diff --git a/libraries/authority-client/contract/catalog.codefly.json b/libraries/authority-client/contract/catalog.codefly.json index 431b6173..0115e2c9 100644 --- a/libraries/authority-client/contract/catalog.codefly.json +++ b/libraries/authority-client/contract/catalog.codefly.json @@ -10,7 +10,7 @@ "kind": "protobuf", "package": "", "path": "contract.binpb", - "digest": "sha256:b49a5399e647c61b1991fc22bf7fcf8262ab17333dbe01b4afd1d16c346f3ea7", + "digest": "sha256:80609f1725aa77b4db0b9f8e7ad922a8fabbbde191847b26fc6f6da49b3adc14", "services": [ { "name": "LocalService", diff --git a/libraries/authority-client/contract/contract.binpb b/libraries/authority-client/contract/contract.binpb index 236b452b..3dc12725 100644 Binary files a/libraries/authority-client/contract/contract.binpb and b/libraries/authority-client/contract/contract.binpb differ diff --git a/libraries/authority-client/go/gen/api.pb.go b/libraries/authority-client/go/gen/api.pb.go index 0d17bf17..f196f90f 100644 --- a/libraries/authority-client/go/gen/api.pb.go +++ b/libraries/authority-client/go/gen/api.pb.go @@ -4,7 +4,7 @@ // protoc (unknown) // source: api.proto -package api +package client import ( reflect "reflect" @@ -113,8 +113,8 @@ const file_api_proto_rawDesc = "" + "\aversion\x18\x01 \x01(\tR\aversion2V\n" + "\fLocalService\x12F\n" + "\aVersion\x12\x13.api.VersionRequest\x1a\x14.api.VersionResponse\"\x10\x82\xd3\xe4\x93\x02\n" + - "\x12\b/versionBs\n" + - "\acom.apiB\bApiProtoP\x01Z2github.com/codefly-dev/cli/pkg/builder/clients/api\xa2\x02\x03AXX\xaa\x02\x03Api\xca\x02\x03Api\xe2\x02\x0fApi\\GPBMetadata\xea\x02\x03Apib\x06proto3" + "\x12\b/versionBv\n" + + "\acom.apiB\bApiProtoP\x01Z5github.com/codefly-dev/cli/pkg/builder/clients/client\xa2\x02\x03AXX\xaa\x02\x03Api\xca\x02\x03Api\xe2\x02\x0fApi\\GPBMetadata\xea\x02\x03Apib\x06proto3" var ( file_api_proto_rawDescOnce sync.Once diff --git a/libraries/authority-client/go/gen/api_grpc.pb.go b/libraries/authority-client/go/gen/api_grpc.pb.go index 8099665a..270b41be 100644 --- a/libraries/authority-client/go/gen/api_grpc.pb.go +++ b/libraries/authority-client/go/gen/api_grpc.pb.go @@ -4,7 +4,7 @@ // - protoc (unknown) // source: api.proto -package api +package client import ( context "context" diff --git a/libraries/authority-client/go/gen/host/artifact/v1/artifact.pb.go b/libraries/authority-client/go/gen/host/artifact/v1/artifact.pb.go index f9baa315..874fad96 100644 --- a/libraries/authority-client/go/gen/host/artifact/v1/artifact.pb.go +++ b/libraries/authority-client/go/gen/host/artifact/v1/artifact.pb.go @@ -434,8 +434,8 @@ const file_host_artifact_v1_artifact_proto_rawDesc = "" + "\x0fArtifactService\x12H\n" + "\aApprove\x12!.host.artifact.v1.ArtifactRequest\x1a\x1a.host.artifact.v1.Approval\x12J\n" + "\tAuthorize\x12!.host.artifact.v1.ArtifactRequest\x1a\x1a.host.artifact.v1.Approval\x12E\n" + - "\x06Revoke\x12\x1f.host.artifact.v1.RevokeRequest\x1a\x1a.host.artifact.v1.ApprovalB\xd7\x01\n" + - "\x14com.host.artifact.v1B\rArtifactProtoP\x01ZNgithub.com/codefly-dev/cli/pkg/builder/clients/api/host/artifact/v1;artifactv1\xa2\x02\x03HAX\xaa\x02\x10Host.Artifact.V1\xca\x02\x10Host\\Artifact\\V1\xe2\x02\x1cHost\\Artifact\\V1\\GPBMetadata\xea\x02\x12Host::Artifact::V1b\x06proto3" + "\x06Revoke\x12\x1f.host.artifact.v1.RevokeRequest\x1a\x1a.host.artifact.v1.ApprovalB\xda\x01\n" + + "\x14com.host.artifact.v1B\rArtifactProtoP\x01ZQgithub.com/codefly-dev/cli/pkg/builder/clients/client/host/artifact/v1;artifactv1\xa2\x02\x03HAX\xaa\x02\x10Host.Artifact.V1\xca\x02\x10Host\\Artifact\\V1\xe2\x02\x1cHost\\Artifact\\V1\\GPBMetadata\xea\x02\x12Host::Artifact::V1b\x06proto3" var ( file_host_artifact_v1_artifact_proto_rawDescOnce sync.Once diff --git a/libraries/authority-client/go/gen/host/authority/v1/authority.pb.go b/libraries/authority-client/go/gen/host/authority/v1/authority.pb.go index 1acc5e8a..7aaf503a 100644 --- a/libraries/authority-client/go/gen/host/authority/v1/authority.pb.go +++ b/libraries/authority-client/go/gen/host/authority/v1/authority.pb.go @@ -41,6 +41,7 @@ type IssueRequest struct { // *IssueRequest_Installation // *IssueRequest_ParentToken // *IssueRequest_Delegation + // *IssueRequest_Setup As isIssueRequest_As `protobuf_oneof:"as"` // The module principal that may consume the capability. Audience string `protobuf:"bytes,5,opt,name=audience,proto3" json:"audience,omitempty"` @@ -150,6 +151,15 @@ func (x *IssueRequest) GetDelegation() *DelegationRef { return nil } +func (x *IssueRequest) GetSetup() *InstallationSetupRef { + if x != nil { + if x, ok := x.As.(*IssueRequest_Setup); ok { + return x.Setup + } + } + return nil +} + func (x *IssueRequest) GetAudience() string { if x != nil { return x.Audience @@ -234,6 +244,12 @@ type IssueRequest_Delegation struct { Delegation *DelegationRef `protobuf:"bytes,11,opt,name=delegation,proto3,oneof"` } +type IssueRequest_Setup struct { + // Current authenticated install callback evidence for one declared setup + // method. Independent of standing roles; requires the solution's actor. + Setup *InstallationSetupRef `protobuf:"bytes,13,opt,name=setup,proto3,oneof"` +} + func (*IssueRequest_Person) isIssueRequest_As() {} func (*IssueRequest_Workload) isIssueRequest_As() {} @@ -244,6 +260,64 @@ func (*IssueRequest_ParentToken) isIssueRequest_As() {} func (*IssueRequest_Delegation) isIssueRequest_As() {} +func (*IssueRequest_Setup) isIssueRequest_As() {} + +// InstallationSetupRef selects one exact method from the reviewed setup grant. +// The callback token proves the current attempt; it is not data authority. +type InstallationSetupRef struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The unexpired standard installation callback credential. + StepToken string `protobuf:"bytes,1,opt,name=step_token,json=stepToken,proto3" json:"step_token,omitempty"` + // The exact destination method selected by the setup declaration. + Method string `protobuf:"bytes,2,opt,name=method,proto3" json:"method,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *InstallationSetupRef) Reset() { + *x = InstallationSetupRef{} + mi := &file_host_authority_v1_authority_proto_msgTypes[1] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *InstallationSetupRef) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*InstallationSetupRef) ProtoMessage() {} + +func (x *InstallationSetupRef) ProtoReflect() protoreflect.Message { + mi := &file_host_authority_v1_authority_proto_msgTypes[1] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use InstallationSetupRef.ProtoReflect.Descriptor instead. +func (*InstallationSetupRef) Descriptor() ([]byte, []int) { + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{1} +} + +func (x *InstallationSetupRef) GetStepToken() string { + if x != nil { + return x.StepToken + } + return "" +} + +func (x *InstallationSetupRef) GetMethod() string { + if x != nil { + return x.Method + } + return "" +} + // DelegationRef names one delegation. type DelegationRef struct { state protoimpl.MessageState `protogen:"open.v1"` @@ -255,7 +329,7 @@ type DelegationRef struct { func (x *DelegationRef) Reset() { *x = DelegationRef{} - mi := &file_host_authority_v1_authority_proto_msgTypes[1] + mi := &file_host_authority_v1_authority_proto_msgTypes[2] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -267,7 +341,7 @@ func (x *DelegationRef) String() string { func (*DelegationRef) ProtoMessage() {} func (x *DelegationRef) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[1] + mi := &file_host_authority_v1_authority_proto_msgTypes[2] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -280,7 +354,7 @@ func (x *DelegationRef) ProtoReflect() protoreflect.Message { // Deprecated: Use DelegationRef.ProtoReflect.Descriptor instead. func (*DelegationRef) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{1} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{2} } func (x *DelegationRef) GetDelegationId() string { @@ -310,7 +384,7 @@ type DelegateRequest struct { func (x *DelegateRequest) Reset() { *x = DelegateRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[2] + mi := &file_host_authority_v1_authority_proto_msgTypes[3] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -322,7 +396,7 @@ func (x *DelegateRequest) String() string { func (*DelegateRequest) ProtoMessage() {} func (x *DelegateRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[2] + mi := &file_host_authority_v1_authority_proto_msgTypes[3] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -335,7 +409,7 @@ func (x *DelegateRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DelegateRequest.ProtoReflect.Descriptor instead. func (*DelegateRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{2} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{3} } func (x *DelegateRequest) GetModule() string { @@ -387,7 +461,7 @@ type Delegation struct { func (x *Delegation) Reset() { *x = Delegation{} - mi := &file_host_authority_v1_authority_proto_msgTypes[3] + mi := &file_host_authority_v1_authority_proto_msgTypes[4] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -399,7 +473,7 @@ func (x *Delegation) String() string { func (*Delegation) ProtoMessage() {} func (x *Delegation) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[3] + mi := &file_host_authority_v1_authority_proto_msgTypes[4] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -412,7 +486,7 @@ func (x *Delegation) ProtoReflect() protoreflect.Message { // Deprecated: Use Delegation.ProtoReflect.Descriptor instead. func (*Delegation) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{3} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{4} } func (x *Delegation) GetDelegationId() string { @@ -484,7 +558,7 @@ type GetDelegationRequest struct { func (x *GetDelegationRequest) Reset() { *x = GetDelegationRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[4] + mi := &file_host_authority_v1_authority_proto_msgTypes[5] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -496,7 +570,7 @@ func (x *GetDelegationRequest) String() string { func (*GetDelegationRequest) ProtoMessage() {} func (x *GetDelegationRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[4] + mi := &file_host_authority_v1_authority_proto_msgTypes[5] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -509,7 +583,7 @@ func (x *GetDelegationRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDelegationRequest.ProtoReflect.Descriptor instead. func (*GetDelegationRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{4} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{5} } func (x *GetDelegationRequest) GetDelegationId() string { @@ -537,7 +611,7 @@ type RevokeDelegationRequest struct { func (x *RevokeDelegationRequest) Reset() { *x = RevokeDelegationRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[5] + mi := &file_host_authority_v1_authority_proto_msgTypes[6] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -549,7 +623,7 @@ func (x *RevokeDelegationRequest) String() string { func (*RevokeDelegationRequest) ProtoMessage() {} func (x *RevokeDelegationRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[5] + mi := &file_host_authority_v1_authority_proto_msgTypes[6] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -562,7 +636,7 @@ func (x *RevokeDelegationRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RevokeDelegationRequest.ProtoReflect.Descriptor instead. func (*RevokeDelegationRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{5} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{6} } func (x *RevokeDelegationRequest) GetDelegationId() string { @@ -582,7 +656,7 @@ type RevokeDelegationResponse struct { func (x *RevokeDelegationResponse) Reset() { *x = RevokeDelegationResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[6] + mi := &file_host_authority_v1_authority_proto_msgTypes[7] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -594,7 +668,7 @@ func (x *RevokeDelegationResponse) String() string { func (*RevokeDelegationResponse) ProtoMessage() {} func (x *RevokeDelegationResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[6] + mi := &file_host_authority_v1_authority_proto_msgTypes[7] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -607,7 +681,7 @@ func (x *RevokeDelegationResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RevokeDelegationResponse.ProtoReflect.Descriptor instead. func (*RevokeDelegationResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{6} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{7} } func (x *RevokeDelegationResponse) GetDelegation() *Delegation { @@ -628,7 +702,7 @@ type PersonSession struct { func (x *PersonSession) Reset() { *x = PersonSession{} - mi := &file_host_authority_v1_authority_proto_msgTypes[7] + mi := &file_host_authority_v1_authority_proto_msgTypes[8] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -640,7 +714,7 @@ func (x *PersonSession) String() string { func (*PersonSession) ProtoMessage() {} func (x *PersonSession) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[7] + mi := &file_host_authority_v1_authority_proto_msgTypes[8] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -653,7 +727,7 @@ func (x *PersonSession) ProtoReflect() protoreflect.Message { // Deprecated: Use PersonSession.ProtoReflect.Descriptor instead. func (*PersonSession) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{7} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{8} } // WorkloadCredential proves which module a running process is: the native @@ -669,7 +743,7 @@ type WorkloadCredential struct { func (x *WorkloadCredential) Reset() { *x = WorkloadCredential{} - mi := &file_host_authority_v1_authority_proto_msgTypes[8] + mi := &file_host_authority_v1_authority_proto_msgTypes[9] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -681,7 +755,7 @@ func (x *WorkloadCredential) String() string { func (*WorkloadCredential) ProtoMessage() {} func (x *WorkloadCredential) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[8] + mi := &file_host_authority_v1_authority_proto_msgTypes[9] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -694,7 +768,7 @@ func (x *WorkloadCredential) ProtoReflect() protoreflect.Message { // Deprecated: Use WorkloadCredential.ProtoReflect.Descriptor instead. func (*WorkloadCredential) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{8} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{9} } func (x *WorkloadCredential) GetCredential() string { @@ -715,7 +789,7 @@ type InstallationRef struct { func (x *InstallationRef) Reset() { *x = InstallationRef{} - mi := &file_host_authority_v1_authority_proto_msgTypes[9] + mi := &file_host_authority_v1_authority_proto_msgTypes[10] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -727,7 +801,7 @@ func (x *InstallationRef) String() string { func (*InstallationRef) ProtoMessage() {} func (x *InstallationRef) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[9] + mi := &file_host_authority_v1_authority_proto_msgTypes[10] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -740,7 +814,7 @@ func (x *InstallationRef) ProtoReflect() protoreflect.Message { // Deprecated: Use InstallationRef.ProtoReflect.Descriptor instead. func (*InstallationRef) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{9} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{10} } func (x *InstallationRef) GetInstallationId() string { @@ -765,7 +839,7 @@ type IssueResponse struct { func (x *IssueResponse) Reset() { *x = IssueResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[10] + mi := &file_host_authority_v1_authority_proto_msgTypes[11] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -777,7 +851,7 @@ func (x *IssueResponse) String() string { func (*IssueResponse) ProtoMessage() {} func (x *IssueResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[10] + mi := &file_host_authority_v1_authority_proto_msgTypes[11] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -790,7 +864,7 @@ func (x *IssueResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use IssueResponse.ProtoReflect.Descriptor instead. func (*IssueResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{10} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{11} } func (x *IssueResponse) GetToken() string { @@ -852,7 +926,7 @@ type CheckRequest struct { func (x *CheckRequest) Reset() { *x = CheckRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[11] + mi := &file_host_authority_v1_authority_proto_msgTypes[12] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -864,7 +938,7 @@ func (x *CheckRequest) String() string { func (*CheckRequest) ProtoMessage() {} func (x *CheckRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[11] + mi := &file_host_authority_v1_authority_proto_msgTypes[12] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -877,7 +951,7 @@ func (x *CheckRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CheckRequest.ProtoReflect.Descriptor instead. func (*CheckRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{11} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{12} } func (x *CheckRequest) GetToken() string { @@ -924,7 +998,7 @@ type CheckResponse struct { func (x *CheckResponse) Reset() { *x = CheckResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[12] + mi := &file_host_authority_v1_authority_proto_msgTypes[13] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -936,7 +1010,7 @@ func (x *CheckResponse) String() string { func (*CheckResponse) ProtoMessage() {} func (x *CheckResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[12] + mi := &file_host_authority_v1_authority_proto_msgTypes[13] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -949,7 +1023,7 @@ func (x *CheckResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use CheckResponse.ProtoReflect.Descriptor instead. func (*CheckResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{12} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{13} } func (x *CheckResponse) GetContext() *WorkContextV1 { @@ -982,7 +1056,7 @@ type KeysRequest struct { func (x *KeysRequest) Reset() { *x = KeysRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[13] + mi := &file_host_authority_v1_authority_proto_msgTypes[14] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -994,7 +1068,7 @@ func (x *KeysRequest) String() string { func (*KeysRequest) ProtoMessage() {} func (x *KeysRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[13] + mi := &file_host_authority_v1_authority_proto_msgTypes[14] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1007,7 +1081,7 @@ func (x *KeysRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use KeysRequest.ProtoReflect.Descriptor instead. func (*KeysRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{13} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{14} } // KeysResponse is the issuer and its keys. @@ -1032,7 +1106,7 @@ type KeysResponse struct { func (x *KeysResponse) Reset() { *x = KeysResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[14] + mi := &file_host_authority_v1_authority_proto_msgTypes[15] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1044,7 +1118,7 @@ func (x *KeysResponse) String() string { func (*KeysResponse) ProtoMessage() {} func (x *KeysResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[14] + mi := &file_host_authority_v1_authority_proto_msgTypes[15] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1057,7 +1131,7 @@ func (x *KeysResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use KeysResponse.ProtoReflect.Descriptor instead. func (*KeysResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{14} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{15} } func (x *KeysResponse) GetIssuer() string { @@ -1100,7 +1174,7 @@ type PublicKey struct { func (x *PublicKey) Reset() { *x = PublicKey{} - mi := &file_host_authority_v1_authority_proto_msgTypes[15] + mi := &file_host_authority_v1_authority_proto_msgTypes[16] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1112,7 +1186,7 @@ func (x *PublicKey) String() string { func (*PublicKey) ProtoMessage() {} func (x *PublicKey) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[15] + mi := &file_host_authority_v1_authority_proto_msgTypes[16] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1125,7 +1199,7 @@ func (x *PublicKey) ProtoReflect() protoreflect.Message { // Deprecated: Use PublicKey.ProtoReflect.Descriptor instead. func (*PublicKey) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{15} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{16} } func (x *PublicKey) GetKeyId() string { @@ -1180,7 +1254,7 @@ type RegisterAdmissionKeyRequest struct { func (x *RegisterAdmissionKeyRequest) Reset() { *x = RegisterAdmissionKeyRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[16] + mi := &file_host_authority_v1_authority_proto_msgTypes[17] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1192,7 +1266,7 @@ func (x *RegisterAdmissionKeyRequest) String() string { func (*RegisterAdmissionKeyRequest) ProtoMessage() {} func (x *RegisterAdmissionKeyRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[16] + mi := &file_host_authority_v1_authority_proto_msgTypes[17] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1205,7 +1279,7 @@ func (x *RegisterAdmissionKeyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RegisterAdmissionKeyRequest.ProtoReflect.Descriptor instead. func (*RegisterAdmissionKeyRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{16} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{17} } func (x *RegisterAdmissionKeyRequest) GetActor() *WorkloadCredential { @@ -1242,7 +1316,7 @@ type RegisterAdmissionKeyResponse struct { func (x *RegisterAdmissionKeyResponse) Reset() { *x = RegisterAdmissionKeyResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[17] + mi := &file_host_authority_v1_authority_proto_msgTypes[18] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1254,7 +1328,7 @@ func (x *RegisterAdmissionKeyResponse) String() string { func (*RegisterAdmissionKeyResponse) ProtoMessage() {} func (x *RegisterAdmissionKeyResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[17] + mi := &file_host_authority_v1_authority_proto_msgTypes[18] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1267,7 +1341,7 @@ func (x *RegisterAdmissionKeyResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RegisterAdmissionKeyResponse.ProtoReflect.Descriptor instead. func (*RegisterAdmissionKeyResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{17} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{18} } func (x *RegisterAdmissionKeyResponse) GetKey() *PublicKey { @@ -1301,7 +1375,7 @@ type ListResourcesRequest struct { func (x *ListResourcesRequest) Reset() { *x = ListResourcesRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[18] + mi := &file_host_authority_v1_authority_proto_msgTypes[19] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1313,7 +1387,7 @@ func (x *ListResourcesRequest) String() string { func (*ListResourcesRequest) ProtoMessage() {} func (x *ListResourcesRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[18] + mi := &file_host_authority_v1_authority_proto_msgTypes[19] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1326,7 +1400,7 @@ func (x *ListResourcesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListResourcesRequest.ProtoReflect.Descriptor instead. func (*ListResourcesRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{18} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{19} } func (x *ListResourcesRequest) GetToken() string { @@ -1369,7 +1443,7 @@ type ListResourcesResponse struct { func (x *ListResourcesResponse) Reset() { *x = ListResourcesResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[19] + mi := &file_host_authority_v1_authority_proto_msgTypes[20] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1381,7 +1455,7 @@ func (x *ListResourcesResponse) String() string { func (*ListResourcesResponse) ProtoMessage() {} func (x *ListResourcesResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[19] + mi := &file_host_authority_v1_authority_proto_msgTypes[20] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1394,7 +1468,7 @@ func (x *ListResourcesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListResourcesResponse.ProtoReflect.Descriptor instead. func (*ListResourcesResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{19} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{20} } func (x *ListResourcesResponse) GetGrants() []*ResourceGrant { @@ -1421,7 +1495,7 @@ type AttachResourceRequest struct { func (x *AttachResourceRequest) Reset() { *x = AttachResourceRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[20] + mi := &file_host_authority_v1_authority_proto_msgTypes[21] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1433,7 +1507,7 @@ func (x *AttachResourceRequest) String() string { func (*AttachResourceRequest) ProtoMessage() {} func (x *AttachResourceRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[20] + mi := &file_host_authority_v1_authority_proto_msgTypes[21] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1446,7 +1520,7 @@ func (x *AttachResourceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use AttachResourceRequest.ProtoReflect.Descriptor instead. func (*AttachResourceRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{20} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{21} } func (x *AttachResourceRequest) GetToken() string { @@ -1488,7 +1562,7 @@ type AttachResourceResponse struct { func (x *AttachResourceResponse) Reset() { *x = AttachResourceResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[21] + mi := &file_host_authority_v1_authority_proto_msgTypes[22] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1500,7 +1574,7 @@ func (x *AttachResourceResponse) String() string { func (*AttachResourceResponse) ProtoMessage() {} func (x *AttachResourceResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[21] + mi := &file_host_authority_v1_authority_proto_msgTypes[22] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1513,7 +1587,7 @@ func (x *AttachResourceResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use AttachResourceResponse.ProtoReflect.Descriptor instead. func (*AttachResourceResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{21} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{22} } func (x *AttachResourceResponse) GetInstallationId() string { @@ -1540,7 +1614,7 @@ type DetachResourceRequest struct { func (x *DetachResourceRequest) Reset() { *x = DetachResourceRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[22] + mi := &file_host_authority_v1_authority_proto_msgTypes[23] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1552,7 +1626,7 @@ func (x *DetachResourceRequest) String() string { func (*DetachResourceRequest) ProtoMessage() {} func (x *DetachResourceRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[22] + mi := &file_host_authority_v1_authority_proto_msgTypes[23] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1565,7 +1639,7 @@ func (x *DetachResourceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DetachResourceRequest.ProtoReflect.Descriptor instead. func (*DetachResourceRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{22} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{23} } func (x *DetachResourceRequest) GetActor() *WorkloadCredential { @@ -1607,7 +1681,7 @@ type DetachResourceResponse struct { func (x *DetachResourceResponse) Reset() { *x = DetachResourceResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[23] + mi := &file_host_authority_v1_authority_proto_msgTypes[24] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1619,7 +1693,7 @@ func (x *DetachResourceResponse) String() string { func (*DetachResourceResponse) ProtoMessage() {} func (x *DetachResourceResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[23] + mi := &file_host_authority_v1_authority_proto_msgTypes[24] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1632,7 +1706,7 @@ func (x *DetachResourceResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DetachResourceResponse.ProtoReflect.Descriptor instead. func (*DetachResourceResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{23} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{24} } func (x *DetachResourceResponse) GetInstallationId() string { @@ -1664,7 +1738,7 @@ type AuthorizeTransferRequest struct { func (x *AuthorizeTransferRequest) Reset() { *x = AuthorizeTransferRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[24] + mi := &file_host_authority_v1_authority_proto_msgTypes[25] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1676,7 +1750,7 @@ func (x *AuthorizeTransferRequest) String() string { func (*AuthorizeTransferRequest) ProtoMessage() {} func (x *AuthorizeTransferRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[24] + mi := &file_host_authority_v1_authority_proto_msgTypes[25] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1689,7 +1763,7 @@ func (x *AuthorizeTransferRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use AuthorizeTransferRequest.ProtoReflect.Descriptor instead. func (*AuthorizeTransferRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{24} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{25} } func (x *AuthorizeTransferRequest) GetToken() string { @@ -1747,7 +1821,7 @@ type AuthorizeTransferResponse struct { func (x *AuthorizeTransferResponse) Reset() { *x = AuthorizeTransferResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[25] + mi := &file_host_authority_v1_authority_proto_msgTypes[26] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1759,7 +1833,7 @@ func (x *AuthorizeTransferResponse) String() string { func (*AuthorizeTransferResponse) ProtoMessage() {} func (x *AuthorizeTransferResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[25] + mi := &file_host_authority_v1_authority_proto_msgTypes[26] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1772,7 +1846,7 @@ func (x *AuthorizeTransferResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use AuthorizeTransferResponse.ProtoReflect.Descriptor instead. func (*AuthorizeTransferResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{25} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{26} } func (x *AuthorizeTransferResponse) GetPrincipalId() string { @@ -1809,7 +1883,7 @@ type ResourceGrant struct { func (x *ResourceGrant) Reset() { *x = ResourceGrant{} - mi := &file_host_authority_v1_authority_proto_msgTypes[26] + mi := &file_host_authority_v1_authority_proto_msgTypes[27] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1821,7 +1895,7 @@ func (x *ResourceGrant) String() string { func (*ResourceGrant) ProtoMessage() {} func (x *ResourceGrant) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[26] + mi := &file_host_authority_v1_authority_proto_msgTypes[27] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1834,7 +1908,7 @@ func (x *ResourceGrant) ProtoReflect() protoreflect.Message { // Deprecated: Use ResourceGrant.ProtoReflect.Descriptor instead. func (*ResourceGrant) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{26} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{27} } func (x *ResourceGrant) GetMatch() isResourceGrant_Match { @@ -1924,7 +1998,7 @@ var File_host_authority_v1_authority_proto protoreflect.FileDescriptor const file_host_authority_v1_authority_proto_rawDesc = "" + "\n" + - "!host/authority/v1/authority.proto\x12\x11host.authority.v1\x1a\x1cgoogle/api/annotations.proto\x1a$host/authority/v1/work_context.proto\"\xf3\x04\n" + + "!host/authority/v1/authority.proto\x12\x11host.authority.v1\x1a\x1cgoogle/api/annotations.proto\x1a$host/authority/v1/work_context.proto\"\xb4\x05\n" + "\fIssueRequest\x12:\n" + "\x06person\x18\x01 \x01(\v2 .host.authority.v1.PersonSessionH\x00R\x06person\x12C\n" + "\bworkload\x18\x02 \x01(\v2%.host.authority.v1.WorkloadCredentialH\x00R\bworkload\x12H\n" + @@ -1932,7 +2006,8 @@ const file_host_authority_v1_authority_proto_rawDesc = "" + "\fparent_token\x18\x04 \x01(\tH\x00R\vparentToken\x12B\n" + "\n" + "delegation\x18\v \x01(\v2 .host.authority.v1.DelegationRefH\x00R\n" + - "delegation\x12\x1a\n" + + "delegation\x12?