header" | "bearer" - if credential - .header_name - .trim() - .parse::() - .is_ok() => - { - Some(Location::HeaderName( - credential.header_name.trim().to_ascii_lowercase(), - )) - } - "query" - if !credential.query_param.trim().is_empty() - && !credential - .query_param - .chars() - .any(|c| c.is_control() || "&=#?".contains(c)) => - { - Some(Location::QueryParam(credential.query_param.trim().into())) - } - "path" - if credential.path_template.starts_with('/') - && credential - .path_template - .matches(CREDENTIAL_PATH_SLOT) - .count() - == 1 - && !credential - .path_template - .chars() - .any(|c| c.is_control() || "?#".contains(c)) => - { - Some(Location::PathTemplate(credential.path_template.clone())) - } - _ => None, - }; - for key in credential.accepted_stored_keys() { - let location = location.clone().or_else(|| { - (uses_signer - && credential.auth_style.trim().is_empty() - && matches!( - key, - "AWS_ACCESS_KEY_ID" | "AWS_SECRET_ACCESS_KEY" | "AWS_SESSION_TOKEN" - )) - .then_some(Location::SigningOnly(true)) - }); - if let Some(location) = location { - placements.insert( - key.to_string(), - StaticCredentialPlacement { - location: Some(location), - }, - ); - } - } - } - placements -} - fn static_credential_binding( sandbox_id: Option<&str>, record: &ProviderEnvironmentRecord, key: &str, endpoints: &[StaticCredentialEndpointBinding], - placement: &StaticCredentialPlacement, authorization_epoch: Option<&str>, stable_external_placeholder: bool, ) -> StaticCredentialBinding { @@ -1683,22 +1679,11 @@ fn static_credential_binding( let workload_credential_handle = sandbox_id .zip(handle_epoch) .map(|(sandbox_id, epoch)| { - derive_workload_credential_handle( - sandbox_id, - &record.object_id, - key, - epoch, - endpoints, - placement, - ) + derive_workload_credential_handle(sandbox_id, &record.object_id, key, epoch, endpoints) }) .unwrap_or_default(); let credential_identity = if workload_credential_handle.is_empty() { - format!( - "{}:{key}:{}", - record.object_id, - hex::encode(placement.encode_to_vec()) - ) + format!("{}:{key}", record.object_id) } else { format!("refresh:{workload_credential_handle}") }; @@ -1706,7 +1691,6 @@ fn static_credential_binding( endpoints: endpoints.to_vec(), credential_identity, workload_credential_handle, - placement: Some(placement.clone()), } } @@ -1716,7 +1700,6 @@ fn derive_workload_credential_handle( credential_key: &str, authorization_epoch: &str, endpoints: &[StaticCredentialEndpointBinding], - placement: &StaticCredentialPlacement, ) -> String { let mut endpoints = endpoints .iter() @@ -1742,7 +1725,6 @@ fn derive_workload_credential_handle( hash_handle_component(&mut hasher, provider_id.as_bytes()); hash_handle_component(&mut hasher, credential_key.as_bytes()); hash_handle_component(&mut hasher, authorization_epoch.as_bytes()); - hash_handle_component(&mut hasher, &placement.encode_to_vec()); for (host, port, path) in endpoints { hash_handle_component(&mut hasher, host.as_bytes()); hash_handle_component(&mut hasher, &port.to_le_bytes()); @@ -11034,19 +11016,10 @@ mod tests { ) .await .unwrap(); - assert!(!result.contains_key("API_TOKEN")); - assert!(!result.contains_key("SECONDARY")); - assert_eq!( - result.readiness_reason, - openshell_core::proto::ProviderReadinessReason::CredentialsWithheld - ); - let resolved = credentials - .resolve_provider_handles(&stored, crate::persistence::current_time_ms()) - .await - .unwrap(); + assert_eq!(result.get("API_TOKEN"), Some(&"rotated-token".to_string())); assert_eq!( - resolved.values.get("API_TOKEN").map(String::as_str), - Some("rotated-token") + result.get("SECONDARY"), + Some(&"secondary-token".to_string()) ); } @@ -12290,206 +12263,94 @@ mod tests { } #[tokio::test] - async fn missing_placement_withholds_only_the_affected_credential() { + async fn static_request_metadata_is_minimal_owner_bound_and_tracks_delivered_values() { + use openshell_core::provider_credentials::STATIC_CREDENTIAL_METADATA_PREFIX; let store = test_store().await; - let mut profile = custom_profile("partial-placement"); - profile.credentials = vec![ - ProviderProfileCredential { - name: "configured".into(), - env_vars: vec!["CONFIGURED".into()], - auth_style: "header".into(), - header_name: "x-api-key".into(), - ..Default::default() - }, - ProviderProfileCredential { - name: "unconfigured".into(), - env_vars: vec!["UNCONFIGURED".into()], - ..Default::default() - }, - ]; - profile.endpoints = vec![NetworkEndpoint { + let mut owned = custom_profile("metadata-owner"); + owned.credentials = vec![static_credential("token", "TOKEN", true)]; + owned.endpoints = vec![NetworkEndpoint { host: "api.example.com".into(), port: 443, protocol: "rest".into(), access: openshell_core::proto::NetworkAccessPreset::Full as i32, ..Default::default() }]; - let sources = ProviderProfileSources::from_test_profiles(vec![profile]); + let mut optional = owned.clone(); + optional.id = "metadata-optional".into(); + optional.credentials[0].required = false; + optional.credentials[0].header_name = "x-wrong-owner".into(); + let sources = ProviderProfileSources::from_test_profiles(vec![owned, optional]); let catalog = sources.snapshot_catalog(&store, "default").await.unwrap(); - let mut provider = provider_with_credential_value( - "partial", - "partial-placement", - "CONFIGURED", - "synthetic-a", - ); - provider - .credentials - .insert("UNCONFIGURED".into(), "synthetic-b".into()); - create_provider_record_with_catalog(&store, &catalog, "default", provider) - .await - .unwrap(); - let records = load_provider_environment_records(&store, "default", &["partial".into()]) - .await - .unwrap(); - let result = resolve_provider_environment_from_records_with_policy_bindings( - &catalog, - &records, - &HashMap::new(), - ) - .await - .unwrap(); - assert_eq!( - result.get("CONFIGURED").map(String::as_str), - Some("synthetic-a") - ); - assert!(result.static_credential_bindings.contains_key("CONFIGURED")); - assert!(!result.contains_key("UNCONFIGURED")); - assert!(!result.static_credential_keys.contains("UNCONFIGURED")); - assert!( - !result - .static_credential_bindings - .contains_key("UNCONFIGURED") - ); - assert_eq!( - result.readiness_reason, - openshell_core::proto::ProviderReadinessReason::CredentialsWithheld - ); - } - - #[test] - fn static_placement_uses_explicit_locations_and_canonical_signer_roles() { - use static_credential_placement::Location; - let mut profile = custom_profile("placements"); - profile.credentials = [ - ("HEADER", "header", "X-Api-Key", "", ""), - ("BASIC", "basic", "", "", ""), - ("QUERY", "query", "", "access_token", ""), - ("PATH", "path", "", "", "/v1/{credential}/events"), - ("MISSING", "", "", "", ""), - ("UNKNOWN", "future", "", "", ""), - ("AWS_ACCESS_KEY_ID", "", "", "", ""), - ("AWS_SECRET_ACCESS_KEY", "", "", "", ""), - ("UNRELATED", "", "", "", ""), - ] - .into_iter() - .map( - |(key, style, header, query, path)| ProviderProfileCredential { - name: key.to_ascii_lowercase(), - env_vars: vec![key.into()], - auth_style: style.into(), - header_name: header.into(), - query_param: query.into(), - path_template: path.into(), + let record = |name: &str, id: &str, profile: &str| ProviderEnvironmentRecord { + name: name.into(), + object_id: id.into(), + resource_version: 1, + provider: Provider { + r#type: profile.into(), + profile_workspace: "default".into(), ..Default::default() }, - ) - .collect(); - profile.credentials.push(ProviderProfileCredential { - name: "LOGICAL_KEY".into(), - auth_style: "header".into(), - header_name: "x-logical".into(), - ..Default::default() - }); - let locations = static_credential_placements(&ProviderTypeProfile::from_proto(&profile)); - assert_eq!( - locations["LOGICAL_KEY"].location, - Some(Location::HeaderName("x-logical".into())) - ); - assert_eq!( - locations["HEADER"].location, - Some(Location::HeaderName("x-api-key".into())) - ); - assert_eq!( - locations["BASIC"].location, - Some(Location::HeaderName("authorization".into())) - ); - assert_eq!( - locations["QUERY"].location, - Some(Location::QueryParam("access_token".into())) - ); - assert_eq!( - locations["PATH"].location, - Some(Location::PathTemplate("/v1/{credential}/events".into())) - ); - for key in ["MISSING", "UNKNOWN", "AWS_ACCESS_KEY_ID", "UNRELATED"] { - assert!(!locations.contains_key(key)); - } - profile.endpoints = vec![NetworkEndpoint { - host: "s3.amazonaws.com".into(), - credential_signing: "sigv4".into(), - ..Default::default() - }]; - for signing in ["sigv4", "sigv4:body", "sigv4:no_body"] { - profile.endpoints[0].credential_signing = signing.into(); - let signed = static_credential_placements(&ProviderTypeProfile::from_proto(&profile)); - assert_eq!( - signed["AWS_ACCESS_KEY_ID"].location, - Some(Location::SigningOnly(true)) - ); - assert_eq!( - signed["AWS_SECRET_ACCESS_KEY"].location, - Some(Location::SigningOnly(true)) - ); - assert!(!signed.contains_key("UNRELATED")); - assert!(!signed.contains_key("MISSING")); - } - } - - #[test] - fn changing_placement_revokes_workload_handles_and_credential_identity() { - let record = ProviderEnvironmentRecord { - name: "provider".into(), - object_id: "provider-a".into(), - resource_version: 1, - provider: Provider::default(), refresh_states: Vec::new(), }; + let mut records = [ + record("owner", "owner-id", "metadata-owner"), + record("optional", "optional-id", "metadata-optional"), + ]; + records[0] + .provider + .credentials + .insert("TOKEN".into(), "synthetic-sensitive-token".into()); let endpoints = vec![StaticCredentialEndpointBinding { host: "api.example.com".into(), port: 443, path: "/**".into(), }]; - let header = authorization_placement(); - let query = StaticCredentialPlacement { - location: Some(static_credential_placement::Location::QueryParam( - "api_key".into(), - )), + let baseline = static_credential_binding( + Some("sandbox"), + &records[0], + "TOKEN", + &endpoints, + None, + false, + ); + let mut environment = ProviderEnvironment { + environment: HashMap::from([("TOKEN".into(), "synthetic-sensitive-token".into())]), + static_credential_keys: HashSet::from(["TOKEN".into()]), + static_credential_bindings: HashMap::from([("TOKEN".into(), baseline.clone())]), + ..Default::default() }; - for stable in [false, true] { - let old = static_credential_binding( - Some("sandbox"), - &record, - "KEY", - &endpoints, - &header, - None, - stable, - ); - let new = static_credential_binding( - Some("sandbox"), - &record, - "KEY", - &endpoints, - &query, - None, - stable, - ); - assert_ne!(old.credential_identity, new.credential_identity); - if stable { - assert_ne!( - old.workload_credential_handle, - new.workload_credential_handle - ); + let metadata = + static_credential_request_metadata("sandbox", &catalog, &records, &environment) + .unwrap(); + let key = format!("{STATIC_CREDENTIAL_METADATA_PREFIX}TOKEN"); + assert_eq!(metadata.len(), 1); + assert_eq!( + metadata[&key], + ProviderProfileCredential { + name: "token".into(), + env_vars: vec!["TOKEN".into()], + auth_style: "bearer".into(), + header_name: "authorization".into(), + ..Default::default() } - } - } - - fn authorization_placement() -> StaticCredentialPlacement { - StaticCredentialPlacement { - location: Some(static_credential_placement::Location::HeaderName( - "authorization".into(), - )), - } + ); + assert_eq!( + environment.static_credential_bindings["TOKEN"], baseline, + "legacy handles and identities must not change" + ); + let encoded = metadata[&key].encode_to_vec(); + assert!( + !encoded + .windows(b"synthetic-sensitive-token".len()) + .any(|window| window == b"synthetic-sensitive-token") + ); + environment.environment.remove("TOKEN"); + assert!( + static_credential_request_metadata("sandbox", &catalog, &records, &environment) + .unwrap() + .is_empty(), + "expired or withheld material must not leave request metadata behind" + ); } #[test] @@ -12508,15 +12369,7 @@ mod tests { }]; let external_binding = |sandbox, record: &ProviderEnvironmentRecord, key, endpoints: &[_]| { - static_credential_binding( - Some(sandbox), - record, - key, - endpoints, - &authorization_placement(), - None, - true, - ) + static_credential_binding(Some(sandbox), record, key, endpoints, None, true) }; let initial = external_binding("sandbox-a", &record, "API_KEY", &endpoints); assert!(!initial.workload_credential_handle.is_empty()); @@ -12553,17 +12406,9 @@ mod tests { "recreating the same provider name must revoke the original handle" ); assert!( - static_credential_binding( - None, - &record, - "API_KEY", - &endpoints, - &authorization_placement(), - None, - true - ) - .workload_credential_handle - .is_empty(), + static_credential_binding(None, &record, "API_KEY", &endpoints, None, true) + .workload_credential_handle + .is_empty(), "an external handle requires an authenticated sandbox binding" ); } @@ -12590,7 +12435,6 @@ mod tests { "ACCESS_TOKEN", "epoch-a", &endpoints, - &authorization_placement(), ); assert_eq!( first, @@ -12600,7 +12444,6 @@ mod tests { "ACCESS_TOKEN", "epoch-a", &reordered, - &authorization_placement(), ) ); for changed in [ @@ -12610,7 +12453,6 @@ mod tests { "ACCESS_TOKEN", "epoch-a", &endpoints, - &authorization_placement(), ), derive_workload_credential_handle( "sandbox-a", @@ -12618,7 +12460,6 @@ mod tests { "ACCESS_TOKEN", "epoch-a", &endpoints, - &authorization_placement(), ), derive_workload_credential_handle( "sandbox-a", @@ -12626,7 +12467,6 @@ mod tests { "OTHER_TOKEN", "epoch-a", &endpoints, - &authorization_placement(), ), derive_workload_credential_handle( "sandbox-a", @@ -12634,7 +12474,6 @@ mod tests { "ACCESS_TOKEN", "epoch-b", &endpoints, - &authorization_placement(), ), derive_workload_credential_handle( "sandbox-a", @@ -12646,7 +12485,6 @@ mod tests { port: 443, path: "/v2/**".to_string(), }], - &authorization_placement(), ), ] { assert_ne!(first, changed); @@ -12831,9 +12669,6 @@ mod tests { credential_state .resolver_for_endpoint("api.example.com", 443, "/v1/messages") .unwrap() - .with_request_location(openshell_core::secrets::RequestCredentialLocation::Header( - "authorization".into() - )) .resolve_placeholder(&original_placeholder), Some("token-1") ); @@ -12889,9 +12724,6 @@ mod tests { credential_state .resolver_for_endpoint("api.example.com", 443, "/v1/messages") .unwrap() - .with_request_location(openshell_core::secrets::RequestCredentialLocation::Header( - "authorization".into() - )) .resolve_placeholder(&original_placeholder), Some("token-2") ); @@ -12909,9 +12741,6 @@ mod tests { reconstructed .resolver_for_endpoint("api.example.com", 443, "/v1/messages") .unwrap() - .with_request_location(openshell_core::secrets::RequestCredentialLocation::Header( - "authorization".into() - )) .resolve_placeholder(&original_placeholder), Some("token-2") ); @@ -12958,9 +12787,6 @@ mod tests { credential_state .resolver_for_endpoint("api.example.com", 443, "/v1/messages") .unwrap() - .with_request_location(openshell_core::secrets::RequestCredentialLocation::Header( - "authorization".into() - )) .resolve_placeholder(&original_placeholder), None ); @@ -13414,7 +13240,7 @@ mod tests { } #[tokio::test] - async fn resolve_provider_env_withholds_static_provider_without_profile() { + async fn resolve_provider_env_allows_static_provider_without_profile() { let store = test_store().await; create_provider_record( &store, @@ -13429,12 +13255,7 @@ mod tests { .await .unwrap(); - assert!(!result.contains_key("API_TOKEN")); - assert!(!result.contains_key("SECONDARY")); - assert_eq!( - result.readiness_reason, - openshell_core::proto::ProviderReadinessReason::CredentialsWithheld - ); + assert_eq!(result.get("API_TOKEN"), Some(&"token-123".to_string())); assert!(result.dynamic_credentials.is_empty()); assert!(!result.static_credential_bindings.contains_key("API_TOKEN")); } @@ -13569,37 +13390,9 @@ mod tests { assert!(result.expired_static_keys.contains("GITHUB_TOKEN")); } - async fn store_static_test_profile(store: &Store, keys: &[&str]) { - let mut profile = custom_profile("test"); - profile.credentials = keys - .iter() - .map(|key| static_credential(&key.to_ascii_lowercase(), key, false)) - .collect(); - profile.endpoints = vec![NetworkEndpoint { - host: "api.example.com".into(), - port: 443, - protocol: "rest".into(), - access: openshell_core::proto::NetworkAccessPreset::Full as i32, - ..Default::default() - }]; - store - .put_message(&StoredProviderProfile { - metadata: Some(openshell_core::proto::datamodel::v1::ObjectMeta { - id: "test-profile".into(), - name: "test".into(), - workspace: "default".into(), - ..Default::default() - }), - profile: Some(profile), - }) - .await - .unwrap(); - } - #[tokio::test] async fn resolve_provider_env_skips_expired_credentials_and_returns_expiry_metadata() { let store = test_store().await; - store_static_test_profile(&store, &["FRESH_TOKEN", "STALE_TOKEN", "EPOCH_TOKEN"]).await; let now_ms = crate::persistence::current_time_ms(); let provider = Provider { metadata: Some(openshell_core::proto::datamodel::v1::ObjectMeta { @@ -13665,7 +13458,6 @@ mod tests { #[tokio::test] async fn resolve_provider_env_skips_invalid_credential_keys() { let store = test_store().await; - store_static_test_profile(&store, &["VALID_KEY"]).await; let provider = Provider { metadata: Some(openshell_core::proto::datamodel::v1::ObjectMeta { id: String::new(), @@ -13720,7 +13512,7 @@ mod tests { workspace: "default".to_string(), deletion_time: None, }), - r#type: "anthropic".to_string(), + r#type: "claude".to_string(), credentials: std::iter::once(( "ANTHROPIC_API_KEY".to_string(), "sk-abc".to_string(), @@ -13740,7 +13532,7 @@ mod tests { Provider { metadata: Some(openshell_core::proto::datamodel::v1::ObjectMeta { id: String::new(), - name: "github-local".to_string(), + name: "gitlab-local".to_string(), created_time: None, labels: HashMap::new(), resource_version: 0, @@ -13748,12 +13540,9 @@ mod tests { workspace: "default".to_string(), deletion_time: None, }), - r#type: "github".to_string(), - credentials: std::iter::once(( - "GITHUB_TOKEN".to_string(), - "synthetic-github-token".to_string(), - )) - .collect(), + r#type: "gitlab".to_string(), + credentials: std::iter::once(("GITLAB_TOKEN".to_string(), "glpat-xyz".to_string())) + .collect(), config: HashMap::new(), credential_expiration_times: HashMap::new(), profile_workspace: "default".to_string(), @@ -13766,15 +13555,12 @@ mod tests { let result = resolve_provider_environment( &store, "default", - &["claude-local".to_string(), "github-local".to_string()], + &["claude-local".to_string(), "gitlab-local".to_string()], ) .await .unwrap(); assert_eq!(result.get("ANTHROPIC_API_KEY"), Some(&"sk-abc".to_string())); - assert_eq!( - result.get("GITHUB_TOKEN"), - Some(&"synthetic-github-token".to_string()) - ); + assert_eq!(result.get("GITLAB_TOKEN"), Some(&"glpat-xyz".to_string())); } #[tokio::test] @@ -14528,7 +14314,7 @@ mod tests { workspace: "default".to_string(), deletion_time: None, }), - r#type: "anthropic".to_string(), + r#type: "claude".to_string(), credentials: std::iter::once(( "ANTHROPIC_API_KEY".to_string(), "sk-test".to_string(), diff --git a/crates/openshell-server/src/grpc/provider_readiness_tests.rs b/crates/openshell-server/src/grpc/provider_readiness_tests.rs index 060103b943..c046b320dd 100644 --- a/crates/openshell-server/src/grpc/provider_readiness_tests.rs +++ b/crates/openshell-server/src/grpc/provider_readiness_tests.rs @@ -73,7 +73,6 @@ fn hello() -> SupervisorHello { connection_epoch: 0, supports_provider_readiness: true, supports_config_push: false, - supports_static_credential_placement: false, redirected: false, supports_session_redirect: true, } diff --git a/crates/openshell-server/src/storage_proto.rs b/crates/openshell-server/src/storage_proto.rs index 86c79701f2..3b902df1f9 100644 --- a/crates/openshell-server/src/storage_proto.rs +++ b/crates/openshell-server/src/storage_proto.rs @@ -156,10 +156,8 @@ mod tests { // Sandbox-wide grant reporting adds TokenGrantFailureObservation to both // closures and TokenGrantStatus to public reports. Older rows have no grant // record; absent report extensions retain compatibility without a rewrite. - // Static credential placement adds one public-only message and negotiated - // capabilities. Durable provider schemas and their closure are unchanged. const PUBLIC_RPC_SCHEMA_SHA256: &str = - "044707c72ea20c4fe564ac7af51d9f075a49ea3fef7c8e639d283accf5936a7e"; + "a91e2244a2c1a8e369efe85bd0e4f2769f0f29f6263137280fe38e8a8da3cc6e"; const DURABLE_SCHEMA_SHA256: &str = "d4dc7abdb91b919db1f7be0d4652e30cbfda86f3b2ed9b59d5de1f76a2bf691d"; const PUBLIC_DURABLE_OVERLAP_SHA256: &str = @@ -697,7 +695,7 @@ mod tests { overlap_hash.as_str(), ), ( - (329, 29), + (328, 29), (95, 22), (83, 22), PUBLIC_RPC_SCHEMA_SHA256, diff --git a/crates/openshell-server/src/supervisor_session.rs b/crates/openshell-server/src/supervisor_session.rs index ee446e1692..a0fb2654be 100644 --- a/crates/openshell-server/src/supervisor_session.rs +++ b/crates/openshell-server/src/supervisor_session.rs @@ -2449,13 +2449,6 @@ async fn accept_supervisor_session(setup: SessionSetup) -> Result<(), Status> { Ok(()) } -// A pushed session reuses its capability for its entire lifetime, including -// bootstrap and subsequent credential refreshes. Older supervisors are accepted -// in polling mode, whose request capability gates all static credential values. -fn supports_protected_config_push(hello: &SupervisorHello) -> bool { - hello.supports_config_push && hello.supports_static_credential_placement -} - pub async fn handle_connect_supervisor( state: &Arc, request: Request>, @@ -2488,7 +2481,7 @@ pub async fn handle_connect_supervisor( // apply it; the rest keep polling. let pushes_config = state.config.config_delivery_mode == openshell_core::config::ConfigDeliveryMode::Push - && supports_protected_config_push(&hello); + && hello.supports_config_push; let mode = if pushes_config { SessionMode::Push } else { @@ -5482,23 +5475,6 @@ mod tests { } } - #[test] - fn static_placement_capability_gates_the_entire_push_session() { - for supports_push in [false, true] { - for supports_placement in [false, true] { - let hello = SupervisorHello { - supports_config_push: supports_push, - supports_static_credential_placement: supports_placement, - ..Default::default() - }; - assert_eq!( - supports_protected_config_push(&hello), - supports_push && supports_placement - ); - } - } - } - #[test] fn redirected_supervisors_are_only_bounced_by_a_shutting_down_replica() { let hello = |redirected| SupervisorHello { diff --git a/crates/openshell-supervisor-network/README.md b/crates/openshell-supervisor-network/README.md index 170cd86f21..81f59cf306 100644 --- a/crates/openshell-supervisor-network/README.md +++ b/crates/openshell-supervisor-network/README.md @@ -29,10 +29,10 @@ several instances serves `/v1/denials` from a per-instance ## Static credential placement -Static credential substitution checks the credential's declared request location -before writing upstream. HTTP placement violations return a safe 403 response; +When placement metadata is available, substitution checks the declared request +location before writing upstream. HTTP placement violations return a safe 403 response; WebSocket violations close the connection with policy denial. Both paths emit a domain event and a detection finding without credential values or placeholders. -Body and WebSocket rewrite flags do not override static placement. SigV4 signing -uses the endpoint-scoped resolver's trusted signing-only access instead of a -workload-selected request location. +Legacy credentials preserve endpoint-scoped rewriting. Explicit body and WebSocket +rewrite flags authorize those locations for ordinary static credentials. SigV4 +signing retains the endpoint-scoped resolver's existing trusted access. diff --git a/crates/openshell-supervisor-network/src/google_cloud_metadata.rs b/crates/openshell-supervisor-network/src/google_cloud_metadata.rs index b38f428a34..988f8073aa 100644 --- a/crates/openshell-supervisor-network/src/google_cloud_metadata.rs +++ b/crates/openshell-supervisor-network/src/google_cloud_metadata.rs @@ -356,13 +356,6 @@ mod tests { }], credential_identity: "test-google:token".into(), workload_credential_handle: String::new(), - placement: Some(openshell_core::proto::StaticCredentialPlacement { - location: Some( - openshell_core::proto::static_credential_placement::Location::HeaderName( - "Authorization".into(), - ), - ), - }), } } diff --git a/crates/openshell-supervisor-network/src/l7/relay.rs b/crates/openshell-supervisor-network/src/l7/relay.rs index 9358627132..56ec88f0f6 100644 --- a/crates/openshell-supervisor-network/src/l7/relay.rs +++ b/crates/openshell-supervisor-network/src/l7/relay.rs @@ -1910,9 +1910,13 @@ where assembly_budget, resolver, generation_guard: options.generation_guard, - provider_credentials: options - .ctx - .and_then(|ctx| ctx.provider_credentials.as_ref()), + provider_credentials: if options.websocket.credential_rewrite { + options + .ctx + .and_then(|ctx| ctx.provider_credentials.as_ref()) + } else { + None + }, target: &options.target, inspector, compression, @@ -3999,13 +4003,6 @@ mod tests { }], credential_identity: identity.to_string(), workload_credential_handle: String::new(), - placement: Some(openshell_core::proto::StaticCredentialPlacement { - location: Some( - openshell_core::proto::static_credential_placement::Location::HeaderName( - "Authorization".into(), - ), - ), - }), } } @@ -4337,13 +4334,204 @@ mod tests { 1, TestHashMap::from([("API_TOKEN".into(), "synthetic-private-token".into())]), TestHashMap::new(), - TestHashMap::new(), + crate::test_support::header_placement_metadata(&["API_TOKEN"]), TestHashMap::from([("API_TOKEN".into(), endpoint_binding("provider:API_TOKEN"))]), Vec::new(), ) .expect("bound placement fixture") } + #[tokio::test] + async fn mixed_legacy_and_strict_credentials_preserve_opt_in_body_and_query_rewriting() { + let legacy_binding = endpoint_binding("provider:LEGACY_TOKEN"); + let state = ProviderCredentialState::from_bound_environment( + 1, + TestHashMap::from([ + ("STRICT_TOKEN".into(), "strict-private-token".into()), + ("LEGACY_TOKEN".into(), "legacy-private-token".into()), + ]), + TestHashMap::new(), + crate::test_support::header_placement_metadata(&["STRICT_TOKEN"]), + TestHashMap::from([ + ( + "STRICT_TOKEN".into(), + endpoint_binding("provider:STRICT_TOKEN"), + ), + ("LEGACY_TOKEN".into(), legacy_binding), + ]), + Vec::new(), + ) + .expect("mixed placement fixture"); + let snapshot = state.snapshot(); + let strict = &snapshot.child_env["STRICT_TOKEN"]; + let legacy = &snapshot.child_env["LEGACY_TOKEN"]; + let resolver = state + .resolver_for_endpoint("allowed.example.test", 443, "/allowed/search") + .unwrap(); + let body = format!("legacy={legacy}&strict={strict}"); + let target = format!("/allowed/search?probe={legacy}"); + let raw = format!( + "POST {target} HTTP/1.1\r\nHost: allowed.example.test\r\nAuthorization: token {strict}\r\nX-Legacy: {legacy}\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: {}\r\n\r\n{body}", + body.len() + ); + let request = crate::l7::rest::request_from_buffered_http( + "POST", + "/allowed/search", + &target, + raw.into_bytes(), + ) + .unwrap(); + let (mut _app, mut client) = tokio::io::duplex(8192); + let (mut upstream, mut service) = tokio::io::duplex(8192); + let service_task = tokio::spawn(async move { + let mut bytes = Vec::new(); + loop { + let mut byte = [0]; + service.read_exact(&mut byte).await.unwrap(); + bytes.push(byte[0]); + if bytes.ends_with(b"\r\n\r\n") { + break; + } + } + let headers = String::from_utf8(bytes).unwrap(); + let length = headers + .lines() + .find_map(|line| { + let (name, value) = line.split_once(':')?; + name.eq_ignore_ascii_case("Content-Length") + .then(|| value.trim().parse::().unwrap()) + }) + .unwrap(); + let mut body = vec![0; length]; + service.read_exact(&mut body).await.unwrap(); + service + .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\n") + .await + .unwrap(); + (headers, String::from_utf8(body).unwrap()) + }); + crate::l7::rest::relay_http_request_with_options_guarded( + &request, + &mut client, + &mut upstream, + crate::l7::rest::RelayRequestOptions { + resolver: Some(&resolver), + request_body_credential_rewrite: true, + ..Default::default() + }, + ) + .await + .unwrap(); + let (headers, body) = service_task.await.unwrap(); + assert!(headers.contains("/allowed/search?probe=legacy-private-token")); + assert!(headers.contains("Authorization: token strict-private-token")); + assert!(headers.contains("X-Legacy: legacy-private-token")); + assert_eq!( + body, + "legacy=legacy-private-token&strict=strict-private-token" + ); + assert!( + resolver + .rewrite_header_value_for_name("X-Legacy", strict) + .unwrap_err() + .is_placement_mismatch() + ); + } + + #[tokio::test] + async fn metadata_credentials_do_not_enable_disabled_body_rewriting() { + let state = placement_test_state(); + let resolver = state + .resolver_for_endpoint("allowed.example.test", 443, "/allowed/search") + .unwrap(); + let token = state.snapshot().child_env["API_TOKEN"].clone(); + let body = format!("token={token}"); + let raw = format!( + "POST /allowed/search HTTP/1.1\r\nHost: allowed.example.test\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: {}\r\n\r\n{body}", + body.len() + ); + let request = crate::l7::rest::request_from_buffered_http( + "POST", + "/allowed/search", + "/allowed/search", + raw.into_bytes(), + ) + .unwrap(); + let (mut _app, mut client) = tokio::io::duplex(8192); + let (mut upstream, mut service) = tokio::io::duplex(8192); + let error = crate::l7::rest::relay_http_request_with_options_guarded( + &request, + &mut client, + &mut upstream, + crate::l7::rest::RelayRequestOptions { + resolver: Some(&resolver), + request_body_credential_rewrite: false, + deny_uninspected_credentials: true, + ..Default::default() + }, + ) + .await + .expect_err("placement metadata must not enable body rewriting"); + assert!( + error + .downcast_ref::() + .is_some(), + "{error}" + ); + drop(upstream); + let mut sent = String::new(); + service.read_to_string(&mut sent).await.unwrap(); + assert!(!sent.contains("synthetic-private-token")); + } + + #[tokio::test] + async fn metadata_credentials_do_not_enable_disabled_websocket_rewriting() { + let state = placement_test_state(); + let token = state.snapshot().child_env["API_TOKEN"].clone(); + let ctx = L7EvalContext { + host: "allowed.example.test".into(), + port: 443, + provider_credentials: Some(state.clone()), + ..Default::default() + }; + let (mut app, mut client) = tokio::io::duplex(8192); + let (mut upstream, mut service) = tokio::io::duplex(8192); + let relay = tokio::spawn(async move { + handle_upgrade( + &mut client, + &mut upstream, + Vec::new(), + "allowed.example.test", + 443, + UpgradeRelayOptions { + websocket_request: true, + websocket: WebSocketUpgradeBehavior { + credential_rewrite: false, + deny_uninspected_credentials: true, + ..Default::default() + }, + secret_resolver: state.resolver(), + ctx: Some(&ctx), + target: "/allowed/socket".into(), + ..Default::default() + }, + ) + .await + }); + app.write_all(&masked_text_frame(token.as_bytes())) + .await + .unwrap(); + let error = tokio::time::timeout(std::time::Duration::from_secs(1), relay) + .await + .unwrap() + .unwrap() + .expect_err("disabled rewriting must deny credential frames"); + assert!(error.to_string().contains("rewrite is disabled"), "{error}"); + let mut sent = Vec::new(); + service.read_to_end(&mut sent).await.unwrap(); + assert!(sent.is_empty()); + } + #[tokio::test] async fn header_credential_query_reflection_is_denied_before_upstream_write() { let state = placement_test_state(); @@ -4366,12 +4554,6 @@ mod tests { String::new(), false, ), - ( - "/allowed/search".into(), - String::new(), - format!("token={token}"), - true, - ), ] { let raw = format!( "GET {target} HTTP/1.1\r\nHost: allowed.example.test\r\n{extra_headers}Content-Type: application/x-www-form-urlencoded\r\nContent-Length: {}\r\n\r\n{body}", @@ -4528,7 +4710,7 @@ mod tests { } #[tokio::test] - async fn signing_only_credentials_support_supervisor_sigv4_without_request_substitution() { + async fn trusted_sigv4_signing_preserves_metadata_free_credentials() { let values = TestHashMap::from([ ("AWS_ACCESS_KEY_ID".into(), "synthetic-access-key".into()), ( @@ -4540,14 +4722,7 @@ mod tests { let bindings = values .keys() .map(|key: &String| { - let mut binding = endpoint_binding(&format!("aws:{key}")); - binding.placement = Some(openshell_core::proto::StaticCredentialPlacement { - location: Some( - openshell_core::proto::static_credential_placement::Location::SigningOnly( - true, - ), - ), - }); + let binding = endpoint_binding(&format!("aws:{key}")); (key.clone(), binding) }) .collect(); @@ -4563,13 +4738,6 @@ mod tests { let resolver = state .resolver_for_endpoint("allowed.example.test", 443, "/allowed/api") .unwrap(); - let placeholder = state.snapshot().child_env["AWS_SECRET_ACCESS_KEY"].clone(); - assert!( - resolver - .rewrite_header_value_for_name("Authorization", &placeholder) - .unwrap_err() - .is_placement_mismatch() - ); let request = crate::l7::rest::request_from_buffered_http( "GET", "/allowed/api", @@ -6306,9 +6474,6 @@ network_policies: }], credential_identity: "provider-a:API_TOKEN".to_string(), workload_credential_handle: String::new(), - placement: Some(openshell_core::proto::StaticCredentialPlacement { - location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), - }), }, )]), Vec::new(), @@ -6413,9 +6578,6 @@ network_policies: }], credential_identity: "provider-a:API_TOKEN".to_string(), workload_credential_handle: String::new(), - placement: Some(openshell_core::proto::StaticCredentialPlacement { - location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), - }), }, )]), Vec::new(), @@ -7071,9 +7233,6 @@ network_policies: }], credential_identity: "provider-a:API_TOKEN".to_string(), workload_credential_handle: String::new(), - placement: Some(openshell_core::proto::StaticCredentialPlacement { - location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), - }), }, )]), Vec::new(), @@ -9966,9 +10125,6 @@ network_policies: }], credential_identity: "provider-a:API_TOKEN".to_string(), workload_credential_handle: String::new(), - placement: Some(openshell_core::proto::StaticCredentialPlacement { - location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), - }), }, )]), Vec::new(), @@ -12529,9 +12685,6 @@ network_policies: }], credential_identity: "provider:API_TOKEN".into(), workload_credential_handle: String::new(), - placement: Some(openshell_core::proto::StaticCredentialPlacement { - location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), - }), }, )]), Vec::new(), diff --git a/crates/openshell-supervisor-network/src/l7/rest.rs b/crates/openshell-supervisor-network/src/l7/rest.rs index 1c453b678b..7b85942666 100644 --- a/crates/openshell-supervisor-network/src/l7/rest.rs +++ b/crates/openshell-supervisor-network/src/l7/rest.rs @@ -9862,9 +9862,6 @@ mod tests { StaticCredentialBinding { credential_identity: "github".into(), workload_credential_handle: String::new(), - placement: Some(openshell_core::proto::StaticCredentialPlacement { - location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), - }), endpoints: vec![StaticCredentialEndpointBinding { host: "api.github.com".into(), port: 443, diff --git a/crates/openshell-supervisor-network/src/l7/websocket.rs b/crates/openshell-supervisor-network/src/l7/websocket.rs index 8e2b1fe0ab..e0dad1aba6 100644 --- a/crates/openshell-supervisor-network/src/l7/websocket.rs +++ b/crates/openshell-supervisor-network/src/l7/websocket.rs @@ -2739,7 +2739,7 @@ network_policies: 1, HashMap::from([("DISCORD_BOT_TOKEN".to_string(), "real-token".to_string())]), HashMap::new(), - HashMap::new(), + crate::test_support::header_placement_metadata(&["DISCORD_BOT_TOKEN"]), HashMap::from([( "DISCORD_BOT_TOKEN".to_string(), StaticCredentialBinding { @@ -2750,9 +2750,6 @@ network_policies: }], credential_identity: "provider-a:DISCORD_BOT_TOKEN".to_string(), workload_credential_handle: String::new(), - placement: Some(openshell_core::proto::StaticCredentialPlacement { - location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), - }), }, )]), Vec::new(), @@ -2844,7 +2841,7 @@ network_policies: } #[tokio::test] - async fn guarded_websocket_rejects_header_credential_in_text() { + async fn guarded_websocket_rewrites_header_credentials_with_policy_opt_in() { let state = bound_websocket_provider_state(); let placeholder = b"openshell:resolve:env:v1_DISCORD_BOT_TOKEN"; let input = masked_frame(true, OPCODE_TEXT, placeholder); @@ -2875,24 +2872,79 @@ network_policies: ) .await; assert!( - result.as_ref().is_err_and(|error| error - .error - .to_string() - .contains(CREDENTIAL_PLACEMENT_MISMATCH)), - "header credentials must not resolve in WebSocket frames: {result:?}" + result.is_ok(), + "explicit WebSocket rewriting must permit header credentials: {result:?}" ); drop(relay_write); let mut output = Vec::new(); upstream_read.read_to_end(&mut output).await.unwrap(); + assert_eq!(decode_masked_text_frame(&output), "real-token"); + } + + #[tokio::test] + async fn legacy_websocket_credential_rewrite_remains_available() { + let state = ProviderCredentialState::from_bound_environment( + 1, + HashMap::from([("DISCORD_BOT_TOKEN".to_string(), "real-token".to_string())]), + HashMap::new(), + HashMap::new(), + HashMap::from([( + "DISCORD_BOT_TOKEN".to_string(), + StaticCredentialBinding { + endpoints: vec![StaticCredentialEndpointBinding { + host: "gateway.example.test".into(), + port: 443, + path: "/socket".into(), + }], + credential_identity: "provider:DISCORD_BOT_TOKEN".into(), + workload_credential_handle: String::new(), + }, + )]), + Vec::new(), + ) + .expect("legacy websocket fixture"); + let placeholder = b"openshell:resolve:env:v1_DISCORD_BOT_TOKEN"; + let input = masked_frame(true, OPCODE_TEXT, placeholder); + let (mut client_write, mut relay_read) = tokio::io::duplex(4096); + let (mut relay_write, mut upstream_read) = tokio::io::duplex(4096); + client_write.write_all(&input).await.unwrap(); + drop(client_write); + + let mut options = RelayOptions { + policy_name: "test-policy", + assembly_budget: WebSocketAssemblyBudget::default(), + resolver: None, + generation_guard: None, + provider_credentials: Some(&state), + target: "/socket", + inspector: None, + compression: WebSocketCompression::None, + middleware_session: None, + middleware_context: None, + deny_uninspected_credentials: true, + }; + let result = relay_client_to_server( + &mut relay_read, + &mut relay_write, + "gateway.example.test", + 443, + &mut options, + ) + .await; assert!( - output.is_empty(), - "placement denial must send no upstream bytes" + result.is_ok(), + "legacy placement must preserve WebSocket rewriting: {result:?}" ); + + drop(relay_write); + let mut output = Vec::new(); + upstream_read.read_to_end(&mut output).await.unwrap(); + assert_eq!(decode_masked_text_frame(&output), "real-token"); } #[tokio::test] - async fn compressed_websocket_rejects_header_credential_before_frame_write() { + async fn websocket_rewrite_rejects_revocation_before_frame_write() { let state = bound_websocket_provider_state(); let fallback = state.resolver().expect("upgrade-time resolver"); let placeholder = b"openshell:resolve:env:v1_DISCORD_BOT_TOKEN"; @@ -2919,6 +2971,8 @@ network_policies: middleware_context: None, deny_uninspected_credentials: false, }; + let reached_write = tokio::sync::Barrier::new(2); + let release_write = tokio::sync::Barrier::new(2); let (mut relay_write, mut upstream_read) = tokio::io::duplex(4096); let relay = relay_text_payload_with_before_credential_write( @@ -2932,15 +2986,22 @@ network_policies: "gateway.example.test", 443, &mut options, - async { panic!