\n" + + "\x05setup\x18\r \x01(\v2'.host.authority.v1.InstallationSetupRefH\x00R\x05setup\x12\x1a\n" + "\baudience\x18\x05 \x01(\tR\baudience\x126\n" + "\x06scopes\x18\x06 \x03(\v2\x1e.host.authority.v1.WorkScopeV1R\x06scopes\x12\x1f\n" + "\vttl_seconds\x18\a \x01(\x03R\n" + @@ -1942,7 +2017,11 @@ const file_host_authority_v1_authority_proto_rawDesc = "" + "\x05actor\x18\n" + " \x01(\v2%.host.authority.v1.WorkloadCredentialR\x05actor\x12\x1c\n" + "\toperation\x18\f \x01(\tR\toperationB\x04\n" + - "\x02as\"4\n" + + "\x02as\"M\n" + + "\x14InstallationSetupRef\x12\x1d\n" + + "\n" + + "step_token\x18\x01 \x01(\tR\tstepToken\x12\x16\n" + + "\x06method\x18\x02 \x01(\tR\x06method\"4\n" + "\rDelegationRef\x12#\n" + "\rdelegation_id\x18\x01 \x01(\tR\fdelegationId\"\x9c\x01\n" + "\x0fDelegateRequest\x12\x16\n" + @@ -2062,8 +2141,8 @@ const file_host_authority_v1_authority_proto_rawDesc = "" + "\x11AuthorizeTransfer\x12+.host.authority.v1.AuthorizeTransferRequest\x1a,.host.authority.v1.AuthorizeTransferResponse\x12M\n" + "\bDelegate\x12\".host.authority.v1.DelegateRequest\x1a\x1d.host.authority.v1.Delegation\x12k\n" + "\x10RevokeDelegation\x12*.host.authority.v1.RevokeDelegationRequest\x1a+.host.authority.v1.RevokeDelegationResponse\x12W\n" + - "\rGetDelegation\x12'.host.authority.v1.GetDelegationRequest\x1a\x1d.host.authority.v1.DelegationB\xdf\x01\n" + - "\x15com.host.authority.v1B\x0eAuthorityProtoP\x01ZPgithub.com/codefly-dev/cli/pkg/builder/clients/api/host/authority/v1;authorityv1\xa2\x02\x03HAX\xaa\x02\x11Host.Authority.V1\xca\x02\x11Host\\Authority\\V1\xe2\x02\x1dHost\\Authority\\V1\\GPBMetadata\xea\x02\x13Host::Authority::V1b\x06proto3" + "\rGetDelegation\x12'.host.authority.v1.GetDelegationRequest\x1a\x1d.host.authority.v1.DelegationB\xe2\x01\n" + + "\x15com.host.authority.v1B\x0eAuthorityProtoP\x01ZSgithub.com/codefly-dev/cli/pkg/builder/clients/client/host/authority/v1;authorityv1\xa2\x02\x03HAX\xaa\x02\x11Host.Authority.V1\xca\x02\x11Host\\Authority\\V1\xe2\x02\x1dHost\\Authority\\V1\\GPBMetadata\xea\x02\x13Host::Authority::V1b\x06proto3" var ( file_host_authority_v1_authority_proto_rawDescOnce sync.Once @@ -2077,86 +2156,88 @@ func file_host_authority_v1_authority_proto_rawDescGZIP() []byte { return file_host_authority_v1_authority_proto_rawDescData } -var file_host_authority_v1_authority_proto_msgTypes = make([]protoimpl.MessageInfo, 27) +var file_host_authority_v1_authority_proto_msgTypes = make([]protoimpl.MessageInfo, 28) var file_host_authority_v1_authority_proto_goTypes = []any{ (*IssueRequest)(nil), // 0: host.authority.v1.IssueRequest - (*DelegationRef)(nil), // 1: host.authority.v1.DelegationRef - (*DelegateRequest)(nil), // 2: host.authority.v1.DelegateRequest - (*Delegation)(nil), // 3: host.authority.v1.Delegation - (*GetDelegationRequest)(nil), // 4: host.authority.v1.GetDelegationRequest - (*RevokeDelegationRequest)(nil), // 5: host.authority.v1.RevokeDelegationRequest - (*RevokeDelegationResponse)(nil), // 6: host.authority.v1.RevokeDelegationResponse - (*PersonSession)(nil), // 7: host.authority.v1.PersonSession - (*WorkloadCredential)(nil), // 8: host.authority.v1.WorkloadCredential - (*InstallationRef)(nil), // 9: host.authority.v1.InstallationRef - (*IssueResponse)(nil), // 10: host.authority.v1.IssueResponse - (*CheckRequest)(nil), // 11: host.authority.v1.CheckRequest - (*CheckResponse)(nil), // 12: host.authority.v1.CheckResponse - (*KeysRequest)(nil), // 13: host.authority.v1.KeysRequest - (*KeysResponse)(nil), // 14: host.authority.v1.KeysResponse - (*PublicKey)(nil), // 15: host.authority.v1.PublicKey - (*RegisterAdmissionKeyRequest)(nil), // 16: host.authority.v1.RegisterAdmissionKeyRequest - (*RegisterAdmissionKeyResponse)(nil), // 17: host.authority.v1.RegisterAdmissionKeyResponse - (*ListResourcesRequest)(nil), // 18: host.authority.v1.ListResourcesRequest - (*ListResourcesResponse)(nil), // 19: host.authority.v1.ListResourcesResponse - (*AttachResourceRequest)(nil), // 20: host.authority.v1.AttachResourceRequest - (*AttachResourceResponse)(nil), // 21: host.authority.v1.AttachResourceResponse - (*DetachResourceRequest)(nil), // 22: host.authority.v1.DetachResourceRequest - (*DetachResourceResponse)(nil), // 23: host.authority.v1.DetachResourceResponse - (*AuthorizeTransferRequest)(nil), // 24: host.authority.v1.AuthorizeTransferRequest - (*AuthorizeTransferResponse)(nil), // 25: host.authority.v1.AuthorizeTransferResponse - (*ResourceGrant)(nil), // 26: host.authority.v1.ResourceGrant - (*WorkScopeV1)(nil), // 27: host.authority.v1.WorkScopeV1 - (*WorkContextV1)(nil), // 28: host.authority.v1.WorkContextV1 + (*InstallationSetupRef)(nil), // 1: host.authority.v1.InstallationSetupRef + (*DelegationRef)(nil), // 2: host.authority.v1.DelegationRef + (*DelegateRequest)(nil), // 3: host.authority.v1.DelegateRequest + (*Delegation)(nil), // 4: host.authority.v1.Delegation + (*GetDelegationRequest)(nil), // 5: host.authority.v1.GetDelegationRequest + (*RevokeDelegationRequest)(nil), // 6: host.authority.v1.RevokeDelegationRequest + (*RevokeDelegationResponse)(nil), // 7: host.authority.v1.RevokeDelegationResponse + (*PersonSession)(nil), // 8: host.authority.v1.PersonSession + (*WorkloadCredential)(nil), // 9: host.authority.v1.WorkloadCredential + (*InstallationRef)(nil), // 10: host.authority.v1.InstallationRef + (*IssueResponse)(nil), // 11: host.authority.v1.IssueResponse + (*CheckRequest)(nil), // 12: host.authority.v1.CheckRequest + (*CheckResponse)(nil), // 13: host.authority.v1.CheckResponse + (*KeysRequest)(nil), // 14: host.authority.v1.KeysRequest + (*KeysResponse)(nil), // 15: host.authority.v1.KeysResponse + (*PublicKey)(nil), // 16: host.authority.v1.PublicKey + (*RegisterAdmissionKeyRequest)(nil), // 17: host.authority.v1.RegisterAdmissionKeyRequest + (*RegisterAdmissionKeyResponse)(nil), // 18: host.authority.v1.RegisterAdmissionKeyResponse + (*ListResourcesRequest)(nil), // 19: host.authority.v1.ListResourcesRequest + (*ListResourcesResponse)(nil), // 20: host.authority.v1.ListResourcesResponse + (*AttachResourceRequest)(nil), // 21: host.authority.v1.AttachResourceRequest + (*AttachResourceResponse)(nil), // 22: host.authority.v1.AttachResourceResponse + (*DetachResourceRequest)(nil), // 23: host.authority.v1.DetachResourceRequest + (*DetachResourceResponse)(nil), // 24: host.authority.v1.DetachResourceResponse + (*AuthorizeTransferRequest)(nil), // 25: host.authority.v1.AuthorizeTransferRequest + (*AuthorizeTransferResponse)(nil), // 26: host.authority.v1.AuthorizeTransferResponse + (*ResourceGrant)(nil), // 27: host.authority.v1.ResourceGrant + (*WorkScopeV1)(nil), // 28: host.authority.v1.WorkScopeV1 + (*WorkContextV1)(nil), // 29: host.authority.v1.WorkContextV1 } var file_host_authority_v1_authority_proto_depIdxs = []int32{ - 7, // 0: host.authority.v1.IssueRequest.person:type_name -> host.authority.v1.PersonSession - 8, // 1: host.authority.v1.IssueRequest.workload:type_name -> host.authority.v1.WorkloadCredential - 9, // 2: host.authority.v1.IssueRequest.installation:type_name -> host.authority.v1.InstallationRef - 1, // 3: host.authority.v1.IssueRequest.delegation:type_name -> host.authority.v1.DelegationRef - 27, // 4: host.authority.v1.IssueRequest.scopes:type_name -> host.authority.v1.WorkScopeV1 - 8, // 5: host.authority.v1.IssueRequest.actor:type_name -> host.authority.v1.WorkloadCredential - 27, // 6: host.authority.v1.DelegateRequest.scopes:type_name -> host.authority.v1.WorkScopeV1 - 27, // 7: host.authority.v1.Delegation.scopes:type_name -> host.authority.v1.WorkScopeV1 - 8, // 8: host.authority.v1.GetDelegationRequest.actor:type_name -> host.authority.v1.WorkloadCredential - 3, // 9: host.authority.v1.RevokeDelegationResponse.delegation:type_name -> host.authority.v1.Delegation - 28, // 10: host.authority.v1.IssueResponse.context:type_name -> host.authority.v1.WorkContextV1 - 28, // 11: host.authority.v1.CheckResponse.context:type_name -> host.authority.v1.WorkContextV1 - 15, // 12: host.authority.v1.KeysResponse.keys:type_name -> host.authority.v1.PublicKey - 15, // 13: host.authority.v1.KeysResponse.admission_keys:type_name -> host.authority.v1.PublicKey - 8, // 14: host.authority.v1.RegisterAdmissionKeyRequest.actor:type_name -> host.authority.v1.WorkloadCredential - 15, // 15: host.authority.v1.RegisterAdmissionKeyResponse.key:type_name -> host.authority.v1.PublicKey - 26, // 16: host.authority.v1.ListResourcesResponse.grants:type_name -> host.authority.v1.ResourceGrant - 8, // 17: host.authority.v1.AttachResourceRequest.actor:type_name -> host.authority.v1.WorkloadCredential - 8, // 18: host.authority.v1.DetachResourceRequest.actor:type_name -> host.authority.v1.WorkloadCredential - 8, // 19: host.authority.v1.AuthorizeTransferRequest.actor:type_name -> host.authority.v1.WorkloadCredential - 0, // 20: host.authority.v1.AuthorityService.Issue:input_type -> host.authority.v1.IssueRequest - 11, // 21: host.authority.v1.AuthorityService.Check:input_type -> host.authority.v1.CheckRequest - 13, // 22: host.authority.v1.AuthorityService.Keys:input_type -> host.authority.v1.KeysRequest - 16, // 23: host.authority.v1.AuthorityService.RegisterAdmissionKey:input_type -> host.authority.v1.RegisterAdmissionKeyRequest - 18, // 24: host.authority.v1.AuthorityService.ListResources:input_type -> host.authority.v1.ListResourcesRequest - 20, // 25: host.authority.v1.AuthorityService.AttachResource:input_type -> host.authority.v1.AttachResourceRequest - 22, // 26: host.authority.v1.AuthorityService.DetachResource:input_type -> host.authority.v1.DetachResourceRequest - 24, // 27: host.authority.v1.AuthorityService.AuthorizeTransfer:input_type -> host.authority.v1.AuthorizeTransferRequest - 2, // 28: host.authority.v1.AuthorityService.Delegate:input_type -> host.authority.v1.DelegateRequest - 5, // 29: host.authority.v1.AuthorityService.RevokeDelegation:input_type -> host.authority.v1.RevokeDelegationRequest - 4, // 30: host.authority.v1.AuthorityService.GetDelegation:input_type -> host.authority.v1.GetDelegationRequest - 10, // 31: host.authority.v1.AuthorityService.Issue:output_type -> host.authority.v1.IssueResponse - 12, // 32: host.authority.v1.AuthorityService.Check:output_type -> host.authority.v1.CheckResponse - 14, // 33: host.authority.v1.AuthorityService.Keys:output_type -> host.authority.v1.KeysResponse - 17, // 34: host.authority.v1.AuthorityService.RegisterAdmissionKey:output_type -> host.authority.v1.RegisterAdmissionKeyResponse - 19, // 35: host.authority.v1.AuthorityService.ListResources:output_type -> host.authority.v1.ListResourcesResponse - 21, // 36: host.authority.v1.AuthorityService.AttachResource:output_type -> host.authority.v1.AttachResourceResponse - 23, // 37: host.authority.v1.AuthorityService.DetachResource:output_type -> host.authority.v1.DetachResourceResponse - 25, // 38: host.authority.v1.AuthorityService.AuthorizeTransfer:output_type -> host.authority.v1.AuthorizeTransferResponse - 3, // 39: host.authority.v1.AuthorityService.Delegate:output_type -> host.authority.v1.Delegation - 6, // 40: host.authority.v1.AuthorityService.RevokeDelegation:output_type -> host.authority.v1.RevokeDelegationResponse - 3, // 41: host.authority.v1.AuthorityService.GetDelegation:output_type -> host.authority.v1.Delegation - 31, // [31:42] is the sub-list for method output_type - 20, // [20:31] is the sub-list for method input_type - 20, // [20:20] is the sub-list for extension type_name - 20, // [20:20] is the sub-list for extension extendee - 0, // [0:20] is the sub-list for field type_name + 8, // 0: host.authority.v1.IssueRequest.person:type_name -> host.authority.v1.PersonSession + 9, // 1: host.authority.v1.IssueRequest.workload:type_name -> host.authority.v1.WorkloadCredential + 10, // 2: host.authority.v1.IssueRequest.installation:type_name -> host.authority.v1.InstallationRef + 2, // 3: host.authority.v1.IssueRequest.delegation:type_name -> host.authority.v1.DelegationRef + 1, // 4: host.authority.v1.IssueRequest.setup:type_name -> host.authority.v1.InstallationSetupRef + 28, // 5: host.authority.v1.IssueRequest.scopes:type_name -> host.authority.v1.WorkScopeV1 + 9, // 6: host.authority.v1.IssueRequest.actor:type_name -> host.authority.v1.WorkloadCredential + 28, // 7: host.authority.v1.DelegateRequest.scopes:type_name -> host.authority.v1.WorkScopeV1 + 28, // 8: host.authority.v1.Delegation.scopes:type_name -> host.authority.v1.WorkScopeV1 + 9, // 9: host.authority.v1.GetDelegationRequest.actor:type_name -> host.authority.v1.WorkloadCredential + 4, // 10: host.authority.v1.RevokeDelegationResponse.delegation:type_name -> host.authority.v1.Delegation + 29, // 11: host.authority.v1.IssueResponse.context:type_name -> host.authority.v1.WorkContextV1 + 29, // 12: host.authority.v1.CheckResponse.context:type_name -> host.authority.v1.WorkContextV1 + 16, // 13: host.authority.v1.KeysResponse.keys:type_name -> host.authority.v1.PublicKey + 16, // 14: host.authority.v1.KeysResponse.admission_keys:type_name -> host.authority.v1.PublicKey + 9, // 15: host.authority.v1.RegisterAdmissionKeyRequest.actor:type_name -> host.authority.v1.WorkloadCredential + 16, // 16: host.authority.v1.RegisterAdmissionKeyResponse.key:type_name -> host.authority.v1.PublicKey + 27, // 17: host.authority.v1.ListResourcesResponse.grants:type_name -> host.authority.v1.ResourceGrant + 9, // 18: host.authority.v1.AttachResourceRequest.actor:type_name -> host.authority.v1.WorkloadCredential + 9, // 19: host.authority.v1.DetachResourceRequest.actor:type_name -> host.authority.v1.WorkloadCredential + 9, // 20: host.authority.v1.AuthorizeTransferRequest.actor:type_name -> host.authority.v1.WorkloadCredential + 0, // 21: host.authority.v1.AuthorityService.Issue:input_type -> host.authority.v1.IssueRequest + 12, // 22: host.authority.v1.AuthorityService.Check:input_type -> host.authority.v1.CheckRequest + 14, // 23: host.authority.v1.AuthorityService.Keys:input_type -> host.authority.v1.KeysRequest + 17, // 24: host.authority.v1.AuthorityService.RegisterAdmissionKey:input_type -> host.authority.v1.RegisterAdmissionKeyRequest + 19, // 25: host.authority.v1.AuthorityService.ListResources:input_type -> host.authority.v1.ListResourcesRequest + 21, // 26: host.authority.v1.AuthorityService.AttachResource:input_type -> host.authority.v1.AttachResourceRequest + 23, // 27: host.authority.v1.AuthorityService.DetachResource:input_type -> host.authority.v1.DetachResourceRequest + 25, // 28: host.authority.v1.AuthorityService.AuthorizeTransfer:input_type -> host.authority.v1.AuthorizeTransferRequest + 3, // 29: host.authority.v1.AuthorityService.Delegate:input_type -> host.authority.v1.DelegateRequest + 6, // 30: host.authority.v1.AuthorityService.RevokeDelegation:input_type -> host.authority.v1.RevokeDelegationRequest + 5, // 31: host.authority.v1.AuthorityService.GetDelegation:input_type -> host.authority.v1.GetDelegationRequest + 11, // 32: host.authority.v1.AuthorityService.Issue:output_type -> host.authority.v1.IssueResponse + 13, // 33: host.authority.v1.AuthorityService.Check:output_type -> host.authority.v1.CheckResponse + 15, // 34: host.authority.v1.AuthorityService.Keys:output_type -> host.authority.v1.KeysResponse + 18, // 35: host.authority.v1.AuthorityService.RegisterAdmissionKey:output_type -> host.authority.v1.RegisterAdmissionKeyResponse + 20, // 36: host.authority.v1.AuthorityService.ListResources:output_type -> host.authority.v1.ListResourcesResponse + 22, // 37: host.authority.v1.AuthorityService.AttachResource:output_type -> host.authority.v1.AttachResourceResponse + 24, // 38: host.authority.v1.AuthorityService.DetachResource:output_type -> host.authority.v1.DetachResourceResponse + 26, // 39: host.authority.v1.AuthorityService.AuthorizeTransfer:output_type -> host.authority.v1.AuthorizeTransferResponse + 4, // 40: host.authority.v1.AuthorityService.Delegate:output_type -> host.authority.v1.Delegation + 7, // 41: host.authority.v1.AuthorityService.RevokeDelegation:output_type -> host.authority.v1.RevokeDelegationResponse + 4, // 42: host.authority.v1.AuthorityService.GetDelegation:output_type -> host.authority.v1.Delegation + 32, // [32:43] is the sub-list for method output_type + 21, // [21:32] is the sub-list for method input_type + 21, // [21:21] is the sub-list for extension type_name + 21, // [21:21] is the sub-list for extension extendee + 0, // [0:21] is the sub-list for field type_name } func init() { file_host_authority_v1_authority_proto_init() } @@ -2171,8 +2252,9 @@ func file_host_authority_v1_authority_proto_init() { (*IssueRequest_Installation)(nil), (*IssueRequest_ParentToken)(nil), (*IssueRequest_Delegation)(nil), + (*IssueRequest_Setup)(nil), } - file_host_authority_v1_authority_proto_msgTypes[26].OneofWrappers = []any{ + file_host_authority_v1_authority_proto_msgTypes[27].OneofWrappers = []any{ (*ResourceGrant_All)(nil), (*ResourceGrant_Id)(nil), (*ResourceGrant_Prefix)(nil), @@ -2184,7 +2266,7 @@ func file_host_authority_v1_authority_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_host_authority_v1_authority_proto_rawDesc), len(file_host_authority_v1_authority_proto_rawDesc)), NumEnums: 0, - NumMessages: 27, + NumMessages: 28, NumExtensions: 0, NumServices: 1, }, diff --git a/libraries/authority-client/go/gen/host/authority/v1/work_context.pb.go b/libraries/authority-client/go/gen/host/authority/v1/work_context.pb.go index 56d52154..d4295da9 100644 --- a/libraries/authority-client/go/gen/host/authority/v1/work_context.pb.go +++ b/libraries/authority-client/go/gen/host/authority/v1/work_context.pb.go @@ -1094,8 +1094,8 @@ const file_host_authority_v1_work_context_proto_rawDesc = "" + "\x0erequest_digest\x18\x04 \x01(\tB\n" + "\xbaH\ar\x05\x10\x01\x18\x80\x04R\rrequestDigest\x12&\n" + "\baudience\x18\x05 \x01(\tB\n" + - "\xbaH\ar\x05\x10\x01\x18\x80\x04R\baudienceB\xe1\x01\n" + - "\x15com.host.authority.v1B\x10WorkContextProtoP\x01ZPgithub.com/codefly-dev/cli/pkg/builder/clients/api/host/authority/v1;authorityv1\xa2\x02\x03HAX\xaa\x02\x11Host.Authority.V1\xca\x02\x11Host\\Authority\\V1\xe2\x02\x1dHost\\Authority\\V1\\GPBMetadata\xea\x02\x13Host::Authority::V1b\x06proto3" + "\xbaH\ar\x05\x10\x01\x18\x80\x04R\baudienceB\xe4\x01\n" + + "\x15com.host.authority.v1B\x10WorkContextProtoP\x01ZSgithub.com/codefly-dev/cli/pkg/builder/clients/client/host/authority/v1;authorityv1\xa2\x02\x03HAX\xaa\x02\x11Host.Authority.V1\xca\x02\x11Host\\Authority\\V1\xe2\x02\x1dHost\\Authority\\V1\\GPBMetadata\xea\x02\x13Host::Authority::V1b\x06proto3" var ( file_host_authority_v1_work_context_proto_rawDescOnce sync.Once diff --git a/libraries/authority-client/go/gen/host/composition/v1/composition.pb.go b/libraries/authority-client/go/gen/host/composition/v1/composition.pb.go index 4a9d9a7c..97f96ed7 100644 --- a/libraries/authority-client/go/gen/host/composition/v1/composition.pb.go +++ b/libraries/authority-client/go/gen/host/composition/v1/composition.pb.go @@ -147,8 +147,13 @@ type AuthorityManifestV1 struct { InstallationRole string `protobuf:"bytes,8,opt,name=installation_role,json=installationRole,proto3" json:"installation_role,omitempty"` // Viewer-edge presence only; grants no authority. Nil and empty are equivalent. EdgeDependencies []*EdgeDependencyV1 `protobuf:"bytes,9,rep,name=edge_dependencies,json=edgeDependencies,proto3" json:"edge_dependencies,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + // Resolved installation-only grants; separate from standing roles. + Setup []*SetupGrantV1 `protobuf:"bytes,10,rep,name=setup,proto3" json:"setup,omitempty"` + // Only these served kinds enforce resource-owner selectors. Mutually + // exclusive with owner_aware true; empty means none. + OwnerAwareResourceKinds []string `protobuf:"bytes,11,rep,name=owner_aware_resource_kinds,json=ownerAwareResourceKinds,proto3" json:"owner_aware_resource_kinds,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *AuthorityManifestV1) Reset() { @@ -244,6 +249,84 @@ func (x *AuthorityManifestV1) GetEdgeDependencies() []*EdgeDependencyV1 { return nil } +func (x *AuthorityManifestV1) GetSetup() []*SetupGrantV1 { + if x != nil { + return x.Setup + } + return nil +} + +func (x *AuthorityManifestV1) GetOwnerAwareResourceKinds() []string { + if x != nil { + return x.OwnerAwareResourceKinds + } + return nil +} + +// SetupGrantV1 retains exact methods even when two methods share requirements. +type SetupGrantV1 struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The required foreign invoke binding that reaches the destination. + Binding string `protobuf:"bytes,1,opt,name=binding,proto3" json:"binding,omitempty"` + // Exact, unique methods approved for this installation's setup only. + Methods []string `protobuf:"bytes,2,rep,name=methods,proto3" json:"methods,omitempty"` + // Callee-derived requirements as resource-kind:action, within invoke ceiling. + Scopes []string `protobuf:"bytes,3,rep,name=scopes,proto3" json:"scopes,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *SetupGrantV1) Reset() { + *x = SetupGrantV1{} + mi := &file_host_composition_v1_composition_proto_msgTypes[2] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *SetupGrantV1) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*SetupGrantV1) ProtoMessage() {} + +func (x *SetupGrantV1) ProtoReflect() protoreflect.Message { + mi := &file_host_composition_v1_composition_proto_msgTypes[2] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use SetupGrantV1.ProtoReflect.Descriptor instead. +func (*SetupGrantV1) Descriptor() ([]byte, []int) { + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{2} +} + +func (x *SetupGrantV1) GetBinding() string { + if x != nil { + return x.Binding + } + return "" +} + +func (x *SetupGrantV1) GetMethods() []string { + if x != nil { + return x.Methods + } + return nil +} + +func (x *SetupGrantV1) GetScopes() []string { + if x != nil { + return x.Scopes + } + return nil +} + // EdgeDependencyV1 names the exact signed module principal. The host resolves // it to a live catalogue target; it is not a target UUID, route alias or binding id. type EdgeDependencyV1 struct { @@ -257,7 +340,7 @@ type EdgeDependencyV1 struct { func (x *EdgeDependencyV1) Reset() { *x = EdgeDependencyV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[2] + mi := &file_host_composition_v1_composition_proto_msgTypes[3] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -269,7 +352,7 @@ func (x *EdgeDependencyV1) String() string { func (*EdgeDependencyV1) ProtoMessage() {} func (x *EdgeDependencyV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[2] + mi := &file_host_composition_v1_composition_proto_msgTypes[3] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -282,7 +365,7 @@ func (x *EdgeDependencyV1) ProtoReflect() protoreflect.Message { // Deprecated: Use EdgeDependencyV1.ProtoReflect.Descriptor instead. func (*EdgeDependencyV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{2} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{3} } func (x *EdgeDependencyV1) GetModule() string { @@ -317,7 +400,7 @@ type MethodPolicyV1 struct { func (x *MethodPolicyV1) Reset() { *x = MethodPolicyV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[3] + mi := &file_host_composition_v1_composition_proto_msgTypes[4] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -329,7 +412,7 @@ func (x *MethodPolicyV1) String() string { func (*MethodPolicyV1) ProtoMessage() {} func (x *MethodPolicyV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[3] + mi := &file_host_composition_v1_composition_proto_msgTypes[4] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -342,7 +425,7 @@ func (x *MethodPolicyV1) ProtoReflect() protoreflect.Message { // Deprecated: Use MethodPolicyV1.ProtoReflect.Descriptor instead. func (*MethodPolicyV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{3} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{4} } func (x *MethodPolicyV1) GetMethod() string { @@ -378,7 +461,7 @@ type SignedManifestV1 struct { func (x *SignedManifestV1) Reset() { *x = SignedManifestV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[4] + mi := &file_host_composition_v1_composition_proto_msgTypes[5] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -390,7 +473,7 @@ func (x *SignedManifestV1) String() string { func (*SignedManifestV1) ProtoMessage() {} func (x *SignedManifestV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[4] + mi := &file_host_composition_v1_composition_proto_msgTypes[5] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -403,7 +486,7 @@ func (x *SignedManifestV1) ProtoReflect() protoreflect.Message { // Deprecated: Use SignedManifestV1.ProtoReflect.Descriptor instead. func (*SignedManifestV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{4} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{5} } func (x *SignedManifestV1) GetDocument() []byte { @@ -435,7 +518,7 @@ type ApplyManifestResponse struct { func (x *ApplyManifestResponse) Reset() { *x = ApplyManifestResponse{} - mi := &file_host_composition_v1_composition_proto_msgTypes[5] + mi := &file_host_composition_v1_composition_proto_msgTypes[6] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -447,7 +530,7 @@ func (x *ApplyManifestResponse) String() string { func (*ApplyManifestResponse) ProtoMessage() {} func (x *ApplyManifestResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[5] + mi := &file_host_composition_v1_composition_proto_msgTypes[6] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -460,7 +543,7 @@ func (x *ApplyManifestResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ApplyManifestResponse.ProtoReflect.Descriptor instead. func (*ApplyManifestResponse) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{5} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{6} } func (x *ApplyManifestResponse) GetPrincipal() string { @@ -512,7 +595,7 @@ type ModuleManifestV1 struct { func (x *ModuleManifestV1) Reset() { *x = ModuleManifestV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[6] + mi := &file_host_composition_v1_composition_proto_msgTypes[7] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -524,7 +607,7 @@ func (x *ModuleManifestV1) String() string { func (*ModuleManifestV1) ProtoMessage() {} func (x *ModuleManifestV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[6] + mi := &file_host_composition_v1_composition_proto_msgTypes[7] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -537,7 +620,7 @@ func (x *ModuleManifestV1) ProtoReflect() protoreflect.Message { // Deprecated: Use ModuleManifestV1.ProtoReflect.Descriptor instead. func (*ModuleManifestV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{6} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{7} } func (x *ModuleManifestV1) GetModule() string { @@ -616,7 +699,7 @@ type RoleV1 struct { func (x *RoleV1) Reset() { *x = RoleV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[7] + mi := &file_host_composition_v1_composition_proto_msgTypes[8] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -628,7 +711,7 @@ func (x *RoleV1) String() string { func (*RoleV1) ProtoMessage() {} func (x *RoleV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[7] + mi := &file_host_composition_v1_composition_proto_msgTypes[8] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -641,7 +724,7 @@ func (x *RoleV1) ProtoReflect() protoreflect.Message { // Deprecated: Use RoleV1.ProtoReflect.Descriptor instead. func (*RoleV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{7} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{8} } func (x *RoleV1) GetName() string { @@ -687,7 +770,7 @@ type BindingV1 struct { func (x *BindingV1) Reset() { *x = BindingV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[8] + mi := &file_host_composition_v1_composition_proto_msgTypes[9] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -699,7 +782,7 @@ func (x *BindingV1) String() string { func (*BindingV1) ProtoMessage() {} func (x *BindingV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[8] + mi := &file_host_composition_v1_composition_proto_msgTypes[9] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -712,7 +795,7 @@ func (x *BindingV1) ProtoReflect() protoreflect.Message { // Deprecated: Use BindingV1.ProtoReflect.Descriptor instead. func (*BindingV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{8} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{9} } func (x *BindingV1) GetId() string { @@ -763,7 +846,7 @@ type ResourceKindV1 struct { func (x *ResourceKindV1) Reset() { *x = ResourceKindV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[9] + mi := &file_host_composition_v1_composition_proto_msgTypes[10] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -775,7 +858,7 @@ func (x *ResourceKindV1) String() string { func (*ResourceKindV1) ProtoMessage() {} func (x *ResourceKindV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[9] + mi := &file_host_composition_v1_composition_proto_msgTypes[10] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -788,7 +871,7 @@ func (x *ResourceKindV1) ProtoReflect() protoreflect.Message { // Deprecated: Use ResourceKindV1.ProtoReflect.Descriptor instead. func (*ResourceKindV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{9} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{10} } func (x *ResourceKindV1) GetKind() string { @@ -818,7 +901,7 @@ type PageV1 struct { func (x *PageV1) Reset() { *x = PageV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[10] + mi := &file_host_composition_v1_composition_proto_msgTypes[11] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -830,7 +913,7 @@ func (x *PageV1) String() string { func (*PageV1) ProtoMessage() {} func (x *PageV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[10] + mi := &file_host_composition_v1_composition_proto_msgTypes[11] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -843,7 +926,7 @@ func (x *PageV1) ProtoReflect() protoreflect.Message { // Deprecated: Use PageV1.ProtoReflect.Descriptor instead. func (*PageV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{10} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{11} } func (x *PageV1) GetTitle() string { @@ -871,7 +954,7 @@ const file_host_composition_v1_composition_proto_rawDesc = "" + "\n" + "credential\x18\x03 \x01(\tR\n" + "credential\x12C\n" + - "\tauthority\x18\x04 \x01(\v2%.host.composition.v1.SignedManifestV1R\tauthority\"\xda\x03\n" + + "\tauthority\x18\x04 \x01(\v2%.host.composition.v1.SignedManifestV1R\tauthority\"\xd0\x04\n" + "\x13AuthorityManifestV1\x12\x16\n" + "\x06module\x18\x01 \x01(\tR\x06module\x12\x1e\n" + "\n" + @@ -884,7 +967,14 @@ const file_host_composition_v1_composition_proto_rawDesc = "" + "\vowner_aware\x18\a \x01(\bR\n" + "ownerAware\x12+\n" + "\x11installation_role\x18\b \x01(\tR\x10installationRole\x12R\n" + - "\x11edge_dependencies\x18\t \x03(\v2%.host.composition.v1.EdgeDependencyV1R\x10edgeDependencies\"F\n" + + "\x11edge_dependencies\x18\t \x03(\v2%.host.composition.v1.EdgeDependencyV1R\x10edgeDependencies\x127\n" + + "\x05setup\x18\n" + + " \x03(\v2!.host.composition.v1.SetupGrantV1R\x05setup\x12;\n" + + "\x1aowner_aware_resource_kinds\x18\v \x03(\tR\x17ownerAwareResourceKinds\"Z\n" + + "\fSetupGrantV1\x12\x18\n" + + "\abinding\x18\x01 \x01(\tR\abinding\x12\x18\n" + + "\amethods\x18\x02 \x03(\tR\amethods\x12\x16\n" + + "\x06scopes\x18\x03 \x03(\tR\x06scopes\"F\n" + "\x10EdgeDependencyV1\x12\x16\n" + "\x06module\x18\x01 \x01(\tR\x06module\x12\x1a\n" + "\bpresence\x18\x02 \x01(\tR\bpresence\"\x92\x01\n" + @@ -929,8 +1019,8 @@ const file_host_composition_v1_composition_proto_rawDesc = "" + "\x05title\x18\x01 \x01(\tR\x05title\x12\x14\n" + "\x05order\x18\x02 \x01(\x05R\x05order2|\n" + "\x12CompositionService\x12f\n" + - "\rApplyManifest\x12).host.composition.v1.ApplyManifestRequest\x1a*.host.composition.v1.ApplyManifestResponseB\xef\x01\n" + - "\x17com.host.composition.v1B\x10CompositionProtoP\x01ZTgithub.com/codefly-dev/cli/pkg/builder/clients/api/host/composition/v1;compositionv1\xa2\x02\x03HCX\xaa\x02\x13Host.Composition.V1\xca\x02\x13Host\\Composition\\V1\xe2\x02\x1fHost\\Composition\\V1\\GPBMetadata\xea\x02\x15Host::Composition::V1b\x06proto3" + "\rApplyManifest\x12).host.composition.v1.ApplyManifestRequest\x1a*.host.composition.v1.ApplyManifestResponseB\xf2\x01\n" + + "\x17com.host.composition.v1B\x10CompositionProtoP\x01ZWgithub.com/codefly-dev/cli/pkg/builder/clients/client/host/composition/v1;compositionv1\xa2\x02\x03HCX\xaa\x02\x13Host.Composition.V1\xca\x02\x13Host\\Composition\\V1\xe2\x02\x1fHost\\Composition\\V1\\GPBMetadata\xea\x02\x15Host::Composition::V1b\x06proto3" var ( file_host_composition_v1_composition_proto_rawDescOnce sync.Once @@ -944,46 +1034,48 @@ func file_host_composition_v1_composition_proto_rawDescGZIP() []byte { return file_host_composition_v1_composition_proto_rawDescData } -var file_host_composition_v1_composition_proto_msgTypes = make([]protoimpl.MessageInfo, 11) +var file_host_composition_v1_composition_proto_msgTypes = make([]protoimpl.MessageInfo, 12) var file_host_composition_v1_composition_proto_goTypes = []any{ (*ApplyManifestRequest)(nil), // 0: host.composition.v1.ApplyManifestRequest (*AuthorityManifestV1)(nil), // 1: host.composition.v1.AuthorityManifestV1 - (*EdgeDependencyV1)(nil), // 2: host.composition.v1.EdgeDependencyV1 - (*MethodPolicyV1)(nil), // 3: host.composition.v1.MethodPolicyV1 - (*SignedManifestV1)(nil), // 4: host.composition.v1.SignedManifestV1 - (*ApplyManifestResponse)(nil), // 5: host.composition.v1.ApplyManifestResponse - (*ModuleManifestV1)(nil), // 6: host.composition.v1.ModuleManifestV1 - (*RoleV1)(nil), // 7: host.composition.v1.RoleV1 - (*BindingV1)(nil), // 8: host.composition.v1.BindingV1 - (*ResourceKindV1)(nil), // 9: host.composition.v1.ResourceKindV1 - (*PageV1)(nil), // 10: host.composition.v1.PageV1 - (*v1.WorkScopeV1)(nil), // 11: host.authority.v1.WorkScopeV1 + (*SetupGrantV1)(nil), // 2: host.composition.v1.SetupGrantV1 + (*EdgeDependencyV1)(nil), // 3: host.composition.v1.EdgeDependencyV1 + (*MethodPolicyV1)(nil), // 4: host.composition.v1.MethodPolicyV1 + (*SignedManifestV1)(nil), // 5: host.composition.v1.SignedManifestV1 + (*ApplyManifestResponse)(nil), // 6: host.composition.v1.ApplyManifestResponse + (*ModuleManifestV1)(nil), // 7: host.composition.v1.ModuleManifestV1 + (*RoleV1)(nil), // 8: host.composition.v1.RoleV1 + (*BindingV1)(nil), // 9: host.composition.v1.BindingV1 + (*ResourceKindV1)(nil), // 10: host.composition.v1.ResourceKindV1 + (*PageV1)(nil), // 11: host.composition.v1.PageV1 + (*v1.WorkScopeV1)(nil), // 12: host.authority.v1.WorkScopeV1 } var file_host_composition_v1_composition_proto_depIdxs = []int32{ - 6, // 0: host.composition.v1.ApplyManifestRequest.manifest:type_name -> host.composition.v1.ModuleManifestV1 - 4, // 1: host.composition.v1.ApplyManifestRequest.carrier:type_name -> host.composition.v1.SignedManifestV1 - 4, // 2: host.composition.v1.ApplyManifestRequest.authority:type_name -> host.composition.v1.SignedManifestV1 - 3, // 3: host.composition.v1.AuthorityManifestV1.methods:type_name -> host.composition.v1.MethodPolicyV1 - 11, // 4: host.composition.v1.AuthorityManifestV1.scope_ceilings:type_name -> host.authority.v1.WorkScopeV1 - 7, // 5: host.composition.v1.AuthorityManifestV1.roles:type_name -> host.composition.v1.RoleV1 - 2, // 6: host.composition.v1.AuthorityManifestV1.edge_dependencies:type_name -> host.composition.v1.EdgeDependencyV1 - 11, // 7: host.composition.v1.MethodPolicyV1.requires:type_name -> host.authority.v1.WorkScopeV1 - 8, // 8: host.composition.v1.ModuleManifestV1.bindings:type_name -> host.composition.v1.BindingV1 - 9, // 9: host.composition.v1.ModuleManifestV1.resource_kinds:type_name -> host.composition.v1.ResourceKindV1 - 10, // 10: host.composition.v1.ModuleManifestV1.page:type_name -> host.composition.v1.PageV1 - 7, // 11: host.composition.v1.ModuleManifestV1.roles:type_name -> host.composition.v1.RoleV1 - 11, // 12: host.composition.v1.RoleV1.scopes:type_name -> host.authority.v1.WorkScopeV1 - 11, // 13: host.composition.v1.RoleV1.installation_owned_scopes:type_name -> host.authority.v1.WorkScopeV1 - 11, // 14: host.composition.v1.BindingV1.invoke_scopes:type_name -> host.authority.v1.WorkScopeV1 - 11, // 15: host.composition.v1.BindingV1.headless_scopes:type_name -> host.authority.v1.WorkScopeV1 - 11, // 16: host.composition.v1.BindingV1.lookup_scopes:type_name -> host.authority.v1.WorkScopeV1 - 0, // 17: host.composition.v1.CompositionService.ApplyManifest:input_type -> host.composition.v1.ApplyManifestRequest - 5, // 18: host.composition.v1.CompositionService.ApplyManifest:output_type -> host.composition.v1.ApplyManifestResponse - 18, // [18:19] is the sub-list for method output_type - 17, // [17:18] is the sub-list for method input_type - 17, // [17:17] is the sub-list for extension type_name - 17, // [17:17] is the sub-list for extension extendee - 0, // [0:17] is the sub-list for field type_name + 7, // 0: host.composition.v1.ApplyManifestRequest.manifest:type_name -> host.composition.v1.ModuleManifestV1 + 5, // 1: host.composition.v1.ApplyManifestRequest.carrier:type_name -> host.composition.v1.SignedManifestV1 + 5, // 2: host.composition.v1.ApplyManifestRequest.authority:type_name -> host.composition.v1.SignedManifestV1 + 4, // 3: host.composition.v1.AuthorityManifestV1.methods:type_name -> host.composition.v1.MethodPolicyV1 + 12, // 4: host.composition.v1.AuthorityManifestV1.scope_ceilings:type_name -> host.authority.v1.WorkScopeV1 + 8, // 5: host.composition.v1.AuthorityManifestV1.roles:type_name -> host.composition.v1.RoleV1 + 3, // 6: host.composition.v1.AuthorityManifestV1.edge_dependencies:type_name -> host.composition.v1.EdgeDependencyV1 + 2, // 7: host.composition.v1.AuthorityManifestV1.setup:type_name -> host.composition.v1.SetupGrantV1 + 12, // 8: host.composition.v1.MethodPolicyV1.requires:type_name -> host.authority.v1.WorkScopeV1 + 9, // 9: host.composition.v1.ModuleManifestV1.bindings:type_name -> host.composition.v1.BindingV1 + 10, // 10: host.composition.v1.ModuleManifestV1.resource_kinds:type_name -> host.composition.v1.ResourceKindV1 + 11, // 11: host.composition.v1.ModuleManifestV1.page:type_name -> host.composition.v1.PageV1 + 8, // 12: host.composition.v1.ModuleManifestV1.roles:type_name -> host.composition.v1.RoleV1 + 12, // 13: host.composition.v1.RoleV1.scopes:type_name -> host.authority.v1.WorkScopeV1 + 12, // 14: host.composition.v1.RoleV1.installation_owned_scopes:type_name -> host.authority.v1.WorkScopeV1 + 12, // 15: host.composition.v1.BindingV1.invoke_scopes:type_name -> host.authority.v1.WorkScopeV1 + 12, // 16: host.composition.v1.BindingV1.headless_scopes:type_name -> host.authority.v1.WorkScopeV1 + 12, // 17: host.composition.v1.BindingV1.lookup_scopes:type_name -> host.authority.v1.WorkScopeV1 + 0, // 18: host.composition.v1.CompositionService.ApplyManifest:input_type -> host.composition.v1.ApplyManifestRequest + 6, // 19: host.composition.v1.CompositionService.ApplyManifest:output_type -> host.composition.v1.ApplyManifestResponse + 19, // [19:20] is the sub-list for method output_type + 18, // [18:19] is the sub-list for method input_type + 18, // [18:18] is the sub-list for extension type_name + 18, // [18:18] is the sub-list for extension extendee + 0, // [0:18] is the sub-list for field type_name } func init() { file_host_composition_v1_composition_proto_init() } @@ -997,7 +1089,7 @@ func file_host_composition_v1_composition_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_host_composition_v1_composition_proto_rawDesc), len(file_host_composition_v1_composition_proto_rawDesc)), NumEnums: 0, - NumMessages: 11, + NumMessages: 12, NumExtensions: 0, NumServices: 1, }, diff --git a/libraries/authority-client/go/gen/host/installation/v1/installation.pb.go b/libraries/authority-client/go/gen/host/installation/v1/installation.pb.go index dcf393d2..dbe63858 100644 --- a/libraries/authority-client/go/gen/host/installation/v1/installation.pb.go +++ b/libraries/authority-client/go/gen/host/installation/v1/installation.pb.go @@ -1229,8 +1229,10 @@ type ReviewedOffer struct { // Exact declared viewer-edge presence, covered by the reviewed digest. // Required access and per-module approval are separate host review concerns. EdgeDependencies []*OfferDependency `protobuf:"bytes,8,rep,name=edge_dependencies,json=edgeDependencies,proto3" json:"edge_dependencies,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + // Temporary installation-confined grants, not standing roles. + Setup []*OfferSetup `protobuf:"bytes,9,rep,name=setup,proto3" json:"setup,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *ReviewedOffer) Reset() { @@ -1319,6 +1321,86 @@ func (x *ReviewedOffer) GetEdgeDependencies() []*OfferDependency { return nil } +func (x *ReviewedOffer) GetSetup() []*OfferSetup { + if x != nil { + return x.Setup + } + return nil +} + +// OfferSetup explains the exact authority usable only while setup is pending. +type OfferSetup struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The declared binding. + Binding string `protobuf:"bytes,1,opt,name=binding,proto3" json:"binding,omitempty"` + // The destination principal. + Module string `protobuf:"bytes,2,opt,name=module,proto3" json:"module,omitempty"` + // The exact allowed methods, even if other methods share their scopes. + Methods []string `protobuf:"bytes,3,rep,name=methods,proto3" json:"methods,omitempty"` + // Requirements, always confined to the pending installation's owner. + Scopes []*OfferScope `protobuf:"bytes,4,rep,name=scopes,proto3" json:"scopes,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *OfferSetup) Reset() { + *x = OfferSetup{} + mi := &file_host_installation_v1_installation_proto_msgTypes[19] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *OfferSetup) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*OfferSetup) ProtoMessage() {} + +func (x *OfferSetup) ProtoReflect() protoreflect.Message { + mi := &file_host_installation_v1_installation_proto_msgTypes[19] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use OfferSetup.ProtoReflect.Descriptor instead. +func (*OfferSetup) Descriptor() ([]byte, []int) { + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{19} +} + +func (x *OfferSetup) GetBinding() string { + if x != nil { + return x.Binding + } + return "" +} + +func (x *OfferSetup) GetModule() string { + if x != nil { + return x.Module + } + return "" +} + +func (x *OfferSetup) GetMethods() []string { + if x != nil { + return x.Methods + } + return nil +} + +func (x *OfferSetup) GetScopes() []*OfferScope { + if x != nil { + return x.Scopes + } + return nil +} + // OfferDependency carries presence only, never scopes or inferred binding ids. // Module is the exact signed principal, resolved by the host to its live target. type OfferDependency struct { @@ -1331,7 +1413,7 @@ type OfferDependency struct { func (x *OfferDependency) Reset() { *x = OfferDependency{} - mi := &file_host_installation_v1_installation_proto_msgTypes[19] + mi := &file_host_installation_v1_installation_proto_msgTypes[20] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1343,7 +1425,7 @@ func (x *OfferDependency) String() string { func (*OfferDependency) ProtoMessage() {} func (x *OfferDependency) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[19] + mi := &file_host_installation_v1_installation_proto_msgTypes[20] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1356,7 +1438,7 @@ func (x *OfferDependency) ProtoReflect() protoreflect.Message { // Deprecated: Use OfferDependency.ProtoReflect.Descriptor instead. func (*OfferDependency) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{19} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{20} } func (x *OfferDependency) GetModule() string { @@ -1386,7 +1468,7 @@ type OfferBinding struct { func (x *OfferBinding) Reset() { *x = OfferBinding{} - mi := &file_host_installation_v1_installation_proto_msgTypes[20] + mi := &file_host_installation_v1_installation_proto_msgTypes[21] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1398,7 +1480,7 @@ func (x *OfferBinding) String() string { func (*OfferBinding) ProtoMessage() {} func (x *OfferBinding) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[20] + mi := &file_host_installation_v1_installation_proto_msgTypes[21] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1411,7 +1493,7 @@ func (x *OfferBinding) ProtoReflect() protoreflect.Message { // Deprecated: Use OfferBinding.ProtoReflect.Descriptor instead. func (*OfferBinding) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{20} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{21} } func (x *OfferBinding) GetBinding() string { @@ -1449,7 +1531,7 @@ type OfferRole struct { func (x *OfferRole) Reset() { *x = OfferRole{} - mi := &file_host_installation_v1_installation_proto_msgTypes[21] + mi := &file_host_installation_v1_installation_proto_msgTypes[22] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1461,7 +1543,7 @@ func (x *OfferRole) String() string { func (*OfferRole) ProtoMessage() {} func (x *OfferRole) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[21] + mi := &file_host_installation_v1_installation_proto_msgTypes[22] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1474,7 +1556,7 @@ func (x *OfferRole) ProtoReflect() protoreflect.Message { // Deprecated: Use OfferRole.ProtoReflect.Descriptor instead. func (*OfferRole) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{21} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{22} } func (x *OfferRole) GetName() string { @@ -1514,7 +1596,7 @@ type OfferScope struct { func (x *OfferScope) Reset() { *x = OfferScope{} - mi := &file_host_installation_v1_installation_proto_msgTypes[22] + mi := &file_host_installation_v1_installation_proto_msgTypes[23] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1526,7 +1608,7 @@ func (x *OfferScope) String() string { func (*OfferScope) ProtoMessage() {} func (x *OfferScope) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[22] + mi := &file_host_installation_v1_installation_proto_msgTypes[23] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1539,7 +1621,7 @@ func (x *OfferScope) ProtoReflect() protoreflect.Message { // Deprecated: Use OfferScope.ProtoReflect.Descriptor instead. func (*OfferScope) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{22} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{23} } func (x *OfferScope) GetResourceKind() string { @@ -1587,7 +1669,7 @@ type OfferCapability struct { func (x *OfferCapability) Reset() { *x = OfferCapability{} - mi := &file_host_installation_v1_installation_proto_msgTypes[23] + mi := &file_host_installation_v1_installation_proto_msgTypes[24] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1599,7 +1681,7 @@ func (x *OfferCapability) String() string { func (*OfferCapability) ProtoMessage() {} func (x *OfferCapability) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[23] + mi := &file_host_installation_v1_installation_proto_msgTypes[24] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1612,7 +1694,7 @@ func (x *OfferCapability) ProtoReflect() protoreflect.Message { // Deprecated: Use OfferCapability.ProtoReflect.Descriptor instead. func (*OfferCapability) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{23} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{24} } func (x *OfferCapability) GetModule() string { @@ -1658,7 +1740,7 @@ type OfferTool struct { func (x *OfferTool) Reset() { *x = OfferTool{} - mi := &file_host_installation_v1_installation_proto_msgTypes[24] + mi := &file_host_installation_v1_installation_proto_msgTypes[25] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1670,7 +1752,7 @@ func (x *OfferTool) String() string { func (*OfferTool) ProtoMessage() {} func (x *OfferTool) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[24] + mi := &file_host_installation_v1_installation_proto_msgTypes[25] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1683,7 +1765,7 @@ func (x *OfferTool) ProtoReflect() protoreflect.Message { // Deprecated: Use OfferTool.ProtoReflect.Descriptor instead. func (*OfferTool) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{24} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{25} } func (x *OfferTool) GetName() string { @@ -1719,7 +1801,7 @@ type ListHeldRequest struct { func (x *ListHeldRequest) Reset() { *x = ListHeldRequest{} - mi := &file_host_installation_v1_installation_proto_msgTypes[25] + mi := &file_host_installation_v1_installation_proto_msgTypes[26] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1731,7 +1813,7 @@ func (x *ListHeldRequest) String() string { func (*ListHeldRequest) ProtoMessage() {} func (x *ListHeldRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[25] + mi := &file_host_installation_v1_installation_proto_msgTypes[26] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1744,7 +1826,7 @@ func (x *ListHeldRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListHeldRequest.ProtoReflect.Descriptor instead. func (*ListHeldRequest) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{25} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{26} } func (x *ListHeldRequest) GetOrganizationId() string { @@ -1766,7 +1848,7 @@ type ListHeldResponse struct { func (x *ListHeldResponse) Reset() { *x = ListHeldResponse{} - mi := &file_host_installation_v1_installation_proto_msgTypes[26] + mi := &file_host_installation_v1_installation_proto_msgTypes[27] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1778,7 +1860,7 @@ func (x *ListHeldResponse) String() string { func (*ListHeldResponse) ProtoMessage() {} func (x *ListHeldResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[26] + mi := &file_host_installation_v1_installation_proto_msgTypes[27] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1791,7 +1873,7 @@ func (x *ListHeldResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListHeldResponse.ProtoReflect.Descriptor instead. func (*ListHeldResponse) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{26} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{27} } func (x *ListHeldResponse) GetInstallations() []*HeldInstallation { @@ -1814,7 +1896,7 @@ type HeldInstallation struct { func (x *HeldInstallation) Reset() { *x = HeldInstallation{} - mi := &file_host_installation_v1_installation_proto_msgTypes[27] + mi := &file_host_installation_v1_installation_proto_msgTypes[28] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1826,7 +1908,7 @@ func (x *HeldInstallation) String() string { func (*HeldInstallation) ProtoMessage() {} func (x *HeldInstallation) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[27] + mi := &file_host_installation_v1_installation_proto_msgTypes[28] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1839,7 +1921,7 @@ func (x *HeldInstallation) ProtoReflect() protoreflect.Message { // Deprecated: Use HeldInstallation.ProtoReflect.Descriptor instead. func (*HeldInstallation) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{27} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{28} } func (x *HeldInstallation) GetInstallation() *Installation { @@ -1939,7 +2021,7 @@ const file_host_installation_v1_installation_proto_rawDesc = "" + "\x06target\x18\x01 \x01(\tR\x06target\x12\x1e\n" + "\n" + "generation\x18\x02 \x01(\x04R\n" + - "generation\"\xcf\x03\n" + + "generation\"\x87\x04\n" + "\rReviewedOffer\x12A\n" + "\bapproval\x18\x01 \x01(\v2%.host.installation.v1.ConsentApprovalR\bapproval\x12\x16\n" + "\x06target\x18\x02 \x01(\tR\x06target\x125\n" + @@ -1948,7 +2030,14 @@ const file_host_installation_v1_installation_proto_rawDesc = "" + "\aceiling\x18\x05 \x03(\v2\".host.installation.v1.OfferBindingR\aceiling\x12%\n" + "\x0etools_composed\x18\x06 \x01(\bR\rtoolsComposed\x12+\n" + "\x11installation_role\x18\a \x01(\tR\x10installationRole\x12R\n" + - "\x11edge_dependencies\x18\b \x03(\v2%.host.installation.v1.OfferDependencyR\x10edgeDependencies\"E\n" + + "\x11edge_dependencies\x18\b \x03(\v2%.host.installation.v1.OfferDependencyR\x10edgeDependencies\x126\n" + + "\x05setup\x18\t \x03(\v2 .host.installation.v1.OfferSetupR\x05setup\"\x92\x01\n" + + "\n" + + "OfferSetup\x12\x18\n" + + "\abinding\x18\x01 \x01(\tR\abinding\x12\x16\n" + + "\x06module\x18\x02 \x01(\tR\x06module\x12\x18\n" + + "\amethods\x18\x03 \x03(\tR\amethods\x128\n" + + "\x06scopes\x18\x04 \x03(\v2 .host.installation.v1.OfferScopeR\x06scopes\"E\n" + "\x0fOfferDependency\x12\x16\n" + "\x06module\x18\x01 \x01(\tR\x06module\x12\x1a\n" + "\bpresence\x18\x02 \x01(\tR\bpresence\"z\n" + @@ -1997,8 +2086,8 @@ const file_host_installation_v1_installation_proto_rawDesc = "" + "\fOfferService\x12_\n" + "\n" + "ListOffers\x12'.host.installation.v1.ListOffersRequest\x1a(.host.installation.v1.ListOffersResponse\x12W\n" + - "\vReviewOffer\x12#.host.installation.v1.ReviewRequest\x1a#.host.installation.v1.ReviewedOfferB\xf7\x01\n" + - "\x18com.host.installation.v1B\x11InstallationProtoP\x01ZVgithub.com/codefly-dev/cli/pkg/builder/clients/api/host/installation/v1;installationv1\xa2\x02\x03HIX\xaa\x02\x14Host.Installation.V1\xca\x02\x14Host\\Installation\\V1\xe2\x02 Host\\Installation\\V1\\GPBMetadata\xea\x02\x16Host::Installation::V1b\x06proto3" + "\vReviewOffer\x12#.host.installation.v1.ReviewRequest\x1a#.host.installation.v1.ReviewedOfferB\xfa\x01\n" + + "\x18com.host.installation.v1B\x11InstallationProtoP\x01ZYgithub.com/codefly-dev/cli/pkg/builder/clients/client/host/installation/v1;installationv1\xa2\x02\x03HIX\xaa\x02\x14Host.Installation.V1\xca\x02\x14Host\\Installation\\V1\xe2\x02 Host\\Installation\\V1\\GPBMetadata\xea\x02\x16Host::Installation::V1b\x06proto3" var ( file_host_installation_v1_installation_proto_rawDescOnce sync.Once @@ -2013,7 +2102,7 @@ func file_host_installation_v1_installation_proto_rawDescGZIP() []byte { } var file_host_installation_v1_installation_proto_enumTypes = make([]protoimpl.EnumInfo, 1) -var file_host_installation_v1_installation_proto_msgTypes = make([]protoimpl.MessageInfo, 28) +var file_host_installation_v1_installation_proto_msgTypes = make([]protoimpl.MessageInfo, 29) var file_host_installation_v1_installation_proto_goTypes = []any{ (Installation_Status)(0), // 0: host.installation.v1.Installation.Status (*CurrentInstallationRequest)(nil), // 1: host.installation.v1.CurrentInstallationRequest @@ -2035,15 +2124,16 @@ var file_host_installation_v1_installation_proto_goTypes = []any{ (*ListOffersResponse)(nil), // 17: host.installation.v1.ListOffersResponse (*Offer)(nil), // 18: host.installation.v1.Offer (*ReviewedOffer)(nil), // 19: host.installation.v1.ReviewedOffer - (*OfferDependency)(nil), // 20: host.installation.v1.OfferDependency - (*OfferBinding)(nil), // 21: host.installation.v1.OfferBinding - (*OfferRole)(nil), // 22: host.installation.v1.OfferRole - (*OfferScope)(nil), // 23: host.installation.v1.OfferScope - (*OfferCapability)(nil), // 24: host.installation.v1.OfferCapability - (*OfferTool)(nil), // 25: host.installation.v1.OfferTool - (*ListHeldRequest)(nil), // 26: host.installation.v1.ListHeldRequest - (*ListHeldResponse)(nil), // 27: host.installation.v1.ListHeldResponse - (*HeldInstallation)(nil), // 28: host.installation.v1.HeldInstallation + (*OfferSetup)(nil), // 20: host.installation.v1.OfferSetup + (*OfferDependency)(nil), // 21: host.installation.v1.OfferDependency + (*OfferBinding)(nil), // 22: host.installation.v1.OfferBinding + (*OfferRole)(nil), // 23: host.installation.v1.OfferRole + (*OfferScope)(nil), // 24: host.installation.v1.OfferScope + (*OfferCapability)(nil), // 25: host.installation.v1.OfferCapability + (*OfferTool)(nil), // 26: host.installation.v1.OfferTool + (*ListHeldRequest)(nil), // 27: host.installation.v1.ListHeldRequest + (*ListHeldResponse)(nil), // 28: host.installation.v1.ListHeldResponse + (*HeldInstallation)(nil), // 29: host.installation.v1.HeldInstallation } var file_host_installation_v1_installation_proto_depIdxs = []int32{ 5, // 0: host.installation.v1.InstallRequest.approval:type_name -> host.installation.v1.ConsentApproval @@ -2053,44 +2143,46 @@ var file_host_installation_v1_installation_proto_depIdxs = []int32{ 13, // 4: host.installation.v1.InstallationNotice.installation:type_name -> host.installation.v1.Installation 18, // 5: host.installation.v1.ListOffersResponse.offers:type_name -> host.installation.v1.Offer 5, // 6: host.installation.v1.ReviewedOffer.approval:type_name -> host.installation.v1.ConsentApproval - 22, // 7: host.installation.v1.ReviewedOffer.roles:type_name -> host.installation.v1.OfferRole + 23, // 7: host.installation.v1.ReviewedOffer.roles:type_name -> host.installation.v1.OfferRole 13, // 8: host.installation.v1.ReviewedOffer.installation:type_name -> host.installation.v1.Installation - 21, // 9: host.installation.v1.ReviewedOffer.ceiling:type_name -> host.installation.v1.OfferBinding - 20, // 10: host.installation.v1.ReviewedOffer.edge_dependencies:type_name -> host.installation.v1.OfferDependency - 23, // 11: host.installation.v1.OfferBinding.scopes:type_name -> host.installation.v1.OfferScope - 23, // 12: host.installation.v1.OfferRole.scopes:type_name -> host.installation.v1.OfferScope - 24, // 13: host.installation.v1.OfferRole.capabilities:type_name -> host.installation.v1.OfferCapability - 23, // 14: host.installation.v1.OfferCapability.requires:type_name -> host.installation.v1.OfferScope - 25, // 15: host.installation.v1.OfferCapability.tools:type_name -> host.installation.v1.OfferTool - 28, // 16: host.installation.v1.ListHeldResponse.installations:type_name -> host.installation.v1.HeldInstallation - 13, // 17: host.installation.v1.HeldInstallation.installation:type_name -> host.installation.v1.Installation - 1, // 18: host.installation.v1.InstallationService.Current:input_type -> host.installation.v1.CurrentInstallationRequest - 3, // 19: host.installation.v1.InstallationService.Install:input_type -> host.installation.v1.InstallRequest - 4, // 20: host.installation.v1.InstallationService.Review:input_type -> host.installation.v1.ReviewRequest - 6, // 21: host.installation.v1.InstallationService.GrantRole:input_type -> host.installation.v1.GrantRoleRequest - 7, // 22: host.installation.v1.InstallationService.RevokeRole:input_type -> host.installation.v1.RevokeRoleRequest - 8, // 23: host.installation.v1.InstallationService.ListRoleGrants:input_type -> host.installation.v1.ListRoleGrantsRequest - 11, // 24: host.installation.v1.InstallationService.List:input_type -> host.installation.v1.ListRequest - 26, // 25: host.installation.v1.InstallationService.ListHeld:input_type -> host.installation.v1.ListHeldRequest - 14, // 26: host.installation.v1.InstallableService.Install:input_type -> host.installation.v1.InstallationNotice - 16, // 27: host.installation.v1.OfferService.ListOffers:input_type -> host.installation.v1.ListOffersRequest - 4, // 28: host.installation.v1.OfferService.ReviewOffer:input_type -> host.installation.v1.ReviewRequest - 2, // 29: host.installation.v1.InstallationService.Current:output_type -> host.installation.v1.CurrentInstallation - 13, // 30: host.installation.v1.InstallationService.Install:output_type -> host.installation.v1.Installation - 5, // 31: host.installation.v1.InstallationService.Review:output_type -> host.installation.v1.ConsentApproval - 13, // 32: host.installation.v1.InstallationService.GrantRole:output_type -> host.installation.v1.Installation - 13, // 33: host.installation.v1.InstallationService.RevokeRole:output_type -> host.installation.v1.Installation - 9, // 34: host.installation.v1.InstallationService.ListRoleGrants:output_type -> host.installation.v1.ListRoleGrantsResponse - 12, // 35: host.installation.v1.InstallationService.List:output_type -> host.installation.v1.ListResponse - 27, // 36: host.installation.v1.InstallationService.ListHeld:output_type -> host.installation.v1.ListHeldResponse - 15, // 37: host.installation.v1.InstallableService.Install:output_type -> host.installation.v1.InstallationAck - 17, // 38: host.installation.v1.OfferService.ListOffers:output_type -> host.installation.v1.ListOffersResponse - 19, // 39: host.installation.v1.OfferService.ReviewOffer:output_type -> host.installation.v1.ReviewedOffer - 29, // [29:40] is the sub-list for method output_type - 18, // [18:29] is the sub-list for method input_type - 18, // [18:18] is the sub-list for extension type_name - 18, // [18:18] is the sub-list for extension extendee - 0, // [0:18] is the sub-list for field type_name + 22, // 9: host.installation.v1.ReviewedOffer.ceiling:type_name -> host.installation.v1.OfferBinding + 21, // 10: host.installation.v1.ReviewedOffer.edge_dependencies:type_name -> host.installation.v1.OfferDependency + 20, // 11: host.installation.v1.ReviewedOffer.setup:type_name -> host.installation.v1.OfferSetup + 24, // 12: host.installation.v1.OfferSetup.scopes:type_name -> host.installation.v1.OfferScope + 24, // 13: host.installation.v1.OfferBinding.scopes:type_name -> host.installation.v1.OfferScope + 24, // 14: host.installation.v1.OfferRole.scopes:type_name -> host.installation.v1.OfferScope + 25, // 15: host.installation.v1.OfferRole.capabilities:type_name -> host.installation.v1.OfferCapability + 24, // 16: host.installation.v1.OfferCapability.requires:type_name -> host.installation.v1.OfferScope + 26, // 17: host.installation.v1.OfferCapability.tools:type_name -> host.installation.v1.OfferTool + 29, // 18: host.installation.v1.ListHeldResponse.installations:type_name -> host.installation.v1.HeldInstallation + 13, // 19: host.installation.v1.HeldInstallation.installation:type_name -> host.installation.v1.Installation + 1, // 20: host.installation.v1.InstallationService.Current:input_type -> host.installation.v1.CurrentInstallationRequest + 3, // 21: host.installation.v1.InstallationService.Install:input_type -> host.installation.v1.InstallRequest + 4, // 22: host.installation.v1.InstallationService.Review:input_type -> host.installation.v1.ReviewRequest + 6, // 23: host.installation.v1.InstallationService.GrantRole:input_type -> host.installation.v1.GrantRoleRequest + 7, // 24: host.installation.v1.InstallationService.RevokeRole:input_type -> host.installation.v1.RevokeRoleRequest + 8, // 25: host.installation.v1.InstallationService.ListRoleGrants:input_type -> host.installation.v1.ListRoleGrantsRequest + 11, // 26: host.installation.v1.InstallationService.List:input_type -> host.installation.v1.ListRequest + 27, // 27: host.installation.v1.InstallationService.ListHeld:input_type -> host.installation.v1.ListHeldRequest + 14, // 28: host.installation.v1.InstallableService.Install:input_type -> host.installation.v1.InstallationNotice + 16, // 29: host.installation.v1.OfferService.ListOffers:input_type -> host.installation.v1.ListOffersRequest + 4, // 30: host.installation.v1.OfferService.ReviewOffer:input_type -> host.installation.v1.ReviewRequest + 2, // 31: host.installation.v1.InstallationService.Current:output_type -> host.installation.v1.CurrentInstallation + 13, // 32: host.installation.v1.InstallationService.Install:output_type -> host.installation.v1.Installation + 5, // 33: host.installation.v1.InstallationService.Review:output_type -> host.installation.v1.ConsentApproval + 13, // 34: host.installation.v1.InstallationService.GrantRole:output_type -> host.installation.v1.Installation + 13, // 35: host.installation.v1.InstallationService.RevokeRole:output_type -> host.installation.v1.Installation + 9, // 36: host.installation.v1.InstallationService.ListRoleGrants:output_type -> host.installation.v1.ListRoleGrantsResponse + 12, // 37: host.installation.v1.InstallationService.List:output_type -> host.installation.v1.ListResponse + 28, // 38: host.installation.v1.InstallationService.ListHeld:output_type -> host.installation.v1.ListHeldResponse + 15, // 39: host.installation.v1.InstallableService.Install:output_type -> host.installation.v1.InstallationAck + 17, // 40: host.installation.v1.OfferService.ListOffers:output_type -> host.installation.v1.ListOffersResponse + 19, // 41: host.installation.v1.OfferService.ReviewOffer:output_type -> host.installation.v1.ReviewedOffer + 31, // [31:42] is the sub-list for method output_type + 20, // [20:31] is the sub-list for method input_type + 20, // [20:20] is the sub-list for extension type_name + 20, // [20:20] is the sub-list for extension extendee + 0, // [0:20] is the sub-list for field type_name } func init() { file_host_installation_v1_installation_proto_init() } @@ -2104,7 +2196,7 @@ func file_host_installation_v1_installation_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_host_installation_v1_installation_proto_rawDesc), len(file_host_installation_v1_installation_proto_rawDesc)), NumEnums: 1, - NumMessages: 28, + NumMessages: 29, NumExtensions: 0, NumServices: 3, }, diff --git a/libraries/authority-client/go/gen/host/session/v1/session.pb.go b/libraries/authority-client/go/gen/host/session/v1/session.pb.go index e556a5da..9d2af86d 100644 --- a/libraries/authority-client/go/gen/host/session/v1/session.pb.go +++ b/libraries/authority-client/go/gen/host/session/v1/session.pb.go @@ -438,8 +438,8 @@ const file_host_session_v1_session_proto_rawDesc = "" + "\x0eSessionService\x12b\n" + "\x06SignIn\x12\x1e.host.session.v1.SignInRequest\x1a\x18.host.session.v1.Session\"\x1e\x82\xd3\xe4\x93\x02\x18:\x01*\"\x13/v1/session:sign-in\x12Y\n" + "\aCurrent\x12\x1f.host.session.v1.CurrentRequest\x1a\x18.host.session.v1.Session\"\x13\x82\xd3\xe4\x93\x02\r\x12\v/v1/session\x12\x8e\x01\n" + - "\x11ListFixturePeople\x12).host.session.v1.ListFixturePeopleRequest\x1a*.host.session.v1.ListFixturePeopleResponse\"\"\x82\xd3\xe4\x93\x02\x1c\x12\x1a/v1/session/fixture-peopleB\xcf\x01\n" + - "\x13com.host.session.v1B\fSessionProtoP\x01ZLgithub.com/codefly-dev/cli/pkg/builder/clients/api/host/session/v1;sessionv1\xa2\x02\x03HSX\xaa\x02\x0fHost.Session.V1\xca\x02\x0fHost\\Session\\V1\xe2\x02\x1bHost\\Session\\V1\\GPBMetadata\xea\x02\x11Host::Session::V1b\x06proto3" + "\x11ListFixturePeople\x12).host.session.v1.ListFixturePeopleRequest\x1a*.host.session.v1.ListFixturePeopleResponse\"\"\x82\xd3\xe4\x93\x02\x1c\x12\x1a/v1/session/fixture-peopleB\xd2\x01\n" + + "\x13com.host.session.v1B\fSessionProtoP\x01ZOgithub.com/codefly-dev/cli/pkg/builder/clients/client/host/session/v1;sessionv1\xa2\x02\x03HSX\xaa\x02\x0fHost.Session.V1\xca\x02\x0fHost\\Session\\V1\xe2\x02\x1bHost\\Session\\V1\\GPBMetadata\xea\x02\x11Host::Session::V1b\x06proto3" var ( file_host_session_v1_session_proto_rawDescOnce sync.Once diff --git a/libraries/authority-client/library.codefly.yaml b/libraries/authority-client/library.codefly.yaml index 0dfd3dcb..d56e9c03 100644 --- a/libraries/authority-client/library.codefly.yaml +++ b/libraries/authority-client/library.codefly.yaml @@ -20,7 +20,7 @@ sources: module: authority service: local endpoint: grpc - contract-digest: sha256:b49a5399e647c61b1991fc22bf7fcf8262ab17333dbe01b4afd1d16c346f3ea7 + contract-digest: sha256:80609f1725aa77b4db0b9f8e7ad922a8fabbbde191847b26fc6f6da49b3adc14 services: - LocalService - ArtifactService @@ -29,8 +29,7 @@ sources: - InstallationService - OfferService - SessionService - as: api generated-by: - codefly: 0.1.221 + codefly: development companion: ghcr.io/codefly-dev/proto:0.0.18 facade: false diff --git a/libraries/authority-client/python/authority_client/_gen/host/authority/v1/authority_pb2.py b/libraries/authority-client/python/authority_client/_gen/host/authority/v1/authority_pb2.py index 8a541d9e..6d823809 100644 --- a/libraries/authority-client/python/authority_client/_gen/host/authority/v1/authority_pb2.py +++ b/libraries/authority-client/python/authority_client/_gen/host/authority/v1/authority_pb2.py @@ -25,7 +25,7 @@ from authority_client._gen.host.authority.v1 import work_context_pb2 as host_dot_authority_dot_v1_dot_work__context__pb2 -DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n!host/authority/v1/authority.proto\x12\x11host.authority.v1\x1a$host/authority/v1/work_context.proto\"\xf3\x04\n\x0cIssueRequest\x12:\n\x06person\x18\x01 \x01(\x0b\x32 .host.authority.v1.PersonSessionH\x00R\x06person\x12\x43\n\x08workload\x18\x02 \x01(\x0b\x32%.host.authority.v1.WorkloadCredentialH\x00R\x08workload\x12H\n\x0cinstallation\x18\x03 \x01(\x0b\x32\".host.authority.v1.InstallationRefH\x00R\x0cinstallation\x12#\n\x0cparent_token\x18\x04 \x01(\tH\x00R\x0bparentToken\x12\x42\n\ndelegation\x18\x0b \x01(\x0b\x32 .host.authority.v1.DelegationRefH\x00R\ndelegation\x12\x1a\n\x08\x61udience\x18\x05 \x01(\tR\x08\x61udience\x12\x36\n\x06scopes\x18\x06 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\x06scopes\x12\x1f\n\x0bttl_seconds\x18\x07 \x01(\x03R\nttlSeconds\x12\x30\n\x14operation_binding_id\x18\x08 \x01(\tR\x12operationBindingId\x12\'\n\x0forganization_id\x18\t \x01(\tR\x0eorganizationId\x12;\n\x05\x61\x63tor\x18\n \x01(\x0b\x32%.host.authority.v1.WorkloadCredentialR\x05\x61\x63tor\x12\x1c\n\toperation\x18\x0c \x01(\tR\toperationB\x04\n\x02\x61s\"4\n\rDelegationRef\x12#\n\rdelegation_id\x18\x01 \x01(\tR\x0c\x64\x65legationId\"\x9c\x01\n\x0f\x44\x65legateRequest\x12\x16\n\x06module\x18\x01 \x01(\tR\x06module\x12\x36\n\x06scopes\x18\x02 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\x06scopes\x12\x18\n\x07purpose\x18\x03 \x01(\tR\x07purpose\x12\x1f\n\x0bttl_seconds\x18\x04 \x01(\x03R\nttlSeconds\"\x9e\x02\n\nDelegation\x12#\n\rdelegation_id\x18\x01 \x01(\tR\x0c\x64\x65legationId\x12\'\n\x0forganization_id\x18\x02 \x01(\tR\x0eorganizationId\x12\x18\n\x07grantor\x18\x03 \x01(\tR\x07grantor\x12\x16\n\x06module\x18\x04 \x01(\tR\x06module\x12\x36\n\x06scopes\x18\x05 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\x06scopes\x12\x18\n\x07purpose\x18\x06 \x01(\tR\x07purpose\x12\x16\n\x06\x61\x63tive\x18\x07 \x01(\x08R\x06\x61\x63tive\x12&\n\x0f\x65xpires_at_unix\x18\x08 \x01(\x03R\rexpiresAtUnix\"x\n\x14GetDelegationRequest\x12#\n\rdelegation_id\x18\x01 \x01(\tR\x0c\x64\x65legationId\x12;\n\x05\x61\x63tor\x18\x02 \x01(\x0b\x32%.host.authority.v1.WorkloadCredentialR\x05\x61\x63tor\">\n\x17RevokeDelegationRequest\x12#\n\rdelegation_id\x18\x01 \x01(\tR\x0c\x64\x65legationId\"Y\n\x18RevokeDelegationResponse\x12=\n\ndelegation\x18\x01 \x01(\x0b\x32\x1d.host.authority.v1.DelegationR\ndelegation\"!\n\rPersonSessionJ\x04\x08\x01\x10\x02R\nsession_id\"4\n\x12WorkloadCredential\x12\x1e\n\ncredential\x18\x01 \x01(\tR\ncredential\":\n\x0fInstallationRef\x12\'\n\x0finstallation_id\x18\x01 \x01(\tR\x0einstallationId\"\x89\x01\n\rIssueResponse\x12\x14\n\x05token\x18\x01 \x01(\tR\x05token\x12&\n\x0f\x65xpires_at_unix\x18\x02 \x01(\x03R\rexpiresAtUnix\x12:\n\x07\x63ontext\x18\x03 \x01(\x0b\x32 .host.authority.v1.WorkContextV1R\x07\x63ontext\"t\n\x0c\x43heckRequest\x12\x14\n\x05token\x18\x01 \x01(\tR\x05token\x12\x1a\n\x08\x61udience\x18\x02 \x01(\tR\x08\x61udience\x12\x16\n\x06method\x18\x03 \x01(\tR\x06method\x12\x1a\n\x08\x61\x64visory\x18\x04 \x01(\x08R\x08\x61\x64visory\"\x9c\x01\n\rCheckResponse\x12:\n\x07\x63ontext\x18\x01 \x01(\x0b\x32 .host.authority.v1.WorkContextV1R\x07\x63ontext\x12\x35\n\x16\x61uthorization_revision\x18\x02 \x01(\x04R\x15\x61uthorizationRevision\x12\x18\n\x07refusal\x18\x03 \x01(\tR\x07refusal\"\r\n\x0bKeysRequest\"\x9d\x01\n\x0cKeysResponse\x12\x16\n\x06issuer\x18\x01 \x01(\tR\x06issuer\x12\x30\n\x04keys\x18\x02 \x03(\x0b\x32\x1c.host.authority.v1.PublicKeyR\x04keys\x12\x43\n\x0e\x61\x64mission_keys\x18\x03 \x03(\x0b\x32\x1c.host.authority.v1.PublicKeyR\radmissionKeys\"y\n\tPublicKey\x12\x15\n\x06key_id\x18\x01 \x01(\tR\x05keyId\x12\x1c\n\talgorithm\x18\x02 \x01(\tR\talgorithm\x12\x1d\n\npublic_key\x18\x03 \x01(\x0cR\tpublicKey\x12\x18\n\x07purpose\x18\x04 \x01(\tR\x07purpose\"\x8f\x01\n\x1bRegisterAdmissionKeyRequest\x12;\n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32%.host.authority.v1.WorkloadCredentialR\x05\x61\x63tor\x12\x1d\n\npublic_key\x18\x02 \x01(\x0cR\tpublicKey\x12\x14\n\x05proof\x18\x03 \x01(\tR\x05proof\"v\n\x1cRegisterAdmissionKeyResponse\x12.\n\x03key\x18\x01 \x01(\x0b\x32\x1c.host.authority.v1.PublicKeyR\x03key\x12&\n\x0f\x65xpires_at_unix\x18\x02 \x01(\x03R\rexpiresAtUnix\"\x85\x01\n\x14ListResourcesRequest\x12\x14\n\x05token\x18\x01 \x01(\tR\x05token\x12\x1a\n\x08\x61udience\x18\x02 \x01(\tR\x08\x61udience\x12#\n\rresource_kind\x18\x03 \x01(\tR\x0cresourceKind\x12\x16\n\x06\x61\x63tion\x18\x04 \x01(\tR\x06\x61\x63tion\"Q\n\x15ListResourcesResponse\x12\x38\n\x06grants\x18\x01 \x03(\x0b\x32 .host.authority.v1.ResourceGrantR\x06grants\"\xb0\x01\n\x15\x41ttachResourceRequest\x12\x14\n\x05token\x18\x01 \x01(\tR\x05token\x12;\n\x05\x61\x63tor\x18\x02 \x01(\x0b\x32%.host.authority.v1.WorkloadCredentialR\x05\x61\x63tor\x12#\n\rresource_kind\x18\x03 \x01(\tR\x0cresourceKind\x12\x1f\n\x0bresource_id\x18\x04 \x01(\tR\nresourceId\"A\n\x16\x41ttachResourceResponse\x12\'\n\x0finstallation_id\x18\x01 \x01(\tR\x0einstallationId\"\xc3\x01\n\x15\x44\x65tachResourceRequest\x12;\n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32%.host.authority.v1.WorkloadCredentialR\x05\x61\x63tor\x12\'\n\x0forganization_id\x18\x02 \x01(\tR\x0eorganizationId\x12#\n\rresource_kind\x18\x03 \x01(\tR\x0cresourceKind\x12\x1f\n\x0bresource_id\x18\x04 \x01(\tR\nresourceId\"A\n\x16\x44\x65tachResourceResponse\x12\'\n\x0finstallation_id\x18\x01 \x01(\tR\x0einstallationId\"\xff\x01\n\x18\x41uthorizeTransferRequest\x12\x14\n\x05token\x18\x01 \x01(\tR\x05token\x12;\n\x05\x61\x63tor\x18\x02 \x01(\x0b\x32%.host.authority.v1.WorkloadCredentialR\x05\x61\x63tor\x12#\n\rresource_kind\x18\x03 \x01(\tR\x0cresourceKind\x12\x1f\n\x0bresource_id\x18\x04 \x01(\tR\nresourceId\x12\"\n\rfrom_owner_id\x18\x05 \x01(\tR\x0b\x66romOwnerId\x12&\n\x0fto_principal_id\x18\x06 \x01(\tR\rtoPrincipalId\"c\n\x19\x41uthorizeTransferResponse\x12!\n\x0cprincipal_id\x18\x01 \x01(\tR\x0bprincipalId\x12#\n\rauthorized_by\x18\x02 \x01(\tR\x0c\x61uthorizedBy\"\xa0\x01\n\rResourceGrant\x12\x12\n\x03\x61ll\x18\x01 \x01(\x08H\x00R\x03\x61ll\x12\x10\n\x02id\x18\x02 \x01(\tH\x00R\x02id\x12\x18\n\x06prefix\x18\x03 \x01(\tH\x00R\x06prefix\x12\x1a\n\x07pattern\x18\x04 \x01(\tH\x00R\x07pattern\x12*\n\x11resource_owner_id\x18\x05 \x01(\tR\x0fresourceOwnerIdB\x07\n\x05match2\xa3\x08\n\x10\x41uthorityService\x12J\n\x05Issue\x12\x1f.host.authority.v1.IssueRequest\x1a .host.authority.v1.IssueResponse\x12J\n\x05\x43heck\x12\x1f.host.authority.v1.CheckRequest\x1a .host.authority.v1.CheckResponse\x12G\n\x04Keys\x12\x1e.host.authority.v1.KeysRequest\x1a\x1f.host.authority.v1.KeysResponse\x12w\n\x14RegisterAdmissionKey\x12..host.authority.v1.RegisterAdmissionKeyRequest\x1a/.host.authority.v1.RegisterAdmissionKeyResponse\x12\x62\n\rListResources\x12\'.host.authority.v1.ListResourcesRequest\x1a(.host.authority.v1.ListResourcesResponse\x12\x65\n\x0e\x41ttachResource\x12(.host.authority.v1.AttachResourceRequest\x1a).host.authority.v1.AttachResourceResponse\x12\x65\n\x0e\x44\x65tachResource\x12(.host.authority.v1.DetachResourceRequest\x1a).host.authority.v1.DetachResourceResponse\x12n\n\x11\x41uthorizeTransfer\x12+.host.authority.v1.AuthorizeTransferRequest\x1a,.host.authority.v1.AuthorizeTransferResponse\x12M\n\x08\x44\x65legate\x12\".host.authority.v1.DelegateRequest\x1a\x1d.host.authority.v1.Delegation\x12k\n\x10RevokeDelegation\x12*.host.authority.v1.RevokeDelegationRequest\x1a+.host.authority.v1.RevokeDelegationResponse\x12W\n\rGetDelegation\x12\'.host.authority.v1.GetDelegationRequest\x1a\x1d.host.authority.v1.DelegationB/Z-gateway/pkg/gen/host/authority/v1;authorityv1b\x06proto3') +DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n!host/authority/v1/authority.proto\x12\x11host.authority.v1\x1a$host/authority/v1/work_context.proto\"\xb4\x05\n\x0cIssueRequest\x12:\n\x06person\x18\x01 \x01(\x0b\x32 .host.authority.v1.PersonSessionH\x00R\x06person\x12\x43\n\x08workload\x18\x02 \x01(\x0b\x32%.host.authority.v1.WorkloadCredentialH\x00R\x08workload\x12H\n\x0cinstallation\x18\x03 \x01(\x0b\x32\".host.authority.v1.InstallationRefH\x00R\x0cinstallation\x12#\n\x0cparent_token\x18\x04 \x01(\tH\x00R\x0bparentToken\x12\x42\n\ndelegation\x18\x0b \x01(\x0b\x32 .host.authority.v1.DelegationRefH\x00R\ndelegation\x12?\n\x05setup\x18\r \x01(\x0b\x32\'.host.authority.v1.InstallationSetupRefH\x00R\x05setup\x12\x1a\n\x08\x61udience\x18\x05 \x01(\tR\x08\x61udience\x12\x36\n\x06scopes\x18\x06 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\x06scopes\x12\x1f\n\x0bttl_seconds\x18\x07 \x01(\x03R\nttlSeconds\x12\x30\n\x14operation_binding_id\x18\x08 \x01(\tR\x12operationBindingId\x12\'\n\x0forganization_id\x18\t \x01(\tR\x0eorganizationId\x12;\n\x05\x61\x63tor\x18\n \x01(\x0b\x32%.host.authority.v1.WorkloadCredentialR\x05\x61\x63tor\x12\x1c\n\toperation\x18\x0c \x01(\tR\toperationB\x04\n\x02\x61s\"M\n\x14InstallationSetupRef\x12\x1d\n\nstep_token\x18\x01 \x01(\tR\tstepToken\x12\x16\n\x06method\x18\x02 \x01(\tR\x06method\"4\n\rDelegationRef\x12#\n\rdelegation_id\x18\x01 \x01(\tR\x0c\x64\x65legationId\"\x9c\x01\n\x0f\x44\x65legateRequest\x12\x16\n\x06module\x18\x01 \x01(\tR\x06module\x12\x36\n\x06scopes\x18\x02 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\x06scopes\x12\x18\n\x07purpose\x18\x03 \x01(\tR\x07purpose\x12\x1f\n\x0bttl_seconds\x18\x04 \x01(\x03R\nttlSeconds\"\x9e\x02\n\nDelegation\x12#\n\rdelegation_id\x18\x01 \x01(\tR\x0c\x64\x65legationId\x12\'\n\x0forganization_id\x18\x02 \x01(\tR\x0eorganizationId\x12\x18\n\x07grantor\x18\x03 \x01(\tR\x07grantor\x12\x16\n\x06module\x18\x04 \x01(\tR\x06module\x12\x36\n\x06scopes\x18\x05 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\x06scopes\x12\x18\n\x07purpose\x18\x06 \x01(\tR\x07purpose\x12\x16\n\x06\x61\x63tive\x18\x07 \x01(\x08R\x06\x61\x63tive\x12&\n\x0f\x65xpires_at_unix\x18\x08 \x01(\x03R\rexpiresAtUnix\"x\n\x14GetDelegationRequest\x12#\n\rdelegation_id\x18\x01 \x01(\tR\x0c\x64\x65legationId\x12;\n\x05\x61\x63tor\x18\x02 \x01(\x0b\x32%.host.authority.v1.WorkloadCredentialR\x05\x61\x63tor\">\n\x17RevokeDelegationRequest\x12#\n\rdelegation_id\x18\x01 \x01(\tR\x0c\x64\x65legationId\"Y\n\x18RevokeDelegationResponse\x12=\n\ndelegation\x18\x01 \x01(\x0b\x32\x1d.host.authority.v1.DelegationR\ndelegation\"!\n\rPersonSessionJ\x04\x08\x01\x10\x02R\nsession_id\"4\n\x12WorkloadCredential\x12\x1e\n\ncredential\x18\x01 \x01(\tR\ncredential\":\n\x0fInstallationRef\x12\'\n\x0finstallation_id\x18\x01 \x01(\tR\x0einstallationId\"\x89\x01\n\rIssueResponse\x12\x14\n\x05token\x18\x01 \x01(\tR\x05token\x12&\n\x0f\x65xpires_at_unix\x18\x02 \x01(\x03R\rexpiresAtUnix\x12:\n\x07\x63ontext\x18\x03 \x01(\x0b\x32 .host.authority.v1.WorkContextV1R\x07\x63ontext\"t\n\x0c\x43heckRequest\x12\x14\n\x05token\x18\x01 \x01(\tR\x05token\x12\x1a\n\x08\x61udience\x18\x02 \x01(\tR\x08\x61udience\x12\x16\n\x06method\x18\x03 \x01(\tR\x06method\x12\x1a\n\x08\x61\x64visory\x18\x04 \x01(\x08R\x08\x61\x64visory\"\x9c\x01\n\rCheckResponse\x12:\n\x07\x63ontext\x18\x01 \x01(\x0b\x32 .host.authority.v1.WorkContextV1R\x07\x63ontext\x12\x35\n\x16\x61uthorization_revision\x18\x02 \x01(\x04R\x15\x61uthorizationRevision\x12\x18\n\x07refusal\x18\x03 \x01(\tR\x07refusal\"\r\n\x0bKeysRequest\"\x9d\x01\n\x0cKeysResponse\x12\x16\n\x06issuer\x18\x01 \x01(\tR\x06issuer\x12\x30\n\x04keys\x18\x02 \x03(\x0b\x32\x1c.host.authority.v1.PublicKeyR\x04keys\x12\x43\n\x0e\x61\x64mission_keys\x18\x03 \x03(\x0b\x32\x1c.host.authority.v1.PublicKeyR\radmissionKeys\"y\n\tPublicKey\x12\x15\n\x06key_id\x18\x01 \x01(\tR\x05keyId\x12\x1c\n\talgorithm\x18\x02 \x01(\tR\talgorithm\x12\x1d\n\npublic_key\x18\x03 \x01(\x0cR\tpublicKey\x12\x18\n\x07purpose\x18\x04 \x01(\tR\x07purpose\"\x8f\x01\n\x1bRegisterAdmissionKeyRequest\x12;\n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32%.host.authority.v1.WorkloadCredentialR\x05\x61\x63tor\x12\x1d\n\npublic_key\x18\x02 \x01(\x0cR\tpublicKey\x12\x14\n\x05proof\x18\x03 \x01(\tR\x05proof\"v\n\x1cRegisterAdmissionKeyResponse\x12.\n\x03key\x18\x01 \x01(\x0b\x32\x1c.host.authority.v1.PublicKeyR\x03key\x12&\n\x0f\x65xpires_at_unix\x18\x02 \x01(\x03R\rexpiresAtUnix\"\x85\x01\n\x14ListResourcesRequest\x12\x14\n\x05token\x18\x01 \x01(\tR\x05token\x12\x1a\n\x08\x61udience\x18\x02 \x01(\tR\x08\x61udience\x12#\n\rresource_kind\x18\x03 \x01(\tR\x0cresourceKind\x12\x16\n\x06\x61\x63tion\x18\x04 \x01(\tR\x06\x61\x63tion\"Q\n\x15ListResourcesResponse\x12\x38\n\x06grants\x18\x01 \x03(\x0b\x32 .host.authority.v1.ResourceGrantR\x06grants\"\xb0\x01\n\x15\x41ttachResourceRequest\x12\x14\n\x05token\x18\x01 \x01(\tR\x05token\x12;\n\x05\x61\x63tor\x18\x02 \x01(\x0b\x32%.host.authority.v1.WorkloadCredentialR\x05\x61\x63tor\x12#\n\rresource_kind\x18\x03 \x01(\tR\x0cresourceKind\x12\x1f\n\x0bresource_id\x18\x04 \x01(\tR\nresourceId\"A\n\x16\x41ttachResourceResponse\x12\'\n\x0finstallation_id\x18\x01 \x01(\tR\x0einstallationId\"\xc3\x01\n\x15\x44\x65tachResourceRequest\x12;\n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32%.host.authority.v1.WorkloadCredentialR\x05\x61\x63tor\x12\'\n\x0forganization_id\x18\x02 \x01(\tR\x0eorganizationId\x12#\n\rresource_kind\x18\x03 \x01(\tR\x0cresourceKind\x12\x1f\n\x0bresource_id\x18\x04 \x01(\tR\nresourceId\"A\n\x16\x44\x65tachResourceResponse\x12\'\n\x0finstallation_id\x18\x01 \x01(\tR\x0einstallationId\"\xff\x01\n\x18\x41uthorizeTransferRequest\x12\x14\n\x05token\x18\x01 \x01(\tR\x05token\x12;\n\x05\x61\x63tor\x18\x02 \x01(\x0b\x32%.host.authority.v1.WorkloadCredentialR\x05\x61\x63tor\x12#\n\rresource_kind\x18\x03 \x01(\tR\x0cresourceKind\x12\x1f\n\x0bresource_id\x18\x04 \x01(\tR\nresourceId\x12\"\n\rfrom_owner_id\x18\x05 \x01(\tR\x0b\x66romOwnerId\x12&\n\x0fto_principal_id\x18\x06 \x01(\tR\rtoPrincipalId\"c\n\x19\x41uthorizeTransferResponse\x12!