("placement denial must precede credential write callback") }, + async { + reached_write.wait().await; + release_write.wait().await; + }, ); - let result = relay.await; + let revoke = async { + reached_write.wait().await; + state.revoke_static_provider_environment(2); + release_write.wait().await; + }; + let (result, ()) = tokio::join!(relay, revoke); assert!( - result.as_ref().is_err_and(|error| error - .error - .to_string() - .contains(CREDENTIAL_PLACEMENT_MISMATCH)), - "placement denial must fail before the frame write: {result:?}" + result + .as_ref() + .is_err_and(|error| error.error.to_string().contains("generation changed")), + "revoked generation must fail before the frame write: {result:?}" ); drop(relay_write); @@ -2948,7 +3009,7 @@ network_policies: upstream_read.read_to_end(&mut output).await.unwrap(); assert!( output.is_empty(), - "placement-denied credential must not reach upstream" + "credential revoked before the write guard must not reach upstream" ); } diff --git a/crates/openshell-supervisor-network/src/proxy.rs b/crates/openshell-supervisor-network/src/proxy.rs index e07d8c5b58..f73831c79a 100644 --- a/crates/openshell-supervisor-network/src/proxy.rs +++ b/crates/openshell-supervisor-network/src/proxy.rs @@ -10624,9 +10624,6 @@ network_policies: }], credential_identity: "provider-a:API_TOKEN".to_string(), workload_credential_handle: String::new(), - placement: Some(openshell_core::proto::StaticCredentialPlacement { - location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), - }), }, )]), Vec::new(), @@ -12993,9 +12990,6 @@ network_policies: }], credential_identity: "provider-a:API_TOKEN".to_string(), workload_credential_handle: String::new(), - placement: Some(openshell_core::proto::StaticCredentialPlacement { - location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), - }), }, )]), Vec::new(), @@ -13041,9 +13035,6 @@ network_policies: }], credential_identity: "provider-a:API_TOKEN".to_string(), workload_credential_handle: String::new(), - placement: Some(openshell_core::proto::StaticCredentialPlacement { - location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), - }), }, )]), Vec::new(), @@ -13090,9 +13081,6 @@ network_policies: }], credential_identity: "provider-a:API_TOKEN".to_string(), workload_credential_handle: String::new(), - placement: Some(openshell_core::proto::StaticCredentialPlacement { - location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), - }), }, )]), Vec::new(), @@ -13766,9 +13754,6 @@ network_policies: StaticCredentialBinding { credential_identity: "provider".into(), workload_credential_handle: String::new(), - placement: Some(openshell_core::proto::StaticCredentialPlacement { - location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), - }), endpoints: vec![StaticCredentialEndpointBinding { host: "api.example.com".into(), port: 80, @@ -13921,9 +13906,6 @@ network_policies: }], credential_identity: "provider-a:API_TOKEN".to_string(), workload_credential_handle: String::new(), - placement: Some(openshell_core::proto::StaticCredentialPlacement { - location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("Authorization".into())), - }), }, )]), Vec::new(), @@ -14015,9 +13997,6 @@ network_policies: }], credential_identity: format!("provider-a:{key}"), workload_credential_handle: String::new(), - placement: Some(openshell_core::proto::StaticCredentialPlacement { - location: Some(openshell_core::proto::static_credential_placement::Location::SigningOnly(true)), - }), }, ) }) diff --git a/crates/openshell-supervisor-network/src/test_support.rs b/crates/openshell-supervisor-network/src/test_support.rs index d1b23b6f31..5c302b91de 100644 --- a/crates/openshell-supervisor-network/src/test_support.rs +++ b/crates/openshell-supervisor-network/src/test_support.rs @@ -1,7 +1,28 @@ // SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. // SPDX-License-Identifier: Apache-2.0 -//! Executable identity and socket-owner subprocess fixtures. +//! Credential, executable identity, and socket-owner subprocess fixtures. + +pub fn header_placement_metadata( + keys: &[&str], +) -> std::collections::HashMap { + keys.iter() + .map(|key| { + ( + format!( + "{}{key}", + openshell_core::provider_credentials::STATIC_CREDENTIAL_METADATA_PREFIX + ), + openshell_core::proto::ProviderProfileCredential { + env_vars: vec![(*key).to_string()], + auth_style: "bearer".to_string(), + header_name: "Authorization".to_string(), + ..Default::default() + }, + ) + }) + .collect() +} #[cfg(target_os = "linux")] use std::net::TcpStream; diff --git a/crates/openshell-supervisor-process/src/supervisor_session.rs b/crates/openshell-supervisor-process/src/supervisor_session.rs index fb8643f2be..71313e19c0 100644 --- a/crates/openshell-supervisor-process/src/supervisor_session.rs +++ b/crates/openshell-supervisor-process/src/supervisor_session.rs @@ -611,7 +611,6 @@ async fn run_single_session( redirected, supports_session_redirect: true, supports_config_push: true, - supports_static_credential_placement: true, })), }) .await diff --git a/crates/openshell-supervisor/src/config_runtime.rs b/crates/openshell-supervisor/src/config_runtime.rs index 252cc1334b..1a83fd0887 100644 --- a/crates/openshell-supervisor/src/config_runtime.rs +++ b/crates/openshell-supervisor/src/config_runtime.rs @@ -457,9 +457,10 @@ impl ConfigRuntime { Ok(generation) => { policy_runtime_reconciled = true; if let Some(prepared) = prepared_provider.as_ref() { - prepared.record_installation( - &ctx.provider_readiness, + ctx.provider_readiness.credentials_installed( + prepared.identity.clone(), &ctx.provider_credentials, + prepared.expires_at_ms, ); } ctx.provider_readiness.policy_activated( @@ -638,7 +639,11 @@ impl ConfigRuntime { if !reloads_gateway_policy && let Some(prepared) = prepared_provider.as_ref() { ctx.provider_credentials .install_prepared(&prepared.credentials); - prepared.record_installation(&ctx.provider_readiness, &ctx.provider_credentials); + ctx.provider_readiness.credentials_installed( + prepared.identity.clone(), + &ctx.provider_credentials, + prepared.expires_at_ms, + ); } if provider_env_changed || policy_runtime_reconciled { self.provider_env_revision = result.provider_env_revision; @@ -1915,9 +1920,6 @@ mod tests { }], credential_identity: "provider-a:EXTERNAL_TOKEN".into(), workload_credential_handle: String::new(), - placement: Some(openshell_core::proto::StaticCredentialPlacement { - location: Some(openshell_core::proto::static_credential_placement::Location::HeaderName("authorization".into())), - }), }, ); } @@ -1939,9 +1941,6 @@ mod tests { state .resolver_for_endpoint("tools.example.com", 443, "/v1/chat") .unwrap() - .with_request_location(openshell_core::secrets::RequestCredentialLocation::Header( - "authorization".into() - )) .resolve_placeholder(reference), Some("initial"), ); @@ -2013,9 +2012,6 @@ mod tests { state .resolver_for_endpoint("tools.example.com", 443, "/v1/chat") .unwrap() - .with_request_location(openshell_core::secrets::RequestCredentialLocation::Header( - "authorization".into() - )) .resolve_placeholder(reference), Some("initial"), ); @@ -2568,14 +2564,7 @@ mod tests { let resolved = state .resolver_for_endpoint("tools.example.com", 443, "/v1/chat") .and_then(|resolver| { - resolver - .with_request_location( - openshell_core::secrets::RequestCredentialLocation::Header( - "authorization".into(), - ), - ) - .resolve_placeholder(&reference) - .map(str::to_owned) + resolver.resolve_placeholder(&reference).map(str::to_owned) }); let observed = tracker.observation(&state); if state.revision() == revision @@ -2597,11 +2586,6 @@ mod tests { state .resolver_for_endpoint("tools.example.com", 443, "/v1/chat") .unwrap() - .with_request_location( - openshell_core::secrets::RequestCredentialLocation::Header( - "authorization".into() - ) - ) .resolve_placeholder(old_reference), Some("initial") ); @@ -2674,14 +2658,7 @@ mod tests { let resolved = state .resolver_for_endpoint("tools.example.com", 443, "/v1/chat") .and_then(|resolver| { - resolver - .with_request_location( - openshell_core::secrets::RequestCredentialLocation::Header( - "authorization".into(), - ), - ) - .resolve_placeholder(&reference) - .map(str::to_owned) + resolver.resolve_placeholder(&reference).map(str::to_owned) }); let observed = tracker.observation(&state); if state.revision() == revision diff --git a/crates/openshell-supervisor/src/lib.rs b/crates/openshell-supervisor/src/lib.rs index e20a1ebc1b..a84c70a4a3 100644 --- a/crates/openshell-supervisor/src/lib.rs +++ b/crates/openshell-supervisor/src/lib.rs @@ -2424,31 +2424,16 @@ impl VmPolicyIdentity { #[derive(Clone)] struct CapturedProviderEnvironment { credentials: ProviderCredentialState, - readiness_reason: ProviderReadinessReason, expires_at_ms: Option, identity: EnvironmentIdentity, } impl CapturedProviderEnvironment { fn install(self, readiness: &ProviderReadinessTracker) -> ProviderCredentialState { - self.record_installation(readiness, &self.credentials); + readiness.credentials_installed(self.identity, &self.credentials, self.expires_at_ms); self.credentials } - fn record_installation( - &self, - readiness: &ProviderReadinessTracker, - credentials: &ProviderCredentialState, - ) { - if self.readiness_reason == ProviderReadinessReason::Unspecified { - readiness.credentials_installed(self.identity.clone(), credentials, self.expires_at_ms); - } else { - // The reduced snapshot is valid and its remaining keys are usable, - // while readiness still reports the omitted credential material. - readiness.credentials_failed(self.identity.clone(), self.readiness_reason); - } - } - /// Validate the environment's bindings without touching live credentials. fn prepare(provider: &openshell_core::grpc_client::ProviderEnvironmentResult) -> Result { prepare_provider_environment(provider).map(|credentials| Self::new(credentials, provider)) @@ -2460,7 +2445,6 @@ impl CapturedProviderEnvironment { ) -> Self { Self { credentials, - readiness_reason: provider.readiness_reason, expires_at_ms: provider .credential_expires_at_ms .values() @@ -3638,7 +3622,7 @@ fn initial_provider_credentials( .copied() .filter(|expiry| *expiry > 0) .min(); - if !provider_environment_is_installable(result.readiness_reason) { + if result.readiness_reason != ProviderReadinessReason::Unspecified { readiness.credentials_failed(identity, result.readiness_reason); return ProviderCredentialState::from_environment( result.provider_env_revision, @@ -3659,11 +3643,7 @@ fn initial_provider_credentials( ) { Ok(credentials) => { credentials.set_managed_files(result.files); - if result.readiness_reason == ProviderReadinessReason::Unspecified { - readiness.credentials_installed(identity, &credentials, expires_at_ms); - } else { - readiness.credentials_failed(identity, result.readiness_reason); - } + readiness.credentials_installed(identity, &credentials, expires_at_ms); credentials } Err(error) => { @@ -6211,53 +6191,6 @@ network_policies: } } - #[test] - fn reduced_environment_preserves_authorized_credentials_and_omission_readiness() { - use openshell_core::proto::{ - StaticCredentialBinding, StaticCredentialEndpointBinding, StaticCredentialPlacement, - static_credential_placement, - }; - for captured in [false, true] { - let mut provider = startup_provider(10); - provider.policy_hash = "policy".into(); - provider.readiness_reason = ProviderReadinessReason::CredentialsWithheld; - provider - .environment - .insert("TOKEN".into(), "synthetic".into()); - provider.static_credential_bindings.insert( - "TOKEN".into(), - StaticCredentialBinding { - endpoints: vec![StaticCredentialEndpointBinding { - host: "api.example.com".into(), - port: 443, - path: "/**".into(), - }], - credential_identity: "provider:TOKEN".into(), - placement: Some(StaticCredentialPlacement { - location: Some(static_credential_placement::Location::HeaderName( - "authorization".into(), - )), - }), - ..Default::default() - }, - ); - let identity = EnvironmentIdentity::from_environment(&provider); - let tracker = ProviderReadinessTracker::new(); - let credentials = if captured { - CapturedProviderEnvironment::prepare(&provider) - .unwrap() - .install(&tracker) - } else { - initial_provider_credentials(provider, &tracker) - }; - assert!(credentials.snapshot().child_env.contains_key("TOKEN")); - assert!( - tracker.needs_environment(&identity), - "omitted keys remain visible in readiness" - ); - } - } - #[test] fn startup_configuration_rejects_mixed_provider_revision() { let policy = proto_policy_fixture(); diff --git a/docs/how-it-works/policies/network-rules.mdx b/docs/how-it-works/policies/network-rules.mdx index 656dbc794c..c2aec12e2a 100644 --- a/docs/how-it-works/policies/network-rules.mdx +++ b/docs/how-it-works/policies/network-rules.mdx @@ -440,9 +440,9 @@ frames or messages from the server. If the endpoint carries provider credentials, OpenShell closes the connection with close code `1008` when the client sends a binary frame, because it cannot check the frame for credentials. Set `allow_uninspected_credentials: true` to relay binary frames anyway. Set -`websocket_credential_rewrite` does not override provider credential placement. -Static credentials declared for a header, query parameter, or path cannot -resolve inside WebSocket messages, even when this flag is enabled. +`websocket_credential_rewrite: true` when client text messages contain credential +placeholders that must be resolved. This explicitly authorizes WebSocket text +rewriting for ordinary static credentials, including credentials with HTTP placement metadata. When new network rules take effect, OpenShell closes open WebSocket connections, so the client must reconnect. The client might receive close code `1012`, or the diff --git a/docs/how-it-works/policies/schema.mdx b/docs/how-it-works/policies/schema.mdx index 183a317287..40faf25379 100644 --- a/docs/how-it-works/policies/schema.mdx +++ b/docs/how-it-works/policies/schema.mdx @@ -166,8 +166,8 @@ the gateway host. | Field | Type | Default | Description | |---|---|---|---| | `credential_binding.provider` | string | None | Binds the static credentials of an attached provider whose profile defines no endpoints. Valid only in a sandbox policy. | -| `request_body_credential_rewrite` | bool | `false` | Enables REST body rewriting without overriding credential placement. Header-, query-, and path-bound static credentials cannot resolve in bodies. | -| `websocket_credential_rewrite` | bool | `false` | Enables WebSocket text rewriting without overriding credential placement. Header-, query-, and path-bound static credentials cannot resolve in messages. | +| `request_body_credential_rewrite` | bool | `false` | Replaces ordinary static credential placeholders in REST bodies, including those with declared HTTP placement. | +| `websocket_credential_rewrite` | bool | `false` | Replaces ordinary static credential placeholders in client WebSocket text messages, including those with declared HTTP placement. | | `allow_uninspected_credentials` | bool | `false` | Allows a provider-credentialed endpoint to omit request inspection or use `tls: skip`. | | `credential_signing` | string | None | AWS request signing: `sigv4`, `sigv4:body`, or `sigv4:no_body`. | | `signing_service` | string | None | AWS service name, such as `bedrock` or `s3`. Required with `credential_signing`. | diff --git a/docs/how-it-works/providers/overview.mdx b/docs/how-it-works/providers/overview.mdx index 685f963665..44e0959924 100644 --- a/docs/how-it-works/providers/overview.mdx +++ b/docs/how-it-works/providers/overview.mdx @@ -443,8 +443,9 @@ Static credential resolution has three independent authorization boundaries: endpoints provide the binding by default. An endpointless profile can use a sandbox policy endpoint that names the attached provider instance through `credential_binding.provider`. -3. The request location must match the credential's declared header, query - parameter, or path-template slot. +3. When placement metadata is supported and available, the request location + must match the declared header, query parameter, or path-template slot, or an + explicitly enabled body/WebSocket rewrite policy. All three checks must pass. A provider profile endpoint does not grant network access unless provider policy composition or the sandbox's own policy allows the @@ -463,9 +464,10 @@ for endpoint matching and migration guidance. ### Supported injection locations -The proxy resolves static credential placeholders only in their declared -placement. Moving a header credential into a query parameter, path, or another -header is denied before the request is forwarded. +The proxy automatically enforces declared placement when the gateway and +supervisor support it. Moving a header credential into a query parameter, path, +or unrelated header is denied before forwarding. Credentials without usable +placement metadata and older components retain legacy endpoint-scoped rewriting. | Location | How the agent uses it | Example | |---|---|---| @@ -478,9 +480,9 @@ header is denied before the request is forwarded. The proxy does not rewrite cookies, response content, unsupported request bodies, or WebSocket binary frames. -Static credentials bound to headers, query parameters, or paths cannot resolve in -request bodies or WebSocket messages. Endpoint-wide rewrite flags do not grant -additional credential placements. See [Profiles](/how-it-works/providers/profiles#understand-static-credential-endpoint-binding) +Explicit endpoint policies can enable credential rewriting in request bodies +or WebSocket text messages. These flags do not authorize arbitrary query +parameters, path slots, or unrelated headers. See [Profiles](/how-it-works/providers/profiles#understand-static-credential-endpoint-binding) for placement configuration and upgrade requirements. ### Clients that parse JWT claims diff --git a/docs/how-it-works/providers/profiles.mdx b/docs/how-it-works/providers/profiles.mdx index d56b15bd40..3fad35a9da 100644 --- a/docs/how-it-works/providers/profiles.mdx +++ b/docs/how-it-works/providers/profiles.mdx @@ -70,7 +70,7 @@ A request can use a static credential only when all of these checks pass: | The placeholder belongs to the current attached provider state. | Sandbox provider attachment and current provider record. | | The calling binary and destination are allowed. | Effective sandbox network policy. | | The host, port, and canonical request path match the credential binding. | Provider profile endpoints, or an explicit sandbox policy binding for an endpointless profile. | -| The request location matches the credential's declared placement. | The credential's `auth_style` and its header, query parameter, or path template. | +| When supported placement metadata is available, the request location matches it or an explicit body/WebSocket rewrite policy. | The credential's `auth_style` and its header, query parameter, or path template. | | The HTTP method, path, or protocol operation is allowed when L7 inspection is configured. | Effective sandbox network policy. | | The credential has not expired. | Provider credential expiry metadata. | @@ -95,34 +95,32 @@ glob matching. OpenShell removes the query string and uses a canonical, secret-redacted path for this check, so a credential embedded in a request path does not need to be revealed before authorization. -Each static credential also has a placement boundary. Header credentials resolve -only in the declared header, query credentials only in the declared parameter, -and path credentials only in the `{credential}` slot of their path template. -Header names are case-insensitive. An `Authorization` binding supports the -client's authentication format, including Bearer, token, and Basic authentication; -it does not require a literal `Bearer` prefix. - -The gateway withholds static credentials that lack usable placement metadata and -reports `CredentialsWithheld`. Add the appropriate placement to the profile -before attaching it. Signing-only AWS credentials are available only to the -supervisor's SigV4 signer. -Request-body and WebSocket rewrite flags do not override a credential's placement. - -Signing-only credentials require a profile signing endpoint or an AWS STS -refresh declaration. A custom endpointless AWS profile with signing configured -only in sandbox policy is withheld; move the signing declaration into the -profile before upgrading that workload. - -The Codex reference profile declares placement for its access token and account -header. Its refresh token and ID token have no supported static HTTP placement -and are withheld. Workloads that require those environment variables need a -compatible credential flow before upgrading; body rewrite flags cannot restore -that access. - -Upgrade both gateway and supervisor before using placement-bound credentials. -An upgraded gateway withholds static credentials from supervisors that do not -advertise placement enforcement. Restart older sandboxes after upgrading, then -wait for provider readiness before launching clients. +The supervisor automatically enforces usable static credential auth metadata. +No additional profile flag is required. Header credentials resolve only in the +declared header, query credentials only in the declared parameter, and path +credentials only in the `{credential}` slot of their path template. Header names +are case-insensitive. An `Authorization` binding accepts Bearer, token, and Basic +authentication. + +Existing endpoint policies that enable request-body or WebSocket text rewriting +continue to authorize those locations. Those flags do not authorize arbitrary +query parameters, URL paths, or unrelated headers. Trusted AWS signing retains +its existing endpoint authorization. + +Credentials without usable placement metadata retain legacy endpoint-scoped +substitution. This preserves custom profiles, policy-only AWS signers, and Codex +refresh and ID tokens. The Codex reference profile supplies placement for its +access token and account header. + +Gateway and supervisor upgrades can happen in either order. The gateway forwards +static auth metadata with the existing provider environment. Older supervisors +ignore it and keep their previous behavior. New supervisors connected to an older +gateway receive no static auth metadata and retain legacy behavior. Existing +credential delivery and wire identities remain unchanged. + +The hardening takes effect automatically once both components support it and +usable placement is declared. Existing credential placeholder and update +lifecycles remain unchanged. Use an explicit sandbox policy binding when the profile intentionally defines credentials without defining service endpoints. The policy names the concrete diff --git a/e2e/python/test_sandbox_providers.py b/e2e/python/test_sandbox_providers.py index 7055b56ba9..ebfbc02d46 100644 --- a/e2e/python/test_sandbox_providers.py +++ b/e2e/python/test_sandbox_providers.py @@ -727,11 +727,15 @@ def call_native_openai(host: str, port: int) -> str: assert body["model"] == "fixture-openai-model" +@pytest.mark.parametrize( + "placement_metadata", [True, False], ids=["metadata", "legacy"] +) def test_static_header_credentials_reject_reflective_request_locations( sandbox: Callable[..., Sandbox], sandbox_client: SandboxClient, + placement_metadata: bool, ) -> None: - """Only the declared auth header can resolve a static credential.""" + """Existing metadata selects placement checks while missing metadata stays compatible.""" stub = sandbox_client._stub profile_id = f"e2e-placement-{time.time_ns()}" secret = "synthetic-placement-secret" @@ -741,6 +745,9 @@ def test_static_header_credentials_reject_reflective_request_locations( port=0, rules=[sandbox_pb2.L7Rule(allow=sandbox_pb2.L7Allow(method="*", path="/**"))], ) + if not placement_metadata: + profile.credentials[0].auth_style = "" + profile.credentials[0].header_name = "" profile.endpoints[0].request_body_credential_rewrite = True def probe_locations(host: str, port: int) -> str: @@ -758,7 +765,7 @@ def probe_locations(host: str, port: int) -> str: + "/search?" + urllib.parse.urlencode({"q": "rust", "per_page": "1", "probe": token}) ), - urllib.request.Request(root + "/search", headers={"X-Reflect": token}), + urllib.request.Request(root + "/search", headers={"X-Api-Key": token}), urllib.request.Request( root + "/" + urllib.parse.quote(token, safe="") + "/search" ), @@ -773,7 +780,11 @@ def probe_locations(host: str, port: int) -> str: try: with urllib.request.urlopen(request, timeout=30) as response: results.append( - {"status": response.status, "body": response.read().decode()} + { + "status": response.status, + "body": response.read().decode(), + "link": response.headers.get("Link"), + } ) except urllib.error.HTTPError as error: results.append( @@ -819,11 +830,20 @@ def probe_locations(host: str, port: int) -> str: ) assert result.exit_code == 0, result.stderr payload = json.loads(result.stdout) - for denied in payload["denied"]: - assert denied["status"] == 403, denied - assert "credential_placement_mismatch" in denied["body"] - assert secret not in denied["body"] - assert denied["link"] is None + for result in payload["denied"][:3]: + if placement_metadata: + assert result["status"] == 403, result + assert "credential_placement_mismatch" in result["body"] + assert secret not in result["body"] + assert result["link"] is None + else: + assert result["status"] == 200, result + assert secret in result["body"], result + body_result = payload["denied"][3] + assert body_result["status"] == 200, body_result + assert secret in body_result["body"] + if not placement_metadata: + assert secret in payload["denied"][0]["link"] assert payload["valid"]["body"]["authorization"] == f"token {secret}" assert "per_page=1&page=2" in payload["valid"]["link"] assert secret not in payload["valid"]["link"] diff --git a/proto/openshell.proto b/proto/openshell.proto index e4febb4bf1..2d1310f946 100644 --- a/proto/openshell.proto +++ b/proto/openshell.proto @@ -2676,9 +2676,6 @@ message GetSandboxProviderEnvironmentRequest { // metadata. Gateways withhold credentials that require this behavior when // the capability is absent. bool supports_stable_placeholder_environment_keys = 3; - // The supervisor enforces credential-specific request locations. Gateways - // withhold static credential material when this capability is absent. - bool supports_static_credential_placement = 4; } // One network endpoint at which a static provider credential may be resolved. @@ -2688,19 +2685,7 @@ message StaticCredentialEndpointBinding { string path = 3; } -// Authorized request location for one static credential. Missing or unknown -// locations must never authorize substitution. Signing-only material may be -// accessed only by the supervisor-owned request signer. -message StaticCredentialPlacement { - oneof location { - string header_name = 1; - string query_param = 2; - string path_template = 3; - bool signing_only = 4; - } -} - -// Endpoint and request-location authorization for one static credential. +// Endpoint allowlist for one static provider credential environment variable. message StaticCredentialBinding { repeated StaticCredentialEndpointBinding endpoints = 1; // Stable identity of the provider credential that produced this binding. @@ -2710,10 +2695,9 @@ message StaticCredentialBinding { // Opaque gateway-issued handle for a stable credential lifecycle. When // non-empty, supervisors keep the workload placeholder stable across value // updates and replace only the resolver value. The handle changes when the - // sandbox, provider, credential key, endpoint or placement authorization, or - // an applicable refresh authorization epoch changes. + // sandbox, provider, credential key, endpoint authorization, or an applicable + // refresh authorization epoch changes. string workload_credential_handle = 3; - StaticCredentialPlacement placement = 4; } // Polling projection of ProviderEnvironmentSnapshot. The parallel maps below @@ -2728,9 +2712,10 @@ message GetSandboxProviderEnvironmentResponse { uint64 provider_env_revision = 2; // Expiration timestamps for returned environment variables. map credential_expiration_times = 103; - // Dynamic credentials that require token grants or other runtime injection. - // Maps endpoint-bound provider metadata to credential metadata. - // Supervisor uses this to inject Authorization headers for token grant credentials. + // Endpoint-bound token grants and static credential request metadata. + // Reserved static-env: entries carry authored placement fields for + // a delivered static value and have no token_grant. Older supervisors ignore + // those entries; newer supervisors separate them before grant processing. map dynamic_credentials = 4; // Endpoint allowlists for static credential environment variables. Metadata // can be incomplete when a provider profile is invalid; capable supervisors @@ -2791,6 +2776,8 @@ message ProviderEnvironmentValue { message ProviderEnvironmentSnapshot { uint64 provider_env_revision = 1; repeated ProviderEnvironmentValue values = 2; + // Token grants and reserved static-env: request metadata, atomically + // delivered with the static environment. Metadata entries have no token_grant. map dynamic_credentials = 3; string provider_attachment_epoch = 4; string policy_hash = 5; @@ -3166,9 +3153,6 @@ message SupervisorHello { // ConfigUpdate payloads, and answers each with its result and admission. // Gateways push configuration only to supervisors that set this. bool supports_config_push = 7; - // Required for pushed static credential material. Older supervisors fall - // back to polling, which withholds material without this capability. - bool supports_static_credential_placement = 8; } // Gateway accepts the supervisor session. diff --git a/providers/codex.yaml b/providers/codex.yaml index 1f9278f8f3..fb2d76b2e5 100644 --- a/providers/codex.yaml +++ b/providers/codex.yaml @@ -39,8 +39,6 @@ credentials: description: Codex OAuth refresh token env_vars: [CODEX_AUTH_REFRESH_TOKEN] required: true - # OAuth refresh uses a request body. Static body placement is unsupported, - # so this credential is withheld rather than granted arbitrary placement. - name: account_id description: Codex account identifier env_vars: [CODEX_AUTH_ACCOUNT_ID] @@ -50,7 +48,6 @@ credentials: - name: id_token description: Codex OAuth ID token env_vars: [CODEX_AUTH_ID_TOKEN] - # Local token inspection has no HTTP placement; this value is withheld. discovery: credentials: [access_token, refresh_token, account_id, id_token] endpoints: diff --git a/sdk/go/proto/openshellv1/openshell.pb.go b/sdk/go/proto/openshellv1/openshell.pb.go index 0db14027d8..98355eb283 100644 --- a/sdk/go/proto/openshellv1/openshell.pb.go +++ b/sdk/go/proto/openshellv1/openshell.pb.go @@ -11335,11 +11335,8 @@ type GetSandboxProviderEnvironmentRequest struct { // metadata. Gateways withhold credentials that require this behavior when // the capability is absent. SupportsStablePlaceholderEnvironmentKeys bool `protobuf:"varint,3,opt,name=supports_stable_placeholder_environment_keys,json=supportsStablePlaceholderEnvironmentKeys,proto3" json:"supports_stable_placeholder_environment_keys,omitempty"` - // The supervisor enforces credential-specific request locations. Gateways - // withhold static credential material when this capability is absent. - SupportsStaticCredentialPlacement bool `protobuf:"varint,4,opt,name=supports_static_credential_placement,json=supportsStaticCredentialPlacement,proto3" json:"supports_static_credential_placement,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *GetSandboxProviderEnvironmentRequest) Reset() { @@ -11393,13 +11390,6 @@ func (x *GetSandboxProviderEnvironmentRequest) GetSupportsStablePlaceholderEnvir return false } -func (x *GetSandboxProviderEnvironmentRequest) GetSupportsStaticCredentialPlacement() bool { - if x != nil { - return x.SupportsStaticCredentialPlacement - } - return false -} - // One network endpoint at which a static provider credential may be resolved. type StaticCredentialEndpointBinding struct { state protoimpl.MessageState `protogen:"open.v1"` @@ -11461,124 +11451,7 @@ func (x *StaticCredentialEndpointBinding) GetPath() string { return "" } -// Authorized request location for one static credential. Missing or unknown -// locations must never authorize substitution. Signing-only material may be -// accessed only by the supervisor-owned request signer. -type StaticCredentialPlacement struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Location: - // - // *StaticCredentialPlacement_HeaderName - // *StaticCredentialPlacement_QueryParam - // *StaticCredentialPlacement_PathTemplate - // *StaticCredentialPlacement_SigningOnly - Location isStaticCredentialPlacement_Location `protobuf_oneof:"location"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *StaticCredentialPlacement) Reset() { - *x = StaticCredentialPlacement{} - mi := &file_openshell_proto_msgTypes[139] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *StaticCredentialPlacement) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*StaticCredentialPlacement) ProtoMessage() {} - -func (x *StaticCredentialPlacement) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[139] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use StaticCredentialPlacement.ProtoReflect.Descriptor instead. -func (*StaticCredentialPlacement) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{139} -} - -func (x *StaticCredentialPlacement) GetLocation() isStaticCredentialPlacement_Location { - if x != nil { - return x.Location - } - return nil -} - -func (x *StaticCredentialPlacement) GetHeaderName() string { - if x != nil { - if x, ok := x.Location.(*StaticCredentialPlacement_HeaderName); ok { - return x.HeaderName - } - } - return "" -} - -func (x *StaticCredentialPlacement) GetQueryParam() string { - if x != nil { - if x, ok := x.Location.(*StaticCredentialPlacement_QueryParam); ok { - return x.QueryParam - } - } - return "" -} - -func (x *StaticCredentialPlacement) GetPathTemplate() string { - if x != nil { - if x, ok := x.Location.(*StaticCredentialPlacement_PathTemplate); ok { - return x.PathTemplate - } - } - return "" -} - -func (x *StaticCredentialPlacement) GetSigningOnly() bool { - if x != nil { - if x, ok := x.Location.(*StaticCredentialPlacement_SigningOnly); ok { - return x.SigningOnly - } - } - return false -} - -type isStaticCredentialPlacement_Location interface { - isStaticCredentialPlacement_Location() -} - -type StaticCredentialPlacement_HeaderName struct { - HeaderName string `protobuf:"bytes,1,opt,name=header_name,json=headerName,proto3,oneof"` -} - -type StaticCredentialPlacement_QueryParam struct { - QueryParam string `protobuf:"bytes,2,opt,name=query_param,json=queryParam,proto3,oneof"` -} - -type StaticCredentialPlacement_PathTemplate struct { - PathTemplate string `protobuf:"bytes,3,opt,name=path_template,json=pathTemplate,proto3,oneof"` -} - -type StaticCredentialPlacement_SigningOnly struct { - SigningOnly bool `protobuf:"varint,4,opt,name=signing_only,json=signingOnly,proto3,oneof"` -} - -func (*StaticCredentialPlacement_HeaderName) isStaticCredentialPlacement_Location() {} - -func (*StaticCredentialPlacement_QueryParam) isStaticCredentialPlacement_Location() {} - -func (*StaticCredentialPlacement_PathTemplate) isStaticCredentialPlacement_Location() {} - -func (*StaticCredentialPlacement_SigningOnly) isStaticCredentialPlacement_Location() {} - -// Endpoint and request-location authorization for one static credential. +// Endpoint allowlist for one static provider credential environment variable. type StaticCredentialBinding struct { state protoimpl.MessageState `protogen:"open.v1"` Endpoints []*StaticCredentialEndpointBinding `protobuf:"bytes,1,rep,name=endpoints,proto3" json:"endpoints,omitempty"` @@ -11589,17 +11462,16 @@ type StaticCredentialBinding struct { // Opaque gateway-issued handle for a stable credential lifecycle. When // non-empty, supervisors keep the workload placeholder stable across value // updates and replace only the resolver value. The handle changes when the - // sandbox, provider, credential key, endpoint or placement authorization, or - // an applicable refresh authorization epoch changes. - WorkloadCredentialHandle string `protobuf:"bytes,3,opt,name=workload_credential_handle,json=workloadCredentialHandle,proto3" json:"workload_credential_handle,omitempty"` - Placement *StaticCredentialPlacement `protobuf:"bytes,4,opt,name=placement,proto3" json:"placement,omitempty"` + // sandbox, provider, credential key, endpoint authorization, or an applicable + // refresh authorization epoch changes. + WorkloadCredentialHandle string `protobuf:"bytes,3,opt,name=workload_credential_handle,json=workloadCredentialHandle,proto3" json:"workload_credential_handle,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } func (x *StaticCredentialBinding) Reset() { *x = StaticCredentialBinding{} - mi := &file_openshell_proto_msgTypes[140] + mi := &file_openshell_proto_msgTypes[139] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11611,7 +11483,7 @@ func (x *StaticCredentialBinding) String() string { func (*StaticCredentialBinding) ProtoMessage() {} func (x *StaticCredentialBinding) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[140] + mi := &file_openshell_proto_msgTypes[139] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11624,7 +11496,7 @@ func (x *StaticCredentialBinding) ProtoReflect() protoreflect.Message { // Deprecated: Use StaticCredentialBinding.ProtoReflect.Descriptor instead. func (*StaticCredentialBinding) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{140} + return file_openshell_proto_rawDescGZIP(), []int{139} } func (x *StaticCredentialBinding) GetEndpoints() []*StaticCredentialEndpointBinding { @@ -11648,13 +11520,6 @@ func (x *StaticCredentialBinding) GetWorkloadCredentialHandle() string { return "" } -func (x *StaticCredentialBinding) GetPlacement() *StaticCredentialPlacement { - if x != nil { - return x.Placement - } - return nil -} - // Polling projection of ProviderEnvironmentSnapshot. The parallel maps below // are keyed by the same environment variable names. Removed with the polling // RPCs; new provider environment fields belong on the snapshot first. @@ -11666,9 +11531,10 @@ type GetSandboxProviderEnvironmentResponse struct { ProviderEnvRevision uint64 `protobuf:"varint,2,opt,name=provider_env_revision,json=providerEnvRevision,proto3" json:"provider_env_revision,omitempty"` // Expiration timestamps for returned environment variables. CredentialExpirationTimes map[string]*timestamppb.Timestamp `protobuf:"bytes,103,rep,name=credential_expiration_times,json=credentialExpirationTimes,proto3" json:"credential_expiration_times,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Dynamic credentials that require token grants or other runtime injection. - // Maps endpoint-bound provider metadata to credential metadata. - // Supervisor uses this to inject Authorization headers for token grant credentials. + // Endpoint-bound token grants and static credential request metadata. + // Reserved static-env: entries carry authored placement fields for + // a delivered static value and have no token_grant. Older supervisors ignore + // those entries; newer supervisors separate them before grant processing. DynamicCredentials map[string]*ProviderProfileCredential `protobuf:"bytes,4,rep,name=dynamic_credentials,json=dynamicCredentials,proto3" json:"dynamic_credentials,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` // Endpoint allowlists for static credential environment variables. Metadata // can be incomplete when a provider profile is invalid; capable supervisors @@ -11701,7 +11567,7 @@ type GetSandboxProviderEnvironmentResponse struct { func (x *GetSandboxProviderEnvironmentResponse) Reset() { *x = GetSandboxProviderEnvironmentResponse{} - mi := &file_openshell_proto_msgTypes[141] + mi := &file_openshell_proto_msgTypes[140] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11713,7 +11579,7 @@ func (x *GetSandboxProviderEnvironmentResponse) String() string { func (*GetSandboxProviderEnvironmentResponse) ProtoMessage() {} func (x *GetSandboxProviderEnvironmentResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[141] + mi := &file_openshell_proto_msgTypes[140] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11726,7 +11592,7 @@ func (x *GetSandboxProviderEnvironmentResponse) ProtoReflect() protoreflect.Mess // Deprecated: Use GetSandboxProviderEnvironmentResponse.ProtoReflect.Descriptor instead. func (*GetSandboxProviderEnvironmentResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{141} + return file_openshell_proto_rawDescGZIP(), []int{140} } func (x *GetSandboxProviderEnvironmentResponse) GetEnvironment() map[string]string { @@ -11835,7 +11701,7 @@ type ProviderEnvironmentValue struct { func (x *ProviderEnvironmentValue) Reset() { *x = ProviderEnvironmentValue{} - mi := &file_openshell_proto_msgTypes[142] + mi := &file_openshell_proto_msgTypes[141] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11847,7 +11713,7 @@ func (x *ProviderEnvironmentValue) String() string { func (*ProviderEnvironmentValue) ProtoMessage() {} func (x *ProviderEnvironmentValue) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[142] + mi := &file_openshell_proto_msgTypes[141] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11860,7 +11726,7 @@ func (x *ProviderEnvironmentValue) ProtoReflect() protoreflect.Message { // Deprecated: Use ProviderEnvironmentValue.ProtoReflect.Descriptor instead. func (*ProviderEnvironmentValue) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{142} + return file_openshell_proto_rawDescGZIP(), []int{141} } func (x *ProviderEnvironmentValue) GetName() string { @@ -11911,9 +11777,11 @@ func (x *ProviderEnvironmentValue) GetStablePlaceholder() bool { // credentials are endpoint selectors rather than environment values and stay // in their own collection. type ProviderEnvironmentSnapshot struct { - state protoimpl.MessageState `protogen:"open.v1"` - ProviderEnvRevision uint64 `protobuf:"varint,1,opt,name=provider_env_revision,json=providerEnvRevision,proto3" json:"provider_env_revision,omitempty"` - Values []*ProviderEnvironmentValue `protobuf:"bytes,2,rep,name=values,proto3" json:"values,omitempty"` + state protoimpl.MessageState `protogen:"open.v1"` + ProviderEnvRevision uint64 `protobuf:"varint,1,opt,name=provider_env_revision,json=providerEnvRevision,proto3" json:"provider_env_revision,omitempty"` + Values []*ProviderEnvironmentValue `protobuf:"bytes,2,rep,name=values,proto3" json:"values,omitempty"` + // Token grants and reserved static-env: request metadata, atomically + // delivered with the static environment. Metadata entries have no token_grant. DynamicCredentials map[string]*ProviderProfileCredential `protobuf:"bytes,3,rep,name=dynamic_credentials,json=dynamicCredentials,proto3" json:"dynamic_credentials,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` ProviderAttachmentEpoch string `protobuf:"bytes,4,opt,name=provider_attachment_epoch,json=providerAttachmentEpoch,proto3" json:"provider_attachment_epoch,omitempty"` PolicyHash string `protobuf:"bytes,5,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"` @@ -11926,7 +11794,7 @@ type ProviderEnvironmentSnapshot struct { func (x *ProviderEnvironmentSnapshot) Reset() { *x = ProviderEnvironmentSnapshot{} - mi := &file_openshell_proto_msgTypes[143] + mi := &file_openshell_proto_msgTypes[142] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -11938,7 +11806,7 @@ func (x *ProviderEnvironmentSnapshot) String() string { func (*ProviderEnvironmentSnapshot) ProtoMessage() {} func (x *ProviderEnvironmentSnapshot) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[143] + mi := &file_openshell_proto_msgTypes[142] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -11951,7 +11819,7 @@ func (x *ProviderEnvironmentSnapshot) ProtoReflect() protoreflect.Message { // Deprecated: Use ProviderEnvironmentSnapshot.ProtoReflect.Descriptor instead. func (*ProviderEnvironmentSnapshot) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{143} + return file_openshell_proto_rawDescGZIP(), []int{142} } func (x *ProviderEnvironmentSnapshot) GetProviderEnvRevision() uint64 { @@ -12020,7 +11888,7 @@ type ExchangeProviderSubjectTokenRequest struct { func (x *ExchangeProviderSubjectTokenRequest) Reset() { *x = ExchangeProviderSubjectTokenRequest{} - mi := &file_openshell_proto_msgTypes[144] + mi := &file_openshell_proto_msgTypes[143] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12032,7 +11900,7 @@ func (x *ExchangeProviderSubjectTokenRequest) String() string { func (*ExchangeProviderSubjectTokenRequest) ProtoMessage() {} func (x *ExchangeProviderSubjectTokenRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[144] + mi := &file_openshell_proto_msgTypes[143] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12045,7 +11913,7 @@ func (x *ExchangeProviderSubjectTokenRequest) ProtoReflect() protoreflect.Messag // Deprecated: Use ExchangeProviderSubjectTokenRequest.ProtoReflect.Descriptor instead. func (*ExchangeProviderSubjectTokenRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{144} + return file_openshell_proto_rawDescGZIP(), []int{143} } func (x *ExchangeProviderSubjectTokenRequest) GetSandboxId() string { @@ -12087,7 +11955,7 @@ type ExchangeProviderSubjectTokenResponse struct { func (x *ExchangeProviderSubjectTokenResponse) Reset() { *x = ExchangeProviderSubjectTokenResponse{} - mi := &file_openshell_proto_msgTypes[145] + mi := &file_openshell_proto_msgTypes[144] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12099,7 +11967,7 @@ func (x *ExchangeProviderSubjectTokenResponse) String() string { func (*ExchangeProviderSubjectTokenResponse) ProtoMessage() {} func (x *ExchangeProviderSubjectTokenResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[145] + mi := &file_openshell_proto_msgTypes[144] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12112,7 +11980,7 @@ func (x *ExchangeProviderSubjectTokenResponse) ProtoReflect() protoreflect.Messa // Deprecated: Use ExchangeProviderSubjectTokenResponse.ProtoReflect.Descriptor instead. func (*ExchangeProviderSubjectTokenResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{145} + return file_openshell_proto_rawDescGZIP(), []int{144} } func (x *ExchangeProviderSubjectTokenResponse) GetAccessToken() string { @@ -12186,7 +12054,7 @@ type UpdateConfigRequest struct { func (x *UpdateConfigRequest) Reset() { *x = UpdateConfigRequest{} - mi := &file_openshell_proto_msgTypes[146] + mi := &file_openshell_proto_msgTypes[145] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12198,7 +12066,7 @@ func (x *UpdateConfigRequest) String() string { func (*UpdateConfigRequest) ProtoMessage() {} func (x *UpdateConfigRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[146] + mi := &file_openshell_proto_msgTypes[145] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12211,7 +12079,7 @@ func (x *UpdateConfigRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateConfigRequest.ProtoReflect.Descriptor instead. func (*UpdateConfigRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{146} + return file_openshell_proto_rawDescGZIP(), []int{145} } func (x *UpdateConfigRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -12308,7 +12176,7 @@ type PolicyMergeOperation struct { func (x *PolicyMergeOperation) Reset() { *x = PolicyMergeOperation{} - mi := &file_openshell_proto_msgTypes[147] + mi := &file_openshell_proto_msgTypes[146] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12320,7 +12188,7 @@ func (x *PolicyMergeOperation) String() string { func (*PolicyMergeOperation) ProtoMessage() {} func (x *PolicyMergeOperation) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[147] + mi := &file_openshell_proto_msgTypes[146] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12333,7 +12201,7 @@ func (x *PolicyMergeOperation) ProtoReflect() protoreflect.Message { // Deprecated: Use PolicyMergeOperation.ProtoReflect.Descriptor instead. func (*PolicyMergeOperation) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{147} + return file_openshell_proto_rawDescGZIP(), []int{146} } func (x *PolicyMergeOperation) GetOperation() isPolicyMergeOperation_Operation { @@ -12447,7 +12315,7 @@ type AddNetworkRule struct { func (x *AddNetworkRule) Reset() { *x = AddNetworkRule{} - mi := &file_openshell_proto_msgTypes[148] + mi := &file_openshell_proto_msgTypes[147] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12459,7 +12327,7 @@ func (x *AddNetworkRule) String() string { func (*AddNetworkRule) ProtoMessage() {} func (x *AddNetworkRule) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[148] + mi := &file_openshell_proto_msgTypes[147] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12472,7 +12340,7 @@ func (x *AddNetworkRule) ProtoReflect() protoreflect.Message { // Deprecated: Use AddNetworkRule.ProtoReflect.Descriptor instead. func (*AddNetworkRule) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{148} + return file_openshell_proto_rawDescGZIP(), []int{147} } func (x *AddNetworkRule) GetRuleName() string { @@ -12500,7 +12368,7 @@ type RemoveNetworkEndpoint struct { func (x *RemoveNetworkEndpoint) Reset() { *x = RemoveNetworkEndpoint{} - mi := &file_openshell_proto_msgTypes[149] + mi := &file_openshell_proto_msgTypes[148] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12512,7 +12380,7 @@ func (x *RemoveNetworkEndpoint) String() string { func (*RemoveNetworkEndpoint) ProtoMessage() {} func (x *RemoveNetworkEndpoint) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[149] + mi := &file_openshell_proto_msgTypes[148] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12525,7 +12393,7 @@ func (x *RemoveNetworkEndpoint) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveNetworkEndpoint.ProtoReflect.Descriptor instead. func (*RemoveNetworkEndpoint) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{149} + return file_openshell_proto_rawDescGZIP(), []int{148} } func (x *RemoveNetworkEndpoint) GetRuleName() string { @@ -12558,7 +12426,7 @@ type RemoveNetworkRule struct { func (x *RemoveNetworkRule) Reset() { *x = RemoveNetworkRule{} - mi := &file_openshell_proto_msgTypes[150] + mi := &file_openshell_proto_msgTypes[149] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12570,7 +12438,7 @@ func (x *RemoveNetworkRule) String() string { func (*RemoveNetworkRule) ProtoMessage() {} func (x *RemoveNetworkRule) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[150] + mi := &file_openshell_proto_msgTypes[149] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12583,7 +12451,7 @@ func (x *RemoveNetworkRule) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveNetworkRule.ProtoReflect.Descriptor instead. func (*RemoveNetworkRule) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{150} + return file_openshell_proto_rawDescGZIP(), []int{149} } func (x *RemoveNetworkRule) GetRuleName() string { @@ -12612,7 +12480,7 @@ type L7RuleTarget struct { func (x *L7RuleTarget) Reset() { *x = L7RuleTarget{} - mi := &file_openshell_proto_msgTypes[151] + mi := &file_openshell_proto_msgTypes[150] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12624,7 +12492,7 @@ func (x *L7RuleTarget) String() string { func (*L7RuleTarget) ProtoMessage() {} func (x *L7RuleTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[151] + mi := &file_openshell_proto_msgTypes[150] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12637,7 +12505,7 @@ func (x *L7RuleTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use L7RuleTarget.ProtoReflect.Descriptor instead. func (*L7RuleTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{151} + return file_openshell_proto_rawDescGZIP(), []int{150} } func (x *L7RuleTarget) GetRuleName() string { @@ -12692,7 +12560,7 @@ type AddDenyRules struct { func (x *AddDenyRules) Reset() { *x = AddDenyRules{} - mi := &file_openshell_proto_msgTypes[152] + mi := &file_openshell_proto_msgTypes[151] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12704,7 +12572,7 @@ func (x *AddDenyRules) String() string { func (*AddDenyRules) ProtoMessage() {} func (x *AddDenyRules) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[152] + mi := &file_openshell_proto_msgTypes[151] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12717,7 +12585,7 @@ func (x *AddDenyRules) ProtoReflect() protoreflect.Message { // Deprecated: Use AddDenyRules.ProtoReflect.Descriptor instead. func (*AddDenyRules) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{152} + return file_openshell_proto_rawDescGZIP(), []int{151} } func (x *AddDenyRules) GetDenyRules() []*sandboxv1.L7DenyRule { @@ -12744,7 +12612,7 @@ type AddAllowRules struct { func (x *AddAllowRules) Reset() { *x = AddAllowRules{} - mi := &file_openshell_proto_msgTypes[153] + mi := &file_openshell_proto_msgTypes[152] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12756,7 +12624,7 @@ func (x *AddAllowRules) String() string { func (*AddAllowRules) ProtoMessage() {} func (x *AddAllowRules) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[153] + mi := &file_openshell_proto_msgTypes[152] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12769,7 +12637,7 @@ func (x *AddAllowRules) ProtoReflect() protoreflect.Message { // Deprecated: Use AddAllowRules.ProtoReflect.Descriptor instead. func (*AddAllowRules) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{153} + return file_openshell_proto_rawDescGZIP(), []int{152} } func (x *AddAllowRules) GetRules() []*sandboxv1.L7Rule { @@ -12796,7 +12664,7 @@ type RemoveNetworkBinary struct { func (x *RemoveNetworkBinary) Reset() { *x = RemoveNetworkBinary{} - mi := &file_openshell_proto_msgTypes[154] + mi := &file_openshell_proto_msgTypes[153] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12808,7 +12676,7 @@ func (x *RemoveNetworkBinary) String() string { func (*RemoveNetworkBinary) ProtoMessage() {} func (x *RemoveNetworkBinary) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[154] + mi := &file_openshell_proto_msgTypes[153] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12821,7 +12689,7 @@ func (x *RemoveNetworkBinary) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveNetworkBinary.ProtoReflect.Descriptor instead. func (*RemoveNetworkBinary) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{154} + return file_openshell_proto_rawDescGZIP(), []int{153} } func (x *RemoveNetworkBinary) GetRuleName() string { @@ -12857,7 +12725,7 @@ type UpdateConfigResponse struct { func (x *UpdateConfigResponse) Reset() { *x = UpdateConfigResponse{} - mi := &file_openshell_proto_msgTypes[155] + mi := &file_openshell_proto_msgTypes[154] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12869,7 +12737,7 @@ func (x *UpdateConfigResponse) String() string { func (*UpdateConfigResponse) ProtoMessage() {} func (x *UpdateConfigResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[155] + mi := &file_openshell_proto_msgTypes[154] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12882,7 +12750,7 @@ func (x *UpdateConfigResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateConfigResponse.ProtoReflect.Descriptor instead. func (*UpdateConfigResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{155} + return file_openshell_proto_rawDescGZIP(), []int{154} } func (x *UpdateConfigResponse) GetVersion() uint32 { @@ -12936,7 +12804,7 @@ type GetSandboxPolicyStatusRequest struct { func (x *GetSandboxPolicyStatusRequest) Reset() { *x = GetSandboxPolicyStatusRequest{} - mi := &file_openshell_proto_msgTypes[156] + mi := &file_openshell_proto_msgTypes[155] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -12948,7 +12816,7 @@ func (x *GetSandboxPolicyStatusRequest) String() string { func (*GetSandboxPolicyStatusRequest) ProtoMessage() {} func (x *GetSandboxPolicyStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[156] + mi := &file_openshell_proto_msgTypes[155] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -12961,7 +12829,7 @@ func (x *GetSandboxPolicyStatusRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetSandboxPolicyStatusRequest.ProtoReflect.Descriptor instead. func (*GetSandboxPolicyStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{156} + return file_openshell_proto_rawDescGZIP(), []int{155} } func (x *GetSandboxPolicyStatusRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -13005,7 +12873,7 @@ type GetSandboxPolicyStatusResponse struct { func (x *GetSandboxPolicyStatusResponse) Reset() { *x = GetSandboxPolicyStatusResponse{} - mi := &file_openshell_proto_msgTypes[157] + mi := &file_openshell_proto_msgTypes[156] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13017,7 +12885,7 @@ func (x *GetSandboxPolicyStatusResponse) String() string { func (*GetSandboxPolicyStatusResponse) ProtoMessage() {} func (x *GetSandboxPolicyStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[157] + mi := &file_openshell_proto_msgTypes[156] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13030,7 +12898,7 @@ func (x *GetSandboxPolicyStatusResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetSandboxPolicyStatusResponse.ProtoReflect.Descriptor instead. func (*GetSandboxPolicyStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{157} + return file_openshell_proto_rawDescGZIP(), []int{156} } func (x *GetSandboxPolicyStatusResponse) GetRevision() *SandboxPolicyRevision { @@ -13067,7 +12935,7 @@ type ListSandboxPoliciesRequest struct { func (x *ListSandboxPoliciesRequest) Reset() { *x = ListSandboxPoliciesRequest{} - mi := &file_openshell_proto_msgTypes[158] + mi := &file_openshell_proto_msgTypes[157] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13079,7 +12947,7 @@ func (x *ListSandboxPoliciesRequest) String() string { func (*ListSandboxPoliciesRequest) ProtoMessage() {} func (x *ListSandboxPoliciesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[158] + mi := &file_openshell_proto_msgTypes[157] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13092,7 +12960,7 @@ func (x *ListSandboxPoliciesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListSandboxPoliciesRequest.ProtoReflect.Descriptor instead. func (*ListSandboxPoliciesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{158} + return file_openshell_proto_rawDescGZIP(), []int{157} } func (x *ListSandboxPoliciesRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -13144,7 +13012,7 @@ type ListSandboxPoliciesResponse struct { func (x *ListSandboxPoliciesResponse) Reset() { *x = ListSandboxPoliciesResponse{} - mi := &file_openshell_proto_msgTypes[159] + mi := &file_openshell_proto_msgTypes[158] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13156,7 +13024,7 @@ func (x *ListSandboxPoliciesResponse) String() string { func (*ListSandboxPoliciesResponse) ProtoMessage() {} func (x *ListSandboxPoliciesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[159] + mi := &file_openshell_proto_msgTypes[158] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13169,7 +13037,7 @@ func (x *ListSandboxPoliciesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListSandboxPoliciesResponse.ProtoReflect.Descriptor instead. func (*ListSandboxPoliciesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{159} + return file_openshell_proto_rawDescGZIP(), []int{158} } func (x *ListSandboxPoliciesResponse) GetRevisions() []*SandboxPolicyRevision { @@ -13203,7 +13071,7 @@ type ReportPolicyStatusRequest struct { func (x *ReportPolicyStatusRequest) Reset() { *x = ReportPolicyStatusRequest{} - mi := &file_openshell_proto_msgTypes[160] + mi := &file_openshell_proto_msgTypes[159] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13215,7 +13083,7 @@ func (x *ReportPolicyStatusRequest) String() string { func (*ReportPolicyStatusRequest) ProtoMessage() {} func (x *ReportPolicyStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[160] + mi := &file_openshell_proto_msgTypes[159] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13228,7 +13096,7 @@ func (x *ReportPolicyStatusRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportPolicyStatusRequest.ProtoReflect.Descriptor instead. func (*ReportPolicyStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{160} + return file_openshell_proto_rawDescGZIP(), []int{159} } func (x *ReportPolicyStatusRequest) GetSandboxId() string { @@ -13268,7 +13136,7 @@ type ReportPolicyStatusResponse struct { func (x *ReportPolicyStatusResponse) Reset() { *x = ReportPolicyStatusResponse{} - mi := &file_openshell_proto_msgTypes[161] + mi := &file_openshell_proto_msgTypes[160] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13280,7 +13148,7 @@ func (x *ReportPolicyStatusResponse) String() string { func (*ReportPolicyStatusResponse) ProtoMessage() {} func (x *ReportPolicyStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[161] + mi := &file_openshell_proto_msgTypes[160] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13293,7 +13161,7 @@ func (x *ReportPolicyStatusResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportPolicyStatusResponse.ProtoReflect.Descriptor instead. func (*ReportPolicyStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{161} + return file_openshell_proto_rawDescGZIP(), []int{160} } type SandboxConfigurationAdmission struct { @@ -13311,7 +13179,7 @@ type SandboxConfigurationAdmission struct { func (x *SandboxConfigurationAdmission) Reset() { *x = SandboxConfigurationAdmission{} - mi := &file_openshell_proto_msgTypes[162] + mi := &file_openshell_proto_msgTypes[161] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13323,7 +13191,7 @@ func (x *SandboxConfigurationAdmission) String() string { func (*SandboxConfigurationAdmission) ProtoMessage() {} func (x *SandboxConfigurationAdmission) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[162] + mi := &file_openshell_proto_msgTypes[161] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13336,7 +13204,7 @@ func (x *SandboxConfigurationAdmission) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxConfigurationAdmission.ProtoReflect.Descriptor instead. func (*SandboxConfigurationAdmission) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{162} + return file_openshell_proto_rawDescGZIP(), []int{161} } func (x *SandboxConfigurationAdmission) GetInstanceId() string { @@ -13400,7 +13268,7 @@ type ReportSandboxConfigurationRequest struct { func (x *ReportSandboxConfigurationRequest) Reset() { *x = ReportSandboxConfigurationRequest{} - mi := &file_openshell_proto_msgTypes[163] + mi := &file_openshell_proto_msgTypes[162] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13412,7 +13280,7 @@ func (x *ReportSandboxConfigurationRequest) String() string { func (*ReportSandboxConfigurationRequest) ProtoMessage() {} func (x *ReportSandboxConfigurationRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[163] + mi := &file_openshell_proto_msgTypes[162] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13425,7 +13293,7 @@ func (x *ReportSandboxConfigurationRequest) ProtoReflect() protoreflect.Message // Deprecated: Use ReportSandboxConfigurationRequest.ProtoReflect.Descriptor instead. func (*ReportSandboxConfigurationRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{163} + return file_openshell_proto_rawDescGZIP(), []int{162} } func (x *ReportSandboxConfigurationRequest) GetSandboxId() string { @@ -13457,7 +13325,7 @@ type ReportSandboxConfigurationResponse struct { func (x *ReportSandboxConfigurationResponse) Reset() { *x = ReportSandboxConfigurationResponse{} - mi := &file_openshell_proto_msgTypes[164] + mi := &file_openshell_proto_msgTypes[163] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13469,7 +13337,7 @@ func (x *ReportSandboxConfigurationResponse) String() string { func (*ReportSandboxConfigurationResponse) ProtoMessage() {} func (x *ReportSandboxConfigurationResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[164] + mi := &file_openshell_proto_msgTypes[163] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13482,7 +13350,7 @@ func (x *ReportSandboxConfigurationResponse) ProtoReflect() protoreflect.Message // Deprecated: Use ReportSandboxConfigurationResponse.ProtoReflect.Descriptor instead. func (*ReportSandboxConfigurationResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{164} + return file_openshell_proto_rawDescGZIP(), []int{163} } // A versioned policy revision with metadata. @@ -13515,7 +13383,7 @@ type SandboxPolicyRevision struct { func (x *SandboxPolicyRevision) Reset() { *x = SandboxPolicyRevision{} - mi := &file_openshell_proto_msgTypes[165] + mi := &file_openshell_proto_msgTypes[164] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13527,7 +13395,7 @@ func (x *SandboxPolicyRevision) String() string { func (*SandboxPolicyRevision) ProtoMessage() {} func (x *SandboxPolicyRevision) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[165] + mi := &file_openshell_proto_msgTypes[164] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13540,7 +13408,7 @@ func (x *SandboxPolicyRevision) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxPolicyRevision.ProtoReflect.Descriptor instead. func (*SandboxPolicyRevision) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{165} + return file_openshell_proto_rawDescGZIP(), []int{164} } func (x *SandboxPolicyRevision) GetVersion() uint32 { @@ -13620,7 +13488,7 @@ type GetSandboxLogsRequest struct { func (x *GetSandboxLogsRequest) Reset() { *x = GetSandboxLogsRequest{} - mi := &file_openshell_proto_msgTypes[166] + mi := &file_openshell_proto_msgTypes[165] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13632,7 +13500,7 @@ func (x *GetSandboxLogsRequest) String() string { func (*GetSandboxLogsRequest) ProtoMessage() {} func (x *GetSandboxLogsRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[166] + mi := &file_openshell_proto_msgTypes[165] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13645,7 +13513,7 @@ func (x *GetSandboxLogsRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetSandboxLogsRequest.ProtoReflect.Descriptor instead. func (*GetSandboxLogsRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{166} + return file_openshell_proto_rawDescGZIP(), []int{165} } func (x *GetSandboxLogsRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -13703,7 +13571,7 @@ type PushSandboxLogsRequest struct { func (x *PushSandboxLogsRequest) Reset() { *x = PushSandboxLogsRequest{} - mi := &file_openshell_proto_msgTypes[167] + mi := &file_openshell_proto_msgTypes[166] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13715,7 +13583,7 @@ func (x *PushSandboxLogsRequest) String() string { func (*PushSandboxLogsRequest) ProtoMessage() {} func (x *PushSandboxLogsRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[167] + mi := &file_openshell_proto_msgTypes[166] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13728,7 +13596,7 @@ func (x *PushSandboxLogsRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use PushSandboxLogsRequest.ProtoReflect.Descriptor instead. func (*PushSandboxLogsRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{167} + return file_openshell_proto_rawDescGZIP(), []int{166} } func (x *PushSandboxLogsRequest) GetSandboxId() string { @@ -13754,7 +13622,7 @@ type PushSandboxLogsResponse struct { func (x *PushSandboxLogsResponse) Reset() { *x = PushSandboxLogsResponse{} - mi := &file_openshell_proto_msgTypes[168] + mi := &file_openshell_proto_msgTypes[167] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13766,7 +13634,7 @@ func (x *PushSandboxLogsResponse) String() string { func (*PushSandboxLogsResponse) ProtoMessage() {} func (x *PushSandboxLogsResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[168] + mi := &file_openshell_proto_msgTypes[167] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13779,7 +13647,7 @@ func (x *PushSandboxLogsResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use PushSandboxLogsResponse.ProtoReflect.Descriptor instead. func (*PushSandboxLogsResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{168} + return file_openshell_proto_rawDescGZIP(), []int{167} } // Get sandbox logs response. @@ -13795,7 +13663,7 @@ type GetSandboxLogsResponse struct { func (x *GetSandboxLogsResponse) Reset() { *x = GetSandboxLogsResponse{} - mi := &file_openshell_proto_msgTypes[169] + mi := &file_openshell_proto_msgTypes[168] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13807,7 +13675,7 @@ func (x *GetSandboxLogsResponse) String() string { func (*GetSandboxLogsResponse) ProtoMessage() {} func (x *GetSandboxLogsResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[169] + mi := &file_openshell_proto_msgTypes[168] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13820,7 +13688,7 @@ func (x *GetSandboxLogsResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetSandboxLogsResponse.ProtoReflect.Descriptor instead. func (*GetSandboxLogsResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{169} + return file_openshell_proto_rawDescGZIP(), []int{168} } func (x *GetSandboxLogsResponse) GetLogs() []*SandboxLogLine { @@ -13854,7 +13722,7 @@ type SupervisorMessage struct { func (x *SupervisorMessage) Reset() { *x = SupervisorMessage{} - mi := &file_openshell_proto_msgTypes[170] + mi := &file_openshell_proto_msgTypes[169] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13866,7 +13734,7 @@ func (x *SupervisorMessage) String() string { func (*SupervisorMessage) ProtoMessage() {} func (x *SupervisorMessage) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[170] + mi := &file_openshell_proto_msgTypes[169] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -13879,7 +13747,7 @@ func (x *SupervisorMessage) ProtoReflect() protoreflect.Message { // Deprecated: Use SupervisorMessage.ProtoReflect.Descriptor instead. func (*SupervisorMessage) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{170} + return file_openshell_proto_rawDescGZIP(), []int{169} } func (x *SupervisorMessage) GetPayload() isSupervisorMessage_Payload { @@ -13987,7 +13855,7 @@ type GatewayMessage struct { func (x *GatewayMessage) Reset() { *x = GatewayMessage{} - mi := &file_openshell_proto_msgTypes[171] + mi := &file_openshell_proto_msgTypes[170] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -13999,7 +13867,7 @@ func (x *GatewayMessage) String() string { func (*GatewayMessage) ProtoMessage() {} func (x *GatewayMessage) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[171] + mi := &file_openshell_proto_msgTypes[170] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14012,7 +13880,7 @@ func (x *GatewayMessage) ProtoReflect() protoreflect.Message { // Deprecated: Use GatewayMessage.ProtoReflect.Descriptor instead. func (*GatewayMessage) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{171} + return file_openshell_proto_rawDescGZIP(), []int{170} } func (x *GatewayMessage) GetPayload() isGatewayMessage_Payload { @@ -14156,16 +14024,13 @@ type SupervisorHello struct { // ConfigUpdate payloads, and answers each with its result and admission. // Gateways push configuration only to supervisors that set this. SupportsConfigPush bool `protobuf:"varint,7,opt,name=supports_config_push,json=supportsConfigPush,proto3" json:"supports_config_push,omitempty"` - // Required for pushed static credential material. Older supervisors fall - // back to polling, which withholds material without this capability. - SupportsStaticCredentialPlacement bool `protobuf:"varint,8,opt,name=supports_static_credential_placement,json=supportsStaticCredentialPlacement,proto3" json:"supports_static_credential_placement,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *SupervisorHello) Reset() { *x = SupervisorHello{} - mi := &file_openshell_proto_msgTypes[172] + mi := &file_openshell_proto_msgTypes[171] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14177,7 +14042,7 @@ func (x *SupervisorHello) String() string { func (*SupervisorHello) ProtoMessage() {} func (x *SupervisorHello) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[172] + mi := &file_openshell_proto_msgTypes[171] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14190,7 +14055,7 @@ func (x *SupervisorHello) ProtoReflect() protoreflect.Message { // Deprecated: Use SupervisorHello.ProtoReflect.Descriptor instead. func (*SupervisorHello) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{172} + return file_openshell_proto_rawDescGZIP(), []int{171} } func (x *SupervisorHello) GetSandboxId() string { @@ -14242,13 +14107,6 @@ func (x *SupervisorHello) GetSupportsConfigPush() bool { return false } -func (x *SupervisorHello) GetSupportsStaticCredentialPlacement() bool { - if x != nil { - return x.SupportsStaticCredentialPlacement - } - return false -} - // Gateway accepts the supervisor session. type SessionAccepted struct { state protoimpl.MessageState `protogen:"open.v1"` @@ -14270,7 +14128,7 @@ type SessionAccepted struct { func (x *SessionAccepted) Reset() { *x = SessionAccepted{} - mi := &file_openshell_proto_msgTypes[173] + mi := &file_openshell_proto_msgTypes[172] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14282,7 +14140,7 @@ func (x *SessionAccepted) String() string { func (*SessionAccepted) ProtoMessage() {} func (x *SessionAccepted) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[173] + mi := &file_openshell_proto_msgTypes[172] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14295,7 +14153,7 @@ func (x *SessionAccepted) ProtoReflect() protoreflect.Message { // Deprecated: Use SessionAccepted.ProtoReflect.Descriptor instead. func (*SessionAccepted) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{173} + return file_openshell_proto_rawDescGZIP(), []int{172} } func (x *SessionAccepted) GetSessionId() string { @@ -14344,7 +14202,7 @@ type ConfigUpdate struct { func (x *ConfigUpdate) Reset() { *x = ConfigUpdate{} - mi := &file_openshell_proto_msgTypes[174] + mi := &file_openshell_proto_msgTypes[173] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14356,7 +14214,7 @@ func (x *ConfigUpdate) String() string { func (*ConfigUpdate) ProtoMessage() {} func (x *ConfigUpdate) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[174] + mi := &file_openshell_proto_msgTypes[173] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14369,7 +14227,7 @@ func (x *ConfigUpdate) ProtoReflect() protoreflect.Message { // Deprecated: Use ConfigUpdate.ProtoReflect.Descriptor instead. func (*ConfigUpdate) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{174} + return file_openshell_proto_rawDescGZIP(), []int{173} } func (x *ConfigUpdate) GetUpdateId() string { @@ -14406,7 +14264,7 @@ type ConfigApplyFailure struct { func (x *ConfigApplyFailure) Reset() { *x = ConfigApplyFailure{} - mi := &file_openshell_proto_msgTypes[175] + mi := &file_openshell_proto_msgTypes[174] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14418,7 +14276,7 @@ func (x *ConfigApplyFailure) String() string { func (*ConfigApplyFailure) ProtoMessage() {} func (x *ConfigApplyFailure) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[175] + mi := &file_openshell_proto_msgTypes[174] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14431,7 +14289,7 @@ func (x *ConfigApplyFailure) ProtoReflect() protoreflect.Message { // Deprecated: Use ConfigApplyFailure.ProtoReflect.Descriptor instead. func (*ConfigApplyFailure) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{175} + return file_openshell_proto_rawDescGZIP(), []int{174} } func (x *ConfigApplyFailure) GetCode() string { @@ -14475,7 +14333,7 @@ type ConfigUpdateResult struct { func (x *ConfigUpdateResult) Reset() { *x = ConfigUpdateResult{} - mi := &file_openshell_proto_msgTypes[176] + mi := &file_openshell_proto_msgTypes[175] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14487,7 +14345,7 @@ func (x *ConfigUpdateResult) String() string { func (*ConfigUpdateResult) ProtoMessage() {} func (x *ConfigUpdateResult) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[176] + mi := &file_openshell_proto_msgTypes[175] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14500,7 +14358,7 @@ func (x *ConfigUpdateResult) ProtoReflect() protoreflect.Message { // Deprecated: Use ConfigUpdateResult.ProtoReflect.Descriptor instead. func (*ConfigUpdateResult) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{176} + return file_openshell_proto_rawDescGZIP(), []int{175} } func (x *ConfigUpdateResult) GetUpdateId() string { @@ -14551,7 +14409,7 @@ type PolicyLoadResult struct { func (x *PolicyLoadResult) Reset() { *x = PolicyLoadResult{} - mi := &file_openshell_proto_msgTypes[177] + mi := &file_openshell_proto_msgTypes[176] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14563,7 +14421,7 @@ func (x *PolicyLoadResult) String() string { func (*PolicyLoadResult) ProtoMessage() {} func (x *PolicyLoadResult) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[177] + mi := &file_openshell_proto_msgTypes[176] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14576,7 +14434,7 @@ func (x *PolicyLoadResult) ProtoReflect() protoreflect.Message { // Deprecated: Use PolicyLoadResult.ProtoReflect.Descriptor instead. func (*PolicyLoadResult) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{177} + return file_openshell_proto_rawDescGZIP(), []int{176} } func (x *PolicyLoadResult) GetVersion() uint32 { @@ -14611,7 +14469,7 @@ type SessionRejected struct { func (x *SessionRejected) Reset() { *x = SessionRejected{} - mi := &file_openshell_proto_msgTypes[178] + mi := &file_openshell_proto_msgTypes[177] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14623,7 +14481,7 @@ func (x *SessionRejected) String() string { func (*SessionRejected) ProtoMessage() {} func (x *SessionRejected) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[178] + mi := &file_openshell_proto_msgTypes[177] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14636,7 +14494,7 @@ func (x *SessionRejected) ProtoReflect() protoreflect.Message { // Deprecated: Use SessionRejected.ProtoReflect.Descriptor instead. func (*SessionRejected) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{178} + return file_openshell_proto_rawDescGZIP(), []int{177} } func (x *SessionRejected) GetReason() string { @@ -14665,7 +14523,7 @@ type SessionRedirect struct { func (x *SessionRedirect) Reset() { *x = SessionRedirect{} - mi := &file_openshell_proto_msgTypes[179] + mi := &file_openshell_proto_msgTypes[178] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14677,7 +14535,7 @@ func (x *SessionRedirect) String() string { func (*SessionRedirect) ProtoMessage() {} func (x *SessionRedirect) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[179] + mi := &file_openshell_proto_msgTypes[178] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14690,7 +14548,7 @@ func (x *SessionRedirect) ProtoReflect() protoreflect.Message { // Deprecated: Use SessionRedirect.ProtoReflect.Descriptor instead. func (*SessionRedirect) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{179} + return file_openshell_proto_rawDescGZIP(), []int{178} } func (x *SessionRedirect) GetPeerEndpoint() string { @@ -14716,7 +14574,7 @@ type SupervisorHeartbeat struct { func (x *SupervisorHeartbeat) Reset() { *x = SupervisorHeartbeat{} - mi := &file_openshell_proto_msgTypes[180] + mi := &file_openshell_proto_msgTypes[179] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14728,7 +14586,7 @@ func (x *SupervisorHeartbeat) String() string { func (*SupervisorHeartbeat) ProtoMessage() {} func (x *SupervisorHeartbeat) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[180] + mi := &file_openshell_proto_msgTypes[179] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14741,7 +14599,7 @@ func (x *SupervisorHeartbeat) ProtoReflect() protoreflect.Message { // Deprecated: Use SupervisorHeartbeat.ProtoReflect.Descriptor instead. func (*SupervisorHeartbeat) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{180} + return file_openshell_proto_rawDescGZIP(), []int{179} } // Gateway heartbeat. @@ -14753,7 +14611,7 @@ type GatewayHeartbeat struct { func (x *GatewayHeartbeat) Reset() { *x = GatewayHeartbeat{} - mi := &file_openshell_proto_msgTypes[181] + mi := &file_openshell_proto_msgTypes[180] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14765,7 +14623,7 @@ func (x *GatewayHeartbeat) String() string { func (*GatewayHeartbeat) ProtoMessage() {} func (x *GatewayHeartbeat) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[181] + mi := &file_openshell_proto_msgTypes[180] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14778,7 +14636,7 @@ func (x *GatewayHeartbeat) ProtoReflect() protoreflect.Message { // Deprecated: Use GatewayHeartbeat.ProtoReflect.Descriptor instead. func (*GatewayHeartbeat) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{181} + return file_openshell_proto_rawDescGZIP(), []int{180} } // Terminal result reported before the supervisor shuts down. A successful RPC @@ -14795,7 +14653,7 @@ type ReportMainProcessExitRequest struct { func (x *ReportMainProcessExitRequest) Reset() { *x = ReportMainProcessExitRequest{} - mi := &file_openshell_proto_msgTypes[182] + mi := &file_openshell_proto_msgTypes[181] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14807,7 +14665,7 @@ func (x *ReportMainProcessExitRequest) String() string { func (*ReportMainProcessExitRequest) ProtoMessage() {} func (x *ReportMainProcessExitRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[182] + mi := &file_openshell_proto_msgTypes[181] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14820,7 +14678,7 @@ func (x *ReportMainProcessExitRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportMainProcessExitRequest.ProtoReflect.Descriptor instead. func (*ReportMainProcessExitRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{182} + return file_openshell_proto_rawDescGZIP(), []int{181} } func (x *ReportMainProcessExitRequest) GetSandboxId() string { @@ -14852,7 +14710,7 @@ type ReportMainProcessExitResponse struct { func (x *ReportMainProcessExitResponse) Reset() { *x = ReportMainProcessExitResponse{} - mi := &file_openshell_proto_msgTypes[183] + mi := &file_openshell_proto_msgTypes[182] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14864,7 +14722,7 @@ func (x *ReportMainProcessExitResponse) String() string { func (*ReportMainProcessExitResponse) ProtoMessage() {} func (x *ReportMainProcessExitResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[183] + mi := &file_openshell_proto_msgTypes[182] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14877,7 +14735,7 @@ func (x *ReportMainProcessExitResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportMainProcessExitResponse.ProtoReflect.Descriptor instead. func (*ReportMainProcessExitResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{183} + return file_openshell_proto_rawDescGZIP(), []int{182} } // Terminal-delivery completion reported after all expected foreground SSH @@ -14892,7 +14750,7 @@ type FinalizeMainProcessExitRequest struct { func (x *FinalizeMainProcessExitRequest) Reset() { *x = FinalizeMainProcessExitRequest{} - mi := &file_openshell_proto_msgTypes[184] + mi := &file_openshell_proto_msgTypes[183] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14904,7 +14762,7 @@ func (x *FinalizeMainProcessExitRequest) String() string { func (*FinalizeMainProcessExitRequest) ProtoMessage() {} func (x *FinalizeMainProcessExitRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[184] + mi := &file_openshell_proto_msgTypes[183] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14917,7 +14775,7 @@ func (x *FinalizeMainProcessExitRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use FinalizeMainProcessExitRequest.ProtoReflect.Descriptor instead. func (*FinalizeMainProcessExitRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{184} + return file_openshell_proto_rawDescGZIP(), []int{183} } func (x *FinalizeMainProcessExitRequest) GetSandboxId() string { @@ -14942,7 +14800,7 @@ type FinalizeMainProcessExitResponse struct { func (x *FinalizeMainProcessExitResponse) Reset() { *x = FinalizeMainProcessExitResponse{} - mi := &file_openshell_proto_msgTypes[185] + mi := &file_openshell_proto_msgTypes[184] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -14954,7 +14812,7 @@ func (x *FinalizeMainProcessExitResponse) String() string { func (*FinalizeMainProcessExitResponse) ProtoMessage() {} func (x *FinalizeMainProcessExitResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[185] + mi := &file_openshell_proto_msgTypes[184] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -14967,7 +14825,7 @@ func (x *FinalizeMainProcessExitResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use FinalizeMainProcessExitResponse.ProtoReflect.Descriptor instead. func (*FinalizeMainProcessExitResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{185} + return file_openshell_proto_rawDescGZIP(), []int{184} } // Gateway requests the supervisor to open a relay channel. @@ -14996,7 +14854,7 @@ type RelayOpen struct { func (x *RelayOpen) Reset() { *x = RelayOpen{} - mi := &file_openshell_proto_msgTypes[186] + mi := &file_openshell_proto_msgTypes[185] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15008,7 +14866,7 @@ func (x *RelayOpen) String() string { func (*RelayOpen) ProtoMessage() {} func (x *RelayOpen) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[186] + mi := &file_openshell_proto_msgTypes[185] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15021,7 +14879,7 @@ func (x *RelayOpen) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayOpen.ProtoReflect.Descriptor instead. func (*RelayOpen) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{186} + return file_openshell_proto_rawDescGZIP(), []int{185} } func (x *RelayOpen) GetChannelId() string { @@ -15088,7 +14946,7 @@ type SshRelayTarget struct { func (x *SshRelayTarget) Reset() { *x = SshRelayTarget{} - mi := &file_openshell_proto_msgTypes[187] + mi := &file_openshell_proto_msgTypes[186] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15100,7 +14958,7 @@ func (x *SshRelayTarget) String() string { func (*SshRelayTarget) ProtoMessage() {} func (x *SshRelayTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[187] + mi := &file_openshell_proto_msgTypes[186] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15113,7 +14971,7 @@ func (x *SshRelayTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use SshRelayTarget.ProtoReflect.Descriptor instead. func (*SshRelayTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{187} + return file_openshell_proto_rawDescGZIP(), []int{186} } // TCP target dialed by the supervisor from inside the sandbox. @@ -15129,7 +14987,7 @@ type TcpRelayTarget struct { func (x *TcpRelayTarget) Reset() { *x = TcpRelayTarget{} - mi := &file_openshell_proto_msgTypes[188] + mi := &file_openshell_proto_msgTypes[187] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15141,7 +14999,7 @@ func (x *TcpRelayTarget) String() string { func (*TcpRelayTarget) ProtoMessage() {} func (x *TcpRelayTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[188] + mi := &file_openshell_proto_msgTypes[187] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15154,7 +15012,7 @@ func (x *TcpRelayTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use TcpRelayTarget.ProtoReflect.Descriptor instead. func (*TcpRelayTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{188} + return file_openshell_proto_rawDescGZIP(), []int{187} } func (x *TcpRelayTarget) GetHost() string { @@ -15182,7 +15040,7 @@ type RelayInit struct { func (x *RelayInit) Reset() { *x = RelayInit{} - mi := &file_openshell_proto_msgTypes[189] + mi := &file_openshell_proto_msgTypes[188] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15194,7 +15052,7 @@ func (x *RelayInit) String() string { func (*RelayInit) ProtoMessage() {} func (x *RelayInit) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[189] + mi := &file_openshell_proto_msgTypes[188] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15207,7 +15065,7 @@ func (x *RelayInit) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayInit.ProtoReflect.Descriptor instead. func (*RelayInit) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{189} + return file_openshell_proto_rawDescGZIP(), []int{188} } func (x *RelayInit) GetChannelId() string { @@ -15234,7 +15092,7 @@ type RelayFrame struct { func (x *RelayFrame) Reset() { *x = RelayFrame{} - mi := &file_openshell_proto_msgTypes[190] + mi := &file_openshell_proto_msgTypes[189] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15246,7 +15104,7 @@ func (x *RelayFrame) String() string { func (*RelayFrame) ProtoMessage() {} func (x *RelayFrame) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[190] + mi := &file_openshell_proto_msgTypes[189] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15259,7 +15117,7 @@ func (x *RelayFrame) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayFrame.ProtoReflect.Descriptor instead. func (*RelayFrame) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{190} + return file_openshell_proto_rawDescGZIP(), []int{189} } func (x *RelayFrame) GetPayload() isRelayFrame_Payload { @@ -15319,7 +15177,7 @@ type PeerRelayInit struct { func (x *PeerRelayInit) Reset() { *x = PeerRelayInit{} - mi := &file_openshell_proto_msgTypes[191] + mi := &file_openshell_proto_msgTypes[190] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15331,7 +15189,7 @@ func (x *PeerRelayInit) String() string { func (*PeerRelayInit) ProtoMessage() {} func (x *PeerRelayInit) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[191] + mi := &file_openshell_proto_msgTypes[190] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15344,7 +15202,7 @@ func (x *PeerRelayInit) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerRelayInit.ProtoReflect.Descriptor instead. func (*PeerRelayInit) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{191} + return file_openshell_proto_rawDescGZIP(), []int{190} } func (x *PeerRelayInit) GetSandboxId() string { @@ -15382,7 +15240,7 @@ type PeerRelayFrame struct { func (x *PeerRelayFrame) Reset() { *x = PeerRelayFrame{} - mi := &file_openshell_proto_msgTypes[192] + mi := &file_openshell_proto_msgTypes[191] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15394,7 +15252,7 @@ func (x *PeerRelayFrame) String() string { func (*PeerRelayFrame) ProtoMessage() {} func (x *PeerRelayFrame) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[192] + mi := &file_openshell_proto_msgTypes[191] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15407,7 +15265,7 @@ func (x *PeerRelayFrame) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerRelayFrame.ProtoReflect.Descriptor instead. func (*PeerRelayFrame) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{192} + return file_openshell_proto_rawDescGZIP(), []int{191} } func (x *PeerRelayFrame) GetPayload() isPeerRelayFrame_Payload { @@ -15462,7 +15320,7 @@ type PeerConfigSandboxTarget struct { func (x *PeerConfigSandboxTarget) Reset() { *x = PeerConfigSandboxTarget{} - mi := &file_openshell_proto_msgTypes[193] + mi := &file_openshell_proto_msgTypes[192] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15474,7 +15332,7 @@ func (x *PeerConfigSandboxTarget) String() string { func (*PeerConfigSandboxTarget) ProtoMessage() {} func (x *PeerConfigSandboxTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[193] + mi := &file_openshell_proto_msgTypes[192] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15487,7 +15345,7 @@ func (x *PeerConfigSandboxTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerConfigSandboxTarget.ProtoReflect.Descriptor instead. func (*PeerConfigSandboxTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{193} + return file_openshell_proto_rawDescGZIP(), []int{192} } func (x *PeerConfigSandboxTarget) GetSandboxId() string { @@ -15515,7 +15373,7 @@ type PeerConfigProviderTarget struct { func (x *PeerConfigProviderTarget) Reset() { *x = PeerConfigProviderTarget{} - mi := &file_openshell_proto_msgTypes[194] + mi := &file_openshell_proto_msgTypes[193] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15527,7 +15385,7 @@ func (x *PeerConfigProviderTarget) String() string { func (*PeerConfigProviderTarget) ProtoMessage() {} func (x *PeerConfigProviderTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[194] + mi := &file_openshell_proto_msgTypes[193] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15540,7 +15398,7 @@ func (x *PeerConfigProviderTarget) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerConfigProviderTarget.ProtoReflect.Descriptor instead. func (*PeerConfigProviderTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{194} + return file_openshell_proto_rawDescGZIP(), []int{193} } func (x *PeerConfigProviderTarget) GetWorkspace() string { @@ -15572,7 +15430,7 @@ type PeerNotifyConfigUpdateRequest struct { func (x *PeerNotifyConfigUpdateRequest) Reset() { *x = PeerNotifyConfigUpdateRequest{} - mi := &file_openshell_proto_msgTypes[195] + mi := &file_openshell_proto_msgTypes[194] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15584,7 +15442,7 @@ func (x *PeerNotifyConfigUpdateRequest) String() string { func (*PeerNotifyConfigUpdateRequest) ProtoMessage() {} func (x *PeerNotifyConfigUpdateRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[195] + mi := &file_openshell_proto_msgTypes[194] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15597,7 +15455,7 @@ func (x *PeerNotifyConfigUpdateRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerNotifyConfigUpdateRequest.ProtoReflect.Descriptor instead. func (*PeerNotifyConfigUpdateRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{195} + return file_openshell_proto_rawDescGZIP(), []int{194} } func (x *PeerNotifyConfigUpdateRequest) GetScope() isPeerNotifyConfigUpdateRequest_Scope { @@ -15681,7 +15539,7 @@ type PeerNotifyConfigUpdateResponse struct { func (x *PeerNotifyConfigUpdateResponse) Reset() { *x = PeerNotifyConfigUpdateResponse{} - mi := &file_openshell_proto_msgTypes[196] + mi := &file_openshell_proto_msgTypes[195] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15693,7 +15551,7 @@ func (x *PeerNotifyConfigUpdateResponse) String() string { func (*PeerNotifyConfigUpdateResponse) ProtoMessage() {} func (x *PeerNotifyConfigUpdateResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[196] + mi := &file_openshell_proto_msgTypes[195] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15706,7 +15564,7 @@ func (x *PeerNotifyConfigUpdateResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use PeerNotifyConfigUpdateResponse.ProtoReflect.Descriptor instead. func (*PeerNotifyConfigUpdateResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{196} + return file_openshell_proto_rawDescGZIP(), []int{195} } func (x *PeerNotifyConfigUpdateResponse) GetStaleOwner() bool { @@ -15731,7 +15589,7 @@ type RelayOpenResult struct { func (x *RelayOpenResult) Reset() { *x = RelayOpenResult{} - mi := &file_openshell_proto_msgTypes[197] + mi := &file_openshell_proto_msgTypes[196] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15743,7 +15601,7 @@ func (x *RelayOpenResult) String() string { func (*RelayOpenResult) ProtoMessage() {} func (x *RelayOpenResult) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[197] + mi := &file_openshell_proto_msgTypes[196] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15756,7 +15614,7 @@ func (x *RelayOpenResult) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayOpenResult.ProtoReflect.Descriptor instead. func (*RelayOpenResult) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{197} + return file_openshell_proto_rawDescGZIP(), []int{196} } func (x *RelayOpenResult) GetChannelId() string { @@ -15793,7 +15651,7 @@ type RelayClose struct { func (x *RelayClose) Reset() { *x = RelayClose{} - mi := &file_openshell_proto_msgTypes[198] + mi := &file_openshell_proto_msgTypes[197] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15805,7 +15663,7 @@ func (x *RelayClose) String() string { func (*RelayClose) ProtoMessage() {} func (x *RelayClose) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[198] + mi := &file_openshell_proto_msgTypes[197] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15818,7 +15676,7 @@ func (x *RelayClose) ProtoReflect() protoreflect.Message { // Deprecated: Use RelayClose.ProtoReflect.Descriptor instead. func (*RelayClose) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{198} + return file_openshell_proto_rawDescGZIP(), []int{197} } func (x *RelayClose) GetChannelId() string { @@ -15852,7 +15710,7 @@ type L7RequestSample struct { func (x *L7RequestSample) Reset() { *x = L7RequestSample{} - mi := &file_openshell_proto_msgTypes[199] + mi := &file_openshell_proto_msgTypes[198] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15864,7 +15722,7 @@ func (x *L7RequestSample) String() string { func (*L7RequestSample) ProtoMessage() {} func (x *L7RequestSample) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[199] + mi := &file_openshell_proto_msgTypes[198] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15877,7 +15735,7 @@ func (x *L7RequestSample) ProtoReflect() protoreflect.Message { // Deprecated: Use L7RequestSample.ProtoReflect.Descriptor instead. func (*L7RequestSample) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{199} + return file_openshell_proto_rawDescGZIP(), []int{198} } func (x *L7RequestSample) GetMethod() string { @@ -15951,7 +15809,7 @@ type DenialSummary struct { func (x *DenialSummary) Reset() { *x = DenialSummary{} - mi := &file_openshell_proto_msgTypes[200] + mi := &file_openshell_proto_msgTypes[199] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -15963,7 +15821,7 @@ func (x *DenialSummary) String() string { func (*DenialSummary) ProtoMessage() {} func (x *DenialSummary) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[200] + mi := &file_openshell_proto_msgTypes[199] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -15976,7 +15834,7 @@ func (x *DenialSummary) ProtoReflect() protoreflect.Message { // Deprecated: Use DenialSummary.ProtoReflect.Descriptor instead. func (*DenialSummary) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{200} + return file_openshell_proto_rawDescGZIP(), []int{199} } func (x *DenialSummary) GetSandboxId() string { @@ -16111,7 +15969,7 @@ type DenialGroupCount struct { func (x *DenialGroupCount) Reset() { *x = DenialGroupCount{} - mi := &file_openshell_proto_msgTypes[201] + mi := &file_openshell_proto_msgTypes[200] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16123,7 +15981,7 @@ func (x *DenialGroupCount) String() string { func (*DenialGroupCount) ProtoMessage() {} func (x *DenialGroupCount) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[201] + mi := &file_openshell_proto_msgTypes[200] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16136,7 +15994,7 @@ func (x *DenialGroupCount) ProtoReflect() protoreflect.Message { // Deprecated: Use DenialGroupCount.ProtoReflect.Descriptor instead. func (*DenialGroupCount) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{201} + return file_openshell_proto_rawDescGZIP(), []int{200} } func (x *DenialGroupCount) GetDenyGroup() string { @@ -16169,7 +16027,7 @@ type NetworkActivitySummary struct { func (x *NetworkActivitySummary) Reset() { *x = NetworkActivitySummary{} - mi := &file_openshell_proto_msgTypes[202] + mi := &file_openshell_proto_msgTypes[201] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16181,7 +16039,7 @@ func (x *NetworkActivitySummary) String() string { func (*NetworkActivitySummary) ProtoMessage() {} func (x *NetworkActivitySummary) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[202] + mi := &file_openshell_proto_msgTypes[201] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16194,7 +16052,7 @@ func (x *NetworkActivitySummary) ProtoReflect() protoreflect.Message { // Deprecated: Use NetworkActivitySummary.ProtoReflect.Descriptor instead. func (*NetworkActivitySummary) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{202} + return file_openshell_proto_rawDescGZIP(), []int{201} } func (x *NetworkActivitySummary) GetNetworkActivityCount() uint32 { @@ -16282,7 +16140,7 @@ type PolicyChunk struct { func (x *PolicyChunk) Reset() { *x = PolicyChunk{} - mi := &file_openshell_proto_msgTypes[203] + mi := &file_openshell_proto_msgTypes[202] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16294,7 +16152,7 @@ func (x *PolicyChunk) String() string { func (*PolicyChunk) ProtoMessage() {} func (x *PolicyChunk) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[203] + mi := &file_openshell_proto_msgTypes[202] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16307,7 +16165,7 @@ func (x *PolicyChunk) ProtoReflect() protoreflect.Message { // Deprecated: Use PolicyChunk.ProtoReflect.Descriptor instead. func (*PolicyChunk) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{203} + return file_openshell_proto_rawDescGZIP(), []int{202} } func (x *PolicyChunk) GetId() string { @@ -16495,7 +16353,7 @@ type DraftPolicyUpdate struct { func (x *DraftPolicyUpdate) Reset() { *x = DraftPolicyUpdate{} - mi := &file_openshell_proto_msgTypes[204] + mi := &file_openshell_proto_msgTypes[203] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16507,7 +16365,7 @@ func (x *DraftPolicyUpdate) String() string { func (*DraftPolicyUpdate) ProtoMessage() {} func (x *DraftPolicyUpdate) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[204] + mi := &file_openshell_proto_msgTypes[203] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16520,7 +16378,7 @@ func (x *DraftPolicyUpdate) ProtoReflect() protoreflect.Message { // Deprecated: Use DraftPolicyUpdate.ProtoReflect.Descriptor instead. func (*DraftPolicyUpdate) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{204} + return file_openshell_proto_rawDescGZIP(), []int{203} } func (x *DraftPolicyUpdate) GetDraftVersion() uint64 { @@ -16579,7 +16437,7 @@ type SubmitPolicyAnalysisRequest struct { func (x *SubmitPolicyAnalysisRequest) Reset() { *x = SubmitPolicyAnalysisRequest{} - mi := &file_openshell_proto_msgTypes[205] + mi := &file_openshell_proto_msgTypes[204] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16591,7 +16449,7 @@ func (x *SubmitPolicyAnalysisRequest) String() string { func (*SubmitPolicyAnalysisRequest) ProtoMessage() {} func (x *SubmitPolicyAnalysisRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[205] + mi := &file_openshell_proto_msgTypes[204] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16604,7 +16462,7 @@ func (x *SubmitPolicyAnalysisRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use SubmitPolicyAnalysisRequest.ProtoReflect.Descriptor instead. func (*SubmitPolicyAnalysisRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{205} + return file_openshell_proto_rawDescGZIP(), []int{204} } func (x *SubmitPolicyAnalysisRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -16667,7 +16525,7 @@ type SubmitPolicyAnalysisResponse struct { func (x *SubmitPolicyAnalysisResponse) Reset() { *x = SubmitPolicyAnalysisResponse{} - mi := &file_openshell_proto_msgTypes[206] + mi := &file_openshell_proto_msgTypes[205] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16679,7 +16537,7 @@ func (x *SubmitPolicyAnalysisResponse) String() string { func (*SubmitPolicyAnalysisResponse) ProtoMessage() {} func (x *SubmitPolicyAnalysisResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[206] + mi := &file_openshell_proto_msgTypes[205] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16692,7 +16550,7 @@ func (x *SubmitPolicyAnalysisResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use SubmitPolicyAnalysisResponse.ProtoReflect.Descriptor instead. func (*SubmitPolicyAnalysisResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{206} + return file_openshell_proto_rawDescGZIP(), []int{205} } func (x *SubmitPolicyAnalysisResponse) GetAcceptedChunks() uint32 { @@ -16737,7 +16595,7 @@ type GetDraftPolicyRequest struct { func (x *GetDraftPolicyRequest) Reset() { *x = GetDraftPolicyRequest{} - mi := &file_openshell_proto_msgTypes[207] + mi := &file_openshell_proto_msgTypes[206] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16749,7 +16607,7 @@ func (x *GetDraftPolicyRequest) String() string { func (*GetDraftPolicyRequest) ProtoMessage() {} func (x *GetDraftPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[207] + mi := &file_openshell_proto_msgTypes[206] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16762,7 +16620,7 @@ func (x *GetDraftPolicyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDraftPolicyRequest.ProtoReflect.Descriptor instead. func (*GetDraftPolicyRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{207} + return file_openshell_proto_rawDescGZIP(), []int{206} } func (x *GetDraftPolicyRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -16802,7 +16660,7 @@ type GetDraftPolicyResponse struct { func (x *GetDraftPolicyResponse) Reset() { *x = GetDraftPolicyResponse{} - mi := &file_openshell_proto_msgTypes[208] + mi := &file_openshell_proto_msgTypes[207] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16814,7 +16672,7 @@ func (x *GetDraftPolicyResponse) String() string { func (*GetDraftPolicyResponse) ProtoMessage() {} func (x *GetDraftPolicyResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[208] + mi := &file_openshell_proto_msgTypes[207] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16827,7 +16685,7 @@ func (x *GetDraftPolicyResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDraftPolicyResponse.ProtoReflect.Descriptor instead. func (*GetDraftPolicyResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{208} + return file_openshell_proto_rawDescGZIP(), []int{207} } func (x *GetDraftPolicyResponse) GetChunks() []*PolicyChunk { @@ -16878,7 +16736,7 @@ type ApproveDraftChunkRequest struct { func (x *ApproveDraftChunkRequest) Reset() { *x = ApproveDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[209] + mi := &file_openshell_proto_msgTypes[208] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16890,7 +16748,7 @@ func (x *ApproveDraftChunkRequest) String() string { func (*ApproveDraftChunkRequest) ProtoMessage() {} func (x *ApproveDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[209] + mi := &file_openshell_proto_msgTypes[208] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16903,7 +16761,7 @@ func (x *ApproveDraftChunkRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ApproveDraftChunkRequest.ProtoReflect.Descriptor instead. func (*ApproveDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{209} + return file_openshell_proto_rawDescGZIP(), []int{208} } func (x *ApproveDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -16953,7 +16811,7 @@ type ApproveDraftChunkResponse struct { func (x *ApproveDraftChunkResponse) Reset() { *x = ApproveDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[210] + mi := &file_openshell_proto_msgTypes[209] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -16965,7 +16823,7 @@ func (x *ApproveDraftChunkResponse) String() string { func (*ApproveDraftChunkResponse) ProtoMessage() {} func (x *ApproveDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[210] + mi := &file_openshell_proto_msgTypes[209] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -16978,7 +16836,7 @@ func (x *ApproveDraftChunkResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ApproveDraftChunkResponse.ProtoReflect.Descriptor instead. func (*ApproveDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{210} + return file_openshell_proto_rawDescGZIP(), []int{209} } func (x *ApproveDraftChunkResponse) GetPolicyVersion() uint32 { @@ -17014,7 +16872,7 @@ type RejectDraftChunkRequest struct { func (x *RejectDraftChunkRequest) Reset() { *x = RejectDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[211] + mi := &file_openshell_proto_msgTypes[210] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17026,7 +16884,7 @@ func (x *RejectDraftChunkRequest) String() string { func (*RejectDraftChunkRequest) ProtoMessage() {} func (x *RejectDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[211] + mi := &file_openshell_proto_msgTypes[210] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17039,7 +16897,7 @@ func (x *RejectDraftChunkRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RejectDraftChunkRequest.ProtoReflect.Descriptor instead. func (*RejectDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{211} + return file_openshell_proto_rawDescGZIP(), []int{210} } func (x *RejectDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17085,7 +16943,7 @@ type RejectDraftChunkResponse struct { func (x *RejectDraftChunkResponse) Reset() { *x = RejectDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[212] + mi := &file_openshell_proto_msgTypes[211] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17097,7 +16955,7 @@ func (x *RejectDraftChunkResponse) String() string { func (*RejectDraftChunkResponse) ProtoMessage() {} func (x *RejectDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[212] + mi := &file_openshell_proto_msgTypes[211] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17110,7 +16968,7 @@ func (x *RejectDraftChunkResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RejectDraftChunkResponse.ProtoReflect.Descriptor instead. func (*RejectDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{212} + return file_openshell_proto_rawDescGZIP(), []int{211} } // Approve all pending chunks. @@ -17124,7 +16982,7 @@ type DraftChunkApproval struct { func (x *DraftChunkApproval) Reset() { *x = DraftChunkApproval{} - mi := &file_openshell_proto_msgTypes[213] + mi := &file_openshell_proto_msgTypes[212] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17136,7 +16994,7 @@ func (x *DraftChunkApproval) String() string { func (*DraftChunkApproval) ProtoMessage() {} func (x *DraftChunkApproval) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[213] + mi := &file_openshell_proto_msgTypes[212] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17149,7 +17007,7 @@ func (x *DraftChunkApproval) ProtoReflect() protoreflect.Message { // Deprecated: Use DraftChunkApproval.ProtoReflect.Descriptor instead. func (*DraftChunkApproval) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{213} + return file_openshell_proto_rawDescGZIP(), []int{212} } func (x *DraftChunkApproval) GetChunkId() string { @@ -17185,7 +17043,7 @@ type ApproveAllDraftChunksRequest struct { func (x *ApproveAllDraftChunksRequest) Reset() { *x = ApproveAllDraftChunksRequest{} - mi := &file_openshell_proto_msgTypes[214] + mi := &file_openshell_proto_msgTypes[213] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17197,7 +17055,7 @@ func (x *ApproveAllDraftChunksRequest) String() string { func (*ApproveAllDraftChunksRequest) ProtoMessage() {} func (x *ApproveAllDraftChunksRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[214] + mi := &file_openshell_proto_msgTypes[213] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17210,7 +17068,7 @@ func (x *ApproveAllDraftChunksRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ApproveAllDraftChunksRequest.ProtoReflect.Descriptor instead. func (*ApproveAllDraftChunksRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{214} + return file_openshell_proto_rawDescGZIP(), []int{213} } func (x *ApproveAllDraftChunksRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17265,7 +17123,7 @@ type ApproveAllDraftChunksResponse struct { func (x *ApproveAllDraftChunksResponse) Reset() { *x = ApproveAllDraftChunksResponse{} - mi := &file_openshell_proto_msgTypes[215] + mi := &file_openshell_proto_msgTypes[214] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17277,7 +17135,7 @@ func (x *ApproveAllDraftChunksResponse) String() string { func (*ApproveAllDraftChunksResponse) ProtoMessage() {} func (x *ApproveAllDraftChunksResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[215] + mi := &file_openshell_proto_msgTypes[214] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17290,7 +17148,7 @@ func (x *ApproveAllDraftChunksResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ApproveAllDraftChunksResponse.ProtoReflect.Descriptor instead. func (*ApproveAllDraftChunksResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{215} + return file_openshell_proto_rawDescGZIP(), []int{214} } func (x *ApproveAllDraftChunksResponse) GetPolicyVersion() uint32 { @@ -17340,7 +17198,7 @@ type EditDraftChunkRequest struct { func (x *EditDraftChunkRequest) Reset() { *x = EditDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[216] + mi := &file_openshell_proto_msgTypes[215] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17352,7 +17210,7 @@ func (x *EditDraftChunkRequest) String() string { func (*EditDraftChunkRequest) ProtoMessage() {} func (x *EditDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[216] + mi := &file_openshell_proto_msgTypes[215] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17365,7 +17223,7 @@ func (x *EditDraftChunkRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use EditDraftChunkRequest.ProtoReflect.Descriptor instead. func (*EditDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{216} + return file_openshell_proto_rawDescGZIP(), []int{215} } func (x *EditDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17411,7 +17269,7 @@ type EditDraftChunkResponse struct { func (x *EditDraftChunkResponse) Reset() { *x = EditDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[217] + mi := &file_openshell_proto_msgTypes[216] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17423,7 +17281,7 @@ func (x *EditDraftChunkResponse) String() string { func (*EditDraftChunkResponse) ProtoMessage() {} func (x *EditDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[217] + mi := &file_openshell_proto_msgTypes[216] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17436,7 +17294,7 @@ func (x *EditDraftChunkResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use EditDraftChunkResponse.ProtoReflect.Descriptor instead. func (*EditDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{217} + return file_openshell_proto_rawDescGZIP(), []int{216} } // Reverse an approval (remove merged rule from active policy). @@ -17456,7 +17314,7 @@ type UndoDraftChunkRequest struct { func (x *UndoDraftChunkRequest) Reset() { *x = UndoDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[218] + mi := &file_openshell_proto_msgTypes[217] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17468,7 +17326,7 @@ func (x *UndoDraftChunkRequest) String() string { func (*UndoDraftChunkRequest) ProtoMessage() {} func (x *UndoDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[218] + mi := &file_openshell_proto_msgTypes[217] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17481,7 +17339,7 @@ func (x *UndoDraftChunkRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UndoDraftChunkRequest.ProtoReflect.Descriptor instead. func (*UndoDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{218} + return file_openshell_proto_rawDescGZIP(), []int{217} } func (x *UndoDraftChunkRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17524,7 +17382,7 @@ type UndoDraftChunkResponse struct { func (x *UndoDraftChunkResponse) Reset() { *x = UndoDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[219] + mi := &file_openshell_proto_msgTypes[218] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17536,7 +17394,7 @@ func (x *UndoDraftChunkResponse) String() string { func (*UndoDraftChunkResponse) ProtoMessage() {} func (x *UndoDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[219] + mi := &file_openshell_proto_msgTypes[218] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17549,7 +17407,7 @@ func (x *UndoDraftChunkResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use UndoDraftChunkResponse.ProtoReflect.Descriptor instead. func (*UndoDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{219} + return file_openshell_proto_rawDescGZIP(), []int{218} } func (x *UndoDraftChunkResponse) GetPolicyVersion() uint32 { @@ -17581,7 +17439,7 @@ type ClearDraftChunksRequest struct { func (x *ClearDraftChunksRequest) Reset() { *x = ClearDraftChunksRequest{} - mi := &file_openshell_proto_msgTypes[220] + mi := &file_openshell_proto_msgTypes[219] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17593,7 +17451,7 @@ func (x *ClearDraftChunksRequest) String() string { func (*ClearDraftChunksRequest) ProtoMessage() {} func (x *ClearDraftChunksRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[220] + mi := &file_openshell_proto_msgTypes[219] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17606,7 +17464,7 @@ func (x *ClearDraftChunksRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ClearDraftChunksRequest.ProtoReflect.Descriptor instead. func (*ClearDraftChunksRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{220} + return file_openshell_proto_rawDescGZIP(), []int{219} } func (x *ClearDraftChunksRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17640,7 +17498,7 @@ type ClearDraftChunksResponse struct { func (x *ClearDraftChunksResponse) Reset() { *x = ClearDraftChunksResponse{} - mi := &file_openshell_proto_msgTypes[221] + mi := &file_openshell_proto_msgTypes[220] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17652,7 +17510,7 @@ func (x *ClearDraftChunksResponse) String() string { func (*ClearDraftChunksResponse) ProtoMessage() {} func (x *ClearDraftChunksResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[221] + mi := &file_openshell_proto_msgTypes[220] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17665,7 +17523,7 @@ func (x *ClearDraftChunksResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ClearDraftChunksResponse.ProtoReflect.Descriptor instead. func (*ClearDraftChunksResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{221} + return file_openshell_proto_rawDescGZIP(), []int{220} } func (x *ClearDraftChunksResponse) GetChunksCleared() uint32 { @@ -17687,7 +17545,7 @@ type GetDraftHistoryRequest struct { func (x *GetDraftHistoryRequest) Reset() { *x = GetDraftHistoryRequest{} - mi := &file_openshell_proto_msgTypes[222] + mi := &file_openshell_proto_msgTypes[221] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17699,7 +17557,7 @@ func (x *GetDraftHistoryRequest) String() string { func (*GetDraftHistoryRequest) ProtoMessage() {} func (x *GetDraftHistoryRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[222] + mi := &file_openshell_proto_msgTypes[221] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17712,7 +17570,7 @@ func (x *GetDraftHistoryRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDraftHistoryRequest.ProtoReflect.Descriptor instead. func (*GetDraftHistoryRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{222} + return file_openshell_proto_rawDescGZIP(), []int{221} } func (x *GetDraftHistoryRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -17746,7 +17604,7 @@ type DraftHistoryEntry struct { func (x *DraftHistoryEntry) Reset() { *x = DraftHistoryEntry{} - mi := &file_openshell_proto_msgTypes[223] + mi := &file_openshell_proto_msgTypes[222] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17758,7 +17616,7 @@ func (x *DraftHistoryEntry) String() string { func (*DraftHistoryEntry) ProtoMessage() {} func (x *DraftHistoryEntry) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[223] + mi := &file_openshell_proto_msgTypes[222] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17771,7 +17629,7 @@ func (x *DraftHistoryEntry) ProtoReflect() protoreflect.Message { // Deprecated: Use DraftHistoryEntry.ProtoReflect.Descriptor instead. func (*DraftHistoryEntry) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{223} + return file_openshell_proto_rawDescGZIP(), []int{222} } func (x *DraftHistoryEntry) GetEventTime() *timestamppb.Timestamp { @@ -17812,7 +17670,7 @@ type GetDraftHistoryResponse struct { func (x *GetDraftHistoryResponse) Reset() { *x = GetDraftHistoryResponse{} - mi := &file_openshell_proto_msgTypes[224] + mi := &file_openshell_proto_msgTypes[223] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17824,7 +17682,7 @@ func (x *GetDraftHistoryResponse) String() string { func (*GetDraftHistoryResponse) ProtoMessage() {} func (x *GetDraftHistoryResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[224] + mi := &file_openshell_proto_msgTypes[223] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17837,7 +17695,7 @@ func (x *GetDraftHistoryResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDraftHistoryResponse.ProtoReflect.Descriptor instead. func (*GetDraftHistoryResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{224} + return file_openshell_proto_rawDescGZIP(), []int{223} } func (x *GetDraftHistoryResponse) GetEntries() []*DraftHistoryEntry { @@ -17862,7 +17720,7 @@ type CreateWorkspaceRequest struct { func (x *CreateWorkspaceRequest) Reset() { *x = CreateWorkspaceRequest{} - mi := &file_openshell_proto_msgTypes[225] + mi := &file_openshell_proto_msgTypes[224] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17874,7 +17732,7 @@ func (x *CreateWorkspaceRequest) String() string { func (*CreateWorkspaceRequest) ProtoMessage() {} func (x *CreateWorkspaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[225] + mi := &file_openshell_proto_msgTypes[224] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17887,7 +17745,7 @@ func (x *CreateWorkspaceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateWorkspaceRequest.ProtoReflect.Descriptor instead. func (*CreateWorkspaceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{225} + return file_openshell_proto_rawDescGZIP(), []int{224} } func (x *CreateWorkspaceRequest) GetName() string { @@ -17921,7 +17779,7 @@ type CreateWorkspaceResponse struct { func (x *CreateWorkspaceResponse) Reset() { *x = CreateWorkspaceResponse{} - mi := &file_openshell_proto_msgTypes[226] + mi := &file_openshell_proto_msgTypes[225] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17933,7 +17791,7 @@ func (x *CreateWorkspaceResponse) String() string { func (*CreateWorkspaceResponse) ProtoMessage() {} func (x *CreateWorkspaceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[226] + mi := &file_openshell_proto_msgTypes[225] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17946,7 +17804,7 @@ func (x *CreateWorkspaceResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateWorkspaceResponse.ProtoReflect.Descriptor instead. func (*CreateWorkspaceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{226} + return file_openshell_proto_rawDescGZIP(), []int{225} } func (x *CreateWorkspaceResponse) GetWorkspace() *datamodelv1.Workspace { @@ -17967,7 +17825,7 @@ type GetWorkspaceRequest struct { func (x *GetWorkspaceRequest) Reset() { *x = GetWorkspaceRequest{} - mi := &file_openshell_proto_msgTypes[227] + mi := &file_openshell_proto_msgTypes[226] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -17979,7 +17837,7 @@ func (x *GetWorkspaceRequest) String() string { func (*GetWorkspaceRequest) ProtoMessage() {} func (x *GetWorkspaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[227] + mi := &file_openshell_proto_msgTypes[226] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -17992,7 +17850,7 @@ func (x *GetWorkspaceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetWorkspaceRequest.ProtoReflect.Descriptor instead. func (*GetWorkspaceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{227} + return file_openshell_proto_rawDescGZIP(), []int{226} } func (x *GetWorkspaceRequest) GetName() string { @@ -18012,7 +17870,7 @@ type GetWorkspaceResponse struct { func (x *GetWorkspaceResponse) Reset() { *x = GetWorkspaceResponse{} - mi := &file_openshell_proto_msgTypes[228] + mi := &file_openshell_proto_msgTypes[227] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18024,7 +17882,7 @@ func (x *GetWorkspaceResponse) String() string { func (*GetWorkspaceResponse) ProtoMessage() {} func (x *GetWorkspaceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[228] + mi := &file_openshell_proto_msgTypes[227] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18037,7 +17895,7 @@ func (x *GetWorkspaceResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use GetWorkspaceResponse.ProtoReflect.Descriptor instead. func (*GetWorkspaceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{228} + return file_openshell_proto_rawDescGZIP(), []int{227} } func (x *GetWorkspaceResponse) GetWorkspace() *datamodelv1.Workspace { @@ -18064,7 +17922,7 @@ type ListWorkspacesRequest struct { func (x *ListWorkspacesRequest) Reset() { *x = ListWorkspacesRequest{} - mi := &file_openshell_proto_msgTypes[229] + mi := &file_openshell_proto_msgTypes[228] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18076,7 +17934,7 @@ func (x *ListWorkspacesRequest) String() string { func (*ListWorkspacesRequest) ProtoMessage() {} func (x *ListWorkspacesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[229] + mi := &file_openshell_proto_msgTypes[228] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18089,7 +17947,7 @@ func (x *ListWorkspacesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkspacesRequest.ProtoReflect.Descriptor instead. func (*ListWorkspacesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{229} + return file_openshell_proto_rawDescGZIP(), []int{228} } func (x *ListWorkspacesRequest) GetPageSize() int32 { @@ -18125,7 +17983,7 @@ type ListWorkspacesResponse struct { func (x *ListWorkspacesResponse) Reset() { *x = ListWorkspacesResponse{} - mi := &file_openshell_proto_msgTypes[230] + mi := &file_openshell_proto_msgTypes[229] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18137,7 +17995,7 @@ func (x *ListWorkspacesResponse) String() string { func (*ListWorkspacesResponse) ProtoMessage() {} func (x *ListWorkspacesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[230] + mi := &file_openshell_proto_msgTypes[229] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18150,7 +18008,7 @@ func (x *ListWorkspacesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkspacesResponse.ProtoReflect.Descriptor instead. func (*ListWorkspacesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{230} + return file_openshell_proto_rawDescGZIP(), []int{229} } func (x *ListWorkspacesResponse) GetWorkspaces() []*datamodelv1.Workspace { @@ -18181,7 +18039,7 @@ type DeleteWorkspaceRequest struct { func (x *DeleteWorkspaceRequest) Reset() { *x = DeleteWorkspaceRequest{} - mi := &file_openshell_proto_msgTypes[231] + mi := &file_openshell_proto_msgTypes[230] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18193,7 +18051,7 @@ func (x *DeleteWorkspaceRequest) String() string { func (*DeleteWorkspaceRequest) ProtoMessage() {} func (x *DeleteWorkspaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[231] + mi := &file_openshell_proto_msgTypes[230] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18206,7 +18064,7 @@ func (x *DeleteWorkspaceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteWorkspaceRequest.ProtoReflect.Descriptor instead. func (*DeleteWorkspaceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{231} + return file_openshell_proto_rawDescGZIP(), []int{230} } func (x *DeleteWorkspaceRequest) GetName() string { @@ -18240,7 +18098,7 @@ type DeleteWorkspaceResponse struct { func (x *DeleteWorkspaceResponse) Reset() { *x = DeleteWorkspaceResponse{} - mi := &file_openshell_proto_msgTypes[232] + mi := &file_openshell_proto_msgTypes[231] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18252,7 +18110,7 @@ func (x *DeleteWorkspaceResponse) String() string { func (*DeleteWorkspaceResponse) ProtoMessage() {} func (x *DeleteWorkspaceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[232] + mi := &file_openshell_proto_msgTypes[231] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18265,7 +18123,7 @@ func (x *DeleteWorkspaceResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteWorkspaceResponse.ProtoReflect.Descriptor instead. func (*DeleteWorkspaceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{232} + return file_openshell_proto_rawDescGZIP(), []int{231} } func (x *DeleteWorkspaceResponse) GetOutcome() DeletionOutcome { @@ -18289,7 +18147,7 @@ type WorkspaceMember struct { func (x *WorkspaceMember) Reset() { *x = WorkspaceMember{} - mi := &file_openshell_proto_msgTypes[233] + mi := &file_openshell_proto_msgTypes[232] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18301,7 +18159,7 @@ func (x *WorkspaceMember) String() string { func (*WorkspaceMember) ProtoMessage() {} func (x *WorkspaceMember) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[233] + mi := &file_openshell_proto_msgTypes[232] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18314,7 +18172,7 @@ func (x *WorkspaceMember) ProtoReflect() protoreflect.Message { // Deprecated: Use WorkspaceMember.ProtoReflect.Descriptor instead. func (*WorkspaceMember) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{233} + return file_openshell_proto_rawDescGZIP(), []int{232} } func (x *WorkspaceMember) GetMetadata() *datamodelv1.ObjectMeta { @@ -18355,7 +18213,7 @@ type AddWorkspaceMemberRequest struct { func (x *AddWorkspaceMemberRequest) Reset() { *x = AddWorkspaceMemberRequest{} - mi := &file_openshell_proto_msgTypes[234] + mi := &file_openshell_proto_msgTypes[233] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18367,7 +18225,7 @@ func (x *AddWorkspaceMemberRequest) String() string { func (*AddWorkspaceMemberRequest) ProtoMessage() {} func (x *AddWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[234] + mi := &file_openshell_proto_msgTypes[233] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18380,7 +18238,7 @@ func (x *AddWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use AddWorkspaceMemberRequest.ProtoReflect.Descriptor instead. func (*AddWorkspaceMemberRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{234} + return file_openshell_proto_rawDescGZIP(), []int{233} } func (x *AddWorkspaceMemberRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -18421,7 +18279,7 @@ type AddWorkspaceMemberResponse struct { func (x *AddWorkspaceMemberResponse) Reset() { *x = AddWorkspaceMemberResponse{} - mi := &file_openshell_proto_msgTypes[235] + mi := &file_openshell_proto_msgTypes[234] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18433,7 +18291,7 @@ func (x *AddWorkspaceMemberResponse) String() string { func (*AddWorkspaceMemberResponse) ProtoMessage() {} func (x *AddWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[235] + mi := &file_openshell_proto_msgTypes[234] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18446,7 +18304,7 @@ func (x *AddWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use AddWorkspaceMemberResponse.ProtoReflect.Descriptor instead. func (*AddWorkspaceMemberResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{235} + return file_openshell_proto_rawDescGZIP(), []int{234} } func (x *AddWorkspaceMemberResponse) GetMember() *WorkspaceMember { @@ -18472,7 +18330,7 @@ type RemoveWorkspaceMemberRequest struct { func (x *RemoveWorkspaceMemberRequest) Reset() { *x = RemoveWorkspaceMemberRequest{} - mi := &file_openshell_proto_msgTypes[236] + mi := &file_openshell_proto_msgTypes[235] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18484,7 +18342,7 @@ func (x *RemoveWorkspaceMemberRequest) String() string { func (*RemoveWorkspaceMemberRequest) ProtoMessage() {} func (x *RemoveWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[236] + mi := &file_openshell_proto_msgTypes[235] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18497,7 +18355,7 @@ func (x *RemoveWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveWorkspaceMemberRequest.ProtoReflect.Descriptor instead. func (*RemoveWorkspaceMemberRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{236} + return file_openshell_proto_rawDescGZIP(), []int{235} } func (x *RemoveWorkspaceMemberRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -18538,7 +18396,7 @@ type RemoveWorkspaceMemberResponse struct { func (x *RemoveWorkspaceMemberResponse) Reset() { *x = RemoveWorkspaceMemberResponse{} - mi := &file_openshell_proto_msgTypes[237] + mi := &file_openshell_proto_msgTypes[236] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18550,7 +18408,7 @@ func (x *RemoveWorkspaceMemberResponse) String() string { func (*RemoveWorkspaceMemberResponse) ProtoMessage() {} func (x *RemoveWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[237] + mi := &file_openshell_proto_msgTypes[236] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18563,7 +18421,7 @@ func (x *RemoveWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RemoveWorkspaceMemberResponse.ProtoReflect.Descriptor instead. func (*RemoveWorkspaceMemberResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{237} + return file_openshell_proto_rawDescGZIP(), []int{236} } func (x *RemoveWorkspaceMemberResponse) GetOutcome() DeletionOutcome { @@ -18590,7 +18448,7 @@ type ListWorkspaceMembersRequest struct { func (x *ListWorkspaceMembersRequest) Reset() { *x = ListWorkspaceMembersRequest{} - mi := &file_openshell_proto_msgTypes[238] + mi := &file_openshell_proto_msgTypes[237] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18602,7 +18460,7 @@ func (x *ListWorkspaceMembersRequest) String() string { func (*ListWorkspaceMembersRequest) ProtoMessage() {} func (x *ListWorkspaceMembersRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[238] + mi := &file_openshell_proto_msgTypes[237] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18615,7 +18473,7 @@ func (x *ListWorkspaceMembersRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkspaceMembersRequest.ProtoReflect.Descriptor instead. func (*ListWorkspaceMembersRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{238} + return file_openshell_proto_rawDescGZIP(), []int{237} } func (x *ListWorkspaceMembersRequest) GetWorkspaceScope() *datamodelv1.WorkspaceSelector { @@ -18651,7 +18509,7 @@ type ListWorkspaceMembersResponse struct { func (x *ListWorkspaceMembersResponse) Reset() { *x = ListWorkspaceMembersResponse{} - mi := &file_openshell_proto_msgTypes[239] + mi := &file_openshell_proto_msgTypes[238] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18663,7 +18521,7 @@ func (x *ListWorkspaceMembersResponse) String() string { func (*ListWorkspaceMembersResponse) ProtoMessage() {} func (x *ListWorkspaceMembersResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[239] + mi := &file_openshell_proto_msgTypes[238] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18676,7 +18534,7 @@ func (x *ListWorkspaceMembersResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkspaceMembersResponse.ProtoReflect.Descriptor instead. func (*ListWorkspaceMembersResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{239} + return file_openshell_proto_rawDescGZIP(), []int{238} } func (x *ListWorkspaceMembersResponse) GetMembers() []*WorkspaceMember { @@ -18711,7 +18569,7 @@ type ExtensionServiceCredential struct { func (x *ExtensionServiceCredential) Reset() { *x = ExtensionServiceCredential{} - mi := &file_openshell_proto_msgTypes[240] + mi := &file_openshell_proto_msgTypes[239] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18723,7 +18581,7 @@ func (x *ExtensionServiceCredential) String() string { func (*ExtensionServiceCredential) ProtoMessage() {} func (x *ExtensionServiceCredential) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[240] + mi := &file_openshell_proto_msgTypes[239] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18736,7 +18594,7 @@ func (x *ExtensionServiceCredential) ProtoReflect() protoreflect.Message { // Deprecated: Use ExtensionServiceCredential.ProtoReflect.Descriptor instead. func (*ExtensionServiceCredential) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{240} + return file_openshell_proto_rawDescGZIP(), []int{239} } func (x *ExtensionServiceCredential) GetServiceName() string { @@ -18776,7 +18634,7 @@ type EndpointObservation struct { func (x *EndpointObservation) Reset() { *x = EndpointObservation{} - mi := &file_openshell_proto_msgTypes[241] + mi := &file_openshell_proto_msgTypes[240] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18788,7 +18646,7 @@ func (x *EndpointObservation) String() string { func (*EndpointObservation) ProtoMessage() {} func (x *EndpointObservation) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[241] + mi := &file_openshell_proto_msgTypes[240] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18801,7 +18659,7 @@ func (x *EndpointObservation) ProtoReflect() protoreflect.Message { // Deprecated: Use EndpointObservation.ProtoReflect.Descriptor instead. func (*EndpointObservation) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{241} + return file_openshell_proto_rawDescGZIP(), []int{240} } func (x *EndpointObservation) GetEndpointId() string { @@ -18854,7 +18712,7 @@ type ReportEndpointStatusRequest struct { func (x *ReportEndpointStatusRequest) Reset() { *x = ReportEndpointStatusRequest{} - mi := &file_openshell_proto_msgTypes[242] + mi := &file_openshell_proto_msgTypes[241] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18866,7 +18724,7 @@ func (x *ReportEndpointStatusRequest) String() string { func (*ReportEndpointStatusRequest) ProtoMessage() {} func (x *ReportEndpointStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[242] + mi := &file_openshell_proto_msgTypes[241] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18879,7 +18737,7 @@ func (x *ReportEndpointStatusRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportEndpointStatusRequest.ProtoReflect.Descriptor instead. func (*ReportEndpointStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{242} + return file_openshell_proto_rawDescGZIP(), []int{241} } func (x *ReportEndpointStatusRequest) GetSandboxId() string { @@ -18948,7 +18806,7 @@ type TokenGrantStatus struct { func (x *TokenGrantStatus) Reset() { *x = TokenGrantStatus{} - mi := &file_openshell_proto_msgTypes[243] + mi := &file_openshell_proto_msgTypes[242] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -18960,7 +18818,7 @@ func (x *TokenGrantStatus) String() string { func (*TokenGrantStatus) ProtoMessage() {} func (x *TokenGrantStatus) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[243] + mi := &file_openshell_proto_msgTypes[242] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -18973,7 +18831,7 @@ func (x *TokenGrantStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use TokenGrantStatus.ProtoReflect.Descriptor instead. func (*TokenGrantStatus) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{243} + return file_openshell_proto_rawDescGZIP(), []int{242} } func (x *TokenGrantStatus) GetLastFailure() *TokenGrantFailureObservation { @@ -19000,7 +18858,7 @@ type TokenGrantFailureObservation struct { func (x *TokenGrantFailureObservation) Reset() { *x = TokenGrantFailureObservation{} - mi := &file_openshell_proto_msgTypes[244] + mi := &file_openshell_proto_msgTypes[243] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19012,7 +18870,7 @@ func (x *TokenGrantFailureObservation) String() string { func (*TokenGrantFailureObservation) ProtoMessage() {} func (x *TokenGrantFailureObservation) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[244] + mi := &file_openshell_proto_msgTypes[243] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19025,7 +18883,7 @@ func (x *TokenGrantFailureObservation) ProtoReflect() protoreflect.Message { // Deprecated: Use TokenGrantFailureObservation.ProtoReflect.Descriptor instead. func (*TokenGrantFailureObservation) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{244} + return file_openshell_proto_rawDescGZIP(), []int{243} } func (x *TokenGrantFailureObservation) GetDestinationHost() string { @@ -19058,7 +18916,7 @@ type ReportEndpointStatusResponse struct { func (x *ReportEndpointStatusResponse) Reset() { *x = ReportEndpointStatusResponse{} - mi := &file_openshell_proto_msgTypes[245] + mi := &file_openshell_proto_msgTypes[244] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19070,7 +18928,7 @@ func (x *ReportEndpointStatusResponse) String() string { func (*ReportEndpointStatusResponse) ProtoMessage() {} func (x *ReportEndpointStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[245] + mi := &file_openshell_proto_msgTypes[244] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19083,7 +18941,7 @@ func (x *ReportEndpointStatusResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportEndpointStatusResponse.ProtoReflect.Descriptor instead. func (*ReportEndpointStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{245} + return file_openshell_proto_rawDescGZIP(), []int{244} } // A configured endpoint and its last accepted network result in one record. @@ -19117,7 +18975,7 @@ type EndpointStatus struct { func (x *EndpointStatus) Reset() { *x = EndpointStatus{} - mi := &file_openshell_proto_msgTypes[246] + mi := &file_openshell_proto_msgTypes[245] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19129,7 +18987,7 @@ func (x *EndpointStatus) String() string { func (*EndpointStatus) ProtoMessage() {} func (x *EndpointStatus) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[246] + mi := &file_openshell_proto_msgTypes[245] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19142,7 +19000,7 @@ func (x *EndpointStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use EndpointStatus.ProtoReflect.Descriptor instead. func (*EndpointStatus) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{246} + return file_openshell_proto_rawDescGZIP(), []int{245} } func (x *EndpointStatus) GetEndpointId() string { @@ -19237,7 +19095,7 @@ type SandboxProvisioning struct { func (x *SandboxProvisioning) Reset() { *x = SandboxProvisioning{} - mi := &file_openshell_proto_msgTypes[247] + mi := &file_openshell_proto_msgTypes[246] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19249,7 +19107,7 @@ func (x *SandboxProvisioning) String() string { func (*SandboxProvisioning) ProtoMessage() {} func (x *SandboxProvisioning) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[247] + mi := &file_openshell_proto_msgTypes[246] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19262,7 +19120,7 @@ func (x *SandboxProvisioning) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxProvisioning.ProtoReflect.Descriptor instead. func (*SandboxProvisioning) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{247} + return file_openshell_proto_rawDescGZIP(), []int{246} } func (x *SandboxProvisioning) GetAttemptId() string { @@ -19385,7 +19243,7 @@ type SandboxServiceExposure struct { func (x *SandboxServiceExposure) Reset() { *x = SandboxServiceExposure{} - mi := &file_openshell_proto_msgTypes[248] + mi := &file_openshell_proto_msgTypes[247] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19397,7 +19255,7 @@ func (x *SandboxServiceExposure) String() string { func (*SandboxServiceExposure) ProtoMessage() {} func (x *SandboxServiceExposure) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[248] + mi := &file_openshell_proto_msgTypes[247] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19410,7 +19268,7 @@ func (x *SandboxServiceExposure) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxServiceExposure.ProtoReflect.Descriptor instead. func (*SandboxServiceExposure) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{248} + return file_openshell_proto_rawDescGZIP(), []int{247} } func (x *SandboxServiceExposure) GetService() string { @@ -19464,7 +19322,7 @@ type EndpointFailure struct { func (x *EndpointFailure) Reset() { *x = EndpointFailure{} - mi := &file_openshell_proto_msgTypes[249] + mi := &file_openshell_proto_msgTypes[248] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -19476,7 +19334,7 @@ func (x *EndpointFailure) String() string { func (*EndpointFailure) ProtoMessage() {} func (x *EndpointFailure) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[249] + mi := &file_openshell_proto_msgTypes[248] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -19489,7 +19347,7 @@ func (x *EndpointFailure) ProtoReflect() protoreflect.Message { // Deprecated: Use EndpointFailure.ProtoReflect.Descriptor instead. func (*EndpointFailure) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{249} + return file_openshell_proto_rawDescGZIP(), []int{248} } func (x *EndpointFailure) GetDomain() EndpointFailureDomain { @@ -20354,31 +20212,20 @@ const file_openshell_proto_rawDesc = "" + "\n" + "request_id\x18\x04 \x01(\tR\trequestId\"g\n" + "\x1dDeleteProviderProfileResponse\x127\n" + - "\aoutcome\x18\x02 \x01(\x0e2\x1d.openshell.v1.DeletionOutcomeR\aoutcomeJ\x04\b\x01\x10\x02R\adeleted\"\xc5\x02\n" + + "\aoutcome\x18\x02 \x01(\x0e2\x1d.openshell.v1.DeletionOutcomeR\aoutcomeJ\x04\b\x01\x10\x02R\adeleted\"\xf4\x01\n" + "$GetSandboxProviderEnvironmentRequest\x12\x1d\n" + "\n" + "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12M\n" + "#supports_static_credential_bindings\x18\x02 \x01(\bR supportsStaticCredentialBindings\x12^\n" + - ",supports_stable_placeholder_environment_keys\x18\x03 \x01(\bR(supportsStablePlaceholderEnvironmentKeys\x12O\n" + - "$supports_static_credential_placement\x18\x04 \x01(\bR!supportsStaticCredentialPlacement\"]\n" + + ",supports_stable_placeholder_environment_keys\x18\x03 \x01(\bR(supportsStablePlaceholderEnvironmentKeys\"]\n" + "\x1fStaticCredentialEndpointBinding\x12\x12\n" + "\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" + "\x04port\x18\x02 \x01(\rR\x04port\x12\x12\n" + - "\x04path\x18\x03 \x01(\tR\x04path\"\xb9\x01\n" + - "\x19StaticCredentialPlacement\x12!\n" + - "\vheader_name\x18\x01 \x01(\tH\x00R\n" + - "headerName\x12!\n" + - "\vquery_param\x18\x02 \x01(\tH\x00R\n" + - "queryParam\x12%\n" + - "\rpath_template\x18\x03 \x01(\tH\x00R\fpathTemplate\x12#\n" + - "\fsigning_only\x18\x04 \x01(\bH\x00R\vsigningOnlyB\n" + - "\n" + - "\blocation\"\x9c\x02\n" + + "\x04path\x18\x03 \x01(\tR\x04path\"\xd5\x01\n" + "\x17StaticCredentialBinding\x12K\n" + "\tendpoints\x18\x01 \x03(\v2-.openshell.v1.StaticCredentialEndpointBindingR\tendpoints\x12/\n" + "\x13credential_identity\x18\x02 \x01(\tR\x12credentialIdentity\x12<\n" + - "\x1aworkload_credential_handle\x18\x03 \x01(\tR\x18workloadCredentialHandle\x12E\n" + - "\tplacement\x18\x04 \x01(\v2'.openshell.v1.StaticCredentialPlacementR\tplacement\"\xc9\f\n" + + "\x1aworkload_credential_handle\x18\x03 \x01(\tR\x18workloadCredentialHandle\"\xc9\f\n" + "%GetSandboxProviderEnvironmentResponse\x12l\n" + "\venvironment\x18\x01 \x03(\v2D.openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntryB\x04\x88\xb5\x18\x01R\venvironment\x122\n" + "\x15provider_env_revision\x18\x02 \x01(\x04R\x13providerEnvRevision\x12\x92\x01\n" + @@ -20604,7 +20451,7 @@ const file_openshell_proto_rawDesc = "" + "relayClose\x12J\n" + "\x10session_redirect\x18\x06 \x01(\v2\x1d.openshell.v1.SessionRedirectH\x00R\x0fsessionRedirect\x12A\n" + "\rconfig_update\x18\a \x01(\v2\x1a.openshell.v1.ConfigUpdateH\x00R\fconfigUpdateB\t\n" + - "\apayload\"\x9b\x03\n" + + "\apayload\"\xca\x02\n" + "\x0fSupervisorHello\x12\x1d\n" + "\n" + "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1f\n" + @@ -20616,8 +20463,7 @@ const file_openshell_proto_rawDesc = "" + "redirected\x18\x05 \x01(\bR\n" + "redirected\x12:\n" + "\x19supports_session_redirect\x18\x06 \x01(\bR\x17supportsSessionRedirect\x120\n" + - "\x14supports_config_push\x18\a \x01(\bR\x12supportsConfigPush\x12O\n" + - "$supports_static_credential_placement\x18\b \x01(\bR!supportsStaticCredentialPlacement\"\x83\x02\n" + + "\x14supports_config_push\x18\a \x01(\bR\x12supportsConfigPush\"\x83\x02\n" + "\x0fSessionAccepted\x12\x1d\n" + "\n" + "session_id\x18\x01 \x01(\tR\tsessionId\x128\n" + @@ -21358,7 +21204,7 @@ func file_openshell_proto_rawDescGZIP() []byte { } var file_openshell_proto_enumTypes = make([]protoimpl.EnumInfo, 22) -var file_openshell_proto_msgTypes = make([]protoimpl.MessageInfo, 276) +var file_openshell_proto_msgTypes = make([]protoimpl.MessageInfo, 275) var file_openshell_proto_goTypes = []any{ (ExtensionKind)(0), // 0: openshell.v1.ExtensionKind (SandboxPhase)(0), // 1: openshell.v1.SandboxPhase @@ -21521,169 +21367,168 @@ var file_openshell_proto_goTypes = []any{ (*DeleteProviderProfileResponse)(nil), // 158: openshell.v1.DeleteProviderProfileResponse (*GetSandboxProviderEnvironmentRequest)(nil), // 159: openshell.v1.GetSandboxProviderEnvironmentRequest (*StaticCredentialEndpointBinding)(nil), // 160: openshell.v1.StaticCredentialEndpointBinding - (*StaticCredentialPlacement)(nil), // 161: openshell.v1.StaticCredentialPlacement - (*StaticCredentialBinding)(nil), // 162: openshell.v1.StaticCredentialBinding - (*GetSandboxProviderEnvironmentResponse)(nil), // 163: openshell.v1.GetSandboxProviderEnvironmentResponse - (*ProviderEnvironmentValue)(nil), // 164: openshell.v1.ProviderEnvironmentValue - (*ProviderEnvironmentSnapshot)(nil), // 165: openshell.v1.ProviderEnvironmentSnapshot - (*ExchangeProviderSubjectTokenRequest)(nil), // 166: openshell.v1.ExchangeProviderSubjectTokenRequest - (*ExchangeProviderSubjectTokenResponse)(nil), // 167: openshell.v1.ExchangeProviderSubjectTokenResponse - (*UpdateConfigRequest)(nil), // 168: openshell.v1.UpdateConfigRequest - (*PolicyMergeOperation)(nil), // 169: openshell.v1.PolicyMergeOperation - (*AddNetworkRule)(nil), // 170: openshell.v1.AddNetworkRule - (*RemoveNetworkEndpoint)(nil), // 171: openshell.v1.RemoveNetworkEndpoint - (*RemoveNetworkRule)(nil), // 172: openshell.v1.RemoveNetworkRule - (*L7RuleTarget)(nil), // 173: openshell.v1.L7RuleTarget - (*AddDenyRules)(nil), // 174: openshell.v1.AddDenyRules - (*AddAllowRules)(nil), // 175: openshell.v1.AddAllowRules - (*RemoveNetworkBinary)(nil), // 176: openshell.v1.RemoveNetworkBinary - (*UpdateConfigResponse)(nil), // 177: openshell.v1.UpdateConfigResponse - (*GetSandboxPolicyStatusRequest)(nil), // 178: openshell.v1.GetSandboxPolicyStatusRequest - (*GetSandboxPolicyStatusResponse)(nil), // 179: openshell.v1.GetSandboxPolicyStatusResponse - (*ListSandboxPoliciesRequest)(nil), // 180: openshell.v1.ListSandboxPoliciesRequest - (*ListSandboxPoliciesResponse)(nil), // 181: openshell.v1.ListSandboxPoliciesResponse - (*ReportPolicyStatusRequest)(nil), // 182: openshell.v1.ReportPolicyStatusRequest - (*ReportPolicyStatusResponse)(nil), // 183: openshell.v1.ReportPolicyStatusResponse - (*SandboxConfigurationAdmission)(nil), // 184: openshell.v1.SandboxConfigurationAdmission - (*ReportSandboxConfigurationRequest)(nil), // 185: openshell.v1.ReportSandboxConfigurationRequest - (*ReportSandboxConfigurationResponse)(nil), // 186: openshell.v1.ReportSandboxConfigurationResponse - (*SandboxPolicyRevision)(nil), // 187: openshell.v1.SandboxPolicyRevision - (*GetSandboxLogsRequest)(nil), // 188: openshell.v1.GetSandboxLogsRequest - (*PushSandboxLogsRequest)(nil), // 189: openshell.v1.PushSandboxLogsRequest - (*PushSandboxLogsResponse)(nil), // 190: openshell.v1.PushSandboxLogsResponse - (*GetSandboxLogsResponse)(nil), // 191: openshell.v1.GetSandboxLogsResponse - (*SupervisorMessage)(nil), // 192: openshell.v1.SupervisorMessage - (*GatewayMessage)(nil), // 193: openshell.v1.GatewayMessage - (*SupervisorHello)(nil), // 194: openshell.v1.SupervisorHello - (*SessionAccepted)(nil), // 195: openshell.v1.SessionAccepted - (*ConfigUpdate)(nil), // 196: openshell.v1.ConfigUpdate - (*ConfigApplyFailure)(nil), // 197: openshell.v1.ConfigApplyFailure - (*ConfigUpdateResult)(nil), // 198: openshell.v1.ConfigUpdateResult - (*PolicyLoadResult)(nil), // 199: openshell.v1.PolicyLoadResult - (*SessionRejected)(nil), // 200: openshell.v1.SessionRejected - (*SessionRedirect)(nil), // 201: openshell.v1.SessionRedirect - (*SupervisorHeartbeat)(nil), // 202: openshell.v1.SupervisorHeartbeat - (*GatewayHeartbeat)(nil), // 203: openshell.v1.GatewayHeartbeat - (*ReportMainProcessExitRequest)(nil), // 204: openshell.v1.ReportMainProcessExitRequest - (*ReportMainProcessExitResponse)(nil), // 205: openshell.v1.ReportMainProcessExitResponse - (*FinalizeMainProcessExitRequest)(nil), // 206: openshell.v1.FinalizeMainProcessExitRequest - (*FinalizeMainProcessExitResponse)(nil), // 207: openshell.v1.FinalizeMainProcessExitResponse - (*RelayOpen)(nil), // 208: openshell.v1.RelayOpen - (*SshRelayTarget)(nil), // 209: openshell.v1.SshRelayTarget - (*TcpRelayTarget)(nil), // 210: openshell.v1.TcpRelayTarget - (*RelayInit)(nil), // 211: openshell.v1.RelayInit - (*RelayFrame)(nil), // 212: openshell.v1.RelayFrame - (*PeerRelayInit)(nil), // 213: openshell.v1.PeerRelayInit - (*PeerRelayFrame)(nil), // 214: openshell.v1.PeerRelayFrame - (*PeerConfigSandboxTarget)(nil), // 215: openshell.v1.PeerConfigSandboxTarget - (*PeerConfigProviderTarget)(nil), // 216: openshell.v1.PeerConfigProviderTarget - (*PeerNotifyConfigUpdateRequest)(nil), // 217: openshell.v1.PeerNotifyConfigUpdateRequest - (*PeerNotifyConfigUpdateResponse)(nil), // 218: openshell.v1.PeerNotifyConfigUpdateResponse - (*RelayOpenResult)(nil), // 219: openshell.v1.RelayOpenResult - (*RelayClose)(nil), // 220: openshell.v1.RelayClose - (*L7RequestSample)(nil), // 221: openshell.v1.L7RequestSample - (*DenialSummary)(nil), // 222: openshell.v1.DenialSummary - (*DenialGroupCount)(nil), // 223: openshell.v1.DenialGroupCount - (*NetworkActivitySummary)(nil), // 224: openshell.v1.NetworkActivitySummary - (*PolicyChunk)(nil), // 225: openshell.v1.PolicyChunk - (*DraftPolicyUpdate)(nil), // 226: openshell.v1.DraftPolicyUpdate - (*SubmitPolicyAnalysisRequest)(nil), // 227: openshell.v1.SubmitPolicyAnalysisRequest - (*SubmitPolicyAnalysisResponse)(nil), // 228: openshell.v1.SubmitPolicyAnalysisResponse - (*GetDraftPolicyRequest)(nil), // 229: openshell.v1.GetDraftPolicyRequest - (*GetDraftPolicyResponse)(nil), // 230: openshell.v1.GetDraftPolicyResponse - (*ApproveDraftChunkRequest)(nil), // 231: openshell.v1.ApproveDraftChunkRequest - (*ApproveDraftChunkResponse)(nil), // 232: openshell.v1.ApproveDraftChunkResponse - (*RejectDraftChunkRequest)(nil), // 233: openshell.v1.RejectDraftChunkRequest - (*RejectDraftChunkResponse)(nil), // 234: openshell.v1.RejectDraftChunkResponse - (*DraftChunkApproval)(nil), // 235: openshell.v1.DraftChunkApproval - (*ApproveAllDraftChunksRequest)(nil), // 236: openshell.v1.ApproveAllDraftChunksRequest - (*ApproveAllDraftChunksResponse)(nil), // 237: openshell.v1.ApproveAllDraftChunksResponse - (*EditDraftChunkRequest)(nil), // 238: openshell.v1.EditDraftChunkRequest - (*EditDraftChunkResponse)(nil), // 239: openshell.v1.EditDraftChunkResponse - (*UndoDraftChunkRequest)(nil), // 240: openshell.v1.UndoDraftChunkRequest - (*UndoDraftChunkResponse)(nil), // 241: openshell.v1.UndoDraftChunkResponse - (*ClearDraftChunksRequest)(nil), // 242: openshell.v1.ClearDraftChunksRequest - (*ClearDraftChunksResponse)(nil), // 243: openshell.v1.ClearDraftChunksResponse - (*GetDraftHistoryRequest)(nil), // 244: openshell.v1.GetDraftHistoryRequest - (*DraftHistoryEntry)(nil), // 245: openshell.v1.DraftHistoryEntry - (*GetDraftHistoryResponse)(nil), // 246: openshell.v1.GetDraftHistoryResponse - (*CreateWorkspaceRequest)(nil), // 247: openshell.v1.CreateWorkspaceRequest - (*CreateWorkspaceResponse)(nil), // 248: openshell.v1.CreateWorkspaceResponse - (*GetWorkspaceRequest)(nil), // 249: openshell.v1.GetWorkspaceRequest - (*GetWorkspaceResponse)(nil), // 250: openshell.v1.GetWorkspaceResponse - (*ListWorkspacesRequest)(nil), // 251: openshell.v1.ListWorkspacesRequest - (*ListWorkspacesResponse)(nil), // 252: openshell.v1.ListWorkspacesResponse - (*DeleteWorkspaceRequest)(nil), // 253: openshell.v1.DeleteWorkspaceRequest - (*DeleteWorkspaceResponse)(nil), // 254: openshell.v1.DeleteWorkspaceResponse - (*WorkspaceMember)(nil), // 255: openshell.v1.WorkspaceMember - (*AddWorkspaceMemberRequest)(nil), // 256: openshell.v1.AddWorkspaceMemberRequest - (*AddWorkspaceMemberResponse)(nil), // 257: openshell.v1.AddWorkspaceMemberResponse - (*RemoveWorkspaceMemberRequest)(nil), // 258: openshell.v1.RemoveWorkspaceMemberRequest - (*RemoveWorkspaceMemberResponse)(nil), // 259: openshell.v1.RemoveWorkspaceMemberResponse - (*ListWorkspaceMembersRequest)(nil), // 260: openshell.v1.ListWorkspaceMembersRequest - (*ListWorkspaceMembersResponse)(nil), // 261: openshell.v1.ListWorkspaceMembersResponse - (*ExtensionServiceCredential)(nil), // 262: openshell.v1.ExtensionServiceCredential - (*EndpointObservation)(nil), // 263: openshell.v1.EndpointObservation - (*ReportEndpointStatusRequest)(nil), // 264: openshell.v1.ReportEndpointStatusRequest - (*TokenGrantStatus)(nil), // 265: openshell.v1.TokenGrantStatus - (*TokenGrantFailureObservation)(nil), // 266: openshell.v1.TokenGrantFailureObservation - (*ReportEndpointStatusResponse)(nil), // 267: openshell.v1.ReportEndpointStatusResponse - (*EndpointStatus)(nil), // 268: openshell.v1.EndpointStatus - (*SandboxProvisioning)(nil), // 269: openshell.v1.SandboxProvisioning - (*SandboxServiceExposure)(nil), // 270: openshell.v1.SandboxServiceExposure - (*EndpointFailure)(nil), // 271: openshell.v1.EndpointFailure - nil, // 272: openshell.v1.SandboxSpec.EnvironmentEntry - nil, // 273: openshell.v1.SandboxTemplate.LabelsEntry - nil, // 274: openshell.v1.SandboxTemplate.AnnotationsEntry - nil, // 275: openshell.v1.SandboxTemplate.EnvironmentEntry - nil, // 276: openshell.v1.SandboxWorkloadConfig.EnvironmentEntry - nil, // 277: openshell.v1.PlatformEvent.MetadataEntry - nil, // 278: openshell.v1.CreateSandboxRequest.LabelsEntry - nil, // 279: openshell.v1.CreateSandboxRequest.AnnotationsEntry - nil, // 280: openshell.v1.SandboxResponse.ServiceUrlsEntry - nil, // 281: openshell.v1.ExecSandboxRequest.EnvironmentEntry - nil, // 282: openshell.v1.SandboxLogLine.FieldsEntry - nil, // 283: openshell.v1.GetProviderCredentialsResponse.CredentialsEntry - nil, // 284: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry - nil, // 285: openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry - nil, // 286: openshell.v1.ProviderProfile.AnnotationsEntry - nil, // 287: openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry - nil, // 288: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry - nil, // 289: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry - nil, // 290: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry - nil, // 291: openshell.v1.GetSandboxProviderEnvironmentResponse.FilesEntry - nil, // 292: openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry - nil, // 293: openshell.v1.ProviderEnvironmentSnapshot.FilesEntry - nil, // 294: openshell.v1.UpdateConfigRequest.AnnotationsEntry - nil, // 295: openshell.v1.UpdateConfigResponse.AnnotationsEntry - nil, // 296: openshell.v1.SandboxPolicyRevision.ProvenanceEntry - nil, // 297: openshell.v1.CreateWorkspaceRequest.LabelsEntry - (*timestamppb.Timestamp)(nil), // 298: google.protobuf.Timestamp - (*datamodelv1.ObjectMeta)(nil), // 299: openshell.datamodel.v1.ObjectMeta - (*sandboxv1.SandboxPolicy)(nil), // 300: openshell.sandbox.v1.SandboxPolicy - (*structpb.Struct)(nil), // 301: google.protobuf.Struct - (*durationpb.Duration)(nil), // 302: google.protobuf.Duration - (*datamodelv1.WorkspaceSelector)(nil), // 303: openshell.datamodel.v1.WorkspaceSelector - (*datamodelv1.Provider)(nil), // 304: openshell.datamodel.v1.Provider - (sandboxv1.PolicySource)(0), // 305: openshell.sandbox.v1.PolicySource - (*sandboxv1.NetworkEndpoint)(nil), // 306: openshell.sandbox.v1.NetworkEndpoint - (*sandboxv1.NetworkBinary)(nil), // 307: openshell.sandbox.v1.NetworkBinary - (*sandboxv1.SettingValue)(nil), // 308: openshell.sandbox.v1.SettingValue - (*sandboxv1.NetworkPolicyRule)(nil), // 309: openshell.sandbox.v1.NetworkPolicyRule - (*sandboxv1.L7DenyRule)(nil), // 310: openshell.sandbox.v1.L7DenyRule - (*sandboxv1.L7Rule)(nil), // 311: openshell.sandbox.v1.L7Rule - (*sandboxv1.SandboxConfigSnapshot)(nil), // 312: openshell.sandbox.v1.SandboxConfigSnapshot - (*datamodelv1.Workspace)(nil), // 313: openshell.datamodel.v1.Workspace - (*sandboxv1.GetSandboxConfigRequest)(nil), // 314: openshell.sandbox.v1.GetSandboxConfigRequest - (*sandboxv1.GetGatewayConfigRequest)(nil), // 315: openshell.sandbox.v1.GetGatewayConfigRequest - (*sandboxv1.GetSandboxConfigResponse)(nil), // 316: openshell.sandbox.v1.GetSandboxConfigResponse - (*sandboxv1.GetGatewayConfigResponse)(nil), // 317: openshell.sandbox.v1.GetGatewayConfigResponse + (*StaticCredentialBinding)(nil), // 161: openshell.v1.StaticCredentialBinding + (*GetSandboxProviderEnvironmentResponse)(nil), // 162: openshell.v1.GetSandboxProviderEnvironmentResponse + (*ProviderEnvironmentValue)(nil), // 163: openshell.v1.ProviderEnvironmentValue + (*ProviderEnvironmentSnapshot)(nil), // 164: openshell.v1.ProviderEnvironmentSnapshot + (*ExchangeProviderSubjectTokenRequest)(nil), // 165: openshell.v1.ExchangeProviderSubjectTokenRequest + (*ExchangeProviderSubjectTokenResponse)(nil), // 166: openshell.v1.ExchangeProviderSubjectTokenResponse + (*UpdateConfigRequest)(nil), // 167: openshell.v1.UpdateConfigRequest + (*PolicyMergeOperation)(nil), // 168: openshell.v1.PolicyMergeOperation + (*AddNetworkRule)(nil), // 169: openshell.v1.AddNetworkRule + (*RemoveNetworkEndpoint)(nil), // 170: openshell.v1.RemoveNetworkEndpoint + (*RemoveNetworkRule)(nil), // 171: openshell.v1.RemoveNetworkRule + (*L7RuleTarget)(nil), // 172: openshell.v1.L7RuleTarget + (*AddDenyRules)(nil), // 173: openshell.v1.AddDenyRules + (*AddAllowRules)(nil), // 174: openshell.v1.AddAllowRules + (*RemoveNetworkBinary)(nil), // 175: openshell.v1.RemoveNetworkBinary + (*UpdateConfigResponse)(nil), // 176: openshell.v1.UpdateConfigResponse + (*GetSandboxPolicyStatusRequest)(nil), // 177: openshell.v1.GetSandboxPolicyStatusRequest + (*GetSandboxPolicyStatusResponse)(nil), // 178: openshell.v1.GetSandboxPolicyStatusResponse + (*ListSandboxPoliciesRequest)(nil), // 179: openshell.v1.ListSandboxPoliciesRequest + (*ListSandboxPoliciesResponse)(nil), // 180: openshell.v1.ListSandboxPoliciesResponse + (*ReportPolicyStatusRequest)(nil), // 181: openshell.v1.ReportPolicyStatusRequest + (*ReportPolicyStatusResponse)(nil), // 182: openshell.v1.ReportPolicyStatusResponse + (*SandboxConfigurationAdmission)(nil), // 183: openshell.v1.SandboxConfigurationAdmission + (*ReportSandboxConfigurationRequest)(nil), // 184: openshell.v1.ReportSandboxConfigurationRequest + (*ReportSandboxConfigurationResponse)(nil), // 185: openshell.v1.ReportSandboxConfigurationResponse + (*SandboxPolicyRevision)(nil), // 186: openshell.v1.SandboxPolicyRevision + (*GetSandboxLogsRequest)(nil), // 187: openshell.v1.GetSandboxLogsRequest + (*PushSandboxLogsRequest)(nil), // 188: openshell.v1.PushSandboxLogsRequest + (*PushSandboxLogsResponse)(nil), // 189: openshell.v1.PushSandboxLogsResponse + (*GetSandboxLogsResponse)(nil), // 190: openshell.v1.GetSandboxLogsResponse + (*SupervisorMessage)(nil), // 191: openshell.v1.SupervisorMessage + (*GatewayMessage)(nil), // 192: openshell.v1.GatewayMessage + (*SupervisorHello)(nil), // 193: openshell.v1.SupervisorHello + (*SessionAccepted)(nil), // 194: openshell.v1.SessionAccepted + (*ConfigUpdate)(nil), // 195: openshell.v1.ConfigUpdate + (*ConfigApplyFailure)(nil), // 196: openshell.v1.ConfigApplyFailure + (*ConfigUpdateResult)(nil), // 197: openshell.v1.ConfigUpdateResult + (*PolicyLoadResult)(nil), // 198: openshell.v1.PolicyLoadResult + (*SessionRejected)(nil), // 199: openshell.v1.SessionRejected + (*SessionRedirect)(nil), // 200: openshell.v1.SessionRedirect + (*SupervisorHeartbeat)(nil), // 201: openshell.v1.SupervisorHeartbeat + (*GatewayHeartbeat)(nil), // 202: openshell.v1.GatewayHeartbeat + (*ReportMainProcessExitRequest)(nil), // 203: openshell.v1.ReportMainProcessExitRequest + (*ReportMainProcessExitResponse)(nil), // 204: openshell.v1.ReportMainProcessExitResponse + (*FinalizeMainProcessExitRequest)(nil), // 205: openshell.v1.FinalizeMainProcessExitRequest + (*FinalizeMainProcessExitResponse)(nil), // 206: openshell.v1.FinalizeMainProcessExitResponse + (*RelayOpen)(nil), // 207: openshell.v1.RelayOpen + (*SshRelayTarget)(nil), // 208: openshell.v1.SshRelayTarget + (*TcpRelayTarget)(nil), // 209: openshell.v1.TcpRelayTarget + (*RelayInit)(nil), // 210: openshell.v1.RelayInit + (*RelayFrame)(nil), // 211: openshell.v1.RelayFrame + (*PeerRelayInit)(nil), // 212: openshell.v1.PeerRelayInit + (*PeerRelayFrame)(nil), // 213: openshell.v1.PeerRelayFrame + (*PeerConfigSandboxTarget)(nil), // 214: openshell.v1.PeerConfigSandboxTarget + (*PeerConfigProviderTarget)(nil), // 215: openshell.v1.PeerConfigProviderTarget + (*PeerNotifyConfigUpdateRequest)(nil), // 216: openshell.v1.PeerNotifyConfigUpdateRequest + (*PeerNotifyConfigUpdateResponse)(nil), // 217: openshell.v1.PeerNotifyConfigUpdateResponse + (*RelayOpenResult)(nil), // 218: openshell.v1.RelayOpenResult + (*RelayClose)(nil), // 219: openshell.v1.RelayClose + (*L7RequestSample)(nil), // 220: openshell.v1.L7RequestSample + (*DenialSummary)(nil), // 221: openshell.v1.DenialSummary + (*DenialGroupCount)(nil), // 222: openshell.v1.DenialGroupCount + (*NetworkActivitySummary)(nil), // 223: openshell.v1.NetworkActivitySummary + (*PolicyChunk)(nil), // 224: openshell.v1.PolicyChunk + (*DraftPolicyUpdate)(nil), // 225: openshell.v1.DraftPolicyUpdate + (*SubmitPolicyAnalysisRequest)(nil), // 226: openshell.v1.SubmitPolicyAnalysisRequest + (*SubmitPolicyAnalysisResponse)(nil), // 227: openshell.v1.SubmitPolicyAnalysisResponse + (*GetDraftPolicyRequest)(nil), // 228: openshell.v1.GetDraftPolicyRequest + (*GetDraftPolicyResponse)(nil), // 229: openshell.v1.GetDraftPolicyResponse + (*ApproveDraftChunkRequest)(nil), // 230: openshell.v1.ApproveDraftChunkRequest + (*ApproveDraftChunkResponse)(nil), // 231: openshell.v1.ApproveDraftChunkResponse + (*RejectDraftChunkRequest)(nil), // 232: openshell.v1.RejectDraftChunkRequest + (*RejectDraftChunkResponse)(nil), // 233: openshell.v1.RejectDraftChunkResponse + (*DraftChunkApproval)(nil), // 234: openshell.v1.DraftChunkApproval + (*ApproveAllDraftChunksRequest)(nil), // 235: openshell.v1.ApproveAllDraftChunksRequest + (*ApproveAllDraftChunksResponse)(nil), // 236: openshell.v1.ApproveAllDraftChunksResponse + (*EditDraftChunkRequest)(nil), // 237: openshell.v1.EditDraftChunkRequest + (*EditDraftChunkResponse)(nil), // 238: openshell.v1.EditDraftChunkResponse + (*UndoDraftChunkRequest)(nil), // 239: openshell.v1.UndoDraftChunkRequest + (*UndoDraftChunkResponse)(nil), // 240: openshell.v1.UndoDraftChunkResponse + (*ClearDraftChunksRequest)(nil), // 241: openshell.v1.ClearDraftChunksRequest + (*ClearDraftChunksResponse)(nil), // 242: openshell.v1.ClearDraftChunksResponse + (*GetDraftHistoryRequest)(nil), // 243: openshell.v1.GetDraftHistoryRequest + (*DraftHistoryEntry)(nil), // 244: openshell.v1.DraftHistoryEntry + (*GetDraftHistoryResponse)(nil), // 245: openshell.v1.GetDraftHistoryResponse + (*CreateWorkspaceRequest)(nil), // 246: openshell.v1.CreateWorkspaceRequest + (*CreateWorkspaceResponse)(nil), // 247: openshell.v1.CreateWorkspaceResponse + (*GetWorkspaceRequest)(nil), // 248: openshell.v1.GetWorkspaceRequest + (*GetWorkspaceResponse)(nil), // 249: openshell.v1.GetWorkspaceResponse + (*ListWorkspacesRequest)(nil), // 250: openshell.v1.ListWorkspacesRequest + (*ListWorkspacesResponse)(nil), // 251: openshell.v1.ListWorkspacesResponse + (*DeleteWorkspaceRequest)(nil), // 252: openshell.v1.DeleteWorkspaceRequest + (*DeleteWorkspaceResponse)(nil), // 253: openshell.v1.DeleteWorkspaceResponse + (*WorkspaceMember)(nil), // 254: openshell.v1.WorkspaceMember + (*AddWorkspaceMemberRequest)(nil), // 255: openshell.v1.AddWorkspaceMemberRequest + (*AddWorkspaceMemberResponse)(nil), // 256: openshell.v1.AddWorkspaceMemberResponse + (*RemoveWorkspaceMemberRequest)(nil), // 257: openshell.v1.RemoveWorkspaceMemberRequest + (*RemoveWorkspaceMemberResponse)(nil), // 258: openshell.v1.RemoveWorkspaceMemberResponse + (*ListWorkspaceMembersRequest)(nil), // 259: openshell.v1.ListWorkspaceMembersRequest + (*ListWorkspaceMembersResponse)(nil), // 260: openshell.v1.ListWorkspaceMembersResponse + (*ExtensionServiceCredential)(nil), // 261: openshell.v1.ExtensionServiceCredential + (*EndpointObservation)(nil), // 262: openshell.v1.EndpointObservation + (*ReportEndpointStatusRequest)(nil), // 263: openshell.v1.ReportEndpointStatusRequest + (*TokenGrantStatus)(nil), // 264: openshell.v1.TokenGrantStatus + (*TokenGrantFailureObservation)(nil), // 265: openshell.v1.TokenGrantFailureObservation + (*ReportEndpointStatusResponse)(nil), // 266: openshell.v1.ReportEndpointStatusResponse + (*EndpointStatus)(nil), // 267: openshell.v1.EndpointStatus + (*SandboxProvisioning)(nil), // 268: openshell.v1.SandboxProvisioning + (*SandboxServiceExposure)(nil), // 269: openshell.v1.SandboxServiceExposure + (*EndpointFailure)(nil), // 270: openshell.v1.EndpointFailure + nil, // 271: openshell.v1.SandboxSpec.EnvironmentEntry + nil, // 272: openshell.v1.SandboxTemplate.LabelsEntry + nil, // 273: openshell.v1.SandboxTemplate.AnnotationsEntry + nil, // 274: openshell.v1.SandboxTemplate.EnvironmentEntry + nil, // 275: openshell.v1.SandboxWorkloadConfig.EnvironmentEntry + nil, // 276: openshell.v1.PlatformEvent.MetadataEntry + nil, // 277: openshell.v1.CreateSandboxRequest.LabelsEntry + nil, // 278: openshell.v1.CreateSandboxRequest.AnnotationsEntry + nil, // 279: openshell.v1.SandboxResponse.ServiceUrlsEntry + nil, // 280: openshell.v1.ExecSandboxRequest.EnvironmentEntry + nil, // 281: openshell.v1.SandboxLogLine.FieldsEntry + nil, // 282: openshell.v1.GetProviderCredentialsResponse.CredentialsEntry + nil, // 283: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry + nil, // 284: openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry + nil, // 285: openshell.v1.ProviderProfile.AnnotationsEntry + nil, // 286: openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry + nil, // 287: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry + nil, // 288: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry + nil, // 289: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry + nil, // 290: openshell.v1.GetSandboxProviderEnvironmentResponse.FilesEntry + nil, // 291: openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry + nil, // 292: openshell.v1.ProviderEnvironmentSnapshot.FilesEntry + nil, // 293: openshell.v1.UpdateConfigRequest.AnnotationsEntry + nil, // 294: openshell.v1.UpdateConfigResponse.AnnotationsEntry + nil, // 295: openshell.v1.SandboxPolicyRevision.ProvenanceEntry + nil, // 296: openshell.v1.CreateWorkspaceRequest.LabelsEntry + (*timestamppb.Timestamp)(nil), // 297: google.protobuf.Timestamp + (*datamodelv1.ObjectMeta)(nil), // 298: openshell.datamodel.v1.ObjectMeta + (*sandboxv1.SandboxPolicy)(nil), // 299: openshell.sandbox.v1.SandboxPolicy + (*structpb.Struct)(nil), // 300: google.protobuf.Struct + (*durationpb.Duration)(nil), // 301: google.protobuf.Duration + (*datamodelv1.WorkspaceSelector)(nil), // 302: openshell.datamodel.v1.WorkspaceSelector + (*datamodelv1.Provider)(nil), // 303: openshell.datamodel.v1.Provider + (sandboxv1.PolicySource)(0), // 304: openshell.sandbox.v1.PolicySource + (*sandboxv1.NetworkEndpoint)(nil), // 305: openshell.sandbox.v1.NetworkEndpoint + (*sandboxv1.NetworkBinary)(nil), // 306: openshell.sandbox.v1.NetworkBinary + (*sandboxv1.SettingValue)(nil), // 307: openshell.sandbox.v1.SettingValue + (*sandboxv1.NetworkPolicyRule)(nil), // 308: openshell.sandbox.v1.NetworkPolicyRule + (*sandboxv1.L7DenyRule)(nil), // 309: openshell.sandbox.v1.L7DenyRule + (*sandboxv1.L7Rule)(nil), // 310: openshell.sandbox.v1.L7Rule + (*sandboxv1.SandboxConfigSnapshot)(nil), // 311: openshell.sandbox.v1.SandboxConfigSnapshot + (*datamodelv1.Workspace)(nil), // 312: openshell.datamodel.v1.Workspace + (*sandboxv1.GetSandboxConfigRequest)(nil), // 313: openshell.sandbox.v1.GetSandboxConfigRequest + (*sandboxv1.GetGatewayConfigRequest)(nil), // 314: openshell.sandbox.v1.GetGatewayConfigRequest + (*sandboxv1.GetSandboxConfigResponse)(nil), // 315: openshell.sandbox.v1.GetSandboxConfigResponse + (*sandboxv1.GetGatewayConfigResponse)(nil), // 316: openshell.sandbox.v1.GetGatewayConfigResponse } var file_openshell_proto_depIdxs = []int32{ - 298, // 0: openshell.v1.IssueSandboxTokenResponse.expiration_time:type_name -> google.protobuf.Timestamp - 298, // 1: openshell.v1.RefreshSandboxTokenResponse.expiration_time:type_name -> google.protobuf.Timestamp - 262, // 2: openshell.v1.RefreshSandboxTokenResponse.extension_credentials:type_name -> openshell.v1.ExtensionServiceCredential - 298, // 3: openshell.v1.RefreshSandboxTokenResponse.sandbox_expiration_time:type_name -> google.protobuf.Timestamp + 297, // 0: openshell.v1.IssueSandboxTokenResponse.expiration_time:type_name -> google.protobuf.Timestamp + 297, // 1: openshell.v1.RefreshSandboxTokenResponse.expiration_time:type_name -> google.protobuf.Timestamp + 261, // 2: openshell.v1.RefreshSandboxTokenResponse.extension_credentials:type_name -> openshell.v1.ExtensionServiceCredential + 297, // 3: openshell.v1.RefreshSandboxTokenResponse.sandbox_expiration_time:type_name -> google.protobuf.Timestamp 14, // 4: openshell.v1.HealthResponse.status:type_name -> openshell.v1.ServiceStatus 14, // 5: openshell.v1.GetGatewayInfoResponse.status:type_name -> openshell.v1.ServiceStatus 33, // 6: openshell.v1.GetGatewayInfoResponse.compute_drivers:type_name -> openshell.v1.ComputeDriverInfo @@ -21694,525 +21539,524 @@ var file_openshell_proto_depIdxs = []int32{ 36, // 11: openshell.v1.ResourceCapabilities.cpu:type_name -> openshell.v1.CpuResourceCapabilities 37, // 12: openshell.v1.ResourceCapabilities.memory:type_name -> openshell.v1.MemoryResourceCapabilities 38, // 13: openshell.v1.ResourceCapabilities.gpu:type_name -> openshell.v1.GpuResourceCapabilities - 299, // 14: openshell.v1.Sandbox.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 298, // 14: openshell.v1.Sandbox.metadata:type_name -> openshell.datamodel.v1.ObjectMeta 40, // 15: openshell.v1.Sandbox.spec:type_name -> openshell.v1.SandboxSpec 51, // 16: openshell.v1.Sandbox.status:type_name -> openshell.v1.SandboxStatus 50, // 17: openshell.v1.Sandbox.created_from_workload_template:type_name -> openshell.v1.SandboxWorkloadTemplateProvenance - 272, // 18: openshell.v1.SandboxSpec.environment:type_name -> openshell.v1.SandboxSpec.EnvironmentEntry + 271, // 18: openshell.v1.SandboxSpec.environment:type_name -> openshell.v1.SandboxSpec.EnvironmentEntry 43, // 19: openshell.v1.SandboxSpec.template:type_name -> openshell.v1.SandboxTemplate - 300, // 20: openshell.v1.SandboxSpec.policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 299, // 20: openshell.v1.SandboxSpec.policy:type_name -> openshell.sandbox.v1.SandboxPolicy 41, // 21: openshell.v1.SandboxSpec.resource_requirements:type_name -> openshell.v1.ResourceRequirements 17, // 22: openshell.v1.SandboxSpec.restart_policy:type_name -> openshell.v1.SandboxRestartPolicy 42, // 23: openshell.v1.ResourceRequirements.gpu:type_name -> openshell.v1.GpuResourceRequirements - 273, // 24: openshell.v1.SandboxTemplate.labels:type_name -> openshell.v1.SandboxTemplate.LabelsEntry - 274, // 25: openshell.v1.SandboxTemplate.annotations:type_name -> openshell.v1.SandboxTemplate.AnnotationsEntry - 275, // 26: openshell.v1.SandboxTemplate.environment:type_name -> openshell.v1.SandboxTemplate.EnvironmentEntry - 301, // 27: openshell.v1.SandboxTemplate.resources:type_name -> google.protobuf.Struct - 301, // 28: openshell.v1.SandboxTemplate.driver_config:type_name -> google.protobuf.Struct - 299, // 29: openshell.v1.SandboxWorkloadTemplate.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 272, // 24: openshell.v1.SandboxTemplate.labels:type_name -> openshell.v1.SandboxTemplate.LabelsEntry + 273, // 25: openshell.v1.SandboxTemplate.annotations:type_name -> openshell.v1.SandboxTemplate.AnnotationsEntry + 274, // 26: openshell.v1.SandboxTemplate.environment:type_name -> openshell.v1.SandboxTemplate.EnvironmentEntry + 300, // 27: openshell.v1.SandboxTemplate.resources:type_name -> google.protobuf.Struct + 300, // 28: openshell.v1.SandboxTemplate.driver_config:type_name -> google.protobuf.Struct + 298, // 29: openshell.v1.SandboxWorkloadTemplate.metadata:type_name -> openshell.datamodel.v1.ObjectMeta 45, // 30: openshell.v1.SandboxWorkloadTemplate.spec:type_name -> openshell.v1.SandboxWorkloadTemplateSpec 46, // 31: openshell.v1.SandboxWorkloadTemplateSpec.workload:type_name -> openshell.v1.SandboxWorkloadConfig - 301, // 32: openshell.v1.SandboxWorkloadTemplateSpec.driver_config:type_name -> google.protobuf.Struct + 300, // 32: openshell.v1.SandboxWorkloadTemplateSpec.driver_config:type_name -> google.protobuf.Struct 48, // 33: openshell.v1.SandboxWorkloadTemplateSpec.desired_service_level:type_name -> openshell.v1.SandboxServiceLevel - 276, // 34: openshell.v1.SandboxWorkloadConfig.environment:type_name -> openshell.v1.SandboxWorkloadConfig.EnvironmentEntry + 275, // 34: openshell.v1.SandboxWorkloadConfig.environment:type_name -> openshell.v1.SandboxWorkloadConfig.EnvironmentEntry 47, // 35: openshell.v1.SandboxWorkloadConfig.resources:type_name -> openshell.v1.SandboxResources 42, // 36: openshell.v1.SandboxResources.gpu:type_name -> openshell.v1.GpuResourceRequirements 49, // 37: openshell.v1.SandboxServiceLevel.startup:type_name -> openshell.v1.SandboxStartup - 302, // 38: openshell.v1.SandboxStartup.ready_within:type_name -> google.protobuf.Duration + 301, // 38: openshell.v1.SandboxStartup.ready_within:type_name -> google.protobuf.Duration 52, // 39: openshell.v1.SandboxStatus.conditions:type_name -> openshell.v1.SandboxCondition 1, // 40: openshell.v1.SandboxStatus.phase:type_name -> openshell.v1.SandboxPhase - 268, // 41: openshell.v1.SandboxStatus.endpoint_statuses:type_name -> openshell.v1.EndpointStatus - 184, // 42: openshell.v1.SandboxStatus.configuration_admission:type_name -> openshell.v1.SandboxConfigurationAdmission - 269, // 43: openshell.v1.SandboxStatus.provisioning:type_name -> openshell.v1.SandboxProvisioning - 298, // 44: openshell.v1.SandboxStatus.next_restart_time:type_name -> google.protobuf.Timestamp - 298, // 45: openshell.v1.SandboxStatus.main_process_started_time:type_name -> google.protobuf.Timestamp - 266, // 46: openshell.v1.SandboxStatus.last_token_grant_failure:type_name -> openshell.v1.TokenGrantFailureObservation - 298, // 47: openshell.v1.SandboxCondition.transition_time:type_name -> google.protobuf.Timestamp - 298, // 48: openshell.v1.PlatformEvent.event_time:type_name -> google.protobuf.Timestamp - 277, // 49: openshell.v1.PlatformEvent.metadata:type_name -> openshell.v1.PlatformEvent.MetadataEntry - 303, // 50: openshell.v1.CreateSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 267, // 41: openshell.v1.SandboxStatus.endpoint_statuses:type_name -> openshell.v1.EndpointStatus + 183, // 42: openshell.v1.SandboxStatus.configuration_admission:type_name -> openshell.v1.SandboxConfigurationAdmission + 268, // 43: openshell.v1.SandboxStatus.provisioning:type_name -> openshell.v1.SandboxProvisioning + 297, // 44: openshell.v1.SandboxStatus.next_restart_time:type_name -> google.protobuf.Timestamp + 297, // 45: openshell.v1.SandboxStatus.main_process_started_time:type_name -> google.protobuf.Timestamp + 265, // 46: openshell.v1.SandboxStatus.last_token_grant_failure:type_name -> openshell.v1.TokenGrantFailureObservation + 297, // 47: openshell.v1.SandboxCondition.transition_time:type_name -> google.protobuf.Timestamp + 297, // 48: openshell.v1.PlatformEvent.event_time:type_name -> google.protobuf.Timestamp + 276, // 49: openshell.v1.PlatformEvent.metadata:type_name -> openshell.v1.PlatformEvent.MetadataEntry + 302, // 50: openshell.v1.CreateSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 40, // 51: openshell.v1.CreateSandboxRequest.spec:type_name -> openshell.v1.SandboxSpec - 278, // 52: openshell.v1.CreateSandboxRequest.labels:type_name -> openshell.v1.CreateSandboxRequest.LabelsEntry - 279, // 53: openshell.v1.CreateSandboxRequest.annotations:type_name -> openshell.v1.CreateSandboxRequest.AnnotationsEntry - 270, // 54: openshell.v1.CreateSandboxRequest.service_exposures:type_name -> openshell.v1.SandboxServiceExposure - 303, // 55: openshell.v1.CreateSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 277, // 52: openshell.v1.CreateSandboxRequest.labels:type_name -> openshell.v1.CreateSandboxRequest.LabelsEntry + 278, // 53: openshell.v1.CreateSandboxRequest.annotations:type_name -> openshell.v1.CreateSandboxRequest.AnnotationsEntry + 269, // 54: openshell.v1.CreateSandboxRequest.service_exposures:type_name -> openshell.v1.SandboxServiceExposure + 302, // 55: openshell.v1.CreateSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 44, // 56: openshell.v1.CreateSandboxTemplateRequest.template:type_name -> openshell.v1.SandboxWorkloadTemplate - 303, // 57: openshell.v1.GetSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 58: openshell.v1.ListSandboxTemplatesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 59: openshell.v1.DeleteSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 57: openshell.v1.GetSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 58: openshell.v1.ListSandboxTemplatesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 59: openshell.v1.DeleteSandboxTemplateRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 44, // 60: openshell.v1.SandboxTemplateResponse.template:type_name -> openshell.v1.SandboxWorkloadTemplate 44, // 61: openshell.v1.ListSandboxTemplatesResponse.templates:type_name -> openshell.v1.SandboxWorkloadTemplate 18, // 62: openshell.v1.DeleteSandboxTemplateResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 303, // 63: openshell.v1.BeginRootfsTarStagingRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 298, // 64: openshell.v1.BeginRootfsTarStagingResponse.expiration_time:type_name -> google.protobuf.Timestamp - 303, // 65: openshell.v1.GetSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 66: openshell.v1.ListSandboxesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 67: openshell.v1.ListSandboxProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 68: openshell.v1.AttachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 69: openshell.v1.DetachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 70: openshell.v1.DeleteSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 71: openshell.v1.StopSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 72: openshell.v1.StartSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 63: openshell.v1.BeginRootfsTarStagingRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 297, // 64: openshell.v1.BeginRootfsTarStagingResponse.expiration_time:type_name -> google.protobuf.Timestamp + 302, // 65: openshell.v1.GetSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 66: openshell.v1.ListSandboxesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 67: openshell.v1.ListSandboxProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 68: openshell.v1.AttachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 69: openshell.v1.DetachSandboxProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 70: openshell.v1.DeleteSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 71: openshell.v1.StopSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 72: openshell.v1.StartSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 39, // 73: openshell.v1.SandboxResponse.sandbox:type_name -> openshell.v1.Sandbox - 280, // 74: openshell.v1.SandboxResponse.service_urls:type_name -> openshell.v1.SandboxResponse.ServiceUrlsEntry + 279, // 74: openshell.v1.SandboxResponse.service_urls:type_name -> openshell.v1.SandboxResponse.ServiceUrlsEntry 39, // 75: openshell.v1.ListSandboxesResponse.sandboxes:type_name -> openshell.v1.Sandbox - 304, // 76: openshell.v1.ListSandboxProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider + 303, // 76: openshell.v1.ListSandboxProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider 39, // 77: openshell.v1.AttachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox 81, // 78: openshell.v1.AttachSandboxProviderResponse.receipt:type_name -> openshell.v1.ProviderMutationReceipt 39, // 79: openshell.v1.DetachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox 81, // 80: openshell.v1.DetachSandboxProviderResponse.receipt:type_name -> openshell.v1.ProviderMutationReceipt 79, // 81: openshell.v1.ConfigSnapshotRevision.sandbox_config:type_name -> openshell.v1.SandboxConfigRevision 77, // 82: openshell.v1.ConfigSnapshotRevision.provider_target:type_name -> openshell.v1.ProviderDesiredIdentity - 305, // 83: openshell.v1.SandboxConfigRevision.policy_source:type_name -> openshell.sandbox.v1.PolicySource + 304, // 83: openshell.v1.SandboxConfigRevision.policy_source:type_name -> openshell.sandbox.v1.PolicySource 5, // 84: openshell.v1.ConfigUpdateOperation.component:type_name -> openshell.v1.ConfigComponent 78, // 85: openshell.v1.ConfigUpdateOperation.target_revision:type_name -> openshell.v1.ConfigSnapshotRevision 7, // 86: openshell.v1.ConfigUpdateOperation.state:type_name -> openshell.v1.ConfigUpdateOperationState 6, // 87: openshell.v1.ConfigUpdateOperation.outcome:type_name -> openshell.v1.ConfigApplyOutcome - 298, // 88: openshell.v1.ConfigUpdateOperation.created_time:type_name -> google.protobuf.Timestamp - 298, // 89: openshell.v1.ConfigUpdateOperation.updated_time:type_name -> google.protobuf.Timestamp - 298, // 90: openshell.v1.ConfigUpdateOperation.completed_time:type_name -> google.protobuf.Timestamp + 297, // 88: openshell.v1.ConfigUpdateOperation.created_time:type_name -> google.protobuf.Timestamp + 297, // 89: openshell.v1.ConfigUpdateOperation.updated_time:type_name -> google.protobuf.Timestamp + 297, // 90: openshell.v1.ConfigUpdateOperation.completed_time:type_name -> google.protobuf.Timestamp 2, // 91: openshell.v1.ProviderMutationReceipt.kind:type_name -> openshell.v1.ProviderMutationKind 77, // 92: openshell.v1.ProviderMutationReceipt.desired:type_name -> openshell.v1.ProviderDesiredIdentity - 298, // 93: openshell.v1.ProviderMutationReceipt.persisted_time:type_name -> google.protobuf.Timestamp + 297, // 93: openshell.v1.ProviderMutationReceipt.persisted_time:type_name -> google.protobuf.Timestamp 4, // 94: openshell.v1.ProviderReadinessObservation.reason:type_name -> openshell.v1.ProviderReadinessReason 81, // 95: openshell.v1.ProviderReadinessStatus.receipt:type_name -> openshell.v1.ProviderMutationReceipt 3, // 96: openshell.v1.ProviderReadinessStatus.state:type_name -> openshell.v1.ProviderReadinessState 4, // 97: openshell.v1.ProviderReadinessStatus.reason:type_name -> openshell.v1.ProviderReadinessReason 82, // 98: openshell.v1.ProviderReadinessStatus.observed:type_name -> openshell.v1.ProviderReadinessObservation - 298, // 99: openshell.v1.ProviderReadinessStatus.observed_time:type_name -> google.protobuf.Timestamp - 298, // 100: openshell.v1.ProviderReadinessStatus.evaluated_time:type_name -> google.protobuf.Timestamp + 297, // 99: openshell.v1.ProviderReadinessStatus.observed_time:type_name -> google.protobuf.Timestamp + 297, // 100: openshell.v1.ProviderReadinessStatus.evaluated_time:type_name -> google.protobuf.Timestamp 80, // 101: openshell.v1.ProviderReadinessStatus.operation:type_name -> openshell.v1.ConfigUpdateOperation - 303, // 102: openshell.v1.GetSandboxProviderStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 102: openshell.v1.GetSandboxProviderStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 83, // 103: openshell.v1.GetSandboxProviderStatusResponse.status:type_name -> openshell.v1.ProviderReadinessStatus 82, // 104: openshell.v1.ReportProviderReadinessRequest.observation:type_name -> openshell.v1.ProviderReadinessObservation - 302, // 105: openshell.v1.ReportProviderReadinessResponse.report_interval:type_name -> google.protobuf.Duration - 302, // 106: openshell.v1.ReportProviderReadinessResponse.observation_ttl:type_name -> google.protobuf.Duration + 301, // 105: openshell.v1.ReportProviderReadinessResponse.report_interval:type_name -> google.protobuf.Duration + 301, // 106: openshell.v1.ReportProviderReadinessResponse.observation_ttl:type_name -> google.protobuf.Duration 18, // 107: openshell.v1.DeleteSandboxResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 303, // 108: openshell.v1.CreateSshSessionRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 298, // 109: openshell.v1.CreateSshSessionResponse.expiration_time:type_name -> google.protobuf.Timestamp - 303, // 110: openshell.v1.ExposeServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 108: openshell.v1.CreateSshSessionRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 297, // 109: openshell.v1.CreateSshSessionResponse.expiration_time:type_name -> google.protobuf.Timestamp + 302, // 110: openshell.v1.ExposeServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 20, // 111: openshell.v1.ExposeServiceRequest.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode - 303, // 112: openshell.v1.GetServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 113: openshell.v1.ListServicesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 112: openshell.v1.GetServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 113: openshell.v1.ListServicesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 98, // 114: openshell.v1.ListServicesResponse.services:type_name -> openshell.v1.ServiceEndpointResponse - 303, // 115: openshell.v1.DeleteServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 115: openshell.v1.DeleteServiceRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 18, // 116: openshell.v1.DeleteServiceResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 299, // 117: openshell.v1.ServiceEndpoint.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 298, // 117: openshell.v1.ServiceEndpoint.metadata:type_name -> openshell.datamodel.v1.ObjectMeta 20, // 118: openshell.v1.ServiceEndpoint.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode 97, // 119: openshell.v1.ServiceEndpointResponse.endpoint:type_name -> openshell.v1.ServiceEndpoint 18, // 120: openshell.v1.RevokeSshSessionResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 303, // 121: openshell.v1.ExecSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 281, // 122: openshell.v1.ExecSandboxRequest.environment:type_name -> openshell.v1.ExecSandboxRequest.EnvironmentEntry - 302, // 123: openshell.v1.ExecSandboxRequest.execution_timeout:type_name -> google.protobuf.Duration + 302, // 121: openshell.v1.ExecSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 280, // 122: openshell.v1.ExecSandboxRequest.environment:type_name -> openshell.v1.ExecSandboxRequest.EnvironmentEntry + 301, // 123: openshell.v1.ExecSandboxRequest.execution_timeout:type_name -> google.protobuf.Duration 102, // 124: openshell.v1.ExecSandboxEvent.stdout:type_name -> openshell.v1.ExecSandboxStdout 103, // 125: openshell.v1.ExecSandboxEvent.stderr:type_name -> openshell.v1.ExecSandboxStderr 104, // 126: openshell.v1.ExecSandboxEvent.exit:type_name -> openshell.v1.ExecSandboxExit - 209, // 127: openshell.v1.TcpForwardInit.ssh:type_name -> openshell.v1.SshRelayTarget - 210, // 128: openshell.v1.TcpForwardInit.tcp:type_name -> openshell.v1.TcpRelayTarget + 208, // 127: openshell.v1.TcpForwardInit.ssh:type_name -> openshell.v1.SshRelayTarget + 209, // 128: openshell.v1.TcpForwardInit.tcp:type_name -> openshell.v1.TcpRelayTarget 106, // 129: openshell.v1.TcpForwardFrame.init:type_name -> openshell.v1.TcpForwardInit 101, // 130: openshell.v1.ExecSandboxInput.start:type_name -> openshell.v1.ExecSandboxRequest 109, // 131: openshell.v1.ExecSandboxInput.resize:type_name -> openshell.v1.ExecSandboxWindowResize - 299, // 132: openshell.v1.SshSession.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 298, // 133: openshell.v1.SshSession.expiration_time:type_name -> google.protobuf.Timestamp - 303, // 134: openshell.v1.WatchSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 298, // 135: openshell.v1.WatchSandboxRequest.since_time:type_name -> google.protobuf.Timestamp + 298, // 132: openshell.v1.SshSession.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 297, // 133: openshell.v1.SshSession.expiration_time:type_name -> google.protobuf.Timestamp + 302, // 134: openshell.v1.WatchSandboxRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 297, // 135: openshell.v1.WatchSandboxRequest.since_time:type_name -> google.protobuf.Timestamp 39, // 136: openshell.v1.SandboxStreamEvent.sandbox:type_name -> openshell.v1.Sandbox 113, // 137: openshell.v1.SandboxStreamEvent.log:type_name -> openshell.v1.SandboxLogLine 53, // 138: openshell.v1.SandboxStreamEvent.event:type_name -> openshell.v1.PlatformEvent 114, // 139: openshell.v1.SandboxStreamEvent.warning:type_name -> openshell.v1.SandboxStreamWarning - 226, // 140: openshell.v1.SandboxStreamEvent.draft_policy_update:type_name -> openshell.v1.DraftPolicyUpdate - 298, // 141: openshell.v1.SandboxLogLine.event_time:type_name -> google.protobuf.Timestamp - 282, // 142: openshell.v1.SandboxLogLine.fields:type_name -> openshell.v1.SandboxLogLine.FieldsEntry - 303, // 143: openshell.v1.CreateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 304, // 144: openshell.v1.CreateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider - 303, // 145: openshell.v1.GetProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 146: openshell.v1.GetProviderCredentialsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 302, // 147: openshell.v1.GetProviderCredentialsRequest.minimum_remaining_lifetime:type_name -> google.protobuf.Duration - 298, // 148: openshell.v1.ProviderCredentialValue.expiration_time:type_name -> google.protobuf.Timestamp - 283, // 149: openshell.v1.GetProviderCredentialsResponse.credentials:type_name -> openshell.v1.GetProviderCredentialsResponse.CredentialsEntry - 303, // 150: openshell.v1.ListProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 151: openshell.v1.UpdateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 304, // 152: openshell.v1.UpdateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider - 284, // 153: openshell.v1.UpdateProviderRequest.credential_expiration_times:type_name -> openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry - 303, // 154: openshell.v1.DeleteProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 304, // 155: openshell.v1.ProviderResponse.provider:type_name -> openshell.datamodel.v1.Provider + 225, // 140: openshell.v1.SandboxStreamEvent.draft_policy_update:type_name -> openshell.v1.DraftPolicyUpdate + 297, // 141: openshell.v1.SandboxLogLine.event_time:type_name -> google.protobuf.Timestamp + 281, // 142: openshell.v1.SandboxLogLine.fields:type_name -> openshell.v1.SandboxLogLine.FieldsEntry + 302, // 143: openshell.v1.CreateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 144: openshell.v1.CreateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider + 302, // 145: openshell.v1.GetProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 146: openshell.v1.GetProviderCredentialsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 301, // 147: openshell.v1.GetProviderCredentialsRequest.minimum_remaining_lifetime:type_name -> google.protobuf.Duration + 297, // 148: openshell.v1.ProviderCredentialValue.expiration_time:type_name -> google.protobuf.Timestamp + 282, // 149: openshell.v1.GetProviderCredentialsResponse.credentials:type_name -> openshell.v1.GetProviderCredentialsResponse.CredentialsEntry + 302, // 150: openshell.v1.ListProvidersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 151: openshell.v1.UpdateProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 152: openshell.v1.UpdateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider + 283, // 153: openshell.v1.UpdateProviderRequest.credential_expiration_times:type_name -> openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry + 302, // 154: openshell.v1.DeleteProviderRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 155: openshell.v1.ProviderResponse.provider:type_name -> openshell.datamodel.v1.Provider 81, // 156: openshell.v1.ProviderResponse.target_receipts:type_name -> openshell.v1.ProviderMutationReceipt - 304, // 157: openshell.v1.ListProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider - 303, // 158: openshell.v1.ListProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 159: openshell.v1.GetProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 303, // 157: openshell.v1.ListProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider + 302, // 158: openshell.v1.ListProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 159: openshell.v1.GetProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 146, // 160: openshell.v1.ProviderProfileImportItem.profile:type_name -> openshell.v1.ProviderProfile - 302, // 161: openshell.v1.ProviderCredentialTokenGrant.cache_ttl:type_name -> google.protobuf.Duration + 301, // 161: openshell.v1.ProviderCredentialTokenGrant.cache_ttl:type_name -> google.protobuf.Duration 129, // 162: openshell.v1.ProviderCredentialTokenGrant.audience_overrides:type_name -> openshell.v1.ProviderCredentialTokenGrantAudienceOverride 8, // 163: openshell.v1.ProviderCredentialTokenGrant.grant_type:type_name -> openshell.v1.ProviderCredentialTokenGrantType 130, // 164: openshell.v1.ProviderCredentialTokenGrant.subject_token:type_name -> openshell.v1.ProviderCredentialTokenGrantSubjectToken 135, // 165: openshell.v1.ProviderProfileCredential.refresh:type_name -> openshell.v1.ProviderCredentialRefresh 131, // 166: openshell.v1.ProviderProfileCredential.token_grant:type_name -> openshell.v1.ProviderCredentialTokenGrant 9, // 167: openshell.v1.ProviderCredentialRefresh.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 302, // 168: openshell.v1.ProviderCredentialRefresh.refresh_before:type_name -> google.protobuf.Duration - 302, // 169: openshell.v1.ProviderCredentialRefresh.max_lifetime:type_name -> google.protobuf.Duration + 301, // 168: openshell.v1.ProviderCredentialRefresh.refresh_before:type_name -> google.protobuf.Duration + 301, // 169: openshell.v1.ProviderCredentialRefresh.max_lifetime:type_name -> google.protobuf.Duration 133, // 170: openshell.v1.ProviderCredentialRefresh.material:type_name -> openshell.v1.ProviderCredentialRefreshMaterial 134, // 171: openshell.v1.ProviderCredentialRefresh.additional_outputs:type_name -> openshell.v1.ProviderCredentialRefreshOutput 9, // 172: openshell.v1.ProviderCredentialRefreshStatus.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 298, // 173: openshell.v1.ProviderCredentialRefreshStatus.expiration_time:type_name -> google.protobuf.Timestamp - 298, // 174: openshell.v1.ProviderCredentialRefreshStatus.next_refresh_time:type_name -> google.protobuf.Timestamp - 298, // 175: openshell.v1.ProviderCredentialRefreshStatus.last_refresh_time:type_name -> google.protobuf.Timestamp + 297, // 173: openshell.v1.ProviderCredentialRefreshStatus.expiration_time:type_name -> google.protobuf.Timestamp + 297, // 174: openshell.v1.ProviderCredentialRefreshStatus.next_refresh_time:type_name -> google.protobuf.Timestamp + 297, // 175: openshell.v1.ProviderCredentialRefreshStatus.last_refresh_time:type_name -> google.protobuf.Timestamp 16, // 176: openshell.v1.ProviderCredentialRefreshStatus.recovery_action:type_name -> openshell.v1.ProviderCredentialRefreshRecoveryAction - 298, // 177: openshell.v1.ProviderCredentialRefreshStatus.last_error_time:type_name -> google.protobuf.Timestamp - 303, // 178: openshell.v1.GetProviderRefreshStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 297, // 177: openshell.v1.ProviderCredentialRefreshStatus.last_error_time:type_name -> google.protobuf.Timestamp + 302, // 178: openshell.v1.GetProviderRefreshStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 136, // 179: openshell.v1.GetProviderRefreshStatusResponse.credentials:type_name -> openshell.v1.ProviderCredentialRefreshStatus - 303, // 180: openshell.v1.ConfigureProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 180: openshell.v1.ConfigureProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 9, // 181: openshell.v1.ConfigureProviderRefreshRequest.