\n\x0cprincipal_id\x18\x01 \x01(\tR\x0bprincipalId\x12#\n\rauthorized_by\x18\x02 \x01(\tR\x0c\x61uthorizedBy\"\xa0\x01\n\rResourceGrant\x12\x12\n\x03\x61ll\x18\x01 \x01(\x08H\x00R\x03\x61ll\x12\x10\n\x02id\x18\x02 \x01(\tH\x00R\x02id\x12\x18\n\x06prefix\x18\x03 \x01(\tH\x00R\x06prefix\x12\x1a\n\x07pattern\x18\x04 \x01(\tH\x00R\x07pattern\x12*\n\x11resource_owner_id\x18\x05 \x01(\tR\x0fresourceOwnerIdB\x07\n\x05match2\xa3\x08\n\x10\x41uthorityService\x12J\n\x05Issue\x12\x1f.host.authority.v1.IssueRequest\x1a .host.authority.v1.IssueResponse\x12J\n\x05\x43heck\x12\x1f.host.authority.v1.CheckRequest\x1a .host.authority.v1.CheckResponse\x12G\n\x04Keys\x12\x1e.host.authority.v1.KeysRequest\x1a\x1f.host.authority.v1.KeysResponse\x12w\n\x14RegisterAdmissionKey\x12..host.authority.v1.RegisterAdmissionKeyRequest\x1a/.host.authority.v1.RegisterAdmissionKeyResponse\x12\x62\n\rListResources\x12\'.host.authority.v1.ListResourcesRequest\x1a(.host.authority.v1.ListResourcesResponse\x12\x65\n\x0e\x41ttachResource\x12(.host.authority.v1.AttachResourceRequest\x1a).host.authority.v1.AttachResourceResponse\x12\x65\n\x0e\x44\x65tachResource\x12(.host.authority.v1.DetachResourceRequest\x1a).host.authority.v1.DetachResourceResponse\x12n\n\x11\x41uthorizeTransfer\x12+.host.authority.v1.AuthorizeTransferRequest\x1a,.host.authority.v1.AuthorizeTransferResponse\x12M\n\x08\x44\x65legate\x12\".host.authority.v1.DelegateRequest\x1a\x1d.host.authority.v1.Delegation\x12k\n\x10RevokeDelegation\x12*.host.authority.v1.RevokeDelegationRequest\x1a+.host.authority.v1.RevokeDelegationResponse\x12W\n\rGetDelegation\x12\'.host.authority.v1.GetDelegationRequest\x1a\x1d.host.authority.v1.DelegationB/Z-gateway/pkg/gen/host/authority/v1;authorityv1b\x06proto3') _globals = globals() _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals) @@ -34,59 +34,61 @@ _globals['DESCRIPTOR']._loaded_options = None _globals['DESCRIPTOR']._serialized_options = b'Z-gateway/pkg/gen/host/authority/v1;authorityv1' _globals['_ISSUEREQUEST']._serialized_start=95 - _globals['_ISSUEREQUEST']._serialized_end=722 - _globals['_DELEGATIONREF']._serialized_start=724 - _globals['_DELEGATIONREF']._serialized_end=776 - _globals['_DELEGATEREQUEST']._serialized_start=779 - _globals['_DELEGATEREQUEST']._serialized_end=935 - _globals['_DELEGATION']._serialized_start=938 - _globals['_DELEGATION']._serialized_end=1224 - _globals['_GETDELEGATIONREQUEST']._serialized_start=1226 - _globals['_GETDELEGATIONREQUEST']._serialized_end=1346 - _globals['_REVOKEDELEGATIONREQUEST']._serialized_start=1348 - _globals['_REVOKEDELEGATIONREQUEST']._serialized_end=1410 - _globals['_REVOKEDELEGATIONRESPONSE']._serialized_start=1412 - _globals['_REVOKEDELEGATIONRESPONSE']._serialized_end=1501 - _globals['_PERSONSESSION']._serialized_start=1503 - _globals['_PERSONSESSION']._serialized_end=1536 - _globals['_WORKLOADCREDENTIAL']._serialized_start=1538 - _globals['_WORKLOADCREDENTIAL']._serialized_end=1590 - _globals['_INSTALLATIONREF']._serialized_start=1592 - _globals['_INSTALLATIONREF']._serialized_end=1650 - _globals['_ISSUERESPONSE']._serialized_start=1653 - _globals['_ISSUERESPONSE']._serialized_end=1790 - _globals['_CHECKREQUEST']._serialized_start=1792 - _globals['_CHECKREQUEST']._serialized_end=1908 - _globals['_CHECKRESPONSE']._serialized_start=1911 - _globals['_CHECKRESPONSE']._serialized_end=2067 - _globals['_KEYSREQUEST']._serialized_start=2069 - _globals['_KEYSREQUEST']._serialized_end=2082 - _globals['_KEYSRESPONSE']._serialized_start=2085 - _globals['_KEYSRESPONSE']._serialized_end=2242 - _globals['_PUBLICKEY']._serialized_start=2244 - _globals['_PUBLICKEY']._serialized_end=2365 - _globals['_REGISTERADMISSIONKEYREQUEST']._serialized_start=2368 - _globals['_REGISTERADMISSIONKEYREQUEST']._serialized_end=2511 - _globals['_REGISTERADMISSIONKEYRESPONSE']._serialized_start=2513 - _globals['_REGISTERADMISSIONKEYRESPONSE']._serialized_end=2631 - _globals['_LISTRESOURCESREQUEST']._serialized_start=2634 - _globals['_LISTRESOURCESREQUEST']._serialized_end=2767 - _globals['_LISTRESOURCESRESPONSE']._serialized_start=2769 - _globals['_LISTRESOURCESRESPONSE']._serialized_end=2850 - _globals['_ATTACHRESOURCEREQUEST']._serialized_start=2853 - _globals['_ATTACHRESOURCEREQUEST']._serialized_end=3029 - _globals['_ATTACHRESOURCERESPONSE']._serialized_start=3031 - _globals['_ATTACHRESOURCERESPONSE']._serialized_end=3096 - _globals['_DETACHRESOURCEREQUEST']._serialized_start=3099 - _globals['_DETACHRESOURCEREQUEST']._serialized_end=3294 - _globals['_DETACHRESOURCERESPONSE']._serialized_start=3296 - _globals['_DETACHRESOURCERESPONSE']._serialized_end=3361 - _globals['_AUTHORIZETRANSFERREQUEST']._serialized_start=3364 - _globals['_AUTHORIZETRANSFERREQUEST']._serialized_end=3619 - _globals['_AUTHORIZETRANSFERRESPONSE']._serialized_start=3621 - _globals['_AUTHORIZETRANSFERRESPONSE']._serialized_end=3720 - _globals['_RESOURCEGRANT']._serialized_start=3723 - _globals['_RESOURCEGRANT']._serialized_end=3883 - _globals['_AUTHORITYSERVICE']._serialized_start=3886 - _globals['_AUTHORITYSERVICE']._serialized_end=4945 + _globals['_ISSUEREQUEST']._serialized_end=787 + _globals['_INSTALLATIONSETUPREF']._serialized_start=789 + _globals['_INSTALLATIONSETUPREF']._serialized_end=866 + _globals['_DELEGATIONREF']._serialized_start=868 + _globals['_DELEGATIONREF']._serialized_end=920 + _globals['_DELEGATEREQUEST']._serialized_start=923 + _globals['_DELEGATEREQUEST']._serialized_end=1079 + _globals['_DELEGATION']._serialized_start=1082 + _globals['_DELEGATION']._serialized_end=1368 + _globals['_GETDELEGATIONREQUEST']._serialized_start=1370 + _globals['_GETDELEGATIONREQUEST']._serialized_end=1490 + _globals['_REVOKEDELEGATIONREQUEST']._serialized_start=1492 + _globals['_REVOKEDELEGATIONREQUEST']._serialized_end=1554 + _globals['_REVOKEDELEGATIONRESPONSE']._serialized_start=1556 + _globals['_REVOKEDELEGATIONRESPONSE']._serialized_end=1645 + _globals['_PERSONSESSION']._serialized_start=1647 + _globals['_PERSONSESSION']._serialized_end=1680 + _globals['_WORKLOADCREDENTIAL']._serialized_start=1682 + _globals['_WORKLOADCREDENTIAL']._serialized_end=1734 + _globals['_INSTALLATIONREF']._serialized_start=1736 + _globals['_INSTALLATIONREF']._serialized_end=1794 + _globals['_ISSUERESPONSE']._serialized_start=1797 + _globals['_ISSUERESPONSE']._serialized_end=1934 + _globals['_CHECKREQUEST']._serialized_start=1936 + _globals['_CHECKREQUEST']._serialized_end=2052 + _globals['_CHECKRESPONSE']._serialized_start=2055 + _globals['_CHECKRESPONSE']._serialized_end=2211 + _globals['_KEYSREQUEST']._serialized_start=2213 + _globals['_KEYSREQUEST']._serialized_end=2226 + _globals['_KEYSRESPONSE']._serialized_start=2229 + _globals['_KEYSRESPONSE']._serialized_end=2386 + _globals['_PUBLICKEY']._serialized_start=2388 + _globals['_PUBLICKEY']._serialized_end=2509 + _globals['_REGISTERADMISSIONKEYREQUEST']._serialized_start=2512 + _globals['_REGISTERADMISSIONKEYREQUEST']._serialized_end=2655 + _globals['_REGISTERADMISSIONKEYRESPONSE']._serialized_start=2657 + _globals['_REGISTERADMISSIONKEYRESPONSE']._serialized_end=2775 + _globals['_LISTRESOURCESREQUEST']._serialized_start=2778 + _globals['_LISTRESOURCESREQUEST']._serialized_end=2911 + _globals['_LISTRESOURCESRESPONSE']._serialized_start=2913 + _globals['_LISTRESOURCESRESPONSE']._serialized_end=2994 + _globals['_ATTACHRESOURCEREQUEST']._serialized_start=2997 + _globals['_ATTACHRESOURCEREQUEST']._serialized_end=3173 + _globals['_ATTACHRESOURCERESPONSE']._serialized_start=3175 + _globals['_ATTACHRESOURCERESPONSE']._serialized_end=3240 + _globals['_DETACHRESOURCEREQUEST']._serialized_start=3243 + _globals['_DETACHRESOURCEREQUEST']._serialized_end=3438 + _globals['_DETACHRESOURCERESPONSE']._serialized_start=3440 + _globals['_DETACHRESOURCERESPONSE']._serialized_end=3505 + _globals['_AUTHORIZETRANSFERREQUEST']._serialized_start=3508 + _globals['_AUTHORIZETRANSFERREQUEST']._serialized_end=3763 + _globals['_AUTHORIZETRANSFERRESPONSE']._serialized_start=3765 + _globals['_AUTHORIZETRANSFERRESPONSE']._serialized_end=3864 + _globals['_RESOURCEGRANT']._serialized_start=3867 + _globals['_RESOURCEGRANT']._serialized_end=4027 + _globals['_AUTHORITYSERVICE']._serialized_start=4030 + _globals['_AUTHORITYSERVICE']._serialized_end=5089 # @@protoc_insertion_point(module_scope) diff --git a/libraries/authority-client/python/authority_client/_gen/host/composition/v1/composition_pb2.py b/libraries/authority-client/python/authority_client/_gen/host/composition/v1/composition_pb2.py index 7cf1d4c5..64b9a245 100644 --- a/libraries/authority-client/python/authority_client/_gen/host/composition/v1/composition_pb2.py +++ b/libraries/authority-client/python/authority_client/_gen/host/composition/v1/composition_pb2.py @@ -25,7 +25,7 @@ from authority_client._gen.host.authority.v1 import work_context_pb2 as host_dot_authority_dot_v1_dot_work__context__pb2 -DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n%host/composition/v1/composition.proto\x12\x13host.composition.v1\x1a$host/authority/v1/work_context.proto\"\xff\x01\n\x14\x41pplyManifestRequest\x12\x41\n\x08manifest\x18\x01 \x01(\x0b\x32%.host.composition.v1.ModuleManifestV1R\x08manifest\x12?\n\x07\x63\x61rrier\x18\x02 \x01(\x0b\x32%.host.composition.v1.SignedManifestV1R\x07\x63\x61rrier\x12\x1e\n\ncredential\x18\x03 \x01(\tR\ncredential\x12\x43\n\tauthority\x18\x04 \x01(\x0b\x32%.host.composition.v1.SignedManifestV1R\tauthority\"\xda\x03\n\x13\x41uthorityManifestV1\x12\x16\n\x06module\x18\x01 \x01(\tR\x06module\x12\x1e\n\ngeneration\x18\x02 \x01(\x04R\ngeneration\x12\x30\n\x14\x63ore_manifest_digest\x18\x03 \x01(\tR\x12\x63oreManifestDigest\x12=\n\x07methods\x18\x04 \x03(\x0b\x32#.host.composition.v1.MethodPolicyV1R\x07methods\x12\x45\n\x0escope_ceilings\x18\x05 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\rscopeCeilings\x12\x31\n\x05roles\x18\x06 \x03(\x0b\x32\x1b.host.composition.v1.RoleV1R\x05roles\x12\x1f\n\x0bowner_aware\x18\x07 \x01(\x08R\nownerAware\x12+\n\x11installation_role\x18\x08 \x01(\tR\x10installationRole\x12R\n\x11\x65\x64ge_dependencies\x18\t \x03(\x0b\x32%.host.composition.v1.EdgeDependencyV1R\x10\x65\x64geDependencies\"F\n\x10\x45\x64geDependencyV1\x12\x16\n\x06module\x18\x01 \x01(\tR\x06module\x12\x1a\n\x08presence\x18\x02 \x01(\tR\x08presence\"\x92\x01\n\x0eMethodPolicyV1\x12\x16\n\x06method\x18\x01 \x01(\tR\x06method\x12:\n\x08requires\x18\x02 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\x08requires\x12,\n\x12\x61ny_checked_caller\x18\x03 \x01(\x08R\x10\x61nyCheckedCaller\"J\n\x10SignedManifestV1\x12\x1a\n\x08\x64ocument\x18\x01 \x01(\x0cR\x08\x64ocument\x12\x1a\n\x08\x65nvelope\x18\x02 \x01(\x0cR\x08\x65nvelope\"\x80\x01\n\x15\x41pplyManifestResponse\x12\x1c\n\tprincipal\x18\x01 \x01(\tR\tprincipal\x12\x1e\n\ngeneration\x18\x02 \x01(\x04R\ngeneration\x12)\n\x10installation_ids\x18\x03 \x03(\tR\x0finstallationIds\"\xe8\x02\n\x10ModuleManifestV1\x12\x16\n\x06module\x18\x01 \x01(\tR\x06module\x12\x1c\n\tprincipal\x18\x02 \x01(\tR\tprincipal\x12\x12\n\x04kind\x18\x03 \x01(\tR\x04kind\x12\x1e\n\ngeneration\x18\x04 \x01(\x04R\ngeneration\x12:\n\x08\x62indings\x18\x05 \x03(\x0b\x32\x1e.host.composition.v1.BindingV1R\x08\x62indings\x12J\n\x0eresource_kinds\x18\x06 \x03(\x0b\x32#.host.composition.v1.ResourceKindV1R\rresourceKinds\x12/\n\x04page\x18\x07 \x01(\x0b\x32\x1b.host.composition.v1.PageV1R\x04page\x12\x31\n\x05roles\x18\x08 \x03(\x0b\x32\x1b.host.composition.v1.RoleV1R\x05roles\"\xb0\x01\n\x06RoleV1\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x36\n\x06scopes\x18\x02 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\x06scopes\x12Z\n\x19installation_owned_scopes\x18\x03 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\x17installationOwnedScopes\"\x8a\x02\n\tBindingV1\x12\x0e\n\x02id\x18\x01 \x01(\tR\x02id\x12\x1a\n\x08\x61udience\x18\x02 \x01(\tR\x08\x61udience\x12\x43\n\rinvoke_scopes\x18\x03 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\x0cinvokeScopes\x12G\n\x0fheadless_scopes\x18\x04 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\x0eheadlessScopes\x12\x43\n\rlookup_scopes\x18\x05 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\x0clookupScopes\">\n\x0eResourceKindV1\x12\x12\n\x04kind\x18\x01 \x01(\tR\x04kind\x12\x18\n\x07\x61\x63tions\x18\x02 \x03(\tR\x07\x61\x63tions\"4\n\x06PageV1\x12\x14\n\x05title\x18\x01 \x01(\tR\x05title\x12\x14\n\x05order\x18\x02 \x01(\x05R\x05order2|\n\x12\x43ompositionService\x12\x66\n\rApplyManifest\x12).host.composition.v1.ApplyManifestRequest\x1a*.host.composition.v1.ApplyManifestResponseB3Z1gateway/pkg/gen/host/composition/v1;compositionv1b\x06proto3') +DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n%host/composition/v1/composition.proto\x12\x13host.composition.v1\x1a$host/authority/v1/work_context.proto\"\xff\x01\n\x14\x41pplyManifestRequest\x12\x41\n\x08manifest\x18\x01 \x01(\x0b\x32%.host.composition.v1.ModuleManifestV1R\x08manifest\x12?\n\x07\x63\x61rrier\x18\x02 \x01(\x0b\x32%.host.composition.v1.SignedManifestV1R\x07\x63\x61rrier\x12\x1e\n\ncredential\x18\x03 \x01(\tR\ncredential\x12\x43\n\tauthority\x18\x04 \x01(\x0b\x32%.host.composition.v1.SignedManifestV1R\tauthority\"\xd0\x04\n\x13\x41uthorityManifestV1\x12\x16\n\x06module\x18\x01 \x01(\tR\x06module\x12\x1e\n\ngeneration\x18\x02 \x01(\x04R\ngeneration\x12\x30\n\x14\x63ore_manifest_digest\x18\x03 \x01(\tR\x12\x63oreManifestDigest\x12=\n\x07methods\x18\x04 \x03(\x0b\x32#.host.composition.v1.MethodPolicyV1R\x07methods\x12\x45\n\x0escope_ceilings\x18\x05 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\rscopeCeilings\x12\x31\n\x05roles\x18\x06 \x03(\x0b\x32\x1b.host.composition.v1.RoleV1R\x05roles\x12\x1f\n\x0bowner_aware\x18\x07 \x01(\x08R\nownerAware\x12+\n\x11installation_role\x18\x08 \x01(\tR\x10installationRole\x12R\n\x11\x65\x64ge_dependencies\x18\t \x03(\x0b\x32%.host.composition.v1.EdgeDependencyV1R\x10\x65\x64geDependencies\x12\x37\n\x05setup\x18\n \x03(\x0b\x32!.host.composition.v1.SetupGrantV1R\x05setup\x12;\n\x1aowner_aware_resource_kinds\x18\x0b \x03(\tR\x17ownerAwareResourceKinds\"Z\n\x0cSetupGrantV1\x12\x18\n\x07\x62inding\x18\x01 \x01(\tR\x07\x62inding\x12\x18\n\x07methods\x18\x02 \x03(\tR\x07methods\x12\x16\n\x06scopes\x18\x03 \x03(\tR\x06scopes\"F\n\x10\x45\x64geDependencyV1\x12\x16\n\x06module\x18\x01 \x01(\tR\x06module\x12\x1a\n\x08presence\x18\x02 \x01(\tR\x08presence\"\x92\x01\n\x0eMethodPolicyV1\x12\x16\n\x06method\x18\x01 \x01(\tR\x06method\x12:\n\x08requires\x18\x02 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\x08requires\x12,\n\x12\x61ny_checked_caller\x18\x03 \x01(\x08R\x10\x61nyCheckedCaller\"J\n\x10SignedManifestV1\x12\x1a\n\x08\x64ocument\x18\x01 \x01(\x0cR\x08\x64ocument\x12\x1a\n\x08\x65nvelope\x18\x02 \x01(\x0cR\x08\x65nvelope\"\x80\x01\n\x15\x41pplyManifestResponse\x12\x1c\n\tprincipal\x18\x01 \x01(\tR\tprincipal\x12\x1e\n\ngeneration\x18\x02 \x01(\x04R\ngeneration\x12)\n\x10installation_ids\x18\x03 \x03(\tR\x0finstallationIds\"\xe8\x02\n\x10ModuleManifestV1\x12\x16\n\x06module\x18\x01 \x01(\tR\x06module\x12\x1c\n\tprincipal\x18\x02 \x01(\tR\tprincipal\x12\x12\n\x04kind\x18\x03 \x01(\tR\x04kind\x12\x1e\n\ngeneration\x18\x04 \x01(\x04R\ngeneration\x12:\n\x08\x62indings\x18\x05 \x03(\x0b\x32\x1e.host.composition.v1.BindingV1R\x08\x62indings\x12J\n\x0eresource_kinds\x18\x06 \x03(\x0b\x32#.host.composition.v1.ResourceKindV1R\rresourceKinds\x12/\n\x04page\x18\x07 \x01(\x0b\x32\x1b.host.composition.v1.PageV1R\x04page\x12\x31\n\x05roles\x18\x08 \x03(\x0b\x32\x1b.host.composition.v1.RoleV1R\x05roles\"\xb0\x01\n\x06RoleV1\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x36\n\x06scopes\x18\x02 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\x06scopes\x12Z\n\x19installation_owned_scopes\x18\x03 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\x17installationOwnedScopes\"\x8a\x02\n\tBindingV1\x12\x0e\n\x02id\x18\x01 \x01(\tR\x02id\x12\x1a\n\x08\x61udience\x18\x02 \x01(\tR\x08\x61udience\x12\x43\n\rinvoke_scopes\x18\x03 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\x0cinvokeScopes\x12G\n\x0fheadless_scopes\x18\x04 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\x0eheadlessScopes\x12\x43\n\rlookup_scopes\x18\x05 \x03(\x0b\x32\x1e.host.authority.v1.WorkScopeV1R\x0clookupScopes\">\n\x0eResourceKindV1\x12\x12\n\x04kind\x18\x01 \x01(\tR\x04kind\x12\x18\n\x07\x61\x63tions\x18\x02 \x03(\tR\x07\x61\x63tions\"4\n\x06PageV1\x12\x14\n\x05title\x18\x01 \x01(\tR\x05title\x12\x14\n\x05order\x18\x02 \x01(\x05R\x05order2|\n\x12\x43ompositionService\x12\x66\n\rApplyManifest\x12).host.composition.v1.ApplyManifestRequest\x1a*.host.composition.v1.ApplyManifestResponseB3Z1gateway/pkg/gen/host/composition/v1;compositionv1b\x06proto3') _globals = globals() _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals) @@ -36,25 +36,27 @@ _globals['_APPLYMANIFESTREQUEST']._serialized_start=101 _globals['_APPLYMANIFESTREQUEST']._serialized_end=356 _globals['_AUTHORITYMANIFESTV1']._serialized_start=359 - _globals['_AUTHORITYMANIFESTV1']._serialized_end=833 - _globals['_EDGEDEPENDENCYV1']._serialized_start=835 - _globals['_EDGEDEPENDENCYV1']._serialized_end=905 - _globals['_METHODPOLICYV1']._serialized_start=908 - _globals['_METHODPOLICYV1']._serialized_end=1054 - _globals['_SIGNEDMANIFESTV1']._serialized_start=1056 - _globals['_SIGNEDMANIFESTV1']._serialized_end=1130 - _globals['_APPLYMANIFESTRESPONSE']._serialized_start=1133 - _globals['_APPLYMANIFESTRESPONSE']._serialized_end=1261 - _globals['_MODULEMANIFESTV1']._serialized_start=1264 - _globals['_MODULEMANIFESTV1']._serialized_end=1624 - _globals['_ROLEV1']._serialized_start=1627 - _globals['_ROLEV1']._serialized_end=1803 - _globals['_BINDINGV1']._serialized_start=1806 - _globals['_BINDINGV1']._serialized_end=2072 - _globals['_RESOURCEKINDV1']._serialized_start=2074 - _globals['_RESOURCEKINDV1']._serialized_end=2136 - _globals['_PAGEV1']._serialized_start=2138 - _globals['_PAGEV1']._serialized_end=2190 - _globals['_COMPOSITIONSERVICE']._serialized_start=2192 - _globals['_COMPOSITIONSERVICE']._serialized_end=2316 + _globals['_AUTHORITYMANIFESTV1']._serialized_end=951 + _globals['_SETUPGRANTV1']._serialized_start=953 + _globals['_SETUPGRANTV1']._serialized_end=1043 + _globals['_EDGEDEPENDENCYV1']._serialized_start=1045 + _globals['_EDGEDEPENDENCYV1']._serialized_end=1115 + _globals['_METHODPOLICYV1']._serialized_start=1118 + _globals['_METHODPOLICYV1']._serialized_end=1264 + _globals['_SIGNEDMANIFESTV1']._serialized_start=1266 + _globals['_SIGNEDMANIFESTV1']._serialized_end=1340 + _globals['_APPLYMANIFESTRESPONSE']._serialized_start=1343 + _globals['_APPLYMANIFESTRESPONSE']._serialized_end=1471 + _globals['_MODULEMANIFESTV1']._serialized_start=1474 + _globals['_MODULEMANIFESTV1']._serialized_end=1834 + _globals['_ROLEV1']._serialized_start=1837 + _globals['_ROLEV1']._serialized_end=2013 + _globals['_BINDINGV1']._serialized_start=2016 + _globals['_BINDINGV1']._serialized_end=2282 + _globals['_RESOURCEKINDV1']._serialized_start=2284 + _globals['_RESOURCEKINDV1']._serialized_end=2346 + _globals['_PAGEV1']._serialized_start=2348 + _globals['_PAGEV1']._serialized_end=2400 + _globals['_COMPOSITIONSERVICE']._serialized_start=2402 + _globals['_COMPOSITIONSERVICE']._serialized_end=2526 # @@protoc_insertion_point(module_scope) diff --git a/libraries/authority-client/python/authority_client/_gen/host/installation/v1/installation_pb2.py b/libraries/authority-client/python/authority_client/_gen/host/installation/v1/installation_pb2.py index ee775561..af9b7492 100644 --- a/libraries/authority-client/python/authority_client/_gen/host/installation/v1/installation_pb2.py +++ b/libraries/authority-client/python/authority_client/_gen/host/installation/v1/installation_pb2.py @@ -24,7 +24,7 @@ -DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\'host/installation/v1/installation.proto\x12\x14host.installation.v1\"j\n\x1a\x43urrentInstallationRequest\x12!\n\x0cparent_token\x18\x01 \x01(\tR\x0bparentToken\x12)\n\x10\x61\x63tor_credential\x18\x02 \x01(\tR\x0f\x61\x63torCredential\"\xa0\x01\n\x13\x43urrentInstallation\x12\x0e\n\x02id\x18\x01 \x01(\tR\x02id\x12\'\n\x0forganization_id\x18\x02 \x01(\tR\x0eorganizationId\x12\x16\n\x06target\x18\x03 \x01(\tR\x06target\x12\x1a\n\x08revision\x18\x04 \x01(\x04R\x08revision\x12\x1c\n\tnamespace\x18\x05 \x01(\tR\tnamespace\"\xd0\x01\n\x0eInstallRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\x16\n\x06target\x18\x02 \x01(\tR\x06target\x12\x12\n\x04role\x18\x03 \x01(\tR\x04role\x12&\n\x0fowner_person_id\x18\x04 \x01(\tR\rownerPersonId\x12\x41\n\x08\x61pproval\x18\x05 \x01(\x0b\x32%.host.installation.v1.ConsentApprovalR\x08\x61pproval\"P\n\rReviewRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\x16\n\x06target\x18\x02 \x01(\tR\x06target\"\xb6\x01\n\x0f\x43onsentApproval\x12\x1b\n\ttarget_id\x18\x01 \x01(\tR\x08targetId\x12\x1e\n\ngeneration\x18\x02 \x01(\x04R\ngeneration\x12+\n\x11\x65xpected_revision\x18\x03 \x01(\x04R\x10\x65xpectedRevision\x12!\n\x0coperation_id\x18\x04 \x01(\tR\x0boperationId\x12\x16\n\x06\x64igest\x18\x05 \x01(\tR\x06\x64igest\"\xae\x01\n\x10GrantRoleRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\'\n\x0finstallation_id\x18\x02 \x01(\tR\x0einstallationId\x12\x12\n\x04role\x18\x03 \x01(\tR\x04role\x12\x1b\n\tperson_id\x18\x04 \x01(\tR\x08personId\x12\x17\n\x07team_id\x18\x05 \x01(\tR\x06teamId\"\xaf\x01\n\x11RevokeRoleRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\'\n\x0finstallation_id\x18\x02 \x01(\tR\x0einstallationId\x12\x12\n\x04role\x18\x03 \x01(\tR\x04role\x12\x1b\n\tperson_id\x18\x04 \x01(\tR\x08personId\x12\x17\n\x07team_id\x18\x05 \x01(\tR\x06teamId\"i\n\x15ListRoleGrantsRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\'\n\x0finstallation_id\x18\x02 \x01(\tR\x0einstallationId\"Q\n\x16ListRoleGrantsResponse\x12\x37\n\x06grants\x18\x01 \x03(\x0b\x32\x1f.host.installation.v1.RoleGrantR\x06grants\"U\n\tRoleGrant\x12\x12\n\x04role\x18\x01 \x01(\tR\x04role\x12\x1b\n\tperson_id\x18\x02 \x01(\tR\x08personId\x12\x17\n\x07team_id\x18\x03 \x01(\tR\x06teamId\"6\n\x0bListRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\"X\n\x0cListResponse\x12H\n\rinstallations\x18\x01 \x03(\x0b\x32\".host.installation.v1.InstallationR\rinstallations\"\xb0\x03\n\x0cInstallation\x12\x0e\n\x02id\x18\x01 \x01(\tR\x02id\x12\'\n\x0forganization_id\x18\x02 \x01(\tR\x0eorganizationId\x12\x16\n\x06target\x18\x03 \x01(\tR\x06target\x12\x41\n\x06status\x18\x04 \x01(\x0e\x32).host.installation.v1.Installation.StatusR\x06status\x12\x1a\n\x08revision\x18\x05 \x01(\x04R\x08revision\x12\x12\n\x04role\x18\x06 \x01(\tR\x04role\x12\x1c\n\tnamespace\x18\t \x01(\tR\tnamespace\x12!\n\x0cprincipal_id\x18\n \x01(\tR\x0bprincipalId\x12\x14\n\x05roles\x18\x0b \x03(\tR\x05roles\"[\n\x06Status\x12\x16\n\x12STATUS_UNSPECIFIED\x10\x00\x12\x12\n\x0eSTATUS_PENDING\x10\x01\x12\x11\n\rSTATUS_ACTIVE\x10\x02\x12\x12\n\x0eSTATUS_REVOKED\x10\x03J\x04\x08\x07\x10\x08J\x04\x08\x08\x10\tR\x08team_idsR\x12\x61gent_principal_id\"\\\n\x12InstallationNotice\x12\x46\n\x0cinstallation\x18\x01 \x01(\x0b\x32\".host.installation.v1.InstallationR\x0cinstallation\"\x11\n\x0fInstallationAck\"<\n\x11ListOffersRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\"I\n\x12ListOffersResponse\x12\x33\n\x06offers\x18\x01 \x03(\x0b\x32\x1b.host.installation.v1.OfferR\x06offers\"?\n\x05Offer\x12\x16\n\x06target\x18\x01 \x01(\tR\x06target\x12\x1e\n\ngeneration\x18\x02 \x01(\x04R\ngeneration\"\xcf\x03\n\rReviewedOffer\x12\x41\n\x08\x61pproval\x18\x01 \x01(\x0b\x32%.host.installation.v1.ConsentApprovalR\x08\x61pproval\x12\x16\n\x06target\x18\x02 \x01(\tR\x06target\x12\x35\n\x05roles\x18\x03 \x03(\x0b\x32\x1f.host.installation.v1.OfferRoleR\x05roles\x12\x46\n\x0cinstallation\x18\x04 \x01(\x0b\x32\".host.installation.v1.InstallationR\x0cinstallation\x12<\n\x07\x63\x65iling\x18\x05 \x03(\x0b\x32\".host.installation.v1.OfferBindingR\x07\x63\x65iling\x12%\n\x0etools_composed\x18\x06 \x01(\x08R\rtoolsComposed\x12+\n\x11installation_role\x18\x07 \x01(\tR\x10installationRole\x12R\n\x11\x65\x64ge_dependencies\x18\x08 \x03(\x0b\x32%.host.installation.v1.OfferDependencyR\x10\x65\x64geDependencies\"E\n\x0fOfferDependency\x12\x16\n\x06module\x18\x01 \x01(\tR\x06module\x12\x1a\n\x08presence\x18\x02 \x01(\tR\x08presence\"z\n\x0cOfferBinding\x12\x18\n\x07\x62inding\x18\x01 \x01(\tR\x07\x62inding\x12\x16\n\x06module\x18\x02 \x01(\tR\x06module\x12\x38\n\x06scopes\x18\x03 \x03(\x0b\x32 .host.installation.v1.OfferScopeR\x06scopes\"\xa4\x01\n\tOfferRole\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x38\n\x06scopes\x18\x02 \x03(\x0b\x32 .host.installation.v1.OfferScopeR\x06scopes\x12I\n\x0c\x63\x61pabilities\x18\x03 \x03(\x0b\x32%.host.installation.v1.OfferCapabilityR\x0c\x63\x61pabilities\"\x93\x01\n\nOfferScope\x12#\n\rresource_kind\x18\x01 \x01(\tR\x0cresourceKind\x12\x18\n\x07\x61\x63tions\x18\x02 \x03(\tR\x07\x61\x63tions\x12#\n\rattached_only\x18\x03 \x01(\x08R\x0c\x61ttachedOnly\x12!\n\x0cresource_ids\x18\x04 \x03(\tR\x0bresourceIds\"\xbc\x01\n\x0fOfferCapability\x12\x16\n\x06module\x18\x01 \x01(\tR\x06module\x12\x1c\n\toperation\x18\x02 \x01(\tR\toperation\x12<\n\x08requires\x18\x03 \x03(\x0b\x32 .host.installation.v1.OfferScopeR\x08requires\x12\x35\n\x05tools\x18\x04 \x03(\x0b\x32\x1f.host.installation.v1.OfferToolR\x05tools\"O\n\tOfferTool\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x18\n\x07\x62inding\x18\x02 \x01(\tR\x07\x62inding\x12\x14\n\x05write\x18\x03 \x01(\x08R\x05write\":\n\x0fListHeldRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\"`\n\x10ListHeldResponse\x12L\n\rinstallations\x18\x01 \x03(\x0b\x32&.host.installation.v1.HeldInstallationR\rinstallations\"p\n\x10HeldInstallation\x12\x46\n\x0cinstallation\x18\x01 \x01(\x0b\x32\".host.installation.v1.InstallationR\x0cinstallation\x12\x14\n\x05roles\x18\x02 \x03(\tR\x05roles2\xf3\x05\n\x13InstallationService\x12\x66\n\x07\x43urrent\x12\x30.host.installation.v1.CurrentInstallationRequest\x1a).host.installation.v1.CurrentInstallation\x12S\n\x07Install\x12$.host.installation.v1.InstallRequest\x1a\".host.installation.v1.Installation\x12T\n\x06Review\x12#.host.installation.v1.ReviewRequest\x1a%.host.installation.v1.ConsentApproval\x12W\n\tGrantRole\x12&.host.installation.v1.GrantRoleRequest\x1a\".host.installation.v1.Installation\x12Y\n\nRevokeRole\x12\'.host.installation.v1.RevokeRoleRequest\x1a\".host.installation.v1.Installation\x12k\n\x0eListRoleGrants\x12+.host.installation.v1.ListRoleGrantsRequest\x1a,.host.installation.v1.ListRoleGrantsResponse\x12M\n\x04List\x12!.host.installation.v1.ListRequest\x1a\".host.installation.v1.ListResponse\x12Y\n\x08ListHeld\x12%.host.installation.v1.ListHeldRequest\x1a&.host.installation.v1.ListHeldResponse2p\n\x12InstallableService\x12Z\n\x07Install\x12(.host.installation.v1.InstallationNotice\x1a%.host.installation.v1.InstallationAck2\xc8\x01\n\x0cOfferService\x12_\n\nListOffers\x12\'.host.installation.v1.ListOffersRequest\x1a(.host.installation.v1.ListOffersResponse\x12W\n\x0bReviewOffer\x12#.host.installation.v1.ReviewRequest\x1a#.host.installation.v1.ReviewedOfferB5Z3gateway/pkg/gen/host/installation/v1;installationv1b\x06proto3') +DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\'host/installation/v1/installation.proto\x12\x14host.installation.v1\"j\n\x1a\x43urrentInstallationRequest\x12!\n\x0cparent_token\x18\x01 \x01(\tR\x0bparentToken\x12)\n\x10\x61\x63tor_credential\x18\x02 \x01(\tR\x0f\x61\x63torCredential\"\xa0\x01\n\x13\x43urrentInstallation\x12\x0e\n\x02id\x18\x01 \x01(\tR\x02id\x12\'\n\x0forganization_id\x18\x02 \x01(\tR\x0eorganizationId\x12\x16\n\x06target\x18\x03 \x01(\tR\x06target\x12\x1a\n\x08revision\x18\x04 \x01(\x04R\x08revision\x12\x1c\n\tnamespace\x18\x05 \x01(\tR\tnamespace\"\xd0\x01\n\x0eInstallRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\x16\n\x06target\x18\x02 \x01(\tR\x06target\x12\x12\n\x04role\x18\x03 \x01(\tR\x04role\x12&\n\x0fowner_person_id\x18\x04 \x01(\tR\rownerPersonId\x12\x41\n\x08\x61pproval\x18\x05 \x01(\x0b\x32%.host.installation.v1.ConsentApprovalR\x08\x61pproval\"P\n\rReviewRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\x16\n\x06target\x18\x02 \x01(\tR\x06target\"\xb6\x01\n\x0f\x43onsentApproval\x12\x1b\n\ttarget_id\x18\x01 \x01(\tR\x08targetId\x12\x1e\n\ngeneration\x18\x02 \x01(\x04R\ngeneration\x12+\n\x11\x65xpected_revision\x18\x03 \x01(\x04R\x10\x65xpectedRevision\x12!\n\x0coperation_id\x18\x04 \x01(\tR\x0boperationId\x12\x16\n\x06\x64igest\x18\x05 \x01(\tR\x06\x64igest\"\xae\x01\n\x10GrantRoleRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\'\n\x0finstallation_id\x18\x02 \x01(\tR\x0einstallationId\x12\x12\n\x04role\x18\x03 \x01(\tR\x04role\x12\x1b\n\tperson_id\x18\x04 \x01(\tR\x08personId\x12\x17\n\x07team_id\x18\x05 \x01(\tR\x06teamId\"\xaf\x01\n\x11RevokeRoleRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\'\n\x0finstallation_id\x18\x02 \x01(\tR\x0einstallationId\x12\x12\n\x04role\x18\x03 \x01(\tR\x04role\x12\x1b\n\tperson_id\x18\x04 \x01(\tR\x08personId\x12\x17\n\x07team_id\x18\x05 \x01(\tR\x06teamId\"i\n\x15ListRoleGrantsRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\x12\'\n\x0finstallation_id\x18\x02 \x01(\tR\x0einstallationId\"Q\n\x16ListRoleGrantsResponse\x12\x37\n\x06grants\x18\x01 \x03(\x0b\x32\x1f.host.installation.v1.RoleGrantR\x06grants\"U\n\tRoleGrant\x12\x12\n\x04role\x18\x01 \x01(\tR\x04role\x12\x1b\n\tperson_id\x18\x02 \x01(\tR\x08personId\x12\x17\n\x07team_id\x18\x03 \x01(\tR\x06teamId\"6\n\x0bListRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\"X\n\x0cListResponse\x12H\n\rinstallations\x18\x01 \x03(\x0b\x32\".host.installation.v1.InstallationR\rinstallations\"\xb0\x03\n\x0cInstallation\x12\x0e\n\x02id\x18\x01 \x01(\tR\x02id\x12\'\n\x0forganization_id\x18\x02 \x01(\tR\x0eorganizationId\x12\x16\n\x06target\x18\x03 \x01(\tR\x06target\x12\x41\n\x06status\x18\x04 \x01(\x0e\x32).host.installation.v1.Installation.StatusR\x06status\x12\x1a\n\x08revision\x18\x05 \x01(\x04R\x08revision\x12\x12\n\x04role\x18\x06 \x01(\tR\x04role\x12\x1c\n\tnamespace\x18\t \x01(\tR\tnamespace\x12!\n\x0cprincipal_id\x18\n \x01(\tR\x0bprincipalId\x12\x14\n\x05roles\x18\x0b \x03(\tR\x05roles\"[\n\x06Status\x12\x16\n\x12STATUS_UNSPECIFIED\x10\x00\x12\x12\n\x0eSTATUS_PENDING\x10\x01\x12\x11\n\rSTATUS_ACTIVE\x10\x02\x12\x12\n\x0eSTATUS_REVOKED\x10\x03J\x04\x08\x07\x10\x08J\x04\x08\x08\x10\tR\x08team_idsR\x12\x61gent_principal_id\"\\\n\x12InstallationNotice\x12\x46\n\x0cinstallation\x18\x01 \x01(\x0b\x32\".host.installation.v1.InstallationR\x0cinstallation\"\x11\n\x0fInstallationAck\"<\n\x11ListOffersRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\"I\n\x12ListOffersResponse\x12\x33\n\x06offers\x18\x01 \x03(\x0b\x32\x1b.host.installation.v1.OfferR\x06offers\"?\n\x05Offer\x12\x16\n\x06target\x18\x01 \x01(\tR\x06target\x12\x1e\n\ngeneration\x18\x02 \x01(\x04R\ngeneration\"\x87\x04\n\rReviewedOffer\x12\x41\n\x08\x61pproval\x18\x01 \x01(\x0b\x32%.host.installation.v1.ConsentApprovalR\x08\x61pproval\x12\x16\n\x06target\x18\x02 \x01(\tR\x06target\x12\x35\n\x05roles\x18\x03 \x03(\x0b\x32\x1f.host.installation.v1.OfferRoleR\x05roles\x12\x46\n\x0cinstallation\x18\x04 \x01(\x0b\x32\".host.installation.v1.InstallationR\x0cinstallation\x12<\n\x07\x63\x65iling\x18\x05 \x03(\x0b\x32\".host.installation.v1.OfferBindingR\x07\x63\x65iling\x12%\n\x0etools_composed\x18\x06 \x01(\x08R\rtoolsComposed\x12+\n\x11installation_role\x18\x07 \x01(\tR\x10installationRole\x12R\n\x11\x65\x64ge_dependencies\x18\x08 \x03(\x0b\x32%.host.installation.v1.OfferDependencyR\x10\x65\x64geDependencies\x12\x36\n\x05setup\x18\t \x03(\x0b\x32 .host.installation.v1.OfferSetupR\x05setup\"\x92\x01\n\nOfferSetup\x12\x18\n\x07\x62inding\x18\x01 \x01(\tR\x07\x62inding\x12\x16\n\x06module\x18\x02 \x01(\tR\x06module\x12\x18\n\x07methods\x18\x03 \x03(\tR\x07methods\x12\x38\n\x06scopes\x18\x04 \x03(\x0b\x32 .host.installation.v1.OfferScopeR\x06scopes\"E\n\x0fOfferDependency\x12\x16\n\x06module\x18\x01 \x01(\tR\x06module\x12\x1a\n\x08presence\x18\x02 \x01(\tR\x08presence\"z\n\x0cOfferBinding\x12\x18\n\x07\x62inding\x18\x01 \x01(\tR\x07\x62inding\x12\x16\n\x06module\x18\x02 \x01(\tR\x06module\x12\x38\n\x06scopes\x18\x03 \x03(\x0b\x32 .host.installation.v1.OfferScopeR\x06scopes\"\xa4\x01\n\tOfferRole\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x38\n\x06scopes\x18\x02 \x03(\x0b\x32 .host.installation.v1.OfferScopeR\x06scopes\x12I\n\x0c\x63\x61pabilities\x18\x03 \x03(\x0b\x32%.host.installation.v1.OfferCapabilityR\x0c\x63\x61pabilities\"\x93\x01\n\nOfferScope\x12#\n\rresource_kind\x18\x01 \x01(\tR\x0cresourceKind\x12\x18\n\x07\x61\x63tions\x18\x02 \x03(\tR\x07\x61\x63tions\x12#\n\rattached_only\x18\x03 \x01(\x08R\x0c\x61ttachedOnly\x12!\n\x0cresource_ids\x18\x04 \x03(\tR\x0bresourceIds\"\xbc\x01\n\x0fOfferCapability\x12\x16\n\x06module\x18\x01 \x01(\tR\x06module\x12\x1c\n\toperation\x18\x02 \x01(\tR\toperation\x12<\n\x08requires\x18\x03 \x03(\x0b\x32 .host.installation.v1.OfferScopeR\x08requires\x12\x35\n\x05tools\x18\x04 \x03(\x0b\x32\x1f.host.installation.v1.OfferToolR\x05tools\"O\n\tOfferTool\x12\x12\n\x04name\x18\x01 \x01(\tR\x04name\x12\x18\n\x07\x62inding\x18\x02 \x01(\tR\x07\x62inding\x12\x14\n\x05write\x18\x03 \x01(\x08R\x05write\":\n\x0fListHeldRequest\x12\'\n\x0forganization_id\x18\x01 \x01(\tR\x0eorganizationId\"`\n\x10ListHeldResponse\x12L\n\rinstallations\x18\x01 \x03(\x0b\x32&.host.installation.v1.HeldInstallationR\rinstallations\"p\n\x10HeldInstallation\x12\x46\n\x0cinstallation\x18\x01 \x01(\x0b\x32\".host.installation.v1.InstallationR\x0cinstallation\x12\x14\n\x05roles\x18\x02 \x03(\tR\x05roles2\xf3\x05\n\x13InstallationService\x12\x66\n\x07\x43urrent\x12\x30.host.installation.v1.CurrentInstallationRequest\x1a).host.installation.v1.CurrentInstallation\x12S\n\x07Install\x12$.host.installation.v1.InstallRequest\x1a\".host.installation.v1.Installation\x12T\n\x06Review\x12#.host.installation.v1.ReviewRequest\x1a%.host.installation.v1.ConsentApproval\x12W\n\tGrantRole\x12&.host.installation.v1.GrantRoleRequest\x1a\".host.installation.v1.Installation\x12Y\n\nRevokeRole\x12\'.host.installation.v1.RevokeRoleRequest\x1a\".host.installation.v1.Installation\x12k\n\x0eListRoleGrants\x12+.host.installation.v1.ListRoleGrantsRequest\x1a,.host.installation.v1.ListRoleGrantsResponse\x12M\n\x04List\x12!.host.installation.v1.ListRequest\x1a\".host.installation.v1.ListResponse\x12Y\n\x08ListHeld\x12%.host.installation.v1.ListHeldRequest\x1a&.host.installation.v1.ListHeldResponse2p\n\x12InstallableService\x12Z\n\x07Install\x12(.host.installation.v1.InstallationNotice\x1a%.host.installation.v1.InstallationAck2\xc8\x01\n\x0cOfferService\x12_\n\nListOffers\x12\'.host.installation.v1.ListOffersRequest\x1a(.host.installation.v1.ListOffersResponse\x12W\n\x0bReviewOffer\x12#.host.installation.v1.ReviewRequest\x1a#.host.installation.v1.ReviewedOfferB5Z3gateway/pkg/gen/host/installation/v1;installationv1b\x06proto3') _globals = globals() _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals) @@ -71,29 +71,31 @@ _globals['_OFFER']._serialized_start=2277 _globals['_OFFER']._serialized_end=2340 _globals['_REVIEWEDOFFER']._serialized_start=2343 - _globals['_REVIEWEDOFFER']._serialized_end=2806 - _globals['_OFFERDEPENDENCY']._serialized_start=2808 - _globals['_OFFERDEPENDENCY']._serialized_end=2877 - _globals['_OFFERBINDING']._serialized_start=2879 - _globals['_OFFERBINDING']._serialized_end=3001 - _globals['_OFFERROLE']._serialized_start=3004 - _globals['_OFFERROLE']._serialized_end=3168 - _globals['_OFFERSCOPE']._serialized_start=3171 - _globals['_OFFERSCOPE']._serialized_end=3318 - _globals['_OFFERCAPABILITY']._serialized_start=3321 - _globals['_OFFERCAPABILITY']._serialized_end=3509 - _globals['_OFFERTOOL']._serialized_start=3511 - _globals['_OFFERTOOL']._serialized_end=3590 - _globals['_LISTHELDREQUEST']._serialized_start=3592 - _globals['_LISTHELDREQUEST']._serialized_end=3650 - _globals['_LISTHELDRESPONSE']._serialized_start=3652 - _globals['_LISTHELDRESPONSE']._serialized_end=3748 - _globals['_HELDINSTALLATION']._serialized_start=3750 - _globals['_HELDINSTALLATION']._serialized_end=3862 - _globals['_INSTALLATIONSERVICE']._serialized_start=3865 - _globals['_INSTALLATIONSERVICE']._serialized_end=4620 - _globals['_INSTALLABLESERVICE']._serialized_start=4622 - _globals['_INSTALLABLESERVICE']._serialized_end=4734 - _globals['_OFFERSERVICE']._serialized_start=4737 - _globals['_OFFERSERVICE']._serialized_end=4937 + _globals['_REVIEWEDOFFER']._serialized_end=2862 + _globals['_OFFERSETUP']._serialized_start=2865 + _globals['_OFFERSETUP']._serialized_end=3011 + _globals['_OFFERDEPENDENCY']._serialized_start=3013 + _globals['_OFFERDEPENDENCY']._serialized_end=3082 + _globals['_OFFERBINDING']._serialized_start=3084 + _globals['_OFFERBINDING']._serialized_end=3206 + _globals['_OFFERROLE']._serialized_start=3209 + _globals['_OFFERROLE']._serialized_end=3373 + _globals['_OFFERSCOPE']._serialized_start=3376 + _globals['_OFFERSCOPE']._serialized_end=3523 + _globals['_OFFERCAPABILITY']._serialized_start=3526 + _globals['_OFFERCAPABILITY']._serialized_end=3714 + _globals['_OFFERTOOL']._serialized_start=3716 + _globals['_OFFERTOOL']._serialized_end=3795 + _globals['_LISTHELDREQUEST']._serialized_start=3797 + _globals['_LISTHELDREQUEST']._serialized_end=3855 + _globals['_LISTHELDRESPONSE']._serialized_start=3857 + _globals['_LISTHELDRESPONSE']._serialized_end=3953 + _globals['_HELDINSTALLATION']._serialized_start=3955 + _globals['_HELDINSTALLATION']._serialized_end=4067 + _globals['_INSTALLATIONSERVICE']._serialized_start=4070 + _globals['_INSTALLATIONSERVICE']._serialized_end=4825 + _globals['_INSTALLABLESERVICE']._serialized_start=4827 + _globals['_INSTALLABLESERVICE']._serialized_end=4939 + _globals['_OFFERSERVICE']._serialized_start=4942 + _globals['_OFFERSERVICE']._serialized_end=5142 # @@protoc_insertion_point(module_scope) diff --git a/libraries/authority-client/typescript/src/gen/host/authority/v1/authority_pb.ts b/libraries/authority-client/typescript/src/gen/host/authority/v1/authority_pb.ts index e9322b1b..74bb859c 100644 --- a/libraries/authority-client/typescript/src/gen/host/authority/v1/authority_pb.ts +++ b/libraries/authority-client/typescript/src/gen/host/authority/v1/authority_pb.ts @@ -19,7 +19,7 @@ import type { Message } from "@bufbuild/protobuf"; * Describes the file host/authority/v1/authority.proto. */ export const file_host_authority_v1_authority: GenFile = /*@__PURE__*/ - fileDesc("CiFob3N0L2F1dGhvcml0eS92MS9hdXRob3JpdHkucHJvdG8SEWhvc3QuYXV0aG9yaXR5LnYxIuYDCgxJc3N1ZVJlcXVlc3QSMgoGcGVyc29uGAEgASgLMiAuaG9zdC5hdXRob3JpdHkudjEuUGVyc29uU2Vzc2lvbkgAEjkKCHdvcmtsb2FkGAIgASgLMiUuaG9zdC5hdXRob3JpdHkudjEuV29ya2xvYWRDcmVkZW50aWFsSAASOgoMaW5zdGFsbGF0aW9uGAMgASgLMiIuaG9zdC5hdXRob3JpdHkudjEuSW5zdGFsbGF0aW9uUmVmSAASFgoMcGFyZW50X3Rva2VuGAQgASgJSAASNgoKZGVsZWdhdGlvbhgLIAEoCzIgLmhvc3QuYXV0aG9yaXR5LnYxLkRlbGVnYXRpb25SZWZIABIQCghhdWRpZW5jZRgFIAEoCRIuCgZzY29wZXMYBiADKAsyHi5ob3N0LmF1dGhvcml0eS52MS5Xb3JrU2NvcGVWMRITCgt0dGxfc2Vjb25kcxgHIAEoAxIcChRvcGVyYXRpb25fYmluZGluZ19pZBgIIAEoCRIXCg9vcmdhbml6YXRpb25faWQYCSABKAkSNAoFYWN0b3IYCiABKAsyJS5ob3N0LmF1dGhvcml0eS52MS5Xb3JrbG9hZENyZWRlbnRpYWwSEQoJb3BlcmF0aW9uGAwgASgJQgQKAmFzIiYKDURlbGVnYXRpb25SZWYSFQoNZGVsZWdhdGlvbl9pZBgBIAEoCSJ3Cg9EZWxlZ2F0ZVJlcXVlc3QSDgoGbW9kdWxlGAEgASgJEi4KBnNjb3BlcxgCIAMoCzIeLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtTY29wZVYxEg8KB3B1cnBvc2UYAyABKAkSEwoLdHRsX3NlY29uZHMYBCABKAMixwEKCkRlbGVnYXRpb24SFQoNZGVsZWdhdGlvbl9pZBgBIAEoCRIXCg9vcmdhbml6YXRpb25faWQYAiABKAkSDwoHZ3JhbnRvchgDIAEoCRIOCgZtb2R1bGUYBCABKAkSLgoGc2NvcGVzGAUgAygLMh4uaG9zdC5hdXRob3JpdHkudjEuV29ya1Njb3BlVjESDwoHcHVycG9zZRgGIAEoCRIOCgZhY3RpdmUYByABKAgSFwoPZXhwaXJlc19hdF91bml4GAggASgDImMKFEdldERlbGVnYXRpb25SZXF1ZXN0EhUKDWRlbGVnYXRpb25faWQYASABKAkSNAoFYWN0b3IYAiABKAsyJS5ob3N0LmF1dGhvcml0eS52MS5Xb3JrbG9hZENyZWRlbnRpYWwiMAoXUmV2b2tlRGVsZWdhdGlvblJlcXVlc3QSFQoNZGVsZWdhdGlvbl9pZBgBIAEoCSJNChhSZXZva2VEZWxlZ2F0aW9uUmVzcG9uc2USMQoKZGVsZWdhdGlvbhgBIAEoCzIdLmhvc3QuYXV0aG9yaXR5LnYxLkRlbGVnYXRpb24iIQoNUGVyc29uU2Vzc2lvbkoECAEQAlIKc2Vzc2lvbl9pZCIoChJXb3JrbG9hZENyZWRlbnRpYWwSEgoKY3JlZGVudGlhbBgBIAEoCSIqCg9JbnN0YWxsYXRpb25SZWYSFwoPaW5zdGFsbGF0aW9uX2lkGAEgASgJImoKDUlzc3VlUmVzcG9uc2USDQoFdG9rZW4YASABKAkSFwoPZXhwaXJlc19hdF91bml4GAIgASgDEjEKB2NvbnRleHQYAyABKAsyIC5ob3N0LmF1dGhvcml0eS52MS5Xb3JrQ29udGV4dFYxIlEKDENoZWNrUmVxdWVzdBINCgV0b2tlbhgBIAEoCRIQCghhdWRpZW5jZRgCIAEoCRIOCgZtZXRob2QYAyABKAkSEAoIYWR2aXNvcnkYBCABKAgicwoNQ2hlY2tSZXNwb25zZRIxCgdjb250ZXh0GAEgASgLMiAuaG9zdC5hdXRob3JpdHkudjEuV29ya0NvbnRleHRWMRIeChZhdXRob3JpemF0aW9uX3JldmlzaW9uGAIgASgEEg8KB3JlZnVzYWwYAyABKAkiDQoLS2V5c1JlcXVlc3QigAEKDEtleXNSZXNwb25zZRIOCgZpc3N1ZXIYASABKAkSKgoEa2V5cxgCIAMoCzIcLmhvc3QuYXV0aG9yaXR5LnYxLlB1YmxpY0tleRI0Cg5hZG1pc3Npb25fa2V5cxgDIAMoCzIcLmhvc3QuYXV0aG9yaXR5LnYxLlB1YmxpY0tleSJTCglQdWJsaWNLZXkSDgoGa2V5X2lkGAEgASgJEhEKCWFsZ29yaXRobRgCIAEoCRISCgpwdWJsaWNfa2V5GAMgASgMEg8KB3B1cnBvc2UYBCABKAkidgobUmVnaXN0ZXJBZG1pc3Npb25LZXlSZXF1ZXN0EjQKBWFjdG9yGAEgASgLMiUuaG9zdC5hdXRob3JpdHkudjEuV29ya2xvYWRDcmVkZW50aWFsEhIKCnB1YmxpY19rZXkYAiABKAwSDQoFcHJvb2YYAyABKAkiYgocUmVnaXN0ZXJBZG1pc3Npb25LZXlSZXNwb25zZRIpCgNrZXkYASABKAsyHC5ob3N0LmF1dGhvcml0eS52MS5QdWJsaWNLZXkSFwoPZXhwaXJlc19hdF91bml4GAIgASgDIl4KFExpc3RSZXNvdXJjZXNSZXF1ZXN0Eg0KBXRva2VuGAEgASgJEhAKCGF1ZGllbmNlGAIgASgJEhUKDXJlc291cmNlX2tpbmQYAyABKAkSDgoGYWN0aW9uGAQgASgJIkkKFUxpc3RSZXNvdXJjZXNSZXNwb25zZRIwCgZncmFudHMYASADKAsyIC5ob3N0LmF1dGhvcml0eS52MS5SZXNvdXJjZUdyYW50IogBChVBdHRhY2hSZXNvdXJjZVJlcXVlc3QSDQoFdG9rZW4YASABKAkSNAoFYWN0b3IYAiABKAsyJS5ob3N0LmF1dGhvcml0eS52MS5Xb3JrbG9hZENyZWRlbnRpYWwSFQoNcmVzb3VyY2Vfa2luZBgDIAEoCRITCgtyZXNvdXJjZV9pZBgEIAEoCSIxChZBdHRhY2hSZXNvdXJjZVJlc3BvbnNlEhcKD2luc3RhbGxhdGlvbl9pZBgBIAEoCSKSAQoVRGV0YWNoUmVzb3VyY2VSZXF1ZXN0EjQKBWFjdG9yGAEgASgLMiUuaG9zdC5hdXRob3JpdHkudjEuV29ya2xvYWRDcmVkZW50aWFsEhcKD29yZ2FuaXphdGlvbl9pZBgCIAEoCRIVCg1yZXNvdXJjZV9raW5kGAMgASgJEhMKC3Jlc291cmNlX2lkGAQgASgJIjEKFkRldGFjaFJlc291cmNlUmVzcG9uc2USFwoPaW5zdGFsbGF0aW9uX2lkGAEgASgJIrsBChhBdXRob3JpemVUcmFuc2ZlclJlcXVlc3QSDQoFdG9rZW4YASABKAkSNAoFYWN0b3IYAiABKAsyJS5ob3N0LmF1dGhvcml0eS52MS5Xb3JrbG9hZENyZWRlbnRpYWwSFQoNcmVzb3VyY2Vfa2luZBgDIAEoCRITCgtyZXNvdXJjZV9pZBgEIAEoCRIVCg1mcm9tX293bmVyX2lkGAUgASgJEhcKD3RvX3ByaW5jaXBhbF9pZBgGIAEoCSJIChlBdXRob3JpemVUcmFuc2ZlclJlc3BvbnNlEhQKDHByaW5jaXBhbF9pZBgBIAEoCRIVCg1hdXRob3JpemVkX2J5GAIgASgJInUKDVJlc291cmNlR3JhbnQSDQoDYWxsGAEgASgISAASDAoCaWQYAiABKAlIABIQCgZwcmVmaXgYAyABKAlIABIRCgdwYXR0ZXJuGAQgASgJSAASGQoRcmVzb3VyY2Vfb3duZXJfaWQYBSABKAlCBwoFbWF0Y2gy4wgKEEF1dGhvcml0eVNlcnZpY2USagoFSXNzdWUSHy5ob3N0LmF1dGhvcml0eS52MS5Jc3N1ZVJlcXVlc3QaIC5ob3N0LmF1dGhvcml0eS52MS5Jc3N1ZVJlc3BvbnNlIh6C0+STAhg6ASoiEy92MS9hdXRob3JpdHk6aXNzdWUSagoFQ2hlY2sSHy5ob3N0LmF1dGhvcml0eS52MS5DaGVja1JlcXVlc3QaIC5ob3N0LmF1dGhvcml0eS52MS5DaGVja1Jlc3BvbnNlIh6C0+STAhg6ASoiEy92MS9hdXRob3JpdHk6Y2hlY2sSRwoES2V5cxIeLmhvc3QuYXV0aG9yaXR5LnYxLktleXNSZXF1ZXN0Gh8uaG9zdC5hdXRob3JpdHkudjEuS2V5c1Jlc3BvbnNlEncKFFJlZ2lzdGVyQWRtaXNzaW9uS2V5Ei4uaG9zdC5hdXRob3JpdHkudjEuUmVnaXN0ZXJBZG1pc3Npb25LZXlSZXF1ZXN0Gi8uaG9zdC5hdXRob3JpdHkudjEuUmVnaXN0ZXJBZG1pc3Npb25LZXlSZXNwb25zZRJiCg1MaXN0UmVzb3VyY2VzEicuaG9zdC5hdXRob3JpdHkudjEuTGlzdFJlc291cmNlc1JlcXVlc3QaKC5ob3N0LmF1dGhvcml0eS52MS5MaXN0UmVzb3VyY2VzUmVzcG9uc2USZQoOQXR0YWNoUmVzb3VyY2USKC5ob3N0LmF1dGhvcml0eS52MS5BdHRhY2hSZXNvdXJjZVJlcXVlc3QaKS5ob3N0LmF1dGhvcml0eS52MS5BdHRhY2hSZXNvdXJjZVJlc3BvbnNlEmUKDkRldGFjaFJlc291cmNlEiguaG9zdC5hdXRob3JpdHkudjEuRGV0YWNoUmVzb3VyY2VSZXF1ZXN0GikuaG9zdC5hdXRob3JpdHkudjEuRGV0YWNoUmVzb3VyY2VSZXNwb25zZRJuChFBdXRob3JpemVUcmFuc2ZlchIrLmhvc3QuYXV0aG9yaXR5LnYxLkF1dGhvcml6ZVRyYW5zZmVyUmVxdWVzdBosLmhvc3QuYXV0aG9yaXR5LnYxLkF1dGhvcml6ZVRyYW5zZmVyUmVzcG9uc2USTQoIRGVsZWdhdGUSIi5ob3N0LmF1dGhvcml0eS52MS5EZWxlZ2F0ZVJlcXVlc3QaHS5ob3N0LmF1dGhvcml0eS52MS5EZWxlZ2F0aW9uEmsKEFJldm9rZURlbGVnYXRpb24SKi5ob3N0LmF1dGhvcml0eS52MS5SZXZva2VEZWxlZ2F0aW9uUmVxdWVzdBorLmhvc3QuYXV0aG9yaXR5LnYxLlJldm9rZURlbGVnYXRpb25SZXNwb25zZRJXCg1HZXREZWxlZ2F0aW9uEicuaG9zdC5hdXRob3JpdHkudjEuR2V0RGVsZWdhdGlvblJlcXVlc3QaHS5ob3N0LmF1dGhvcml0eS52MS5EZWxlZ2F0aW9uQi9aLWdhdGV3YXkvcGtnL2dlbi9ob3N0L2F1dGhvcml0eS92MTthdXRob3JpdHl2MWIGcHJvdG8z", [file_google_api_annotations, file_host_authority_v1_work_context]); + fileDesc("CiFob3N0L2F1dGhvcml0eS92MS9hdXRob3JpdHkucHJvdG8SEWhvc3QuYXV0aG9yaXR5LnYxIqAECgxJc3N1ZVJlcXVlc3QSMgoGcGVyc29uGAEgASgLMiAuaG9zdC5hdXRob3JpdHkudjEuUGVyc29uU2Vzc2lvbkgAEjkKCHdvcmtsb2FkGAIgASgLMiUuaG9zdC5hdXRob3JpdHkudjEuV29ya2xvYWRDcmVkZW50aWFsSAASOgoMaW5zdGFsbGF0aW9uGAMgASgLMiIuaG9zdC5hdXRob3JpdHkudjEuSW5zdGFsbGF0aW9uUmVmSAASFgoMcGFyZW50X3Rva2VuGAQgASgJSAASNgoKZGVsZWdhdGlvbhgLIAEoCzIgLmhvc3QuYXV0aG9yaXR5LnYxLkRlbGVnYXRpb25SZWZIABI4CgVzZXR1cBgNIAEoCzInLmhvc3QuYXV0aG9yaXR5LnYxLkluc3RhbGxhdGlvblNldHVwUmVmSAASEAoIYXVkaWVuY2UYBSABKAkSLgoGc2NvcGVzGAYgAygLMh4uaG9zdC5hdXRob3JpdHkudjEuV29ya1Njb3BlVjESEwoLdHRsX3NlY29uZHMYByABKAMSHAoUb3BlcmF0aW9uX2JpbmRpbmdfaWQYCCABKAkSFwoPb3JnYW5pemF0aW9uX2lkGAkgASgJEjQKBWFjdG9yGAogASgLMiUuaG9zdC5hdXRob3JpdHkudjEuV29ya2xvYWRDcmVkZW50aWFsEhEKCW9wZXJhdGlvbhgMIAEoCUIECgJhcyI6ChRJbnN0YWxsYXRpb25TZXR1cFJlZhISCgpzdGVwX3Rva2VuGAEgASgJEg4KBm1ldGhvZBgCIAEoCSImCg1EZWxlZ2F0aW9uUmVmEhUKDWRlbGVnYXRpb25faWQYASABKAkidwoPRGVsZWdhdGVSZXF1ZXN0Eg4KBm1vZHVsZRgBIAEoCRIuCgZzY29wZXMYAiADKAsyHi5ob3N0LmF1dGhvcml0eS52MS5Xb3JrU2NvcGVWMRIPCgdwdXJwb3NlGAMgASgJEhMKC3R0bF9zZWNvbmRzGAQgASgDIscBCgpEZWxlZ2F0aW9uEhUKDWRlbGVnYXRpb25faWQYASABKAkSFwoPb3JnYW5pemF0aW9uX2lkGAIgASgJEg8KB2dyYW50b3IYAyABKAkSDgoGbW9kdWxlGAQgASgJEi4KBnNjb3BlcxgFIAMoCzIeLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtTY29wZVYxEg8KB3B1cnBvc2UYBiABKAkSDgoGYWN0aXZlGAcgASgIEhcKD2V4cGlyZXNfYXRfdW5peBgIIAEoAyJjChRHZXREZWxlZ2F0aW9uUmVxdWVzdBIVCg1kZWxlZ2F0aW9uX2lkGAEgASgJEjQKBWFjdG9yGAIgASgLMiUuaG9zdC5hdXRob3JpdHkudjEuV29ya2xvYWRDcmVkZW50aWFsIjAKF1Jldm9rZURlbGVnYXRpb25SZXF1ZXN0EhUKDWRlbGVnYXRpb25faWQYASABKAkiTQoYUmV2b2tlRGVsZWdhdGlvblJlc3BvbnNlEjEKCmRlbGVnYXRpb24YASABKAsyHS5ob3N0LmF1dGhvcml0eS52MS5EZWxlZ2F0aW9uIiEKDVBlcnNvblNlc3Npb25KBAgBEAJSCnNlc3Npb25faWQiKAoSV29ya2xvYWRDcmVkZW50aWFsEhIKCmNyZWRlbnRpYWwYASABKAkiKgoPSW5zdGFsbGF0aW9uUmVmEhcKD2luc3RhbGxhdGlvbl9pZBgBIAEoCSJqCg1Jc3N1ZVJlc3BvbnNlEg0KBXRva2VuGAEgASgJEhcKD2V4cGlyZXNfYXRfdW5peBgCIAEoAxIxCgdjb250ZXh0GAMgASgLMiAuaG9zdC5hdXRob3JpdHkudjEuV29ya0NvbnRleHRWMSJRCgxDaGVja1JlcXVlc3QSDQoFdG9rZW4YASABKAkSEAoIYXVkaWVuY2UYAiABKAkSDgoGbWV0aG9kGAMgASgJEhAKCGFkdmlzb3J5GAQgASgIInMKDUNoZWNrUmVzcG9uc2USMQoHY29udGV4dBgBIAEoCzIgLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtDb250ZXh0VjESHgoWYXV0aG9yaXphdGlvbl9yZXZpc2lvbhgCIAEoBBIPCgdyZWZ1c2FsGAMgASgJIg0KC0tleXNSZXF1ZXN0IoABCgxLZXlzUmVzcG9uc2USDgoGaXNzdWVyGAEgASgJEioKBGtleXMYAiADKAsyHC5ob3N0LmF1dGhvcml0eS52MS5QdWJsaWNLZXkSNAoOYWRtaXNzaW9uX2tleXMYAyADKAsyHC5ob3N0LmF1dGhvcml0eS52MS5QdWJsaWNLZXkiUwoJUHVibGljS2V5Eg4KBmtleV9pZBgBIAEoCRIRCglhbGdvcml0aG0YAiABKAkSEgoKcHVibGljX2tleRgDIAEoDBIPCgdwdXJwb3NlGAQgASgJInYKG1JlZ2lzdGVyQWRtaXNzaW9uS2V5UmVxdWVzdBI0CgVhY3RvchgBIAEoCzIlLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtsb2FkQ3JlZGVudGlhbBISCgpwdWJsaWNfa2V5GAIgASgMEg0KBXByb29mGAMgASgJImIKHFJlZ2lzdGVyQWRtaXNzaW9uS2V5UmVzcG9uc2USKQoDa2V5GAEgASgLMhwuaG9zdC5hdXRob3JpdHkudjEuUHVibGljS2V5EhcKD2V4cGlyZXNfYXRfdW5peBgCIAEoAyJeChRMaXN0UmVzb3VyY2VzUmVxdWVzdBINCgV0b2tlbhgBIAEoCRIQCghhdWRpZW5jZRgCIAEoCRIVCg1yZXNvdXJjZV9raW5kGAMgASgJEg4KBmFjdGlvbhgEIAEoCSJJChVMaXN0UmVzb3VyY2VzUmVzcG9uc2USMAoGZ3JhbnRzGAEgAygLMiAuaG9zdC5hdXRob3JpdHkudjEuUmVzb3VyY2VHcmFudCKIAQoVQXR0YWNoUmVzb3VyY2VSZXF1ZXN0Eg0KBXRva2VuGAEgASgJEjQKBWFjdG9yGAIgASgLMiUuaG9zdC5hdXRob3JpdHkudjEuV29ya2xvYWRDcmVkZW50aWFsEhUKDXJlc291cmNlX2tpbmQYAyABKAkSEwoLcmVzb3VyY2VfaWQYBCABKAkiMQoWQXR0YWNoUmVzb3VyY2VSZXNwb25zZRIXCg9pbnN0YWxsYXRpb25faWQYASABKAkikgEKFURldGFjaFJlc291cmNlUmVxdWVzdBI0CgVhY3RvchgBIAEoCzIlLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtsb2FkQ3JlZGVudGlhbBIXCg9vcmdhbml6YXRpb25faWQYAiABKAkSFQoNcmVzb3VyY2Vfa2luZBgDIAEoCRITCgtyZXNvdXJjZV9pZBgEIAEoCSIxChZEZXRhY2hSZXNvdXJjZVJlc3BvbnNlEhcKD2luc3RhbGxhdGlvbl9pZBgBIAEoCSK7AQoYQXV0aG9yaXplVHJhbnNmZXJSZXF1ZXN0Eg0KBXRva2VuGAEgASgJEjQKBWFjdG9yGAIgASgLMiUuaG9zdC5hdXRob3JpdHkudjEuV29ya2xvYWRDcmVkZW50aWFsEhUKDXJlc291cmNlX2tpbmQYAyABKAkSEwoLcmVzb3VyY2VfaWQYBCABKAkSFQoNZnJvbV9vd25lcl9pZBgFIAEoCRIXCg90b19wcmluY2lwYWxfaWQYBiABKAkiSAoZQXV0aG9yaXplVHJhbnNmZXJSZXNwb25zZRIUCgxwcmluY2lwYWxfaWQYASABKAkSFQoNYXV0aG9yaXplZF9ieRgCIAEoCSJ1Cg1SZXNvdXJjZUdyYW50Eg0KA2FsbBgBIAEoCEgAEgwKAmlkGAIgASgJSAASEAoGcHJlZml4GAMgASgJSAASEQoHcGF0dGVybhgEIAEoCUgAEhkKEXJlc291cmNlX293bmVyX2lkGAUgASgJQgcKBW1hdGNoMuMIChBBdXRob3JpdHlTZXJ2aWNlEmoKBUlzc3VlEh8uaG9zdC5hdXRob3JpdHkudjEuSXNzdWVSZXF1ZXN0GiAuaG9zdC5hdXRob3JpdHkudjEuSXNzdWVSZXNwb25zZSIegtPkkwIYOgEqIhMvdjEvYXV0aG9yaXR5Omlzc3VlEmoKBUNoZWNrEh8uaG9zdC5hdXRob3JpdHkudjEuQ2hlY2tSZXF1ZXN0GiAuaG9zdC5hdXRob3JpdHkudjEuQ2hlY2tSZXNwb25zZSIegtPkkwIYOgEqIhMvdjEvYXV0aG9yaXR5OmNoZWNrEkcKBEtleXMSHi5ob3N0LmF1dGhvcml0eS52MS5LZXlzUmVxdWVzdBofLmhvc3QuYXV0aG9yaXR5LnYxLktleXNSZXNwb25zZRJ3ChRSZWdpc3RlckFkbWlzc2lvbktleRIuLmhvc3QuYXV0aG9yaXR5LnYxLlJlZ2lzdGVyQWRtaXNzaW9uS2V5UmVxdWVzdBovLmhvc3QuYXV0aG9yaXR5LnYxLlJlZ2lzdGVyQWRtaXNzaW9uS2V5UmVzcG9uc2USYgoNTGlzdFJlc291cmNlcxInLmhvc3QuYXV0aG9yaXR5LnYxLkxpc3RSZXNvdXJjZXNSZXF1ZXN0GiguaG9zdC5hdXRob3JpdHkudjEuTGlzdFJlc291cmNlc1Jlc3BvbnNlEmUKDkF0dGFjaFJlc291cmNlEiguaG9zdC5hdXRob3JpdHkudjEuQXR0YWNoUmVzb3VyY2VSZXF1ZXN0GikuaG9zdC5hdXRob3JpdHkudjEuQXR0YWNoUmVzb3VyY2VSZXNwb25zZRJlCg5EZXRhY2hSZXNvdXJjZRIoLmhvc3QuYXV0aG9yaXR5LnYxLkRldGFjaFJlc291cmNlUmVxdWVzdBopLmhvc3QuYXV0aG9yaXR5LnYxLkRldGFjaFJlc291cmNlUmVzcG9uc2USbgoRQXV0aG9yaXplVHJhbnNmZXISKy5ob3N0LmF1dGhvcml0eS52MS5BdXRob3JpemVUcmFuc2ZlclJlcXVlc3QaLC5ob3N0LmF1dGhvcml0eS52MS5BdXRob3JpemVUcmFuc2ZlclJlc3BvbnNlEk0KCERlbGVnYXRlEiIuaG9zdC5hdXRob3JpdHkudjEuRGVsZWdhdGVSZXF1ZXN0Gh0uaG9zdC5hdXRob3JpdHkudjEuRGVsZWdhdGlvbhJrChBSZXZva2VEZWxlZ2F0aW9uEiouaG9zdC5hdXRob3JpdHkudjEuUmV2b2tlRGVsZWdhdGlvblJlcXVlc3QaKy5ob3N0LmF1dGhvcml0eS52MS5SZXZva2VEZWxlZ2F0aW9uUmVzcG9uc2USVwoNR2V0RGVsZWdhdGlvbhInLmhvc3QuYXV0aG9yaXR5LnYxLkdldERlbGVnYXRpb25SZXF1ZXN0Gh0uaG9zdC5hdXRob3JpdHkudjEuRGVsZWdhdGlvbkIvWi1nYXRld2F5L3BrZy9nZW4vaG9zdC9hdXRob3JpdHkvdjE7YXV0aG9yaXR5djFiBnByb3RvMw", [file_google_api_annotations, file_host_authority_v1_work_context]); /** * IssueRequest names on whose behalf the capability is issued. @@ -78,6 +78,15 @@ export type IssueRequest = Message<"host.authority.v1.IssueRequest"> & { */ value: DelegationRef; case: "delegation"; + } | { + /** + * Current authenticated install callback evidence for one declared setup + * method. Independent of standing roles; requires the solution's actor. + * + * @generated from field: host.authority.v1.InstallationSetupRef setup = 13; + */ + value: InstallationSetupRef; + case: "setup"; } | { case: undefined; value?: undefined }; /** @@ -145,6 +154,35 @@ export type IssueRequest = Message<"host.authority.v1.IssueRequest"> & { export const IssueRequestSchema: GenMessage = /*@__PURE__*/ messageDesc(file_host_authority_v1_authority, 0); +/** + * InstallationSetupRef selects one exact method from the reviewed setup grant. + * The callback token proves the current attempt; it is not data authority. + * + * @generated from message host.authority.v1.InstallationSetupRef + */ +export type InstallationSetupRef = Message<"host.authority.v1.InstallationSetupRef"> & { + /** + * The unexpired standard installation callback credential. + * + * @generated from field: string step_token = 1; + */ + stepToken: string; + + /** + * The exact destination method selected by the setup declaration. + * + * @generated from field: string method = 2; + */ + method: string; +}; + +/** + * Describes the message host.authority.v1.InstallationSetupRef. + * Use `create(InstallationSetupRefSchema)` to create a new message. + */ +export const InstallationSetupRefSchema: GenMessage = /*@__PURE__*/ + messageDesc(file_host_authority_v1_authority, 1); + /** * DelegationRef names one delegation. * @@ -164,7 +202,7 @@ export type DelegationRef = Message<"host.authority.v1.DelegationRef"> & { * Use `create(DelegationRefSchema)` to create a new message. */ export const DelegationRefSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 1); + messageDesc(file_host_authority_v1_authority, 2); /** * DelegateRequest is a signed-in person granting a module the right to act for @@ -209,7 +247,7 @@ export type DelegateRequest = Message<"host.authority.v1.DelegateRequest"> & { * Use `create(DelegateRequestSchema)` to create a new message. */ export const DelegateRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 2); + messageDesc(file_host_authority_v1_authority, 3); /** * Delegation is one grant from a person to a module. @@ -271,7 +309,7 @@ export type Delegation = Message<"host.authority.v1.Delegation"> & { * Use `create(DelegationSchema)` to create a new message. */ export const DelegationSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 3); + messageDesc(file_host_authority_v1_authority, 4); /** * GetDelegationRequest names the delegation read; anyone but its module or its @@ -298,7 +336,7 @@ export type GetDelegationRequest = Message<"host.authority.v1.GetDelegationReque * Use `create(GetDelegationRequestSchema)` to create a new message. */ export const GetDelegationRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 4); + messageDesc(file_host_authority_v1_authority, 5); /** * RevokeDelegationRequest ends a delegation; its grantor may, and so may an @@ -318,7 +356,7 @@ export type RevokeDelegationRequest = Message<"host.authority.v1.RevokeDelegatio * Use `create(RevokeDelegationRequestSchema)` to create a new message. */ export const RevokeDelegationRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 5); + messageDesc(file_host_authority_v1_authority, 6); /** * RevokeDelegationResponse is the delegation as it now stands. @@ -337,7 +375,7 @@ export type RevokeDelegationResponse = Message<"host.authority.v1.RevokeDelegati * Use `create(RevokeDelegationResponseSchema)` to create a new message. */ export const RevokeDelegationResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 6); + messageDesc(file_host_authority_v1_authority, 7); /** * PersonSession names the caller's own session. It carries no field: the person @@ -354,7 +392,7 @@ export type PersonSession = Message<"host.authority.v1.PersonSession"> & { * Use `create(PersonSessionSchema)` to create a new message. */ export const PersonSessionSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 7); + messageDesc(file_host_authority_v1_authority, 8); /** * WorkloadCredential proves which module a running process is: the native @@ -377,7 +415,7 @@ export type WorkloadCredential = Message<"host.authority.v1.WorkloadCredential"> * Use `create(WorkloadCredentialSchema)` to create a new message. */ export const WorkloadCredentialSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 8); + messageDesc(file_host_authority_v1_authority, 9); /** * InstallationRef names an installation acting for itself. @@ -398,7 +436,7 @@ export type InstallationRef = Message<"host.authority.v1.InstallationRef"> & { * Use `create(InstallationRefSchema)` to create a new message. */ export const InstallationRefSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 9); + messageDesc(file_host_authority_v1_authority, 10); /** * IssueResponse carries the signed capability and its decoded form. @@ -433,7 +471,7 @@ export type IssueResponse = Message<"host.authority.v1.IssueResponse"> & { * Use `create(IssueResponseSchema)` to create a new message. */ export const IssueResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 10); + messageDesc(file_host_authority_v1_authority, 11); /** * CheckRequest presents a capability for verification. @@ -496,7 +534,7 @@ export type CheckRequest = Message<"host.authority.v1.CheckRequest"> & { * Use `create(CheckRequestSchema)` to create a new message. */ export const CheckRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 11); + messageDesc(file_host_authority_v1_authority, 12); /** * CheckResponse is the verified capability. @@ -532,7 +570,7 @@ export type CheckResponse = Message<"host.authority.v1.CheckResponse"> & { * Use `create(CheckResponseSchema)` to create a new message. */ export const CheckResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 12); + messageDesc(file_host_authority_v1_authority, 13); /** * KeysRequest asks for the verification keys. @@ -547,7 +585,7 @@ export type KeysRequest = Message<"host.authority.v1.KeysRequest"> & { * Use `create(KeysRequestSchema)` to create a new message. */ export const KeysRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 13); + messageDesc(file_host_authority_v1_authority, 14); /** * KeysResponse is the issuer and its keys. @@ -589,7 +627,7 @@ export type KeysResponse = Message<"host.authority.v1.KeysResponse"> & { * Use `create(KeysResponseSchema)` to create a new message. */ export const KeysResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 14); + messageDesc(file_host_authority_v1_authority, 15); /** * PublicKey is one verification key. @@ -633,7 +671,7 @@ export type PublicKey = Message<"host.authority.v1.PublicKey"> & { * Use `create(PublicKeySchema)` to create a new message. */ export const PublicKeySchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 15); + messageDesc(file_host_authority_v1_authority, 16); /** * RegisterAdmissionKeyRequest presents one hop admission key. @@ -677,7 +715,7 @@ export type RegisterAdmissionKeyRequest = Message<"host.authority.v1.RegisterAdm * Use `create(RegisterAdmissionKeyRequestSchema)` to create a new message. */ export const RegisterAdmissionKeyRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 16); + messageDesc(file_host_authority_v1_authority, 17); /** * RegisterAdmissionKeyResponse is the key as Keys now publishes it. @@ -705,7 +743,7 @@ export type RegisterAdmissionKeyResponse = Message<"host.authority.v1.RegisterAd * Use `create(RegisterAdmissionKeyResponseSchema)` to create a new message. */ export const RegisterAdmissionKeyResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 17); + messageDesc(file_host_authority_v1_authority, 18); /** * ListResourcesRequest asks about one kind and one action. @@ -747,7 +785,7 @@ export type ListResourcesRequest = Message<"host.authority.v1.ListResourcesReque * Use `create(ListResourcesRequestSchema)` to create a new message. */ export const ListResourcesRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 18); + messageDesc(file_host_authority_v1_authority, 19); /** * ListResourcesResponse is every grant the capability holds on the kind for the @@ -768,7 +806,7 @@ export type ListResourcesResponse = Message<"host.authority.v1.ListResourcesResp * Use `create(ListResourcesResponseSchema)` to create a new message. */ export const ListResourcesResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 19); + messageDesc(file_host_authority_v1_authority, 20); /** * AttachResourceRequest names one resource and the capability it was created under. @@ -810,7 +848,7 @@ export type AttachResourceRequest = Message<"host.authority.v1.AttachResourceReq * Use `create(AttachResourceRequestSchema)` to create a new message. */ export const AttachResourceRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 20); + messageDesc(file_host_authority_v1_authority, 21); /** * AttachResourceResponse names the installation that now owns the resource. @@ -831,7 +869,7 @@ export type AttachResourceResponse = Message<"host.authority.v1.AttachResourceRe * Use `create(AttachResourceResponseSchema)` to create a new message. */ export const AttachResourceResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 21); + messageDesc(file_host_authority_v1_authority, 22); /** * DetachResourceRequest names one resource its serving module deleted. @@ -873,7 +911,7 @@ export type DetachResourceRequest = Message<"host.authority.v1.DetachResourceReq * Use `create(DetachResourceRequestSchema)` to create a new message. */ export const DetachResourceRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 22); + messageDesc(file_host_authority_v1_authority, 23); /** * DetachResourceResponse names the installation that owned the resource. @@ -894,7 +932,7 @@ export type DetachResourceResponse = Message<"host.authority.v1.DetachResourceRe * Use `create(DetachResourceResponseSchema)` to create a new message. */ export const DetachResourceResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 23); + messageDesc(file_host_authority_v1_authority, 24); /** * AuthorizeTransferRequest names one existing resource and where it moves. @@ -951,7 +989,7 @@ export type AuthorizeTransferRequest = Message<"host.authority.v1.AuthorizeTrans * Use `create(AuthorizeTransferRequestSchema)` to create a new message. */ export const AuthorizeTransferRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 24); + messageDesc(file_host_authority_v1_authority, 25); /** * AuthorizeTransferResponse is the decision the store records. @@ -979,7 +1017,7 @@ export type AuthorizeTransferResponse = Message<"host.authority.v1.AuthorizeTran * Use `create(AuthorizeTransferResponseSchema)` to create a new message. */ export const AuthorizeTransferResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 25); + messageDesc(file_host_authority_v1_authority, 26); /** * ResourceGrant is one way of naming covered resources. Exactly one match is @@ -1040,7 +1078,7 @@ export type ResourceGrant = Message<"host.authority.v1.ResourceGrant"> & { * Use `create(ResourceGrantSchema)` to create a new message. */ export const ResourceGrantSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 26); + messageDesc(file_host_authority_v1_authority, 27); /** * AuthorityService is implemented by the host (accounts) and by the local authority. diff --git a/libraries/authority-client/typescript/src/gen/host/composition/v1/composition_pb.ts b/libraries/authority-client/typescript/src/gen/host/composition/v1/composition_pb.ts index 569c301f..2628e17c 100644 --- a/libraries/authority-client/typescript/src/gen/host/composition/v1/composition_pb.ts +++ b/libraries/authority-client/typescript/src/gen/host/composition/v1/composition_pb.ts @@ -17,7 +17,7 @@ import type { Message } from "@bufbuild/protobuf"; * Describes the file host/composition/v1/composition.proto. */ export const file_host_composition_v1_composition: GenFile = /*@__PURE__*/ - fileDesc("CiVob3N0L2NvbXBvc2l0aW9uL3YxL2NvbXBvc2l0aW9uLnByb3RvEhNob3N0LmNvbXBvc2l0aW9uLnYxItUBChRBcHBseU1hbmlmZXN0UmVxdWVzdBI3CghtYW5pZmVzdBgBIAEoCzIlLmhvc3QuY29tcG9zaXRpb24udjEuTW9kdWxlTWFuaWZlc3RWMRI2CgdjYXJyaWVyGAIgASgLMiUuaG9zdC5jb21wb3NpdGlvbi52MS5TaWduZWRNYW5pZmVzdFYxEhIKCmNyZWRlbnRpYWwYAyABKAkSOAoJYXV0aG9yaXR5GAQgASgLMiUuaG9zdC5jb21wb3NpdGlvbi52MS5TaWduZWRNYW5pZmVzdFYxIuMCChNBdXRob3JpdHlNYW5pZmVzdFYxEg4KBm1vZHVsZRgBIAEoCRISCgpnZW5lcmF0aW9uGAIgASgEEhwKFGNvcmVfbWFuaWZlc3RfZGlnZXN0GAMgASgJEjQKB21ldGhvZHMYBCADKAsyIy5ob3N0LmNvbXBvc2l0aW9uLnYxLk1ldGhvZFBvbGljeVYxEjYKDnNjb3BlX2NlaWxpbmdzGAUgAygLMh4uaG9zdC5hdXRob3JpdHkudjEuV29ya1Njb3BlVjESKgoFcm9sZXMYBiADKAsyGy5ob3N0LmNvbXBvc2l0aW9uLnYxLlJvbGVWMRITCgtvd25lcl9hd2FyZRgHIAEoCBIZChFpbnN0YWxsYXRpb25fcm9sZRgIIAEoCRJAChFlZGdlX2RlcGVuZGVuY2llcxgJIAMoCzIlLmhvc3QuY29tcG9zaXRpb24udjEuRWRnZURlcGVuZGVuY3lWMSI0ChBFZGdlRGVwZW5kZW5jeVYxEg4KBm1vZHVsZRgBIAEoCRIQCghwcmVzZW5jZRgCIAEoCSJuCg5NZXRob2RQb2xpY3lWMRIOCgZtZXRob2QYASABKAkSMAoIcmVxdWlyZXMYAiADKAsyHi5ob3N0LmF1dGhvcml0eS52MS5Xb3JrU2NvcGVWMRIaChJhbnlfY2hlY2tlZF9jYWxsZXIYAyABKAgiNgoQU2lnbmVkTWFuaWZlc3RWMRIQCghkb2N1bWVudBgBIAEoDBIQCghlbnZlbG9wZRgCIAEoDCJYChVBcHBseU1hbmlmZXN0UmVzcG9uc2USEQoJcHJpbmNpcGFsGAEgASgJEhIKCmdlbmVyYXRpb24YAiABKAQSGAoQaW5zdGFsbGF0aW9uX2lkcxgDIAMoCSKdAgoQTW9kdWxlTWFuaWZlc3RWMRIOCgZtb2R1bGUYASABKAkSEQoJcHJpbmNpcGFsGAIgASgJEgwKBGtpbmQYAyABKAkSEgoKZ2VuZXJhdGlvbhgEIAEoBBIwCghiaW5kaW5ncxgFIAMoCzIeLmhvc3QuY29tcG9zaXRpb24udjEuQmluZGluZ1YxEjsKDnJlc291cmNlX2tpbmRzGAYgAygLMiMuaG9zdC5jb21wb3NpdGlvbi52MS5SZXNvdXJjZUtpbmRWMRIpCgRwYWdlGAcgASgLMhsuaG9zdC5jb21wb3NpdGlvbi52MS5QYWdlVjESKgoFcm9sZXMYCCADKAsyGy5ob3N0LmNvbXBvc2l0aW9uLnYxLlJvbGVWMSKJAQoGUm9sZVYxEgwKBG5hbWUYASABKAkSLgoGc2NvcGVzGAIgAygLMh4uaG9zdC5hdXRob3JpdHkudjEuV29ya1Njb3BlVjESQQoZaW5zdGFsbGF0aW9uX293bmVkX3Njb3BlcxgDIAMoCzIeLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtTY29wZVYxItABCglCaW5kaW5nVjESCgoCaWQYASABKAkSEAoIYXVkaWVuY2UYAiABKAkSNQoNaW52b2tlX3Njb3BlcxgDIAMoCzIeLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtTY29wZVYxEjcKD2hlYWRsZXNzX3Njb3BlcxgEIAMoCzIeLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtTY29wZVYxEjUKDWxvb2t1cF9zY29wZXMYBSADKAsyHi5ob3N0LmF1dGhvcml0eS52MS5Xb3JrU2NvcGVWMSIvCg5SZXNvdXJjZUtpbmRWMRIMCgRraW5kGAEgASgJEg8KB2FjdGlvbnMYAiADKAkiJgoGUGFnZVYxEg0KBXRpdGxlGAEgASgJEg0KBW9yZGVyGAIgASgFMnwKEkNvbXBvc2l0aW9uU2VydmljZRJmCg1BcHBseU1hbmlmZXN0EikuaG9zdC5jb21wb3NpdGlvbi52MS5BcHBseU1hbmlmZXN0UmVxdWVzdBoqLmhvc3QuY29tcG9zaXRpb24udjEuQXBwbHlNYW5pZmVzdFJlc3BvbnNlQjNaMWdhdGV3YXkvcGtnL2dlbi9ob3N0L2NvbXBvc2l0aW9uL3YxO2NvbXBvc2l0aW9udjFiBnByb3RvMw", [file_host_authority_v1_work_context]); + fileDesc("CiVob3N0L2NvbXBvc2l0aW9uL3YxL2NvbXBvc2l0aW9uLnByb3RvEhNob3N0LmNvbXBvc2l0aW9uLnYxItUBChRBcHBseU1hbmlmZXN0UmVxdWVzdBI3CghtYW5pZmVzdBgBIAEoCzIlLmhvc3QuY29tcG9zaXRpb24udjEuTW9kdWxlTWFuaWZlc3RWMRI2CgdjYXJyaWVyGAIgASgLMiUuaG9zdC5jb21wb3NpdGlvbi52MS5TaWduZWRNYW5pZmVzdFYxEhIKCmNyZWRlbnRpYWwYAyABKAkSOAoJYXV0aG9yaXR5GAQgASgLMiUuaG9zdC5jb21wb3NpdGlvbi52MS5TaWduZWRNYW5pZmVzdFYxIrkDChNBdXRob3JpdHlNYW5pZmVzdFYxEg4KBm1vZHVsZRgBIAEoCRISCgpnZW5lcmF0aW9uGAIgASgEEhwKFGNvcmVfbWFuaWZlc3RfZGlnZXN0GAMgASgJEjQKB21ldGhvZHMYBCADKAsyIy5ob3N0LmNvbXBvc2l0aW9uLnYxLk1ldGhvZFBvbGljeVYxEjYKDnNjb3BlX2NlaWxpbmdzGAUgAygLMh4uaG9zdC5hdXRob3JpdHkudjEuV29ya1Njb3BlVjESKgoFcm9sZXMYBiADKAsyGy5ob3N0LmNvbXBvc2l0aW9uLnYxLlJvbGVWMRITCgtvd25lcl9hd2FyZRgHIAEoCBIZChFpbnN0YWxsYXRpb25fcm9sZRgIIAEoCRJAChFlZGdlX2RlcGVuZGVuY2llcxgJIAMoCzIlLmhvc3QuY29tcG9zaXRpb24udjEuRWRnZURlcGVuZGVuY3lWMRIwCgVzZXR1cBgKIAMoCzIhLmhvc3QuY29tcG9zaXRpb24udjEuU2V0dXBHcmFudFYxEiIKGm93bmVyX2F3YXJlX3Jlc291cmNlX2tpbmRzGAsgAygJIkAKDFNldHVwR3JhbnRWMRIPCgdiaW5kaW5nGAEgASgJEg8KB21ldGhvZHMYAiADKAkSDgoGc2NvcGVzGAMgAygJIjQKEEVkZ2VEZXBlbmRlbmN5VjESDgoGbW9kdWxlGAEgASgJEhAKCHByZXNlbmNlGAIgASgJIm4KDk1ldGhvZFBvbGljeVYxEg4KBm1ldGhvZBgBIAEoCRIwCghyZXF1aXJlcxgCIAMoCzIeLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtTY29wZVYxEhoKEmFueV9jaGVja2VkX2NhbGxlchgDIAEoCCI2ChBTaWduZWRNYW5pZmVzdFYxEhAKCGRvY3VtZW50GAEgASgMEhAKCGVudmVsb3BlGAIgASgMIlgKFUFwcGx5TWFuaWZlc3RSZXNwb25zZRIRCglwcmluY2lwYWwYASABKAkSEgoKZ2VuZXJhdGlvbhgCIAEoBBIYChBpbnN0YWxsYXRpb25faWRzGAMgAygJIp0CChBNb2R1bGVNYW5pZmVzdFYxEg4KBm1vZHVsZRgBIAEoCRIRCglwcmluY2lwYWwYAiABKAkSDAoEa2luZBgDIAEoCRISCgpnZW5lcmF0aW9uGAQgASgEEjAKCGJpbmRpbmdzGAUgAygLMh4uaG9zdC5jb21wb3NpdGlvbi52MS5CaW5kaW5nVjESOwoOcmVzb3VyY2Vfa2luZHMYBiADKAsyIy5ob3N0LmNvbXBvc2l0aW9uLnYxLlJlc291cmNlS2luZFYxEikKBHBhZ2UYByABKAsyGy5ob3N0LmNvbXBvc2l0aW9uLnYxLlBhZ2VWMRIqCgVyb2xlcxgIIAMoCzIbLmhvc3QuY29tcG9zaXRpb24udjEuUm9sZVYxIokBCgZSb2xlVjESDAoEbmFtZRgBIAEoCRIuCgZzY29wZXMYAiADKAsyHi5ob3N0LmF1dGhvcml0eS52MS5Xb3JrU2NvcGVWMRJBChlpbnN0YWxsYXRpb25fb3duZWRfc2NvcGVzGAMgAygLMh4uaG9zdC5hdXRob3JpdHkudjEuV29ya1Njb3BlVjEi0AEKCUJpbmRpbmdWMRIKCgJpZBgBIAEoCRIQCghhdWRpZW5jZRgCIAEoCRI1Cg1pbnZva2Vfc2NvcGVzGAMgAygLMh4uaG9zdC5hdXRob3JpdHkudjEuV29ya1Njb3BlVjESNwoPaGVhZGxlc3Nfc2NvcGVzGAQgAygLMh4uaG9zdC5hdXRob3JpdHkudjEuV29ya1Njb3BlVjESNQoNbG9va3VwX3Njb3BlcxgFIAMoCzIeLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtTY29wZVYxIi8KDlJlc291cmNlS2luZFYxEgwKBGtpbmQYASABKAkSDwoHYWN0aW9ucxgCIAMoCSImCgZQYWdlVjESDQoFdGl0bGUYASABKAkSDQoFb3JkZXIYAiABKAUyfAoSQ29tcG9zaXRpb25TZXJ2aWNlEmYKDUFwcGx5TWFuaWZlc3QSKS5ob3N0LmNvbXBvc2l0aW9uLnYxLkFwcGx5TWFuaWZlc3RSZXF1ZXN0GiouaG9zdC5jb21wb3NpdGlvbi52MS5BcHBseU1hbmlmZXN0UmVzcG9uc2VCM1oxZ2F0ZXdheS9wa2cvZ2VuL2hvc3QvY29tcG9zaXRpb24vdjE7Y29tcG9zaXRpb252MWIGcHJvdG8z", [file_host_authority_v1_work_context]); /** * ApplyManifestRequest carries the manifest. @@ -154,6 +154,21 @@ export type AuthorityManifestV1 = Message<"host.composition.v1.AuthorityManifest * @generated from field: repeated host.composition.v1.EdgeDependencyV1 edge_dependencies = 9; */ edgeDependencies: EdgeDependencyV1[]; + + /** + * Resolved installation-only grants; separate from standing roles. + * + * @generated from field: repeated host.composition.v1.SetupGrantV1 setup = 10; + */ + setup: SetupGrantV1[]; + + /** + * Only these served kinds enforce resource-owner selectors. Mutually + * exclusive with owner_aware true; empty means none. + * + * @generated from field: repeated string owner_aware_resource_kinds = 11; + */ + ownerAwareResourceKinds: string[]; }; /** @@ -163,6 +178,41 @@ export type AuthorityManifestV1 = Message<"host.composition.v1.AuthorityManifest export const AuthorityManifestV1Schema: GenMessage = /*@__PURE__*/ messageDesc(file_host_composition_v1_composition, 1); +/** + * SetupGrantV1 retains exact methods even when two methods share requirements. + * + * @generated from message host.composition.v1.SetupGrantV1 + */ +export type SetupGrantV1 = Message<"host.composition.v1.SetupGrantV1"> & { + /** + * The required foreign invoke binding that reaches the destination. + * + * @generated from field: string binding = 1; + */ + binding: string; + + /** + * Exact, unique methods approved for this installation's setup only. + * + * @generated from field: repeated string methods = 2; + */ + methods: string[]; + + /** + * Callee-derived requirements as resource-kind:action, within invoke ceiling. + * + * @generated from field: repeated string scopes = 3; + */ + scopes: string[]; +}; + +/** + * Describes the message host.composition.v1.SetupGrantV1. + * Use `create(SetupGrantV1Schema)` to create a new message. + */ +export const SetupGrantV1Schema: GenMessage = /*@__PURE__*/ + messageDesc(file_host_composition_v1_composition, 2); + /** * EdgeDependencyV1 names the exact signed module principal. The host resolves * it to a live catalogue target; it is not a target UUID, route alias or binding id. @@ -188,7 +238,7 @@ export type EdgeDependencyV1 = Message<"host.composition.v1.EdgeDependencyV1"> & * Use `create(EdgeDependencyV1Schema)` to create a new message. */ export const EdgeDependencyV1Schema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_composition_v1_composition, 2); + messageDesc(file_host_composition_v1_composition, 3); /** * MethodPolicyV1 is what a call to one method must hold, as the module's @@ -226,7 +276,7 @@ export type MethodPolicyV1 = Message<"host.composition.v1.MethodPolicyV1"> & { * Use `create(MethodPolicyV1Schema)` to create a new message. */ export const MethodPolicyV1Schema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_composition_v1_composition, 3); + messageDesc(file_host_composition_v1_composition, 4); /** * SignedManifestV1 is core's signed carrier: the manifest document (JSON) and @@ -251,7 +301,7 @@ export type SignedManifestV1 = Message<"host.composition.v1.SignedManifestV1"> & * Use `create(SignedManifestV1Schema)` to create a new message. */ export const SignedManifestV1Schema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_composition_v1_composition, 4); + messageDesc(file_host_composition_v1_composition, 5); /** * ApplyManifestResponse says what the host derived. @@ -286,7 +336,7 @@ export type ApplyManifestResponse = Message<"host.composition.v1.ApplyManifestRe * Use `create(ApplyManifestResponseSchema)` to create a new message. */ export const ApplyManifestResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_composition_v1_composition, 5); + messageDesc(file_host_composition_v1_composition, 6); /** * ModuleManifestV1 is one module instance at one generation. @@ -359,7 +409,7 @@ export type ModuleManifestV1 = Message<"host.composition.v1.ModuleManifestV1"> & * Use `create(ModuleManifestV1Schema)` to create a new message. */ export const ModuleManifestV1Schema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_composition_v1_composition, 6); + messageDesc(file_host_composition_v1_composition, 7); /** * RoleV1 is one role a solution declares. @@ -397,7 +447,7 @@ export type RoleV1 = Message<"host.composition.v1.RoleV1"> & { * Use `create(RoleV1Schema)` to create a new message. */ export const RoleV1Schema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_composition_v1_composition, 7); + messageDesc(file_host_composition_v1_composition, 8); /** * BindingV1 is one declared call towards another module. @@ -449,7 +499,7 @@ export type BindingV1 = Message<"host.composition.v1.BindingV1"> & { * Use `create(BindingV1Schema)` to create a new message. */ export const BindingV1Schema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_composition_v1_composition, 8); + messageDesc(file_host_composition_v1_composition, 9); /** * ResourceKindV1 is one kind the module governs and the actions on it. @@ -477,7 +527,7 @@ export type ResourceKindV1 = Message<"host.composition.v1.ResourceKindV1"> & { * Use `create(ResourceKindV1Schema)` to create a new message. */ export const ResourceKindV1Schema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_composition_v1_composition, 9); + messageDesc(file_host_composition_v1_composition, 10); /** * PageV1 is a module's frontend contribution. @@ -505,7 +555,7 @@ export type PageV1 = Message<"host.composition.v1.PageV1"> & { * Use `create(PageV1Schema)` to create a new message. */ export const PageV1Schema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_composition_v1_composition, 10); + messageDesc(file_host_composition_v1_composition, 11); /** * CompositionService is implemented by the host and by the local authority. diff --git a/libraries/authority-client/typescript/src/gen/host/installation/v1/installation_pb.ts b/libraries/authority-client/typescript/src/gen/host/installation/v1/installation_pb.ts index 6c7d8894..d81f9691 100644 --- a/libraries/authority-client/typescript/src/gen/host/installation/v1/installation_pb.ts +++ b/libraries/authority-client/typescript/src/gen/host/installation/v1/installation_pb.ts @@ -16,7 +16,7 @@ import type { Message } from "@bufbuild/protobuf"; * Describes the file host/installation/v1/installation.proto. */ export const file_host_installation_v1_installation: GenFile = /*@__PURE__*/ - fileDesc("Cidob3N0L2luc3RhbGxhdGlvbi92MS9pbnN0YWxsYXRpb24ucHJvdG8SFGhvc3QuaW5zdGFsbGF0aW9uLnYxIkwKGkN1cnJlbnRJbnN0YWxsYXRpb25SZXF1ZXN0EhQKDHBhcmVudF90b2tlbhgBIAEoCRIYChBhY3Rvcl9jcmVkZW50aWFsGAIgASgJIm8KE0N1cnJlbnRJbnN0YWxsYXRpb24SCgoCaWQYASABKAkSFwoPb3JnYW5pemF0aW9uX2lkGAIgASgJEg4KBnRhcmdldBgDIAEoCRIQCghyZXZpc2lvbhgEIAEoBBIRCgluYW1lc3BhY2UYBSABKAkimQEKDkluc3RhbGxSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCRIOCgZ0YXJnZXQYAiABKAkSDAoEcm9sZRgDIAEoCRIXCg9vd25lcl9wZXJzb25faWQYBCABKAkSNwoIYXBwcm92YWwYBSABKAsyJS5ob3N0Lmluc3RhbGxhdGlvbi52MS5Db25zZW50QXBwcm92YWwiOAoNUmV2aWV3UmVxdWVzdBIXCg9vcmdhbml6YXRpb25faWQYASABKAkSDgoGdGFyZ2V0GAIgASgJInkKD0NvbnNlbnRBcHByb3ZhbBIRCgl0YXJnZXRfaWQYASABKAkSEgoKZ2VuZXJhdGlvbhgCIAEoBBIZChFleHBlY3RlZF9yZXZpc2lvbhgDIAEoBBIUCgxvcGVyYXRpb25faWQYBCABKAkSDgoGZGlnZXN0GAUgASgJInYKEEdyYW50Um9sZVJlcXVlc3QSFwoPb3JnYW5pemF0aW9uX2lkGAEgASgJEhcKD2luc3RhbGxhdGlvbl9pZBgCIAEoCRIMCgRyb2xlGAMgASgJEhEKCXBlcnNvbl9pZBgEIAEoCRIPCgd0ZWFtX2lkGAUgASgJIncKEVJldm9rZVJvbGVSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCRIXCg9pbnN0YWxsYXRpb25faWQYAiABKAkSDAoEcm9sZRgDIAEoCRIRCglwZXJzb25faWQYBCABKAkSDwoHdGVhbV9pZBgFIAEoCSJJChVMaXN0Um9sZUdyYW50c1JlcXVlc3QSFwoPb3JnYW5pemF0aW9uX2lkGAEgASgJEhcKD2luc3RhbGxhdGlvbl9pZBgCIAEoCSJJChZMaXN0Um9sZUdyYW50c1Jlc3BvbnNlEi8KBmdyYW50cxgBIAMoCzIfLmhvc3QuaW5zdGFsbGF0aW9uLnYxLlJvbGVHcmFudCI9CglSb2xlR3JhbnQSDAoEcm9sZRgBIAEoCRIRCglwZXJzb25faWQYAiABKAkSDwoHdGVhbV9pZBgDIAEoCSImCgtMaXN0UmVxdWVzdBIXCg9vcmdhbml6YXRpb25faWQYASABKAkiSQoMTGlzdFJlc3BvbnNlEjkKDWluc3RhbGxhdGlvbnMYASADKAsyIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24i3QIKDEluc3RhbGxhdGlvbhIKCgJpZBgBIAEoCRIXCg9vcmdhbml6YXRpb25faWQYAiABKAkSDgoGdGFyZ2V0GAMgASgJEjkKBnN0YXR1cxgEIAEoDjIpLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbi5TdGF0dXMSEAoIcmV2aXNpb24YBSABKAQSDAoEcm9sZRgGIAEoCRIRCgluYW1lc3BhY2UYCSABKAkSFAoMcHJpbmNpcGFsX2lkGAogASgJEg0KBXJvbGVzGAsgAygJIlsKBlN0YXR1cxIWChJTVEFUVVNfVU5TUEVDSUZJRUQQABISCg5TVEFUVVNfUEVORElORxABEhEKDVNUQVRVU19BQ1RJVkUQAhISCg5TVEFUVVNfUkVWT0tFRBADSgQIBxAISgQICBAJUgh0ZWFtX2lkc1ISYWdlbnRfcHJpbmNpcGFsX2lkIk4KEkluc3RhbGxhdGlvbk5vdGljZRI4CgxpbnN0YWxsYXRpb24YASABKAsyIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24iEQoPSW5zdGFsbGF0aW9uQWNrIiwKEUxpc3RPZmZlcnNSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCSJBChJMaXN0T2ZmZXJzUmVzcG9uc2USKwoGb2ZmZXJzGAEgAygLMhsuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXIiKwoFT2ZmZXISDgoGdGFyZ2V0GAEgASgJEhIKCmdlbmVyYXRpb24YAiABKAQi7AIKDVJldmlld2VkT2ZmZXISNwoIYXBwcm92YWwYASABKAsyJS5ob3N0Lmluc3RhbGxhdGlvbi52MS5Db25zZW50QXBwcm92YWwSDgoGdGFyZ2V0GAIgASgJEi4KBXJvbGVzGAMgAygLMh8uaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJSb2xlEjgKDGluc3RhbGxhdGlvbhgEIAEoCzIiLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbhIzCgdjZWlsaW5nGAUgAygLMiIuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJCaW5kaW5nEhYKDnRvb2xzX2NvbXBvc2VkGAYgASgIEhkKEWluc3RhbGxhdGlvbl9yb2xlGAcgASgJEkAKEWVkZ2VfZGVwZW5kZW5jaWVzGAggAygLMiUuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJEZXBlbmRlbmN5IjMKD09mZmVyRGVwZW5kZW5jeRIOCgZtb2R1bGUYASABKAkSEAoIcHJlc2VuY2UYAiABKAkiYQoMT2ZmZXJCaW5kaW5nEg8KB2JpbmRpbmcYASABKAkSDgoGbW9kdWxlGAIgASgJEjAKBnNjb3BlcxgDIAMoCzIgLmhvc3QuaW5zdGFsbGF0aW9uLnYxLk9mZmVyU2NvcGUiiAEKCU9mZmVyUm9sZRIMCgRuYW1lGAEgASgJEjAKBnNjb3BlcxgCIAMoCzIgLmhvc3QuaW5zdGFsbGF0aW9uLnYxLk9mZmVyU2NvcGUSOwoMY2FwYWJpbGl0aWVzGAMgAygLMiUuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJDYXBhYmlsaXR5ImEKCk9mZmVyU2NvcGUSFQoNcmVzb3VyY2Vfa2luZBgBIAEoCRIPCgdhY3Rpb25zGAIgAygJEhUKDWF0dGFjaGVkX29ubHkYAyABKAgSFAoMcmVzb3VyY2VfaWRzGAQgAygJIpgBCg9PZmZlckNhcGFiaWxpdHkSDgoGbW9kdWxlGAEgASgJEhEKCW9wZXJhdGlvbhgCIAEoCRIyCghyZXF1aXJlcxgDIAMoCzIgLmhvc3QuaW5zdGFsbGF0aW9uLnYxLk9mZmVyU2NvcGUSLgoFdG9vbHMYBCADKAsyHy5ob3N0Lmluc3RhbGxhdGlvbi52MS5PZmZlclRvb2wiOQoJT2ZmZXJUb29sEgwKBG5hbWUYASABKAkSDwoHYmluZGluZxgCIAEoCRINCgV3cml0ZRgDIAEoCCIqCg9MaXN0SGVsZFJlcXVlc3QSFwoPb3JnYW5pemF0aW9uX2lkGAEgASgJIlEKEExpc3RIZWxkUmVzcG9uc2USPQoNaW5zdGFsbGF0aW9ucxgBIAMoCzImLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkhlbGRJbnN0YWxsYXRpb24iWwoQSGVsZEluc3RhbGxhdGlvbhI4CgxpbnN0YWxsYXRpb24YASABKAsyIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24SDQoFcm9sZXMYAiADKAky8wUKE0luc3RhbGxhdGlvblNlcnZpY2USZgoHQ3VycmVudBIwLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkN1cnJlbnRJbnN0YWxsYXRpb25SZXF1ZXN0GikuaG9zdC5pbnN0YWxsYXRpb24udjEuQ3VycmVudEluc3RhbGxhdGlvbhJTCgdJbnN0YWxsEiQuaG9zdC5pbnN0YWxsYXRpb24udjEuSW5zdGFsbFJlcXVlc3QaIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24SVAoGUmV2aWV3EiMuaG9zdC5pbnN0YWxsYXRpb24udjEuUmV2aWV3UmVxdWVzdBolLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkNvbnNlbnRBcHByb3ZhbBJXCglHcmFudFJvbGUSJi5ob3N0Lmluc3RhbGxhdGlvbi52MS5HcmFudFJvbGVSZXF1ZXN0GiIuaG9zdC5pbnN0YWxsYXRpb24udjEuSW5zdGFsbGF0aW9uElkKClJldm9rZVJvbGUSJy5ob3N0Lmluc3RhbGxhdGlvbi52MS5SZXZva2VSb2xlUmVxdWVzdBoiLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbhJrCg5MaXN0Um9sZUdyYW50cxIrLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkxpc3RSb2xlR3JhbnRzUmVxdWVzdBosLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkxpc3RSb2xlR3JhbnRzUmVzcG9uc2USTQoETGlzdBIhLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkxpc3RSZXF1ZXN0GiIuaG9zdC5pbnN0YWxsYXRpb24udjEuTGlzdFJlc3BvbnNlElkKCExpc3RIZWxkEiUuaG9zdC5pbnN0YWxsYXRpb24udjEuTGlzdEhlbGRSZXF1ZXN0GiYuaG9zdC5pbnN0YWxsYXRpb24udjEuTGlzdEhlbGRSZXNwb25zZTJwChJJbnN0YWxsYWJsZVNlcnZpY2USWgoHSW5zdGFsbBIoLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbk5vdGljZRolLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbkFjazLIAQoMT2ZmZXJTZXJ2aWNlEl8KCkxpc3RPZmZlcnMSJy5ob3N0Lmluc3RhbGxhdGlvbi52MS5MaXN0T2ZmZXJzUmVxdWVzdBooLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkxpc3RPZmZlcnNSZXNwb25zZRJXCgtSZXZpZXdPZmZlchIjLmhvc3QuaW5zdGFsbGF0aW9uLnYxLlJldmlld1JlcXVlc3QaIy5ob3N0Lmluc3RhbGxhdGlvbi52MS5SZXZpZXdlZE9mZmVyQjVaM2dhdGV3YXkvcGtnL2dlbi9ob3N0L2luc3RhbGxhdGlvbi92MTtpbnN0YWxsYXRpb252MWIGcHJvdG8z"); + fileDesc("Cidob3N0L2luc3RhbGxhdGlvbi92MS9pbnN0YWxsYXRpb24ucHJvdG8SFGhvc3QuaW5zdGFsbGF0aW9uLnYxIkwKGkN1cnJlbnRJbnN0YWxsYXRpb25SZXF1ZXN0EhQKDHBhcmVudF90b2tlbhgBIAEoCRIYChBhY3Rvcl9jcmVkZW50aWFsGAIgASgJIm8KE0N1cnJlbnRJbnN0YWxsYXRpb24SCgoCaWQYASABKAkSFwoPb3JnYW5pemF0aW9uX2lkGAIgASgJEg4KBnRhcmdldBgDIAEoCRIQCghyZXZpc2lvbhgEIAEoBBIRCgluYW1lc3BhY2UYBSABKAkimQEKDkluc3RhbGxSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCRIOCgZ0YXJnZXQYAiABKAkSDAoEcm9sZRgDIAEoCRIXCg9vd25lcl9wZXJzb25faWQYBCABKAkSNwoIYXBwcm92YWwYBSABKAsyJS5ob3N0Lmluc3RhbGxhdGlvbi52MS5Db25zZW50QXBwcm92YWwiOAoNUmV2aWV3UmVxdWVzdBIXCg9vcmdhbml6YXRpb25faWQYASABKAkSDgoGdGFyZ2V0GAIgASgJInkKD0NvbnNlbnRBcHByb3ZhbBIRCgl0YXJnZXRfaWQYASABKAkSEgoKZ2VuZXJhdGlvbhgCIAEoBBIZChFleHBlY3RlZF9yZXZpc2lvbhgDIAEoBBIUCgxvcGVyYXRpb25faWQYBCABKAkSDgoGZGlnZXN0GAUgASgJInYKEEdyYW50Um9sZVJlcXVlc3QSFwoPb3JnYW5pemF0aW9uX2lkGAEgASgJEhcKD2luc3RhbGxhdGlvbl9pZBgCIAEoCRIMCgRyb2xlGAMgASgJEhEKCXBlcnNvbl9pZBgEIAEoCRIPCgd0ZWFtX2lkGAUgASgJIncKEVJldm9rZVJvbGVSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCRIXCg9pbnN0YWxsYXRpb25faWQYAiABKAkSDAoEcm9sZRgDIAEoCRIRCglwZXJzb25faWQYBCABKAkSDwoHdGVhbV9pZBgFIAEoCSJJChVMaXN0Um9sZUdyYW50c1JlcXVlc3QSFwoPb3JnYW5pemF0aW9uX2lkGAEgASgJEhcKD2luc3RhbGxhdGlvbl9pZBgCIAEoCSJJChZMaXN0Um9sZUdyYW50c1Jlc3BvbnNlEi8KBmdyYW50cxgBIAMoCzIfLmhvc3QuaW5zdGFsbGF0aW9uLnYxLlJvbGVHcmFudCI9CglSb2xlR3JhbnQSDAoEcm9sZRgBIAEoCRIRCglwZXJzb25faWQYAiABKAkSDwoHdGVhbV9pZBgDIAEoCSImCgtMaXN0UmVxdWVzdBIXCg9vcmdhbml6YXRpb25faWQYASABKAkiSQoMTGlzdFJlc3BvbnNlEjkKDWluc3RhbGxhdGlvbnMYASADKAsyIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24i3QIKDEluc3RhbGxhdGlvbhIKCgJpZBgBIAEoCRIXCg9vcmdhbml6YXRpb25faWQYAiABKAkSDgoGdGFyZ2V0GAMgASgJEjkKBnN0YXR1cxgEIAEoDjIpLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbi5TdGF0dXMSEAoIcmV2aXNpb24YBSABKAQSDAoEcm9sZRgGIAEoCRIRCgluYW1lc3BhY2UYCSABKAkSFAoMcHJpbmNpcGFsX2lkGAogASgJEg0KBXJvbGVzGAsgAygJIlsKBlN0YXR1cxIWChJTVEFUVVNfVU5TUEVDSUZJRUQQABISCg5TVEFUVVNfUEVORElORxABEhEKDVNUQVRVU19BQ1RJVkUQAhISCg5TVEFUVVNfUkVWT0tFRBADSgQIBxAISgQICBAJUgh0ZWFtX2lkc1ISYWdlbnRfcHJpbmNpcGFsX2lkIk4KEkluc3RhbGxhdGlvbk5vdGljZRI4CgxpbnN0YWxsYXRpb24YASABKAsyIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24iEQoPSW5zdGFsbGF0aW9uQWNrIiwKEUxpc3RPZmZlcnNSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCSJBChJMaXN0T2ZmZXJzUmVzcG9uc2USKwoGb2ZmZXJzGAEgAygLMhsuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXIiKwoFT2ZmZXISDgoGdGFyZ2V0GAEgASgJEhIKCmdlbmVyYXRpb24YAiABKAQinQMKDVJldmlld2VkT2ZmZXISNwoIYXBwcm92YWwYASABKAsyJS5ob3N0Lmluc3RhbGxhdGlvbi52MS5Db25zZW50QXBwcm92YWwSDgoGdGFyZ2V0GAIgASgJEi4KBXJvbGVzGAMgAygLMh8uaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJSb2xlEjgKDGluc3RhbGxhdGlvbhgEIAEoCzIiLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbhIzCgdjZWlsaW5nGAUgAygLMiIuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJCaW5kaW5nEhYKDnRvb2xzX2NvbXBvc2VkGAYgASgIEhkKEWluc3RhbGxhdGlvbl9yb2xlGAcgASgJEkAKEWVkZ2VfZGVwZW5kZW5jaWVzGAggAygLMiUuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJEZXBlbmRlbmN5Ei8KBXNldHVwGAkgAygLMiAuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJTZXR1cCJwCgpPZmZlclNldHVwEg8KB2JpbmRpbmcYASABKAkSDgoGbW9kdWxlGAIgASgJEg8KB21ldGhvZHMYAyADKAkSMAoGc2NvcGVzGAQgAygLMiAuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJTY29wZSIzCg9PZmZlckRlcGVuZGVuY3kSDgoGbW9kdWxlGAEgASgJEhAKCHByZXNlbmNlGAIgASgJImEKDE9mZmVyQmluZGluZxIPCgdiaW5kaW5nGAEgASgJEg4KBm1vZHVsZRgCIAEoCRIwCgZzY29wZXMYAyADKAsyIC5ob3N0Lmluc3RhbGxhdGlvbi52MS5PZmZlclNjb3BlIogBCglPZmZlclJvbGUSDAoEbmFtZRgBIAEoCRIwCgZzY29wZXMYAiADKAsyIC5ob3N0Lmluc3RhbGxhdGlvbi52MS5PZmZlclNjb3BlEjsKDGNhcGFiaWxpdGllcxgDIAMoCzIlLmhvc3QuaW5zdGFsbGF0aW9uLnYxLk9mZmVyQ2FwYWJpbGl0eSJhCgpPZmZlclNjb3BlEhUKDXJlc291cmNlX2tpbmQYASABKAkSDwoHYWN0aW9ucxgCIAMoCRIVCg1hdHRhY2hlZF9vbmx5GAMgASgIEhQKDHJlc291cmNlX2lkcxgEIAMoCSKYAQoPT2ZmZXJDYXBhYmlsaXR5Eg4KBm1vZHVsZRgBIAEoCRIRCglvcGVyYXRpb24YAiABKAkSMgoIcmVxdWlyZXMYAyADKAsyIC5ob3N0Lmluc3RhbGxhdGlvbi52MS5PZmZlclNjb3BlEi4KBXRvb2xzGAQgAygLMh8uaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJUb29sIjkKCU9mZmVyVG9vbBIMCgRuYW1lGAEgASgJEg8KB2JpbmRpbmcYAiABKAkSDQoFd3JpdGUYAyABKAgiKgoPTGlzdEhlbGRSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCSJRChBMaXN0SGVsZFJlc3BvbnNlEj0KDWluc3RhbGxhdGlvbnMYASADKAsyJi5ob3N0Lmluc3RhbGxhdGlvbi52MS5IZWxkSW5zdGFsbGF0aW9uIlsKEEhlbGRJbnN0YWxsYXRpb24SOAoMaW5zdGFsbGF0aW9uGAEgASgLMiIuaG9zdC5pbnN0YWxsYXRpb24udjEuSW5zdGFsbGF0aW9uEg0KBXJvbGVzGAIgAygJMvMFChNJbnN0YWxsYXRpb25TZXJ2aWNlEmYKB0N1cnJlbnQSMC5ob3N0Lmluc3RhbGxhdGlvbi52MS5DdXJyZW50SW5zdGFsbGF0aW9uUmVxdWVzdBopLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkN1cnJlbnRJbnN0YWxsYXRpb24SUwoHSW5zdGFsbBIkLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxSZXF1ZXN0GiIuaG9zdC5pbnN0YWxsYXRpb24udjEuSW5zdGFsbGF0aW9uElQKBlJldmlldxIjLmhvc3QuaW5zdGFsbGF0aW9uLnYxLlJldmlld1JlcXVlc3QaJS5ob3N0Lmluc3RhbGxhdGlvbi52MS5Db25zZW50QXBwcm92YWwSVwoJR3JhbnRSb2xlEiYuaG9zdC5pbnN0YWxsYXRpb24udjEuR3JhbnRSb2xlUmVxdWVzdBoiLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbhJZCgpSZXZva2VSb2xlEicuaG9zdC5pbnN0YWxsYXRpb24udjEuUmV2b2tlUm9sZVJlcXVlc3QaIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24SawoOTGlzdFJvbGVHcmFudHMSKy5ob3N0Lmluc3RhbGxhdGlvbi52MS5MaXN0Um9sZUdyYW50c1JlcXVlc3QaLC5ob3N0Lmluc3RhbGxhdGlvbi52MS5MaXN0Um9sZUdyYW50c1Jlc3BvbnNlEk0KBExpc3QSIS5ob3N0Lmluc3RhbGxhdGlvbi52MS5MaXN0UmVxdWVzdBoiLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkxpc3RSZXNwb25zZRJZCghMaXN0SGVsZBIlLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkxpc3RIZWxkUmVxdWVzdBomLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkxpc3RIZWxkUmVzcG9uc2UycAoSSW5zdGFsbGFibGVTZXJ2aWNlEloKB0luc3RhbGwSKC5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb25Ob3RpY2UaJS5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb25BY2syyAEKDE9mZmVyU2VydmljZRJfCgpMaXN0T2ZmZXJzEicuaG9zdC5pbnN0YWxsYXRpb24udjEuTGlzdE9mZmVyc1JlcXVlc3QaKC5ob3N0Lmluc3RhbGxhdGlvbi52MS5MaXN0T2ZmZXJzUmVzcG9uc2USVwoLUmV2aWV3T2ZmZXISIy5ob3N0Lmluc3RhbGxhdGlvbi52MS5SZXZpZXdSZXF1ZXN0GiMuaG9zdC5pbnN0YWxsYXRpb24udjEuUmV2aWV3ZWRPZmZlckI1WjNnYXRld2F5L3BrZy9nZW4vaG9zdC9pbnN0YWxsYXRpb24vdjE7aW5zdGFsbGF0aW9udjFiBnByb3RvMw"); /** * @generated