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 285, // 182: openshell.v1.ConfigureProviderRefreshRequest.material:type_name -> openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry - 298, // 183: openshell.v1.ConfigureProviderRefreshRequest.expiration_time:type_name -> google.protobuf.Timestamp + 284, // 182: openshell.v1.ConfigureProviderRefreshRequest.material:type_name -> openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry + 297, // 183: openshell.v1.ConfigureProviderRefreshRequest.expiration_time:type_name -> google.protobuf.Timestamp 136, // 184: openshell.v1.ConfigureProviderRefreshResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus - 303, // 185: openshell.v1.RotateProviderCredentialRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 185: openshell.v1.RotateProviderCredentialRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 136, // 186: openshell.v1.RotateProviderCredentialResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus - 303, // 187: openshell.v1.DeleteProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 187: openshell.v1.DeleteProviderRefreshRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 18, // 188: openshell.v1.DeleteProviderRefreshResponse.outcome:type_name -> openshell.v1.DeletionOutcome 10, // 189: openshell.v1.ProviderProfile.category:type_name -> openshell.v1.ProviderProfileCategory 132, // 190: openshell.v1.ProviderProfile.credentials:type_name -> openshell.v1.ProviderProfileCredential - 306, // 191: openshell.v1.ProviderProfile.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint - 307, // 192: openshell.v1.ProviderProfile.binaries:type_name -> openshell.sandbox.v1.NetworkBinary + 305, // 191: openshell.v1.ProviderProfile.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint + 306, // 192: openshell.v1.ProviderProfile.binaries:type_name -> openshell.sandbox.v1.NetworkBinary 137, // 193: openshell.v1.ProviderProfile.discovery:type_name -> openshell.v1.ProviderProfileDiscovery - 286, // 194: openshell.v1.ProviderProfile.annotations:type_name -> openshell.v1.ProviderProfile.AnnotationsEntry + 285, // 194: openshell.v1.ProviderProfile.annotations:type_name -> openshell.v1.ProviderProfile.AnnotationsEntry 147, // 195: openshell.v1.ProviderProfile.files:type_name -> openshell.v1.ProviderProfileFile 146, // 196: openshell.v1.ProviderProfileResponse.profile:type_name -> openshell.v1.ProviderProfile 146, // 197: openshell.v1.ListProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile - 303, // 198: openshell.v1.ImportProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 198: openshell.v1.ImportProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 127, // 199: openshell.v1.ImportProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem 128, // 200: openshell.v1.ImportProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic 146, // 201: openshell.v1.ImportProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile - 303, // 202: openshell.v1.UpdateProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 202: openshell.v1.UpdateProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 127, // 203: openshell.v1.UpdateProviderProfilesRequest.profile:type_name -> openshell.v1.ProviderProfileImportItem 128, // 204: openshell.v1.UpdateProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic 146, // 205: openshell.v1.UpdateProviderProfilesResponse.profile:type_name -> openshell.v1.ProviderProfile - 303, // 206: openshell.v1.LintProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 206: openshell.v1.LintProviderProfilesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 127, // 207: openshell.v1.LintProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem 128, // 208: openshell.v1.LintProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic 18, // 209: openshell.v1.DeleteProviderResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 303, // 210: openshell.v1.DeleteProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 210: openshell.v1.DeleteProviderProfileRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector 18, // 211: openshell.v1.DeleteProviderProfileResponse.outcome:type_name -> openshell.v1.DeletionOutcome 160, // 212: openshell.v1.StaticCredentialBinding.endpoints:type_name -> openshell.v1.StaticCredentialEndpointBinding - 161, // 213: openshell.v1.StaticCredentialBinding.placement:type_name -> openshell.v1.StaticCredentialPlacement - 287, // 214: openshell.v1.GetSandboxProviderEnvironmentResponse.environment:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry - 288, // 215: openshell.v1.GetSandboxProviderEnvironmentResponse.credential_expiration_times:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry - 289, // 216: openshell.v1.GetSandboxProviderEnvironmentResponse.dynamic_credentials:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry - 290, // 217: openshell.v1.GetSandboxProviderEnvironmentResponse.static_credential_bindings:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry - 4, // 218: openshell.v1.GetSandboxProviderEnvironmentResponse.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason - 291, // 219: openshell.v1.GetSandboxProviderEnvironmentResponse.files:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.FilesEntry - 11, // 220: openshell.v1.ProviderEnvironmentValue.classification:type_name -> openshell.v1.ProviderEnvironmentValueClassification - 162, // 221: openshell.v1.ProviderEnvironmentValue.static_credential_binding:type_name -> openshell.v1.StaticCredentialBinding - 298, // 222: openshell.v1.ProviderEnvironmentValue.expiration_time:type_name -> google.protobuf.Timestamp - 164, // 223: openshell.v1.ProviderEnvironmentSnapshot.values:type_name -> openshell.v1.ProviderEnvironmentValue - 292, // 224: openshell.v1.ProviderEnvironmentSnapshot.dynamic_credentials:type_name -> openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry - 4, // 225: openshell.v1.ProviderEnvironmentSnapshot.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason - 293, // 226: openshell.v1.ProviderEnvironmentSnapshot.files:type_name -> openshell.v1.ProviderEnvironmentSnapshot.FilesEntry - 302, // 227: openshell.v1.ExchangeProviderSubjectTokenResponse.expires_after:type_name -> google.protobuf.Duration - 303, // 228: openshell.v1.UpdateConfigRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 300, // 229: openshell.v1.UpdateConfigRequest.policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 308, // 230: openshell.v1.UpdateConfigRequest.setting_value:type_name -> openshell.sandbox.v1.SettingValue - 169, // 231: openshell.v1.UpdateConfigRequest.merge_operations:type_name -> openshell.v1.PolicyMergeOperation - 294, // 232: openshell.v1.UpdateConfigRequest.annotations:type_name -> openshell.v1.UpdateConfigRequest.AnnotationsEntry - 170, // 233: openshell.v1.PolicyMergeOperation.add_rule:type_name -> openshell.v1.AddNetworkRule - 171, // 234: openshell.v1.PolicyMergeOperation.remove_endpoint:type_name -> openshell.v1.RemoveNetworkEndpoint - 172, // 235: openshell.v1.PolicyMergeOperation.remove_rule:type_name -> openshell.v1.RemoveNetworkRule - 174, // 236: openshell.v1.PolicyMergeOperation.add_deny_rules:type_name -> openshell.v1.AddDenyRules - 175, // 237: openshell.v1.PolicyMergeOperation.add_allow_rules:type_name -> openshell.v1.AddAllowRules - 176, // 238: openshell.v1.PolicyMergeOperation.remove_binary:type_name -> openshell.v1.RemoveNetworkBinary - 309, // 239: openshell.v1.AddNetworkRule.rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 307, // 240: openshell.v1.L7RuleTarget.binaries:type_name -> openshell.sandbox.v1.NetworkBinary - 310, // 241: openshell.v1.AddDenyRules.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule - 173, // 242: openshell.v1.AddDenyRules.target:type_name -> openshell.v1.L7RuleTarget - 311, // 243: openshell.v1.AddAllowRules.rules:type_name -> openshell.sandbox.v1.L7Rule - 173, // 244: openshell.v1.AddAllowRules.target:type_name -> openshell.v1.L7RuleTarget - 295, // 245: openshell.v1.UpdateConfigResponse.annotations:type_name -> openshell.v1.UpdateConfigResponse.AnnotationsEntry - 303, // 246: openshell.v1.GetSandboxPolicyStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 187, // 247: openshell.v1.GetSandboxPolicyStatusResponse.revision:type_name -> openshell.v1.SandboxPolicyRevision - 303, // 248: openshell.v1.ListSandboxPoliciesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 187, // 249: openshell.v1.ListSandboxPoliciesResponse.revisions:type_name -> openshell.v1.SandboxPolicyRevision - 13, // 250: openshell.v1.ReportPolicyStatusRequest.status:type_name -> openshell.v1.PolicyStatus - 12, // 251: openshell.v1.SandboxConfigurationAdmission.state:type_name -> openshell.v1.ConfigurationAdmissionState - 184, // 252: openshell.v1.ReportSandboxConfigurationRequest.admission:type_name -> openshell.v1.SandboxConfigurationAdmission - 13, // 253: openshell.v1.SandboxPolicyRevision.status:type_name -> openshell.v1.PolicyStatus - 298, // 254: openshell.v1.SandboxPolicyRevision.created_time:type_name -> google.protobuf.Timestamp - 298, // 255: openshell.v1.SandboxPolicyRevision.loaded_time:type_name -> google.protobuf.Timestamp - 300, // 256: openshell.v1.SandboxPolicyRevision.policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 296, // 257: openshell.v1.SandboxPolicyRevision.provenance:type_name -> openshell.v1.SandboxPolicyRevision.ProvenanceEntry - 303, // 258: openshell.v1.GetSandboxLogsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 298, // 259: openshell.v1.GetSandboxLogsRequest.since_time:type_name -> google.protobuf.Timestamp - 113, // 260: openshell.v1.PushSandboxLogsRequest.logs:type_name -> openshell.v1.SandboxLogLine - 113, // 261: openshell.v1.GetSandboxLogsResponse.logs:type_name -> openshell.v1.SandboxLogLine - 194, // 262: openshell.v1.SupervisorMessage.hello:type_name -> openshell.v1.SupervisorHello - 202, // 263: openshell.v1.SupervisorMessage.heartbeat:type_name -> openshell.v1.SupervisorHeartbeat - 219, // 264: openshell.v1.SupervisorMessage.relay_open_result:type_name -> openshell.v1.RelayOpenResult - 220, // 265: openshell.v1.SupervisorMessage.relay_close:type_name -> openshell.v1.RelayClose - 198, // 266: openshell.v1.SupervisorMessage.config_update_result:type_name -> openshell.v1.ConfigUpdateResult - 195, // 267: openshell.v1.GatewayMessage.session_accepted:type_name -> openshell.v1.SessionAccepted - 200, // 268: openshell.v1.GatewayMessage.session_rejected:type_name -> openshell.v1.SessionRejected - 203, // 269: openshell.v1.GatewayMessage.heartbeat:type_name -> openshell.v1.GatewayHeartbeat - 208, // 270: openshell.v1.GatewayMessage.relay_open:type_name -> openshell.v1.RelayOpen - 220, // 271: openshell.v1.GatewayMessage.relay_close:type_name -> openshell.v1.RelayClose - 201, // 272: openshell.v1.GatewayMessage.session_redirect:type_name -> openshell.v1.SessionRedirect - 196, // 273: openshell.v1.GatewayMessage.config_update:type_name -> openshell.v1.ConfigUpdate - 196, // 274: openshell.v1.SessionAccepted.bootstrap:type_name -> openshell.v1.ConfigUpdate - 302, // 275: openshell.v1.SessionAccepted.heartbeat_interval:type_name -> google.protobuf.Duration - 312, // 276: openshell.v1.ConfigUpdate.sandbox_config:type_name -> openshell.sandbox.v1.SandboxConfigSnapshot - 165, // 277: openshell.v1.ConfigUpdate.provider_environment:type_name -> openshell.v1.ProviderEnvironmentSnapshot - 6, // 278: openshell.v1.ConfigUpdateResult.outcome:type_name -> openshell.v1.ConfigApplyOutcome - 197, // 279: openshell.v1.ConfigUpdateResult.failure:type_name -> openshell.v1.ConfigApplyFailure - 184, // 280: openshell.v1.ConfigUpdateResult.admission:type_name -> openshell.v1.SandboxConfigurationAdmission - 199, // 281: openshell.v1.ConfigUpdateResult.policy_load:type_name -> openshell.v1.PolicyLoadResult - 209, // 282: openshell.v1.RelayOpen.ssh:type_name -> openshell.v1.SshRelayTarget - 210, // 283: openshell.v1.RelayOpen.tcp:type_name -> openshell.v1.TcpRelayTarget - 211, // 284: openshell.v1.RelayFrame.init:type_name -> openshell.v1.RelayInit - 208, // 285: openshell.v1.PeerRelayInit.relay_open:type_name -> openshell.v1.RelayOpen - 213, // 286: openshell.v1.PeerRelayFrame.init:type_name -> openshell.v1.PeerRelayInit - 215, // 287: openshell.v1.PeerNotifyConfigUpdateRequest.sandbox:type_name -> openshell.v1.PeerConfigSandboxTarget - 216, // 288: openshell.v1.PeerNotifyConfigUpdateRequest.provider:type_name -> openshell.v1.PeerConfigProviderTarget - 298, // 289: openshell.v1.DenialSummary.first_seen_time:type_name -> google.protobuf.Timestamp - 298, // 290: openshell.v1.DenialSummary.last_seen_time:type_name -> google.protobuf.Timestamp - 221, // 291: openshell.v1.DenialSummary.l7_request_samples:type_name -> openshell.v1.L7RequestSample - 223, // 292: openshell.v1.NetworkActivitySummary.denials_by_group:type_name -> openshell.v1.DenialGroupCount - 309, // 293: openshell.v1.PolicyChunk.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 298, // 294: openshell.v1.PolicyChunk.created_time:type_name -> google.protobuf.Timestamp - 298, // 295: openshell.v1.PolicyChunk.decided_time:type_name -> google.protobuf.Timestamp - 298, // 296: openshell.v1.PolicyChunk.first_seen_time:type_name -> google.protobuf.Timestamp - 298, // 297: openshell.v1.PolicyChunk.last_seen_time:type_name -> google.protobuf.Timestamp - 300, // 298: openshell.v1.PolicyChunk.current_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 300, // 299: openshell.v1.PolicyChunk.candidate_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 303, // 300: openshell.v1.SubmitPolicyAnalysisRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 222, // 301: openshell.v1.SubmitPolicyAnalysisRequest.summaries:type_name -> openshell.v1.DenialSummary - 225, // 302: openshell.v1.SubmitPolicyAnalysisRequest.proposed_chunks:type_name -> openshell.v1.PolicyChunk - 224, // 303: openshell.v1.SubmitPolicyAnalysisRequest.network_activity_summaries:type_name -> openshell.v1.NetworkActivitySummary - 303, // 304: openshell.v1.GetDraftPolicyRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 225, // 305: openshell.v1.GetDraftPolicyResponse.chunks:type_name -> openshell.v1.PolicyChunk - 298, // 306: openshell.v1.GetDraftPolicyResponse.last_analyzed_time:type_name -> google.protobuf.Timestamp - 303, // 307: openshell.v1.ApproveDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 308: openshell.v1.RejectDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 309: openshell.v1.ApproveAllDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 235, // 310: openshell.v1.ApproveAllDraftChunksRequest.approvals:type_name -> openshell.v1.DraftChunkApproval - 303, // 311: openshell.v1.EditDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 309, // 312: openshell.v1.EditDraftChunkRequest.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 303, // 313: openshell.v1.UndoDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 314: openshell.v1.ClearDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 303, // 315: openshell.v1.GetDraftHistoryRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 298, // 316: openshell.v1.DraftHistoryEntry.event_time:type_name -> google.protobuf.Timestamp - 245, // 317: openshell.v1.GetDraftHistoryResponse.entries:type_name -> openshell.v1.DraftHistoryEntry - 297, // 318: openshell.v1.CreateWorkspaceRequest.labels:type_name -> openshell.v1.CreateWorkspaceRequest.LabelsEntry - 313, // 319: openshell.v1.CreateWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace - 313, // 320: openshell.v1.GetWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace - 313, // 321: openshell.v1.ListWorkspacesResponse.workspaces:type_name -> openshell.datamodel.v1.Workspace - 18, // 322: openshell.v1.DeleteWorkspaceResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 299, // 323: openshell.v1.WorkspaceMember.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 15, // 324: openshell.v1.WorkspaceMember.role:type_name -> openshell.v1.WorkspaceRole - 303, // 325: openshell.v1.AddWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 15, // 326: openshell.v1.AddWorkspaceMemberRequest.role:type_name -> openshell.v1.WorkspaceRole - 255, // 327: openshell.v1.AddWorkspaceMemberResponse.member:type_name -> openshell.v1.WorkspaceMember - 303, // 328: openshell.v1.RemoveWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 18, // 329: openshell.v1.RemoveWorkspaceMemberResponse.outcome:type_name -> openshell.v1.DeletionOutcome - 303, // 330: openshell.v1.ListWorkspaceMembersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector - 255, // 331: openshell.v1.ListWorkspaceMembersResponse.members:type_name -> openshell.v1.WorkspaceMember - 298, // 332: openshell.v1.ExtensionServiceCredential.expiration_time:type_name -> google.protobuf.Timestamp - 19, // 333: openshell.v1.EndpointObservation.result:type_name -> openshell.v1.EndpointResult - 271, // 334: openshell.v1.EndpointObservation.failure:type_name -> openshell.v1.EndpointFailure - 263, // 335: openshell.v1.ReportEndpointStatusRequest.observations:type_name -> openshell.v1.EndpointObservation - 265, // 336: openshell.v1.ReportEndpointStatusRequest.token_grant_status:type_name -> openshell.v1.TokenGrantStatus - 266, // 337: openshell.v1.TokenGrantStatus.last_failure:type_name -> openshell.v1.TokenGrantFailureObservation - 271, // 338: openshell.v1.TokenGrantFailureObservation.failure:type_name -> openshell.v1.EndpointFailure - 19, // 339: openshell.v1.EndpointStatus.last_result:type_name -> openshell.v1.EndpointResult - 298, // 340: openshell.v1.EndpointStatus.last_reported_time:type_name -> google.protobuf.Timestamp - 271, // 341: openshell.v1.EndpointStatus.last_failure:type_name -> openshell.v1.EndpointFailure - 298, // 342: openshell.v1.SandboxProvisioning.configuration_change_time:type_name -> google.protobuf.Timestamp - 298, // 343: openshell.v1.SandboxProvisioning.first_rejection_time:type_name -> google.protobuf.Timestamp - 298, // 344: openshell.v1.SandboxProvisioning.deadline:type_name -> google.protobuf.Timestamp - 298, // 345: openshell.v1.SandboxProvisioning.timeout_time:type_name -> google.protobuf.Timestamp - 298, // 346: openshell.v1.SandboxProvisioning.cleanup_completed_time:type_name -> google.protobuf.Timestamp - 298, // 347: openshell.v1.SandboxProvisioning.cleanup_retry_time:type_name -> google.protobuf.Timestamp - 298, // 348: openshell.v1.SandboxProvisioning.attachment_change_time:type_name -> google.protobuf.Timestamp - 298, // 349: openshell.v1.SandboxProvisioning.preparation_deadline:type_name -> google.protobuf.Timestamp - 298, // 350: openshell.v1.SandboxProvisioning.admission_start_time:type_name -> google.protobuf.Timestamp - 20, // 351: openshell.v1.SandboxServiceExposure.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode - 21, // 352: openshell.v1.EndpointFailure.domain:type_name -> openshell.v1.EndpointFailureDomain - 16, // 353: openshell.v1.EndpointFailure.recovery_action:type_name -> openshell.v1.ProviderCredentialRefreshRecoveryAction - 118, // 354: openshell.v1.GetProviderCredentialsResponse.CredentialsEntry.value:type_name -> openshell.v1.ProviderCredentialValue - 298, // 355: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp - 298, // 356: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp - 132, // 357: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential - 162, // 358: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry.value:type_name -> openshell.v1.StaticCredentialBinding - 132, // 359: openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential - 26, // 360: openshell.v1.OpenShell.Health:input_type -> openshell.v1.HealthRequest - 28, // 361: openshell.v1.OpenShell.GetCurrentUser:input_type -> openshell.v1.GetCurrentUserRequest - 30, // 362: openshell.v1.OpenShell.GetGatewayInfo:input_type -> openshell.v1.GetGatewayInfoRequest - 54, // 363: openshell.v1.OpenShell.CreateSandbox:input_type -> openshell.v1.CreateSandboxRequest - 62, // 364: openshell.v1.OpenShell.BeginRootfsTarStaging:input_type -> openshell.v1.BeginRootfsTarStagingRequest - 64, // 365: openshell.v1.OpenShell.GetSandbox:input_type -> openshell.v1.GetSandboxRequest - 65, // 366: openshell.v1.OpenShell.ListSandboxes:input_type -> openshell.v1.ListSandboxesRequest - 55, // 367: openshell.v1.OpenShell.CreateSandboxTemplate:input_type -> openshell.v1.CreateSandboxTemplateRequest - 56, // 368: openshell.v1.OpenShell.GetSandboxTemplate:input_type -> openshell.v1.GetSandboxTemplateRequest - 57, // 369: openshell.v1.OpenShell.ListSandboxTemplates:input_type -> openshell.v1.ListSandboxTemplatesRequest - 58, // 370: openshell.v1.OpenShell.DeleteSandboxTemplate:input_type -> openshell.v1.DeleteSandboxTemplateRequest - 66, // 371: openshell.v1.OpenShell.ListSandboxProviders:input_type -> openshell.v1.ListSandboxProvidersRequest - 67, // 372: openshell.v1.OpenShell.AttachSandboxProvider:input_type -> openshell.v1.AttachSandboxProviderRequest - 68, // 373: openshell.v1.OpenShell.DetachSandboxProvider:input_type -> openshell.v1.DetachSandboxProviderRequest - 84, // 374: openshell.v1.OpenShell.GetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest - 69, // 375: openshell.v1.OpenShell.DeleteSandbox:input_type -> openshell.v1.DeleteSandboxRequest - 70, // 376: openshell.v1.OpenShell.StopSandbox:input_type -> openshell.v1.StopSandboxRequest - 71, // 377: openshell.v1.OpenShell.StartSandbox:input_type -> openshell.v1.StartSandboxRequest - 89, // 378: openshell.v1.OpenShell.CreateSshSession:input_type -> openshell.v1.CreateSshSessionRequest - 91, // 379: openshell.v1.OpenShell.ExposeService:input_type -> openshell.v1.ExposeServiceRequest - 92, // 380: openshell.v1.OpenShell.GetService:input_type -> openshell.v1.GetServiceRequest - 93, // 381: openshell.v1.OpenShell.ListServices:input_type -> openshell.v1.ListServicesRequest - 95, // 382: openshell.v1.OpenShell.DeleteService:input_type -> openshell.v1.DeleteServiceRequest - 99, // 383: openshell.v1.OpenShell.RevokeSshSession:input_type -> openshell.v1.RevokeSshSessionRequest - 101, // 384: openshell.v1.OpenShell.ExecSandbox:input_type -> openshell.v1.ExecSandboxRequest - 107, // 385: openshell.v1.OpenShell.ForwardTcp:input_type -> openshell.v1.TcpForwardFrame - 108, // 386: openshell.v1.OpenShell.ExecSandboxInteractive:input_type -> openshell.v1.ExecSandboxInput - 115, // 387: openshell.v1.OpenShell.CreateProvider:input_type -> openshell.v1.CreateProviderRequest - 116, // 388: openshell.v1.OpenShell.GetProvider:input_type -> openshell.v1.GetProviderRequest - 117, // 389: openshell.v1.OpenShell.GetProviderCredentials:input_type -> openshell.v1.GetProviderCredentialsRequest - 120, // 390: openshell.v1.OpenShell.ListProviders:input_type -> openshell.v1.ListProvidersRequest - 125, // 391: openshell.v1.OpenShell.ListProviderProfiles:input_type -> openshell.v1.ListProviderProfilesRequest - 126, // 392: openshell.v1.OpenShell.GetProviderProfile:input_type -> openshell.v1.GetProviderProfileRequest - 150, // 393: openshell.v1.OpenShell.ImportProviderProfiles:input_type -> openshell.v1.ImportProviderProfilesRequest - 152, // 394: openshell.v1.OpenShell.UpdateProviderProfiles:input_type -> openshell.v1.UpdateProviderProfilesRequest - 154, // 395: openshell.v1.OpenShell.LintProviderProfiles:input_type -> openshell.v1.LintProviderProfilesRequest - 121, // 396: openshell.v1.OpenShell.UpdateProvider:input_type -> openshell.v1.UpdateProviderRequest - 138, // 397: openshell.v1.OpenShell.GetProviderRefreshStatus:input_type -> openshell.v1.GetProviderRefreshStatusRequest - 140, // 398: openshell.v1.OpenShell.ConfigureProviderRefresh:input_type -> openshell.v1.ConfigureProviderRefreshRequest - 142, // 399: openshell.v1.OpenShell.RotateProviderCredential:input_type -> openshell.v1.RotateProviderCredentialRequest - 144, // 400: openshell.v1.OpenShell.DeleteProviderRefresh:input_type -> openshell.v1.DeleteProviderRefreshRequest - 122, // 401: openshell.v1.OpenShell.DeleteProvider:input_type -> openshell.v1.DeleteProviderRequest - 157, // 402: openshell.v1.OpenShell.DeleteProviderProfile:input_type -> openshell.v1.DeleteProviderProfileRequest - 314, // 403: openshell.v1.OpenShell.GetSandboxConfig:input_type -> openshell.sandbox.v1.GetSandboxConfigRequest - 315, // 404: openshell.v1.OpenShell.GetGatewayConfig:input_type -> openshell.sandbox.v1.GetGatewayConfigRequest - 168, // 405: openshell.v1.OpenShell.UpdateConfig:input_type -> openshell.v1.UpdateConfigRequest - 178, // 406: openshell.v1.OpenShell.GetSandboxPolicyStatus:input_type -> openshell.v1.GetSandboxPolicyStatusRequest - 180, // 407: openshell.v1.OpenShell.ListSandboxPolicies:input_type -> openshell.v1.ListSandboxPoliciesRequest - 182, // 408: openshell.v1.OpenShell.ReportPolicyStatus:input_type -> openshell.v1.ReportPolicyStatusRequest - 264, // 409: openshell.v1.OpenShell.ReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest - 86, // 410: openshell.v1.OpenShell.ReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest - 185, // 411: openshell.v1.OpenShell.ReportSandboxConfiguration:input_type -> openshell.v1.ReportSandboxConfigurationRequest - 159, // 412: openshell.v1.OpenShell.GetSandboxProviderEnvironment:input_type -> openshell.v1.GetSandboxProviderEnvironmentRequest - 166, // 413: openshell.v1.OpenShell.ExchangeProviderSubjectToken:input_type -> openshell.v1.ExchangeProviderSubjectTokenRequest - 188, // 414: openshell.v1.OpenShell.GetSandboxLogs:input_type -> openshell.v1.GetSandboxLogsRequest - 189, // 415: openshell.v1.OpenShell.PushSandboxLogs:input_type -> openshell.v1.PushSandboxLogsRequest - 192, // 416: openshell.v1.OpenShell.ConnectSupervisor:input_type -> openshell.v1.SupervisorMessage - 204, // 417: openshell.v1.OpenShell.ReportMainProcessExit:input_type -> openshell.v1.ReportMainProcessExitRequest - 206, // 418: openshell.v1.OpenShell.FinalizeMainProcessExit:input_type -> openshell.v1.FinalizeMainProcessExitRequest - 212, // 419: openshell.v1.OpenShell.RelayStream:input_type -> openshell.v1.RelayFrame - 214, // 420: openshell.v1.OpenShell.PeerRelay:input_type -> openshell.v1.PeerRelayFrame - 86, // 421: openshell.v1.OpenShell.PeerReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest - 264, // 422: openshell.v1.OpenShell.PeerReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest - 84, // 423: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest - 217, // 424: openshell.v1.OpenShell.PeerNotifyConfigUpdate:input_type -> openshell.v1.PeerNotifyConfigUpdateRequest - 111, // 425: openshell.v1.OpenShell.WatchSandbox:input_type -> openshell.v1.WatchSandboxRequest - 227, // 426: openshell.v1.OpenShell.SubmitPolicyAnalysis:input_type -> openshell.v1.SubmitPolicyAnalysisRequest - 229, // 427: openshell.v1.OpenShell.GetDraftPolicy:input_type -> openshell.v1.GetDraftPolicyRequest - 231, // 428: openshell.v1.OpenShell.ApproveDraftChunk:input_type -> openshell.v1.ApproveDraftChunkRequest - 233, // 429: openshell.v1.OpenShell.RejectDraftChunk:input_type -> openshell.v1.RejectDraftChunkRequest - 236, // 430: openshell.v1.OpenShell.ApproveAllDraftChunks:input_type -> openshell.v1.ApproveAllDraftChunksRequest - 238, // 431: openshell.v1.OpenShell.EditDraftChunk:input_type -> openshell.v1.EditDraftChunkRequest - 240, // 432: openshell.v1.OpenShell.UndoDraftChunk:input_type -> openshell.v1.UndoDraftChunkRequest - 242, // 433: openshell.v1.OpenShell.ClearDraftChunks:input_type -> openshell.v1.ClearDraftChunksRequest - 244, // 434: openshell.v1.OpenShell.GetDraftHistory:input_type -> openshell.v1.GetDraftHistoryRequest - 22, // 435: openshell.v1.OpenShell.IssueSandboxToken:input_type -> openshell.v1.IssueSandboxTokenRequest - 24, // 436: openshell.v1.OpenShell.RefreshSandboxToken:input_type -> openshell.v1.RefreshSandboxTokenRequest - 247, // 437: openshell.v1.OpenShell.CreateWorkspace:input_type -> openshell.v1.CreateWorkspaceRequest - 249, // 438: openshell.v1.OpenShell.GetWorkspace:input_type -> openshell.v1.GetWorkspaceRequest - 251, // 439: openshell.v1.OpenShell.ListWorkspaces:input_type -> openshell.v1.ListWorkspacesRequest - 253, // 440: openshell.v1.OpenShell.DeleteWorkspace:input_type -> openshell.v1.DeleteWorkspaceRequest - 256, // 441: openshell.v1.OpenShell.AddWorkspaceMember:input_type -> openshell.v1.AddWorkspaceMemberRequest - 258, // 442: openshell.v1.OpenShell.RemoveWorkspaceMember:input_type -> openshell.v1.RemoveWorkspaceMemberRequest - 260, // 443: openshell.v1.OpenShell.ListWorkspaceMembers:input_type -> openshell.v1.ListWorkspaceMembersRequest - 27, // 444: openshell.v1.OpenShell.Health:output_type -> openshell.v1.HealthResponse - 29, // 445: openshell.v1.OpenShell.GetCurrentUser:output_type -> openshell.v1.GetCurrentUserResponse - 31, // 446: openshell.v1.OpenShell.GetGatewayInfo:output_type -> openshell.v1.GetGatewayInfoResponse - 72, // 447: openshell.v1.OpenShell.CreateSandbox:output_type -> openshell.v1.SandboxResponse - 63, // 448: openshell.v1.OpenShell.BeginRootfsTarStaging:output_type -> openshell.v1.BeginRootfsTarStagingResponse - 72, // 449: openshell.v1.OpenShell.GetSandbox:output_type -> openshell.v1.SandboxResponse - 73, // 450: openshell.v1.OpenShell.ListSandboxes:output_type -> openshell.v1.ListSandboxesResponse - 59, // 451: openshell.v1.OpenShell.CreateSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse - 59, // 452: openshell.v1.OpenShell.GetSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse - 60, // 453: openshell.v1.OpenShell.ListSandboxTemplates:output_type -> openshell.v1.ListSandboxTemplatesResponse - 61, // 454: openshell.v1.OpenShell.DeleteSandboxTemplate:output_type -> openshell.v1.DeleteSandboxTemplateResponse - 74, // 455: openshell.v1.OpenShell.ListSandboxProviders:output_type -> openshell.v1.ListSandboxProvidersResponse - 75, // 456: openshell.v1.OpenShell.AttachSandboxProvider:output_type -> openshell.v1.AttachSandboxProviderResponse - 76, // 457: openshell.v1.OpenShell.DetachSandboxProvider:output_type -> openshell.v1.DetachSandboxProviderResponse - 85, // 458: openshell.v1.OpenShell.GetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse - 88, // 459: openshell.v1.OpenShell.DeleteSandbox:output_type -> openshell.v1.DeleteSandboxResponse - 72, // 460: openshell.v1.OpenShell.StopSandbox:output_type -> openshell.v1.SandboxResponse - 72, // 461: openshell.v1.OpenShell.StartSandbox:output_type -> openshell.v1.SandboxResponse - 90, // 462: openshell.v1.OpenShell.CreateSshSession:output_type -> openshell.v1.CreateSshSessionResponse - 98, // 463: openshell.v1.OpenShell.ExposeService:output_type -> openshell.v1.ServiceEndpointResponse - 98, // 464: openshell.v1.OpenShell.GetService:output_type -> openshell.v1.ServiceEndpointResponse - 94, // 465: openshell.v1.OpenShell.ListServices:output_type -> openshell.v1.ListServicesResponse - 96, // 466: openshell.v1.OpenShell.DeleteService:output_type -> openshell.v1.DeleteServiceResponse - 100, // 467: openshell.v1.OpenShell.RevokeSshSession:output_type -> openshell.v1.RevokeSshSessionResponse - 105, // 468: openshell.v1.OpenShell.ExecSandbox:output_type -> openshell.v1.ExecSandboxEvent - 107, // 469: openshell.v1.OpenShell.ForwardTcp:output_type -> openshell.v1.TcpForwardFrame - 105, // 470: openshell.v1.OpenShell.ExecSandboxInteractive:output_type -> openshell.v1.ExecSandboxEvent - 123, // 471: openshell.v1.OpenShell.CreateProvider:output_type -> openshell.v1.ProviderResponse - 123, // 472: openshell.v1.OpenShell.GetProvider:output_type -> openshell.v1.ProviderResponse - 119, // 473: openshell.v1.OpenShell.GetProviderCredentials:output_type -> openshell.v1.GetProviderCredentialsResponse - 124, // 474: openshell.v1.OpenShell.ListProviders:output_type -> openshell.v1.ListProvidersResponse - 149, // 475: openshell.v1.OpenShell.ListProviderProfiles:output_type -> openshell.v1.ListProviderProfilesResponse - 148, // 476: openshell.v1.OpenShell.GetProviderProfile:output_type -> openshell.v1.ProviderProfileResponse - 151, // 477: openshell.v1.OpenShell.ImportProviderProfiles:output_type -> openshell.v1.ImportProviderProfilesResponse - 153, // 478: openshell.v1.OpenShell.UpdateProviderProfiles:output_type -> openshell.v1.UpdateProviderProfilesResponse - 155, // 479: openshell.v1.OpenShell.LintProviderProfiles:output_type -> openshell.v1.LintProviderProfilesResponse - 123, // 480: openshell.v1.OpenShell.UpdateProvider:output_type -> openshell.v1.ProviderResponse - 139, // 481: openshell.v1.OpenShell.GetProviderRefreshStatus:output_type -> openshell.v1.GetProviderRefreshStatusResponse - 141, // 482: openshell.v1.OpenShell.ConfigureProviderRefresh:output_type -> openshell.v1.ConfigureProviderRefreshResponse - 143, // 483: openshell.v1.OpenShell.RotateProviderCredential:output_type -> openshell.v1.RotateProviderCredentialResponse - 145, // 484: openshell.v1.OpenShell.DeleteProviderRefresh:output_type -> openshell.v1.DeleteProviderRefreshResponse - 156, // 485: openshell.v1.OpenShell.DeleteProvider:output_type -> openshell.v1.DeleteProviderResponse - 158, // 486: openshell.v1.OpenShell.DeleteProviderProfile:output_type -> openshell.v1.DeleteProviderProfileResponse - 316, // 487: openshell.v1.OpenShell.GetSandboxConfig:output_type -> openshell.sandbox.v1.GetSandboxConfigResponse - 317, // 488: openshell.v1.OpenShell.GetGatewayConfig:output_type -> openshell.sandbox.v1.GetGatewayConfigResponse - 177, // 489: openshell.v1.OpenShell.UpdateConfig:output_type -> openshell.v1.UpdateConfigResponse - 179, // 490: openshell.v1.OpenShell.GetSandboxPolicyStatus:output_type -> openshell.v1.GetSandboxPolicyStatusResponse - 181, // 491: openshell.v1.OpenShell.ListSandboxPolicies:output_type -> openshell.v1.ListSandboxPoliciesResponse - 183, // 492: openshell.v1.OpenShell.ReportPolicyStatus:output_type -> openshell.v1.ReportPolicyStatusResponse - 267, // 493: openshell.v1.OpenShell.ReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse - 87, // 494: openshell.v1.OpenShell.ReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse - 186, // 495: openshell.v1.OpenShell.ReportSandboxConfiguration:output_type -> openshell.v1.ReportSandboxConfigurationResponse - 163, // 496: openshell.v1.OpenShell.GetSandboxProviderEnvironment:output_type -> openshell.v1.GetSandboxProviderEnvironmentResponse - 167, // 497: openshell.v1.OpenShell.ExchangeProviderSubjectToken:output_type -> openshell.v1.ExchangeProviderSubjectTokenResponse - 191, // 498: openshell.v1.OpenShell.GetSandboxLogs:output_type -> openshell.v1.GetSandboxLogsResponse - 190, // 499: openshell.v1.OpenShell.PushSandboxLogs:output_type -> openshell.v1.PushSandboxLogsResponse - 193, // 500: openshell.v1.OpenShell.ConnectSupervisor:output_type -> openshell.v1.GatewayMessage - 205, // 501: openshell.v1.OpenShell.ReportMainProcessExit:output_type -> openshell.v1.ReportMainProcessExitResponse - 207, // 502: openshell.v1.OpenShell.FinalizeMainProcessExit:output_type -> openshell.v1.FinalizeMainProcessExitResponse - 212, // 503: openshell.v1.OpenShell.RelayStream:output_type -> openshell.v1.RelayFrame - 214, // 504: openshell.v1.OpenShell.PeerRelay:output_type -> openshell.v1.PeerRelayFrame - 87, // 505: openshell.v1.OpenShell.PeerReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse - 267, // 506: openshell.v1.OpenShell.PeerReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse - 85, // 507: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse - 218, // 508: openshell.v1.OpenShell.PeerNotifyConfigUpdate:output_type -> openshell.v1.PeerNotifyConfigUpdateResponse - 112, // 509: openshell.v1.OpenShell.WatchSandbox:output_type -> openshell.v1.SandboxStreamEvent - 228, // 510: openshell.v1.OpenShell.SubmitPolicyAnalysis:output_type -> openshell.v1.SubmitPolicyAnalysisResponse - 230, // 511: openshell.v1.OpenShell.GetDraftPolicy:output_type -> openshell.v1.GetDraftPolicyResponse - 232, // 512: openshell.v1.OpenShell.ApproveDraftChunk:output_type -> openshell.v1.ApproveDraftChunkResponse - 234, // 513: openshell.v1.OpenShell.RejectDraftChunk:output_type -> openshell.v1.RejectDraftChunkResponse - 237, // 514: openshell.v1.OpenShell.ApproveAllDraftChunks:output_type -> openshell.v1.ApproveAllDraftChunksResponse - 239, // 515: openshell.v1.OpenShell.EditDraftChunk:output_type -> openshell.v1.EditDraftChunkResponse - 241, // 516: openshell.v1.OpenShell.UndoDraftChunk:output_type -> openshell.v1.UndoDraftChunkResponse - 243, // 517: openshell.v1.OpenShell.ClearDraftChunks:output_type -> openshell.v1.ClearDraftChunksResponse - 246, // 518: openshell.v1.OpenShell.GetDraftHistory:output_type -> openshell.v1.GetDraftHistoryResponse - 23, // 519: openshell.v1.OpenShell.IssueSandboxToken:output_type -> openshell.v1.IssueSandboxTokenResponse - 25, // 520: openshell.v1.OpenShell.RefreshSandboxToken:output_type -> openshell.v1.RefreshSandboxTokenResponse - 248, // 521: openshell.v1.OpenShell.CreateWorkspace:output_type -> openshell.v1.CreateWorkspaceResponse - 250, // 522: openshell.v1.OpenShell.GetWorkspace:output_type -> openshell.v1.GetWorkspaceResponse - 252, // 523: openshell.v1.OpenShell.ListWorkspaces:output_type -> openshell.v1.ListWorkspacesResponse - 254, // 524: openshell.v1.OpenShell.DeleteWorkspace:output_type -> openshell.v1.DeleteWorkspaceResponse - 257, // 525: openshell.v1.OpenShell.AddWorkspaceMember:output_type -> openshell.v1.AddWorkspaceMemberResponse - 259, // 526: openshell.v1.OpenShell.RemoveWorkspaceMember:output_type -> openshell.v1.RemoveWorkspaceMemberResponse - 261, // 527: openshell.v1.OpenShell.ListWorkspaceMembers:output_type -> openshell.v1.ListWorkspaceMembersResponse - 444, // [444:528] is the sub-list for method output_type - 360, // [360:444] is the sub-list for method input_type - 360, // [360:360] is the sub-list for extension type_name - 360, // [360:360] is the sub-list for extension extendee - 0, // [0:360] is the sub-list for field type_name + 286, // 213: openshell.v1.GetSandboxProviderEnvironmentResponse.environment:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry + 287, // 214: openshell.v1.GetSandboxProviderEnvironmentResponse.credential_expiration_times:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry + 288, // 215: openshell.v1.GetSandboxProviderEnvironmentResponse.dynamic_credentials:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry + 289, // 216: openshell.v1.GetSandboxProviderEnvironmentResponse.static_credential_bindings:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry + 4, // 217: openshell.v1.GetSandboxProviderEnvironmentResponse.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason + 290, // 218: openshell.v1.GetSandboxProviderEnvironmentResponse.files:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.FilesEntry + 11, // 219: openshell.v1.ProviderEnvironmentValue.classification:type_name -> openshell.v1.ProviderEnvironmentValueClassification + 161, // 220: openshell.v1.ProviderEnvironmentValue.static_credential_binding:type_name -> openshell.v1.StaticCredentialBinding + 297, // 221: openshell.v1.ProviderEnvironmentValue.expiration_time:type_name -> google.protobuf.Timestamp + 163, // 222: openshell.v1.ProviderEnvironmentSnapshot.values:type_name -> openshell.v1.ProviderEnvironmentValue + 291, // 223: openshell.v1.ProviderEnvironmentSnapshot.dynamic_credentials:type_name -> openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry + 4, // 224: openshell.v1.ProviderEnvironmentSnapshot.readiness_reason:type_name -> openshell.v1.ProviderReadinessReason + 292, // 225: openshell.v1.ProviderEnvironmentSnapshot.files:type_name -> openshell.v1.ProviderEnvironmentSnapshot.FilesEntry + 301, // 226: openshell.v1.ExchangeProviderSubjectTokenResponse.expires_after:type_name -> google.protobuf.Duration + 302, // 227: openshell.v1.UpdateConfigRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 299, // 228: openshell.v1.UpdateConfigRequest.policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 307, // 229: openshell.v1.UpdateConfigRequest.setting_value:type_name -> openshell.sandbox.v1.SettingValue + 168, // 230: openshell.v1.UpdateConfigRequest.merge_operations:type_name -> openshell.v1.PolicyMergeOperation + 293, // 231: openshell.v1.UpdateConfigRequest.annotations:type_name -> openshell.v1.UpdateConfigRequest.AnnotationsEntry + 169, // 232: openshell.v1.PolicyMergeOperation.add_rule:type_name -> openshell.v1.AddNetworkRule + 170, // 233: openshell.v1.PolicyMergeOperation.remove_endpoint:type_name -> openshell.v1.RemoveNetworkEndpoint + 171, // 234: openshell.v1.PolicyMergeOperation.remove_rule:type_name -> openshell.v1.RemoveNetworkRule + 173, // 235: openshell.v1.PolicyMergeOperation.add_deny_rules:type_name -> openshell.v1.AddDenyRules + 174, // 236: openshell.v1.PolicyMergeOperation.add_allow_rules:type_name -> openshell.v1.AddAllowRules + 175, // 237: openshell.v1.PolicyMergeOperation.remove_binary:type_name -> openshell.v1.RemoveNetworkBinary + 308, // 238: openshell.v1.AddNetworkRule.rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule + 306, // 239: openshell.v1.L7RuleTarget.binaries:type_name -> openshell.sandbox.v1.NetworkBinary + 309, // 240: openshell.v1.AddDenyRules.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule + 172, // 241: openshell.v1.AddDenyRules.target:type_name -> openshell.v1.L7RuleTarget + 310, // 242: openshell.v1.AddAllowRules.rules:type_name -> openshell.sandbox.v1.L7Rule + 172, // 243: openshell.v1.AddAllowRules.target:type_name -> openshell.v1.L7RuleTarget + 294, // 244: openshell.v1.UpdateConfigResponse.annotations:type_name -> openshell.v1.UpdateConfigResponse.AnnotationsEntry + 302, // 245: openshell.v1.GetSandboxPolicyStatusRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 186, // 246: openshell.v1.GetSandboxPolicyStatusResponse.revision:type_name -> openshell.v1.SandboxPolicyRevision + 302, // 247: openshell.v1.ListSandboxPoliciesRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 186, // 248: openshell.v1.ListSandboxPoliciesResponse.revisions:type_name -> openshell.v1.SandboxPolicyRevision + 13, // 249: openshell.v1.ReportPolicyStatusRequest.status:type_name -> openshell.v1.PolicyStatus + 12, // 250: openshell.v1.SandboxConfigurationAdmission.state:type_name -> openshell.v1.ConfigurationAdmissionState + 183, // 251: openshell.v1.ReportSandboxConfigurationRequest.admission:type_name -> openshell.v1.SandboxConfigurationAdmission + 13, // 252: openshell.v1.SandboxPolicyRevision.status:type_name -> openshell.v1.PolicyStatus + 297, // 253: openshell.v1.SandboxPolicyRevision.created_time:type_name -> google.protobuf.Timestamp + 297, // 254: openshell.v1.SandboxPolicyRevision.loaded_time:type_name -> google.protobuf.Timestamp + 299, // 255: openshell.v1.SandboxPolicyRevision.policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 295, // 256: openshell.v1.SandboxPolicyRevision.provenance:type_name -> openshell.v1.SandboxPolicyRevision.ProvenanceEntry + 302, // 257: openshell.v1.GetSandboxLogsRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 297, // 258: openshell.v1.GetSandboxLogsRequest.since_time:type_name -> google.protobuf.Timestamp + 113, // 259: openshell.v1.PushSandboxLogsRequest.logs:type_name -> openshell.v1.SandboxLogLine + 113, // 260: openshell.v1.GetSandboxLogsResponse.logs:type_name -> openshell.v1.SandboxLogLine + 193, // 261: openshell.v1.SupervisorMessage.hello:type_name -> openshell.v1.SupervisorHello + 201, // 262: openshell.v1.SupervisorMessage.heartbeat:type_name -> openshell.v1.SupervisorHeartbeat + 218, // 263: openshell.v1.SupervisorMessage.relay_open_result:type_name -> openshell.v1.RelayOpenResult + 219, // 264: openshell.v1.SupervisorMessage.relay_close:type_name -> openshell.v1.RelayClose + 197, // 265: openshell.v1.SupervisorMessage.config_update_result:type_name -> openshell.v1.ConfigUpdateResult + 194, // 266: openshell.v1.GatewayMessage.session_accepted:type_name -> openshell.v1.SessionAccepted + 199, // 267: openshell.v1.GatewayMessage.session_rejected:type_name -> openshell.v1.SessionRejected + 202, // 268: openshell.v1.GatewayMessage.heartbeat:type_name -> openshell.v1.GatewayHeartbeat + 207, // 269: openshell.v1.GatewayMessage.relay_open:type_name -> openshell.v1.RelayOpen + 219, // 270: openshell.v1.GatewayMessage.relay_close:type_name -> openshell.v1.RelayClose + 200, // 271: openshell.v1.GatewayMessage.session_redirect:type_name -> openshell.v1.SessionRedirect + 195, // 272: openshell.v1.GatewayMessage.config_update:type_name -> openshell.v1.ConfigUpdate + 195, // 273: openshell.v1.SessionAccepted.bootstrap:type_name -> openshell.v1.ConfigUpdate + 301, // 274: openshell.v1.SessionAccepted.heartbeat_interval:type_name -> google.protobuf.Duration + 311, // 275: openshell.v1.ConfigUpdate.sandbox_config:type_name -> openshell.sandbox.v1.SandboxConfigSnapshot + 164, // 276: openshell.v1.ConfigUpdate.provider_environment:type_name -> openshell.v1.ProviderEnvironmentSnapshot + 6, // 277: openshell.v1.ConfigUpdateResult.outcome:type_name -> openshell.v1.ConfigApplyOutcome + 196, // 278: openshell.v1.ConfigUpdateResult.failure:type_name -> openshell.v1.ConfigApplyFailure + 183, // 279: openshell.v1.ConfigUpdateResult.admission:type_name -> openshell.v1.SandboxConfigurationAdmission + 198, // 280: openshell.v1.ConfigUpdateResult.policy_load:type_name -> openshell.v1.PolicyLoadResult + 208, // 281: openshell.v1.RelayOpen.ssh:type_name -> openshell.v1.SshRelayTarget + 209, // 282: openshell.v1.RelayOpen.tcp:type_name -> openshell.v1.TcpRelayTarget + 210, // 283: openshell.v1.RelayFrame.init:type_name -> openshell.v1.RelayInit + 207, // 284: openshell.v1.PeerRelayInit.relay_open:type_name -> openshell.v1.RelayOpen + 212, // 285: openshell.v1.PeerRelayFrame.init:type_name -> openshell.v1.PeerRelayInit + 214, // 286: openshell.v1.PeerNotifyConfigUpdateRequest.sandbox:type_name -> openshell.v1.PeerConfigSandboxTarget + 215, // 287: openshell.v1.PeerNotifyConfigUpdateRequest.provider:type_name -> openshell.v1.PeerConfigProviderTarget + 297, // 288: openshell.v1.DenialSummary.first_seen_time:type_name -> google.protobuf.Timestamp + 297, // 289: openshell.v1.DenialSummary.last_seen_time:type_name -> google.protobuf.Timestamp + 220, // 290: openshell.v1.DenialSummary.l7_request_samples:type_name -> openshell.v1.L7RequestSample + 222, // 291: openshell.v1.NetworkActivitySummary.denials_by_group:type_name -> openshell.v1.DenialGroupCount + 308, // 292: openshell.v1.PolicyChunk.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule + 297, // 293: openshell.v1.PolicyChunk.created_time:type_name -> google.protobuf.Timestamp + 297, // 294: openshell.v1.PolicyChunk.decided_time:type_name -> google.protobuf.Timestamp + 297, // 295: openshell.v1.PolicyChunk.first_seen_time:type_name -> google.protobuf.Timestamp + 297, // 296: openshell.v1.PolicyChunk.last_seen_time:type_name -> google.protobuf.Timestamp + 299, // 297: openshell.v1.PolicyChunk.current_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 299, // 298: openshell.v1.PolicyChunk.candidate_effective_policy:type_name -> openshell.sandbox.v1.SandboxPolicy + 302, // 299: openshell.v1.SubmitPolicyAnalysisRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 221, // 300: openshell.v1.SubmitPolicyAnalysisRequest.summaries:type_name -> openshell.v1.DenialSummary + 224, // 301: openshell.v1.SubmitPolicyAnalysisRequest.proposed_chunks:type_name -> openshell.v1.PolicyChunk + 223, // 302: openshell.v1.SubmitPolicyAnalysisRequest.network_activity_summaries:type_name -> openshell.v1.NetworkActivitySummary + 302, // 303: openshell.v1.GetDraftPolicyRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 224, // 304: openshell.v1.GetDraftPolicyResponse.chunks:type_name -> openshell.v1.PolicyChunk + 297, // 305: openshell.v1.GetDraftPolicyResponse.last_analyzed_time:type_name -> google.protobuf.Timestamp + 302, // 306: openshell.v1.ApproveDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 307: openshell.v1.RejectDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 308: openshell.v1.ApproveAllDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 234, // 309: openshell.v1.ApproveAllDraftChunksRequest.approvals:type_name -> openshell.v1.DraftChunkApproval + 302, // 310: openshell.v1.EditDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 308, // 311: openshell.v1.EditDraftChunkRequest.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule + 302, // 312: openshell.v1.UndoDraftChunkRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 313: openshell.v1.ClearDraftChunksRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 302, // 314: openshell.v1.GetDraftHistoryRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 297, // 315: openshell.v1.DraftHistoryEntry.event_time:type_name -> google.protobuf.Timestamp + 244, // 316: openshell.v1.GetDraftHistoryResponse.entries:type_name -> openshell.v1.DraftHistoryEntry + 296, // 317: openshell.v1.CreateWorkspaceRequest.labels:type_name -> openshell.v1.CreateWorkspaceRequest.LabelsEntry + 312, // 318: openshell.v1.CreateWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace + 312, // 319: openshell.v1.GetWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace + 312, // 320: openshell.v1.ListWorkspacesResponse.workspaces:type_name -> openshell.datamodel.v1.Workspace + 18, // 321: openshell.v1.DeleteWorkspaceResponse.outcome:type_name -> openshell.v1.DeletionOutcome + 298, // 322: openshell.v1.WorkspaceMember.metadata:type_name -> openshell.datamodel.v1.ObjectMeta + 15, // 323: openshell.v1.WorkspaceMember.role:type_name -> openshell.v1.WorkspaceRole + 302, // 324: openshell.v1.AddWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 15, // 325: openshell.v1.AddWorkspaceMemberRequest.role:type_name -> openshell.v1.WorkspaceRole + 254, // 326: openshell.v1.AddWorkspaceMemberResponse.member:type_name -> openshell.v1.WorkspaceMember + 302, // 327: openshell.v1.RemoveWorkspaceMemberRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 18, // 328: openshell.v1.RemoveWorkspaceMemberResponse.outcome:type_name -> openshell.v1.DeletionOutcome + 302, // 329: openshell.v1.ListWorkspaceMembersRequest.workspace_scope:type_name -> openshell.datamodel.v1.WorkspaceSelector + 254, // 330: openshell.v1.ListWorkspaceMembersResponse.members:type_name -> openshell.v1.WorkspaceMember + 297, // 331: openshell.v1.ExtensionServiceCredential.expiration_time:type_name -> google.protobuf.Timestamp + 19, // 332: openshell.v1.EndpointObservation.result:type_name -> openshell.v1.EndpointResult + 270, // 333: openshell.v1.EndpointObservation.failure:type_name -> openshell.v1.EndpointFailure + 262, // 334: openshell.v1.ReportEndpointStatusRequest.observations:type_name -> openshell.v1.EndpointObservation + 264, // 335: openshell.v1.ReportEndpointStatusRequest.token_grant_status:type_name -> openshell.v1.TokenGrantStatus + 265, // 336: openshell.v1.TokenGrantStatus.last_failure:type_name -> openshell.v1.TokenGrantFailureObservation + 270, // 337: openshell.v1.TokenGrantFailureObservation.failure:type_name -> openshell.v1.EndpointFailure + 19, // 338: openshell.v1.EndpointStatus.last_result:type_name -> openshell.v1.EndpointResult + 297, // 339: openshell.v1.EndpointStatus.last_reported_time:type_name -> google.protobuf.Timestamp + 270, // 340: openshell.v1.EndpointStatus.last_failure:type_name -> openshell.v1.EndpointFailure + 297, // 341: openshell.v1.SandboxProvisioning.configuration_change_time:type_name -> google.protobuf.Timestamp + 297, // 342: openshell.v1.SandboxProvisioning.first_rejection_time:type_name -> google.protobuf.Timestamp + 297, // 343: openshell.v1.SandboxProvisioning.deadline:type_name -> google.protobuf.Timestamp + 297, // 344: openshell.v1.SandboxProvisioning.timeout_time:type_name -> google.protobuf.Timestamp + 297, // 345: openshell.v1.SandboxProvisioning.cleanup_completed_time:type_name -> google.protobuf.Timestamp + 297, // 346: openshell.v1.SandboxProvisioning.cleanup_retry_time:type_name -> google.protobuf.Timestamp + 297, // 347: openshell.v1.SandboxProvisioning.attachment_change_time:type_name -> google.protobuf.Timestamp + 297, // 348: openshell.v1.SandboxProvisioning.preparation_deadline:type_name -> google.protobuf.Timestamp + 297, // 349: openshell.v1.SandboxProvisioning.admission_start_time:type_name -> google.protobuf.Timestamp + 20, // 350: openshell.v1.SandboxServiceExposure.authorization_mode:type_name -> openshell.v1.ServiceAuthorizationMode + 21, // 351: openshell.v1.EndpointFailure.domain:type_name -> openshell.v1.EndpointFailureDomain + 16, // 352: openshell.v1.EndpointFailure.recovery_action:type_name -> openshell.v1.ProviderCredentialRefreshRecoveryAction + 118, // 353: openshell.v1.GetProviderCredentialsResponse.CredentialsEntry.value:type_name -> openshell.v1.ProviderCredentialValue + 297, // 354: openshell.v1.UpdateProviderRequest.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp + 297, // 355: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpirationTimesEntry.value:type_name -> google.protobuf.Timestamp + 132, // 356: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential + 161, // 357: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry.value:type_name -> openshell.v1.StaticCredentialBinding + 132, // 358: openshell.v1.ProviderEnvironmentSnapshot.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential + 26, // 359: openshell.v1.OpenShell.Health:input_type -> openshell.v1.HealthRequest + 28, // 360: openshell.v1.OpenShell.GetCurrentUser:input_type -> openshell.v1.GetCurrentUserRequest + 30, // 361: openshell.v1.OpenShell.GetGatewayInfo:input_type -> openshell.v1.GetGatewayInfoRequest + 54, // 362: openshell.v1.OpenShell.CreateSandbox:input_type -> openshell.v1.CreateSandboxRequest + 62, // 363: openshell.v1.OpenShell.BeginRootfsTarStaging:input_type -> openshell.v1.BeginRootfsTarStagingRequest + 64, // 364: openshell.v1.OpenShell.GetSandbox:input_type -> openshell.v1.GetSandboxRequest + 65, // 365: openshell.v1.OpenShell.ListSandboxes:input_type -> openshell.v1.ListSandboxesRequest + 55, // 366: openshell.v1.OpenShell.CreateSandboxTemplate:input_type -> openshell.v1.CreateSandboxTemplateRequest + 56, // 367: openshell.v1.OpenShell.GetSandboxTemplate:input_type -> openshell.v1.GetSandboxTemplateRequest + 57, // 368: openshell.v1.OpenShell.ListSandboxTemplates:input_type -> openshell.v1.ListSandboxTemplatesRequest + 58, // 369: openshell.v1.OpenShell.DeleteSandboxTemplate:input_type -> openshell.v1.DeleteSandboxTemplateRequest + 66, // 370: openshell.v1.OpenShell.ListSandboxProviders:input_type -> openshell.v1.ListSandboxProvidersRequest + 67, // 371: openshell.v1.OpenShell.AttachSandboxProvider:input_type -> openshell.v1.AttachSandboxProviderRequest + 68, // 372: openshell.v1.OpenShell.DetachSandboxProvider:input_type -> openshell.v1.DetachSandboxProviderRequest + 84, // 373: openshell.v1.OpenShell.GetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest + 69, // 374: openshell.v1.OpenShell.DeleteSandbox:input_type -> openshell.v1.DeleteSandboxRequest + 70, // 375: openshell.v1.OpenShell.StopSandbox:input_type -> openshell.v1.StopSandboxRequest + 71, // 376: openshell.v1.OpenShell.StartSandbox:input_type -> openshell.v1.StartSandboxRequest + 89, // 377: openshell.v1.OpenShell.CreateSshSession:input_type -> openshell.v1.CreateSshSessionRequest + 91, // 378: openshell.v1.OpenShell.ExposeService:input_type -> openshell.v1.ExposeServiceRequest + 92, // 379: openshell.v1.OpenShell.GetService:input_type -> openshell.v1.GetServiceRequest + 93, // 380: openshell.v1.OpenShell.ListServices:input_type -> openshell.v1.ListServicesRequest + 95, // 381: openshell.v1.OpenShell.DeleteService:input_type -> openshell.v1.DeleteServiceRequest + 99, // 382: openshell.v1.OpenShell.RevokeSshSession:input_type -> openshell.v1.RevokeSshSessionRequest + 101, // 383: openshell.v1.OpenShell.ExecSandbox:input_type -> openshell.v1.ExecSandboxRequest + 107, // 384: openshell.v1.OpenShell.ForwardTcp:input_type -> openshell.v1.TcpForwardFrame + 108, // 385: openshell.v1.OpenShell.ExecSandboxInteractive:input_type -> openshell.v1.ExecSandboxInput + 115, // 386: openshell.v1.OpenShell.CreateProvider:input_type -> openshell.v1.CreateProviderRequest + 116, // 387: openshell.v1.OpenShell.GetProvider:input_type -> openshell.v1.GetProviderRequest + 117, // 388: openshell.v1.OpenShell.GetProviderCredentials:input_type -> openshell.v1.GetProviderCredentialsRequest + 120, // 389: openshell.v1.OpenShell.ListProviders:input_type -> openshell.v1.ListProvidersRequest + 125, // 390: openshell.v1.OpenShell.ListProviderProfiles:input_type -> openshell.v1.ListProviderProfilesRequest + 126, // 391: openshell.v1.OpenShell.GetProviderProfile:input_type -> openshell.v1.GetProviderProfileRequest + 150, // 392: openshell.v1.OpenShell.ImportProviderProfiles:input_type -> openshell.v1.ImportProviderProfilesRequest + 152, // 393: openshell.v1.OpenShell.UpdateProviderProfiles:input_type -> openshell.v1.UpdateProviderProfilesRequest + 154, // 394: openshell.v1.OpenShell.LintProviderProfiles:input_type -> openshell.v1.LintProviderProfilesRequest + 121, // 395: openshell.v1.OpenShell.UpdateProvider:input_type -> openshell.v1.UpdateProviderRequest + 138, // 396: openshell.v1.OpenShell.GetProviderRefreshStatus:input_type -> openshell.v1.GetProviderRefreshStatusRequest + 140, // 397: openshell.v1.OpenShell.ConfigureProviderRefresh:input_type -> openshell.v1.ConfigureProviderRefreshRequest + 142, // 398: openshell.v1.OpenShell.RotateProviderCredential:input_type -> openshell.v1.RotateProviderCredentialRequest + 144, // 399: openshell.v1.OpenShell.DeleteProviderRefresh:input_type -> openshell.v1.DeleteProviderRefreshRequest + 122, // 400: openshell.v1.OpenShell.DeleteProvider:input_type -> openshell.v1.DeleteProviderRequest + 157, // 401: openshell.v1.OpenShell.DeleteProviderProfile:input_type -> openshell.v1.DeleteProviderProfileRequest + 313, // 402: openshell.v1.OpenShell.GetSandboxConfig:input_type -> openshell.sandbox.v1.GetSandboxConfigRequest + 314, // 403: openshell.v1.OpenShell.GetGatewayConfig:input_type -> openshell.sandbox.v1.GetGatewayConfigRequest + 167, // 404: openshell.v1.OpenShell.UpdateConfig:input_type -> openshell.v1.UpdateConfigRequest + 177, // 405: openshell.v1.OpenShell.GetSandboxPolicyStatus:input_type -> openshell.v1.GetSandboxPolicyStatusRequest + 179, // 406: openshell.v1.OpenShell.ListSandboxPolicies:input_type -> openshell.v1.ListSandboxPoliciesRequest + 181, // 407: openshell.v1.OpenShell.ReportPolicyStatus:input_type -> openshell.v1.ReportPolicyStatusRequest + 263, // 408: openshell.v1.OpenShell.ReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest + 86, // 409: openshell.v1.OpenShell.ReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest + 184, // 410: openshell.v1.OpenShell.ReportSandboxConfiguration:input_type -> openshell.v1.ReportSandboxConfigurationRequest + 159, // 411: openshell.v1.OpenShell.GetSandboxProviderEnvironment:input_type -> openshell.v1.GetSandboxProviderEnvironmentRequest + 165, // 412: openshell.v1.OpenShell.ExchangeProviderSubjectToken:input_type -> openshell.v1.ExchangeProviderSubjectTokenRequest + 187, // 413: openshell.v1.OpenShell.GetSandboxLogs:input_type -> openshell.v1.GetSandboxLogsRequest + 188, // 414: openshell.v1.OpenShell.PushSandboxLogs:input_type -> openshell.v1.PushSandboxLogsRequest + 191, // 415: openshell.v1.OpenShell.ConnectSupervisor:input_type -> openshell.v1.SupervisorMessage + 203, // 416: openshell.v1.OpenShell.ReportMainProcessExit:input_type -> openshell.v1.ReportMainProcessExitRequest + 205, // 417: openshell.v1.OpenShell.FinalizeMainProcessExit:input_type -> openshell.v1.FinalizeMainProcessExitRequest + 211, // 418: openshell.v1.OpenShell.RelayStream:input_type -> openshell.v1.RelayFrame + 213, // 419: openshell.v1.OpenShell.PeerRelay:input_type -> openshell.v1.PeerRelayFrame + 86, // 420: openshell.v1.OpenShell.PeerReportProviderReadiness:input_type -> openshell.v1.ReportProviderReadinessRequest + 263, // 421: openshell.v1.OpenShell.PeerReportEndpointStatus:input_type -> openshell.v1.ReportEndpointStatusRequest + 84, // 422: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:input_type -> openshell.v1.GetSandboxProviderStatusRequest + 216, // 423: openshell.v1.OpenShell.PeerNotifyConfigUpdate:input_type -> openshell.v1.PeerNotifyConfigUpdateRequest + 111, // 424: openshell.v1.OpenShell.WatchSandbox:input_type -> openshell.v1.WatchSandboxRequest + 226, // 425: openshell.v1.OpenShell.SubmitPolicyAnalysis:input_type -> openshell.v1.SubmitPolicyAnalysisRequest + 228, // 426: openshell.v1.OpenShell.GetDraftPolicy:input_type -> openshell.v1.GetDraftPolicyRequest + 230, // 427: openshell.v1.OpenShell.ApproveDraftChunk:input_type -> openshell.v1.ApproveDraftChunkRequest + 232, // 428: openshell.v1.OpenShell.RejectDraftChunk:input_type -> openshell.v1.RejectDraftChunkRequest + 235, // 429: openshell.v1.OpenShell.ApproveAllDraftChunks:input_type -> openshell.v1.ApproveAllDraftChunksRequest + 237, // 430: openshell.v1.OpenShell.EditDraftChunk:input_type -> openshell.v1.EditDraftChunkRequest + 239, // 431: openshell.v1.OpenShell.UndoDraftChunk:input_type -> openshell.v1.UndoDraftChunkRequest + 241, // 432: openshell.v1.OpenShell.ClearDraftChunks:input_type -> openshell.v1.ClearDraftChunksRequest + 243, // 433: openshell.v1.OpenShell.GetDraftHistory:input_type -> openshell.v1.GetDraftHistoryRequest + 22, // 434: openshell.v1.OpenShell.IssueSandboxToken:input_type -> openshell.v1.IssueSandboxTokenRequest + 24, // 435: openshell.v1.OpenShell.RefreshSandboxToken:input_type -> openshell.v1.RefreshSandboxTokenRequest + 246, // 436: openshell.v1.OpenShell.CreateWorkspace:input_type -> openshell.v1.CreateWorkspaceRequest + 248, // 437: openshell.v1.OpenShell.GetWorkspace:input_type -> openshell.v1.GetWorkspaceRequest + 250, // 438: openshell.v1.OpenShell.ListWorkspaces:input_type -> openshell.v1.ListWorkspacesRequest + 252, // 439: openshell.v1.OpenShell.DeleteWorkspace:input_type -> openshell.v1.DeleteWorkspaceRequest + 255, // 440: openshell.v1.OpenShell.AddWorkspaceMember:input_type -> openshell.v1.AddWorkspaceMemberRequest + 257, // 441: openshell.v1.OpenShell.RemoveWorkspaceMember:input_type -> openshell.v1.RemoveWorkspaceMemberRequest + 259, // 442: openshell.v1.OpenShell.ListWorkspaceMembers:input_type -> openshell.v1.ListWorkspaceMembersRequest + 27, // 443: openshell.v1.OpenShell.Health:output_type -> openshell.v1.HealthResponse + 29, // 444: openshell.v1.OpenShell.GetCurrentUser:output_type -> openshell.v1.GetCurrentUserResponse + 31, // 445: openshell.v1.OpenShell.GetGatewayInfo:output_type -> openshell.v1.GetGatewayInfoResponse + 72, // 446: openshell.v1.OpenShell.CreateSandbox:output_type -> openshell.v1.SandboxResponse + 63, // 447: openshell.v1.OpenShell.BeginRootfsTarStaging:output_type -> openshell.v1.BeginRootfsTarStagingResponse + 72, // 448: openshell.v1.OpenShell.GetSandbox:output_type -> openshell.v1.SandboxResponse + 73, // 449: openshell.v1.OpenShell.ListSandboxes:output_type -> openshell.v1.ListSandboxesResponse + 59, // 450: openshell.v1.OpenShell.CreateSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse + 59, // 451: openshell.v1.OpenShell.GetSandboxTemplate:output_type -> openshell.v1.SandboxTemplateResponse + 60, // 452: openshell.v1.OpenShell.ListSandboxTemplates:output_type -> openshell.v1.ListSandboxTemplatesResponse + 61, // 453: openshell.v1.OpenShell.DeleteSandboxTemplate:output_type -> openshell.v1.DeleteSandboxTemplateResponse + 74, // 454: openshell.v1.OpenShell.ListSandboxProviders:output_type -> openshell.v1.ListSandboxProvidersResponse + 75, // 455: openshell.v1.OpenShell.AttachSandboxProvider:output_type -> openshell.v1.AttachSandboxProviderResponse + 76, // 456: openshell.v1.OpenShell.DetachSandboxProvider:output_type -> openshell.v1.DetachSandboxProviderResponse + 85, // 457: openshell.v1.OpenShell.GetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse + 88, // 458: openshell.v1.OpenShell.DeleteSandbox:output_type -> openshell.v1.DeleteSandboxResponse + 72, // 459: openshell.v1.OpenShell.StopSandbox:output_type -> openshell.v1.SandboxResponse + 72, // 460: openshell.v1.OpenShell.StartSandbox:output_type -> openshell.v1.SandboxResponse + 90, // 461: openshell.v1.OpenShell.CreateSshSession:output_type -> openshell.v1.CreateSshSessionResponse + 98, // 462: openshell.v1.OpenShell.ExposeService:output_type -> openshell.v1.ServiceEndpointResponse + 98, // 463: openshell.v1.OpenShell.GetService:output_type -> openshell.v1.ServiceEndpointResponse + 94, // 464: openshell.v1.OpenShell.ListServices:output_type -> openshell.v1.ListServicesResponse + 96, // 465: openshell.v1.OpenShell.DeleteService:output_type -> openshell.v1.DeleteServiceResponse + 100, // 466: openshell.v1.OpenShell.RevokeSshSession:output_type -> openshell.v1.RevokeSshSessionResponse + 105, // 467: openshell.v1.OpenShell.ExecSandbox:output_type -> openshell.v1.ExecSandboxEvent + 107, // 468: openshell.v1.OpenShell.ForwardTcp:output_type -> openshell.v1.TcpForwardFrame + 105, // 469: openshell.v1.OpenShell.ExecSandboxInteractive:output_type -> openshell.v1.ExecSandboxEvent + 123, // 470: openshell.v1.OpenShell.CreateProvider:output_type -> openshell.v1.ProviderResponse + 123, // 471: openshell.v1.OpenShell.GetProvider:output_type -> openshell.v1.ProviderResponse + 119, // 472: openshell.v1.OpenShell.GetProviderCredentials:output_type -> openshell.v1.GetProviderCredentialsResponse + 124, // 473: openshell.v1.OpenShell.ListProviders:output_type -> openshell.v1.ListProvidersResponse + 149, // 474: openshell.v1.OpenShell.ListProviderProfiles:output_type -> openshell.v1.ListProviderProfilesResponse + 148, // 475: openshell.v1.OpenShell.GetProviderProfile:output_type -> openshell.v1.ProviderProfileResponse + 151, // 476: openshell.v1.OpenShell.ImportProviderProfiles:output_type -> openshell.v1.ImportProviderProfilesResponse + 153, // 477: openshell.v1.OpenShell.UpdateProviderProfiles:output_type -> openshell.v1.UpdateProviderProfilesResponse + 155, // 478: openshell.v1.OpenShell.LintProviderProfiles:output_type -> openshell.v1.LintProviderProfilesResponse + 123, // 479: openshell.v1.OpenShell.UpdateProvider:output_type -> openshell.v1.ProviderResponse + 139, // 480: openshell.v1.OpenShell.GetProviderRefreshStatus:output_type -> openshell.v1.GetProviderRefreshStatusResponse + 141, // 481: openshell.v1.OpenShell.ConfigureProviderRefresh:output_type -> openshell.v1.ConfigureProviderRefreshResponse + 143, // 482: openshell.v1.OpenShell.RotateProviderCredential:output_type -> openshell.v1.RotateProviderCredentialResponse + 145, // 483: openshell.v1.OpenShell.DeleteProviderRefresh:output_type -> openshell.v1.DeleteProviderRefreshResponse + 156, // 484: openshell.v1.OpenShell.DeleteProvider:output_type -> openshell.v1.DeleteProviderResponse + 158, // 485: openshell.v1.OpenShell.DeleteProviderProfile:output_type -> openshell.v1.DeleteProviderProfileResponse + 315, // 486: openshell.v1.OpenShell.GetSandboxConfig:output_type -> openshell.sandbox.v1.GetSandboxConfigResponse + 316, // 487: openshell.v1.OpenShell.GetGatewayConfig:output_type -> openshell.sandbox.v1.GetGatewayConfigResponse + 176, // 488: openshell.v1.OpenShell.UpdateConfig:output_type -> openshell.v1.UpdateConfigResponse + 178, // 489: openshell.v1.OpenShell.GetSandboxPolicyStatus:output_type -> openshell.v1.GetSandboxPolicyStatusResponse + 180, // 490: openshell.v1.OpenShell.ListSandboxPolicies:output_type -> openshell.v1.ListSandboxPoliciesResponse + 182, // 491: openshell.v1.OpenShell.ReportPolicyStatus:output_type -> openshell.v1.ReportPolicyStatusResponse + 266, // 492: openshell.v1.OpenShell.ReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse + 87, // 493: openshell.v1.OpenShell.ReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse + 185, // 494: openshell.v1.OpenShell.ReportSandboxConfiguration:output_type -> openshell.v1.ReportSandboxConfigurationResponse + 162, // 495: openshell.v1.OpenShell.GetSandboxProviderEnvironment:output_type -> openshell.v1.GetSandboxProviderEnvironmentResponse + 166, // 496: openshell.v1.OpenShell.ExchangeProviderSubjectToken:output_type -> openshell.v1.ExchangeProviderSubjectTokenResponse + 190, // 497: openshell.v1.OpenShell.GetSandboxLogs:output_type -> openshell.v1.GetSandboxLogsResponse + 189, // 498: openshell.v1.OpenShell.PushSandboxLogs:output_type -> openshell.v1.PushSandboxLogsResponse + 192, // 499: openshell.v1.OpenShell.ConnectSupervisor:output_type -> openshell.v1.GatewayMessage + 204, // 500: openshell.v1.OpenShell.ReportMainProcessExit:output_type -> openshell.v1.ReportMainProcessExitResponse + 206, // 501: openshell.v1.OpenShell.FinalizeMainProcessExit:output_type -> openshell.v1.FinalizeMainProcessExitResponse + 211, // 502: openshell.v1.OpenShell.RelayStream:output_type -> openshell.v1.RelayFrame + 213, // 503: openshell.v1.OpenShell.PeerRelay:output_type -> openshell.v1.PeerRelayFrame + 87, // 504: openshell.v1.OpenShell.PeerReportProviderReadiness:output_type -> openshell.v1.ReportProviderReadinessResponse + 266, // 505: openshell.v1.OpenShell.PeerReportEndpointStatus:output_type -> openshell.v1.ReportEndpointStatusResponse + 85, // 506: openshell.v1.OpenShell.PeerGetSandboxProviderStatus:output_type -> openshell.v1.GetSandboxProviderStatusResponse + 217, // 507: openshell.v1.OpenShell.PeerNotifyConfigUpdate:output_type -> openshell.v1.PeerNotifyConfigUpdateResponse + 112, // 508: openshell.v1.OpenShell.WatchSandbox:output_type -> openshell.v1.SandboxStreamEvent + 227, // 509: openshell.v1.OpenShell.SubmitPolicyAnalysis:output_type -> openshell.v1.SubmitPolicyAnalysisResponse + 229, // 510: openshell.v1.OpenShell.GetDraftPolicy:output_type -> openshell.v1.GetDraftPolicyResponse + 231, // 511: openshell.v1.OpenShell.ApproveDraftChunk:output_type -> openshell.v1.ApproveDraftChunkResponse + 233, // 512: openshell.v1.OpenShell.RejectDraftChunk:output_type -> openshell.v1.RejectDraftChunkResponse + 236, // 513: openshell.v1.OpenShell.ApproveAllDraftChunks:output_type -> openshell.v1.ApproveAllDraftChunksResponse + 238, // 514: openshell.v1.OpenShell.EditDraftChunk:output_type -> openshell.v1.EditDraftChunkResponse + 240, // 515: openshell.v1.OpenShell.UndoDraftChunk:output_type -> openshell.v1.UndoDraftChunkResponse + 242, // 516: openshell.v1.OpenShell.ClearDraftChunks:output_type -> openshell.v1.ClearDraftChunksResponse + 245, // 517: openshell.v1.OpenShell.GetDraftHistory:output_type -> openshell.v1.GetDraftHistoryResponse + 23, // 518: openshell.v1.OpenShell.IssueSandboxToken:output_type -> openshell.v1.IssueSandboxTokenResponse + 25, // 519: openshell.v1.OpenShell.RefreshSandboxToken:output_type -> openshell.v1.RefreshSandboxTokenResponse + 247, // 520: openshell.v1.OpenShell.CreateWorkspace:output_type -> openshell.v1.CreateWorkspaceResponse + 249, // 521: openshell.v1.OpenShell.GetWorkspace:output_type -> openshell.v1.GetWorkspaceResponse + 251, // 522: openshell.v1.OpenShell.ListWorkspaces:output_type -> openshell.v1.ListWorkspacesResponse + 253, // 523: openshell.v1.OpenShell.DeleteWorkspace:output_type -> openshell.v1.DeleteWorkspaceResponse + 256, // 524: openshell.v1.OpenShell.AddWorkspaceMember:output_type -> openshell.v1.AddWorkspaceMemberResponse + 258, // 525: openshell.v1.OpenShell.RemoveWorkspaceMember:output_type -> openshell.v1.RemoveWorkspaceMemberResponse + 260, // 526: openshell.v1.OpenShell.ListWorkspaceMembers:output_type -> openshell.v1.ListWorkspaceMembersResponse + 443, // [443:527] is the sub-list for method output_type + 359, // [359:443] is the sub-list for method input_type + 359, // [359:359] is the sub-list for extension type_name + 359, // [359:359] is the sub-list for extension extendee + 0, // [0:359] is the sub-list for field type_name } func init() { file_openshell_proto_init() } @@ -22253,13 +22097,7 @@ func file_openshell_proto_init() { (*SandboxStreamEvent_Warning)(nil), (*SandboxStreamEvent_DraftPolicyUpdate)(nil), } - file_openshell_proto_msgTypes[139].OneofWrappers = []any{ - (*StaticCredentialPlacement_HeaderName)(nil), - (*StaticCredentialPlacement_QueryParam)(nil), - (*StaticCredentialPlacement_PathTemplate)(nil), - (*StaticCredentialPlacement_SigningOnly)(nil), - } - file_openshell_proto_msgTypes[147].OneofWrappers = []any{ + file_openshell_proto_msgTypes[146].OneofWrappers = []any{ (*PolicyMergeOperation_AddRule)(nil), (*PolicyMergeOperation_RemoveEndpoint)(nil), (*PolicyMergeOperation_RemoveRule)(nil), @@ -22267,15 +22105,15 @@ func file_openshell_proto_init() { (*PolicyMergeOperation_AddAllowRules)(nil), (*PolicyMergeOperation_RemoveBinary)(nil), } - file_openshell_proto_msgTypes[151].OneofWrappers = []any{} - file_openshell_proto_msgTypes[170].OneofWrappers = []any{ + file_openshell_proto_msgTypes[150].OneofWrappers = []any{} + file_openshell_proto_msgTypes[169].OneofWrappers = []any{ (*SupervisorMessage_Hello)(nil), (*SupervisorMessage_Heartbeat)(nil), (*SupervisorMessage_RelayOpenResult)(nil), (*SupervisorMessage_RelayClose)(nil), (*SupervisorMessage_ConfigUpdateResult)(nil), } - file_openshell_proto_msgTypes[171].OneofWrappers = []any{ + file_openshell_proto_msgTypes[170].OneofWrappers = []any{ (*GatewayMessage_SessionAccepted)(nil), (*GatewayMessage_SessionRejected)(nil), (*GatewayMessage_Heartbeat)(nil), @@ -22284,32 +22122,32 @@ func file_openshell_proto_init() { (*GatewayMessage_SessionRedirect)(nil), (*GatewayMessage_ConfigUpdate)(nil), } - file_openshell_proto_msgTypes[186].OneofWrappers = []any{ + file_openshell_proto_msgTypes[185].OneofWrappers = []any{ (*RelayOpen_Ssh)(nil), (*RelayOpen_Tcp)(nil), } - file_openshell_proto_msgTypes[190].OneofWrappers = []any{ + file_openshell_proto_msgTypes[189].OneofWrappers = []any{ (*RelayFrame_Init)(nil), (*RelayFrame_Data)(nil), } - file_openshell_proto_msgTypes[192].OneofWrappers = []any{ + file_openshell_proto_msgTypes[191].OneofWrappers = []any{ (*PeerRelayFrame_Init)(nil), (*PeerRelayFrame_Data)(nil), } - file_openshell_proto_msgTypes[195].OneofWrappers = []any{ + file_openshell_proto_msgTypes[194].OneofWrappers = []any{ (*PeerNotifyConfigUpdateRequest_Sandbox)(nil), (*PeerNotifyConfigUpdateRequest_Workspace)(nil), (*PeerNotifyConfigUpdateRequest_AllConnected)(nil), (*PeerNotifyConfigUpdateRequest_Provider)(nil), } - file_openshell_proto_msgTypes[249].OneofWrappers = []any{} + file_openshell_proto_msgTypes[248].OneofWrappers = []any{} type x struct{} out := protoimpl.TypeBuilder{ File: protoimpl.DescBuilder{ GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_openshell_proto_rawDesc), len(file_openshell_proto_rawDesc)), NumEnums: 22, - NumMessages: 276, + NumMessages: 275, NumExtensions: 0, NumServices: 1, }, diff --git a/skills/debug-inference/SKILL.md b/skills/debug-inference/SKILL.md index cd051f8332..bf28d96d5c 100644 --- a/skills/debug-inference/SKILL.md +++ b/skills/debug-inference/SKILL.md @@ -103,9 +103,9 @@ inference request using the provider's documented API shape. | A retired managed endpoint fails DNS resolution | Client still uses the removed managed endpoint | Configure the provider's native base URL and attach an endpoint-bearing provider profile | | Direct request is denied | Missing attachment, endpoint policy, HTTP rule, or binary authorization | Inspect the attached provider profile and sandbox effective policy | | `credential_endpoint_mismatch` | Credential profile does not authorize the request recipient | Correct the host/port/path or import a narrowly scoped profile for the intended endpoint | -| `credential_placement_mismatch` | A credential placeholder is outside its declared header, query parameter, or path slot | Match the profile's declared placement. Body and WebSocket rewrite flags do not override credential placement. | +| `credential_placement_mismatch` | A placeholder is outside its declared header, query parameter, or path slot | Match the profile placement. Enforcement is automatic with supporting gateway/supervisor versions; explicit body/WebSocket rewrite policies remain supported. | | `request_authority_mismatch` | HTTP authority differs from the CONNECT destination | Use the same host and effective port in both authorities | -| Credential variable is absent | Provider was not attached when this process launched, profiles collide on a key, or placement metadata is missing | Check provider readiness and placement metadata, then launch a new process; resolve duplicate keys explicitly. Older supervisors require an upgrade before receiving static credentials. | +| Credential variable is absent | Provider was not attached when this process launched, profiles collide on a key, or credential delivery failed | Check provider readiness, then launch a new process; resolve duplicate keys explicitly. Missing placement metadata or an older component alone does not withhold credentials. | | Upstream rejects the model or body | Client relied on removed model/request rewriting | Configure the real model and provider-native request format in the application | | `127.0.0.1` works on the host but not in the sandbox | Loopback refers to different runtime | Use `host.openshell.internal` or another gateway-reachable endpoint and profile | | Host-local request times out | Server bind address, gateway topology, or host firewall blocks container-to-host traffic | Verify the listener and permit only the required gateway network path and port | diff --git a/skills/openshell-cli/SKILL.md b/skills/openshell-cli/SKILL.md index fa6aa978cd..7d0a68b84c 100644 --- a/skills/openshell-cli/SKILL.md +++ b/skills/openshell-cli/SKILL.md @@ -150,12 +150,14 @@ when a placeholder is present but requests receive `credential_endpoint_mismatch`. A profileless static provider fails closed because the gateway cannot construct a binding. -Static credentials also require declared placement. A -`credential_placement_mismatch` means the placeholder is outside its permitted -header, query parameter, or path-template slot. Match the profile instead of -broadening network policy or enabling body/WebSocket rewriting. Missing placement -metadata or an older supervisor can cause `CredentialsWithheld`; inspect provider -readiness, correct the profile, and upgrade the supervisor before retrying. +Usable credential placement is enforced automatically when both gateway and +supervisor support it. `credential_placement_mismatch` means a placeholder is +outside its declared header, query parameter, or path-template slot. Match the +profile. Explicit body/WebSocket rewrite policies retain their documented +behavior for ordinary credentials. Missing placement metadata or older components +retain legacy endpoint-scoped substitution; they do not cause withholding by +themselves. Check provider readiness after changing placement and launch a new +process if retained references were revoked. When an inspected request receives `request_authority_mismatch`, compare its HTTP authority with the CONNECT tunnel endpoint. The host and effective port