from message host.installation.v1.CurrentInstallationRequest @@ -713,6 +713,13 @@ export type ReviewedOffer = Message<"host.installation.v1.ReviewedOffer"> & { * @generated from field: repeated host.installation.v1.OfferDependency edge_dependencies = 8; */ edgeDependencies: OfferDependency[]; + + /** + * Temporary installation-confined grants, not standing roles. + * + * @generated from field: repeated host.installation.v1.OfferSetup setup = 9; + */ + setup: OfferSetup[]; }; /** @@ -722,6 +729,48 @@ export type ReviewedOffer = Message<"host.installation.v1.ReviewedOffer"> & { export const ReviewedOfferSchema: GenMessage = /*@__PURE__*/ messageDesc(file_host_installation_v1_installation, 18); +/** + * OfferSetup explains the exact authority usable only while setup is pending. + * + * @generated from message host.installation.v1.OfferSetup + */ +export type OfferSetup = Message<"host.installation.v1.OfferSetup"> & { + /** + * The declared binding. + * + * @generated from field: string binding = 1; + */ + binding: string; + + /** + * The destination principal. + * + * @generated from field: string module = 2; + */ + module: string; + + /** + * The exact allowed methods, even if other methods share their scopes. + * + * @generated from field: repeated string methods = 3; + */ + methods: string[]; + + /** + * Requirements, always confined to the pending installation's owner. + * + * @generated from field: repeated host.installation.v1.OfferScope scopes = 4; + */ + scopes: OfferScope[]; +}; + +/** + * Describes the message host.installation.v1.OfferSetup. + * Use `create(OfferSetupSchema)` to create a new message. + */ +export const OfferSetupSchema: GenMessage = /*@__PURE__*/ + messageDesc(file_host_installation_v1_installation, 19); + /** * OfferDependency carries presence only, never scopes or inferred binding ids. * Module is the exact signed principal, resolved by the host to its live target. @@ -745,7 +794,7 @@ export type OfferDependency = Message<"host.installation.v1.OfferDependency"> & * Use `create(OfferDependencySchema)` to create a new message. */ export const OfferDependencySchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_installation_v1_installation, 19); + messageDesc(file_host_installation_v1_installation, 20); /** * OfferBinding is one declared call from the solution to a module. @@ -776,7 +825,7 @@ export type OfferBinding = Message<"host.installation.v1.OfferBinding"> & { * Use `create(OfferBindingSchema)` to create a new message. */ export const OfferBindingSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_installation_v1_installation, 20); + messageDesc(file_host_installation_v1_installation, 21); /** * OfferRole is one declared role and what a grant of it reaches. @@ -809,7 +858,7 @@ export type OfferRole = Message<"host.installation.v1.OfferRole"> & { * Use `create(OfferRoleSchema)` to create a new message. */ export const OfferRoleSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_installation_v1_installation, 21); + messageDesc(file_host_installation_v1_installation, 22); /** * OfferScope is one declared scope. @@ -847,7 +896,7 @@ export type OfferScope = Message<"host.installation.v1.OfferScope"> & { * Use `create(OfferScopeSchema)` to create a new message. */ export const OfferScopeSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_installation_v1_installation, 22); + messageDesc(file_host_installation_v1_installation, 23); /** * OfferCapability is one module operation a role's scopes cover. @@ -888,7 +937,7 @@ export type OfferCapability = Message<"host.installation.v1.OfferCapability"> & * Use `create(OfferCapabilitySchema)` to create a new message. */ export const OfferCapabilitySchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_installation_v1_installation, 23); + messageDesc(file_host_installation_v1_installation, 24); /** * OfferTool is one tool-exposed Runnable of an operation. @@ -923,7 +972,7 @@ export type OfferTool = Message<"host.installation.v1.OfferTool"> & { * Use `create(OfferToolSchema)` to create a new message. */ export const OfferToolSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_installation_v1_installation, 24); + messageDesc(file_host_installation_v1_installation, 25); /** * ListHeldRequest names the organisation the person reads at: the one their @@ -945,7 +994,7 @@ export type ListHeldRequest = Message<"host.installation.v1.ListHeldRequest"> & * Use `create(ListHeldRequestSchema)` to create a new message. */ export const ListHeldRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_installation_v1_installation, 25); + messageDesc(file_host_installation_v1_installation, 26); /** * ListHeldResponse is every installation the person holds a role on, sorted @@ -967,7 +1016,7 @@ export type ListHeldResponse = Message<"host.installation.v1.ListHeldResponse"> * Use `create(ListHeldResponseSchema)` to create a new message. */ export const ListHeldResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_installation_v1_installation, 26); + messageDesc(file_host_installation_v1_installation, 27); /** * HeldInstallation is one installation the person may use. @@ -995,7 +1044,7 @@ export type HeldInstallation = Message<"host.installation.v1.HeldInstallation"> * Use `create(HeldInstallationSchema)` to create a new message. */ export const HeldInstallationSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_installation_v1_installation, 27); + messageDesc(file_host_installation_v1_installation, 28); /** * InstallationService is implemented by the host and by the local authority. diff --git a/libraries/authority-core/go/authority/check.go b/libraries/authority-core/go/authority/check.go index 8a0b6f77..c2fcc6b7 100644 --- a/libraries/authority-core/go/authority/check.go +++ b/libraries/authority-core/go/authority/check.go @@ -75,6 +75,10 @@ func (s *Service) CheckMethod(ctx context.Context, token, audience, method strin verified, revision, err = s.VerifyInstallationStep(ctx, token, audience) return verified, revision, nil, err } + if isSetupOperation(token) { + verified, revision, err = s.verifyInstallationSetup(ctx, token, audience, method) + return verified, revision, nil, err + } if verified, revision, err = s.Check(ctx, token, audience); err != nil || method == "" { return verified, revision, nil, err } diff --git a/libraries/authority-core/go/authority/installation_setup.go b/libraries/authority-core/go/authority/installation_setup.go new file mode 100644 index 00000000..52eaf885 --- /dev/null +++ b/libraries/authority-core/go/authority/installation_setup.go @@ -0,0 +1,291 @@ +package authority + +import ( + "context" + "crypto/sha256" + "encoding/json" + "errors" + "fmt" + "slices" + "strings" + "time" + + "github.com/codefly-dev/authority/libraries/authority-core/go/decide" + "github.com/codefly-dev/authority/libraries/authority-core/go/domain" + "github.com/codefly-dev/authority/libraries/authority-core/go/scope" + modulecontract "github.com/codefly-dev/core/contracts/module" + basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0" + "github.com/codefly-dev/core/workcontext" +) + +const setupBindingPrefix = "installation-setup:" + +// IssueForInstallationSetup uses callback evidence to grant one reviewed setup +// method. It does not attenuate the callback's delivery scope into data authority. +// The adapter authenticates w with the same workload attestation as ordinary Issue. +func (s *Service) IssueForInstallationSetup(ctx context.Context, w Workload, stepToken, method string, r IssueRequest) (Issued, error) { + if r.Operation != "" || r.Binding == "" || method == "" { + return Issued{}, domain.Refuse("setup names a binding and exact method, not an ordinary operation") + } + var solution domain.Module + err := s.store.Read(ctx, func(tx Tx) error { var err error; solution, err = tx.ModuleNamed(w.Module); return err }) + if err != nil { + return Issued{}, notFound(err) + } + step, _, err := s.VerifyInstallationStep(ctx, stepToken, solution.Principal) + if err != nil { + return Issued{}, err + } + src, err := s.setupSource(ctx, step.Context().GetSeal().GetInstallationId(), r.Binding, method) + if err != nil { + return Issued{}, err + } + // Source capture must remain bound to the callback we authenticated, not + // merely to whichever approval now occupies the same installation ID. + witness := step.Context() + if witness.GetOperationBinding().GetBindingId() != src.stepSeals.bindingID() || + witness.GetOwnerPrincipalId() != src.principal || witness.GetAuthorizationRevision() != src.revision { + return Issued{}, domain.NotNow("authenticated installation callback attempt changed") + } + if src.attempt.Target != w.Module || (r.Audience != "" && r.Audience != src.audience) || (r.Organization != "" && r.Organization != src.attempt.Organization) { + return Issued{}, domain.Refuse("setup workload, audience and organization must match the reviewed attempt") + } + scopes, err := decide.Issue(r.Scopes, src.scopes) + if err != nil { + return Issued{}, err + } + if err := decide.AdmitMethod(src.destination, method, scopes); err != nil { + return Issued{}, err + } + now := s.cfg.Clock() + ttl := min(time.Unix(step.Context().GetExpiresAtUnix(), 0).Sub(now), MaxInstallationStepTTL, s.cfg.MaxTTL) + if r.TTL > 0 { + ttl = min(ttl, r.TTL) + } + if ttl <= 0 { + return Issued{}, domain.NotNow("setup evidence expired") + } + minter := *s.authority + minter.Seals, minter.Now = src, func() time.Time { return now } + token, claims, err := minter.Start(ctx, workcontext.StartInput{ + TenantID: src.attempt.Organization, OrganizationID: src.attempt.Organization, + OwnerPrincipalID: src.principal, OwnerPrincipalKind: "agent", OwnerAgentID: src.attempt.Target, + TaskID: src.attempt.Consent.OperationID, Audience: src.audience, + InstallationID: src.attempt.InstallationID, OperationBindingID: src.bindingID(), + AuthorityScopes: scopes, TTL: ttl, ReplayPolicy: workcontext.ReplayIdempotent, + }) + if err != nil { + return Issued{}, err + } + if err := src.current(ctx); err != nil { + return Issued{}, err + } + if claims.GetAuthorizationRevision() != src.revision || !s.cfg.Clock().Before(time.Unix(claims.GetExpiresAtUnix(), 0)) { + return Issued{}, domain.NotNow("setup changed or expired during issuance") + } + return Issued{token, claims}, nil +} + +// setupSeals supplies pending state only for this exact reviewed operation. +// The opaque binding fingerprints every live destination and consent boundary. +type setupSeals struct { + stepSeals + binding, method, audience string + destination domain.Module + destinationInstallation domain.Installation + scopes Scopes + ownerAwareRevision uint64 +} + +func (s *Service) setupSource(ctx context.Context, installation, binding, method string) (setupSeals, error) { + step, err := s.stepSource(ctx, installation) + if err != nil { + return setupSeals{}, err + } + src := setupSeals{stepSeals: step, binding: binding, method: method} + err = s.store.Read(ctx, func(tx Tx) error { + m, err := tx.ModuleNamed(step.attempt.Target) + if err != nil { + return err + } + i := slices.IndexFunc(m.Setup, func(e modulecontract.ResolvedSetup) bool { + return e.Binding == binding && slices.Contains(e.Methods, method) + }) + if i < 0 { + return domain.Refuse("method is not declared for this setup binding") + } + b, ok := m.Bindings[binding] + if !ok || b.Audience == m.Principal { + return domain.Refuse("setup binding must reach a declared foreign audience") + } + inst, err := tx.Installation(installation) + if err != nil { + return err + } + if inst.Bindings != nil { + consented, ok := inst.Bindings[binding] + if !ok || consented.Audience != b.Audience { + return domain.Refuse("setup binding is not consented") + } + b.InvokeScopes = scope.Intersect(b.InvokeScopes, consented.InvokeScopes) + } + src.audience = b.Audience + if src.destination, err = tx.Module(b.Audience); err != nil { + return err + } + if src.destinationInstallation, err = installationOf(tx, inst.Organization, src.destination.Name); err != nil { + return err + } + if src.destinationInstallation.Status != domain.Active { + return domain.NotNow("setup destination is not active") + } + policy, ok := src.destination.Methods[method] + if !ok || policy.AnyCheckedCaller || len(policy.Requires) == 0 { + return domain.Refuse("setup requires an explicit served method policy") + } + var approved Scopes + for _, text := range m.Setup[i].Scopes { + kind, action, ok := strings.Cut(text, ":") + if !ok { + return domain.Refuse("setup declaration has malformed scope") + } + approved = append(approved, &basev0.WorkScopeV1{ResourceKind: kind, Actions: []string{action}}) + } + ceiling := scope.Intersect(scope.Intersect(approved, b.InvokeScopes), decide.Served(src.destination)) + if !scope.Attenuates(policy.Requires, ceiling) { + return domain.Refuse("current setup method exceeds reviewed scope") + } + src.scopes = scope.Intersect(policy.Requires, ceiling) + for _, sc := range src.scopes { + sc.ResourceOwnerId = step.principal + } + if err := decide.OwnerAware(src.destination, src.scopes); err != nil { + return err + } + src.ownerAwareRevision, err = tx.OwnerAwareRevision(src.audience) + return err + }) + if err == nil { + err = step.current(ctx) + } + return src, err +} + +func (src setupSeals) bindingID() string { + // These are owner state, not caller-selected fields. Destination digest + // changes also fence method-policy and owner-awareness changes. + digest, _ := offerDigest(src.destination) + raw, _ := json.Marshal(struct { + Attempt InstallationStepAttempt + Binding, Method, Audience, DestinationDigest string + DestinationID string + DestinationRevision, OwnerAwareRevision uint64 + Scopes Scopes + }{src.attempt, src.binding, src.method, src.audience, digest, src.destinationInstallation.ID, + src.destinationInstallation.Revision, src.ownerAwareRevision, src.scopes}) + return fmt.Sprintf("%s%x", setupBindingPrefix, sha256.Sum256(raw)) +} + +func (src setupSeals) current(ctx context.Context) error { + next, err := src.s.setupSource(ctx, src.attempt.InstallationID, src.binding, src.method) + if err != nil { + return err + } + if next.bindingID() != src.bindingID() || next.principal != src.principal || next.revision != src.revision { + return domain.NotNow("installation setup operation changed") + } + return nil +} + +func (src setupSeals) OperationBinding(ctx context.Context, id string) (workcontext.OperationBinding, error) { + if id != src.bindingID() { + return workcontext.OperationBinding{}, workcontext.ErrNoBinding + } + return workcontext.OperationBinding{ID: id, PrincipalID: src.principal, InstallationID: src.attempt.InstallationID, + Revision: src.attempt.Revision, Incarnation: src.attempt.Generation}, src.current(ctx) +} + +func (s *Service) verifyInstallationSetup(ctx context.Context, token, audience, method string) (*workcontext.Verified, uint64, error) { + if method == "" { + return nil, 0, domain.Refuse("setup capability requires its exact method") + } + v, err := s.verifier(ctx, audience) + if err != nil { + return nil, 0, err + } + inspector := workcontext.Inspector{Issuer: v.Issuer, Keys: v.Keys, Now: v.Now} + if _, err := inspector.Inspect(token, audience); err != nil { + return nil, 0, err + } + decoded, err := workcontext.Decode(token) + if err != nil { + return nil, 0, err + } + wc := decoded.Context() + step, err := s.stepSource(ctx, wc.GetSeal().GetInstallationId()) + if err != nil { + return nil, 0, err + } + var bindings []string + err = s.store.Read(ctx, func(tx Tx) error { + m, err := tx.ModuleNamed(step.attempt.Target) + if err != nil { + return err + } + for _, entry := range m.Setup { + if b, ok := m.Bindings[entry.Binding]; ok && b.Audience == audience && slices.Contains(entry.Methods, method) { + bindings = append(bindings, entry.Binding) + } + } + return nil + }) + if err != nil { + return nil, 0, err + } + for _, binding := range bindings { + src, err := s.setupSource(ctx, step.attempt.InstallationID, binding, method) + if err != nil { + if _, refusal := domain.CodeOf(err); !refusal && !errors.Is(err, domain.ErrNotFound) { + return nil, 0, err + } + // A withdrawn or ineligible declaration cannot match a valid live + // operation. Another binding to this audience may still be valid. + continue + } + if wc.GetOperationBinding().GetBindingId() != src.bindingID() { + continue + } + if audience != src.audience || wc.GetTenantId() != src.attempt.Organization || wc.GetOrganizationId() != src.attempt.Organization || + wc.GetOwnerPrincipalId() != src.principal || wc.GetOwnerPrincipalKind() != "agent" || wc.GetOwnerAgentId() != src.attempt.Target || + wc.GetTaskId() != src.attempt.Consent.OperationID || len(wc.GetActorChain()) != 0 || wc.GetReplayPolicy() != workcontext.ReplayIdempotent || + !scope.Attenuates(wc.GetAuthorityScopes(), src.scopes) { + return nil, 0, domain.Refuse("not this installation's setup operation credential") + } + v.Seals = src + verified, err := v.Verify(ctx, token) + if err != nil { + return nil, 0, err + } + if err := src.current(ctx); err != nil { + return nil, 0, err + } + if now := s.cfg.Clock(); now.Before(time.Unix(wc.GetNotBeforeUnix(), 0)) || !now.Before(time.Unix(wc.GetExpiresAtUnix(), 0)) { + return nil, 0, domain.NotNow("setup operation is outside its evidence window") + } + if err := decide.OwnerAware(src.destination, verified.EffectiveScopes()); err != nil { + return nil, 0, err + } + if err := decide.AdmitMethod(src.destination, method, verified.EffectiveScopes()); err != nil { + return nil, 0, err + } + return verified, src.revision, nil + } + return nil, 0, domain.Refuse("setup capability does not select this current exact method") +} + +// This only selects the verification path. The path authenticates the token +// before trusting any lookup key; a fabricated prefix grants nothing. +func isSetupOperation(token string) bool { + decoded, err := workcontext.Decode(token) + return err == nil && strings.HasPrefix(decoded.Context().GetOperationBinding().GetBindingId(), setupBindingPrefix) +} diff --git a/libraries/authority-core/go/authority/installation_setup_regression_test.go b/libraries/authority-core/go/authority/installation_setup_regression_test.go new file mode 100644 index 00000000..f0c845b0 --- /dev/null +++ b/libraries/authority-core/go/authority/installation_setup_regression_test.go @@ -0,0 +1,112 @@ +package authority_test + +import ( + "context" + "errors" + "github.com/codefly-dev/authority/libraries/authority-core/go/authority" + "github.com/codefly-dev/authority/libraries/authority-core/go/domain" + modulecontract "github.com/codefly-dev/core/contracts/module" + "testing" +) + +func TestReviewSetupUnrelatedBindingCannotBlockCurrentBinding(t *testing.T) { + h := newHarness(t) + destination := domain.Module{Name: "store", Principal: "store", Kind: domain.KindModule, Generation: 2, OwnerAware: true, ResourceKinds: authority.Scopes{sc(kind, "admin", "create", "read", "write")}, Methods: map[string]domain.MethodPolicy{setupMethod: {Requires: authority.Scopes{sc(kind, "create")}}}} + if _, err := h.svc.ApplyModule(h.ctx, destination); err != nil { + t.Fatal(err) + } + // Both destinations publish the same interface method. One has not adopted owner-aware enforcement. + legacy := domain.Module{Name: "legacy-store", Principal: "legacy-store", Kind: domain.KindModule, Generation: 2, ResourceKinds: authority.Scopes{sc(legacyKind, "read")}, Methods: map[string]domain.MethodPolicy{setupMethod: {Requires: authority.Scopes{sc(legacyKind, "read")}}}} + if _, err := h.svc.ApplyModule(h.ctx, legacy); err != nil { + t.Fatal(err) + } + m := solution("b", true) + m.Generation = 2 + m.InstallationRole = domain.NoInstallationRole + m.Setup = []modulecontract.ResolvedSetup{{Binding: "legacy", Methods: []string{setupMethod}, Scopes: []string{legacyKind + ":read"}}, {Binding: "store", Methods: []string{setupMethod}, Scopes: []string{kind + ":create"}}} + if _, err := h.svc.ApplyModule(h.ctx, m); err != nil { + t.Fatal(err) + } + approval := h.approval(globex, "b") + admin := h.admin(globex) + inst, err := h.svc.Install(h.ctx, admin, globex, "b", "", admin.ID, approval, func(context.Context, domain.Installation) error { return awaitingStep }) + if !errors.Is(err, awaitingStep) { + t.Fatal(err) + } + a := authority.InstallationStepAttempt{InstallationID: inst.ID, Organization: inst.Organization, Target: inst.Target, TargetID: approval.TargetID, Revision: inst.Revision, Generation: approval.Generation, Consent: inst.Consent, Digest: approval.Digest} + step := issueStep(t, h, a) + issued, err := h.svc.IssueForInstallationSetup(h.ctx, authority.Workload{Module: "b"}, step.Token, setupMethod, authority.IssueRequest{Binding: "store"}) + if err != nil { + t.Fatalf("independent current binding failed to issue: %v", err) + } + if _, _, _, err = h.svc.CheckMethod(h.ctx, issued.Token, "store", setupMethod, false); err != nil { + t.Fatalf("issued current binding failed verification because another binding is ineligible: %v", err) + } +} + +func TestReviewSetupMustStayBoundToAuthenticatedCallbackAttempt(t *testing.T) { + for at := 1; at <= 30; at++ { + t.Run(string(rune('A'+at-1)), func(t *testing.T) { + h, a, _ := pendingSetup(t) + step := issueStep(t, h, a) + changed := false + store := &stepRaceStore{Store: h.store, at: at, change: func() { + changed = true + approval := h.approval(globex, "b") + admin := h.admin(globex) + _, err := h.svc.Install(h.ctx, admin, globex, "b", "", admin.ID, approval, func(context.Context, domain.Installation) error { return awaitingStep }) + if !errors.Is(err, awaitingStep) { + t.Fatal(err) + } + }} + svc, err := authority.New(store, h.cfg) + if err != nil { + t.Fatal(err) + } + issued, err := svc.IssueForInstallationSetup(h.ctx, authority.Workload{Module: "b"}, step.Token, setupMethod, authority.IssueRequest{Binding: "store"}) + if changed && err == nil { + if _, _, err := h.svc.VerifyInstallationStep(h.ctx, step.Token, "b"); err == nil { + t.Fatal("probe did not obsolete callback") + } + if _, _, _, err := h.svc.CheckMethod(h.ctx, issued.Token, "store", setupMethod, false); err == nil { + t.Fatalf("read boundary %d: stale callback minted valid capability for replacement consent; old rev=%d, new rev=%d", at, a.Revision, issued.Context.GetSeal().GetInstallationRevision()) + } + } + }) + } +} + +type eleganceReadFailure struct { + authority.Store + at, reads int + failure error +} + +func (s *eleganceReadFailure) Read(ctx context.Context, f func(authority.Tx) error) error { + s.reads++ + if s.reads == s.at { + return s.failure + } + return s.Store.Read(ctx, f) +} +func TestEleganceSetupCheckInfrastructureErrorClassification(t *testing.T) { + for at := 1; at <= 20; at++ { + h, attempt, _ := pendingSetup(t) + step := issueStep(t, h, attempt) + issued, err := h.svc.IssueForInstallationSetup(h.ctx, authority.Workload{Module: "b"}, step.Token, setupMethod, authority.IssueRequest{Binding: "store"}) + if err != nil { + t.Fatal(err) + } + failure := errors.New("test backing store unavailable") + store := &eleganceReadFailure{Store: h.store, at: at, failure: failure} + svc, err := authority.New(store, h.cfg) + if err != nil { + t.Fatal(err) + } + store.reads = 0 + _, _, _, err = svc.CheckMethod(h.ctx, issued.Token, "store", setupMethod, false) + if store.reads >= at && !errors.Is(err, failure) { + t.Fatalf("store read %d: lost operational failure: %v", at, err) + } + } +} diff --git a/libraries/authority-core/go/authority/installation_setup_test.go b/libraries/authority-core/go/authority/installation_setup_test.go new file mode 100644 index 00000000..9bc32a0a --- /dev/null +++ b/libraries/authority-core/go/authority/installation_setup_test.go @@ -0,0 +1,141 @@ +package authority_test + +import ( + "context" + "errors" + "testing" + "time" + + "github.com/codefly-dev/authority/libraries/authority-core/go/authority" + "github.com/codefly-dev/authority/libraries/authority-core/go/domain" + modulecontract "github.com/codefly-dev/core/contracts/module" +) + +const setupMethod = "/store.v1.Store/Define" +const otherSetupMethod = "/store.v1.Store/Project" + +func pendingSetup(t *testing.T) (*harness, authority.InstallationStepAttempt, *domain.ConsentApproval) { + t.Helper() + h := newHarness(t) + destination := domain.Module{Name: "store", Principal: "store", Kind: domain.KindModule, Generation: 2, + OwnerAwareResourceKinds: []string{kind}, ResourceKinds: authority.Scopes{sc(kind, "admin", "create", "read", "write")}, + Methods: map[string]domain.MethodPolicy{setupMethod: {Requires: authority.Scopes{sc(kind, "create")}}, otherSetupMethod: {Requires: authority.Scopes{sc(kind, "create")}}}} + if _, err := h.svc.ApplyModule(h.ctx, destination); err != nil { + t.Fatal(err) + } + m := solution("b", true) + m.Generation = 2 + m.InstallationRole = domain.NoInstallationRole + m.Setup = []modulecontract.ResolvedSetup{{Binding: "store", Methods: []string{setupMethod}, Scopes: []string{kind + ":create"}}} + if _, err := h.svc.ApplyModule(h.ctx, m); err != nil { + t.Fatal(err) + } + approval := h.approval(globex, "b") + admin := h.admin(globex) + inst, err := h.svc.Install(h.ctx, admin, globex, "b", "", admin.ID, approval, func(context.Context, domain.Installation) error { return awaitingStep }) + if !errors.Is(err, awaitingStep) || inst.Status != domain.Pending { + t.Fatalf("pending: %+v %v", inst, err) + } + return h, authority.InstallationStepAttempt{InstallationID: inst.ID, Organization: inst.Organization, Target: inst.Target, TargetID: approval.TargetID, + Revision: inst.Revision, Generation: approval.Generation, Consent: inst.Consent, Digest: approval.Digest}, approval +} + +func TestSetupGrantIsExactOwnedTemporaryAndNotStanding(t *testing.T) { + h, a, approval := pendingSetup(t) + step := issueStep(t, h, a) + issue := func(r authority.IssueRequest, method string, actor string) (authority.Issued, error) { + return h.svc.IssueForInstallationSetup(h.ctx, authority.Workload{Module: actor}, step.Token, method, r) + } + r := authority.IssueRequest{Binding: "store", TTL: time.Hour} + issued, err := issue(r, setupMethod, "b") + if err != nil { + t.Fatal(err) + } + if issued.Context.GetExpiresAtUnix() > step.Context.GetExpiresAtUnix() { + t.Fatal("outlived callback") + } + if got := issued.Context.GetAuthorityScopes(); len(got) != 1 || got[0].GetResourceOwnerId() != h.principal(globex, "b") { + t.Fatalf("not installation confined: %v", got) + } + if _, _, _, err := h.svc.CheckMethod(h.ctx, issued.Token, "store", setupMethod, false); err != nil { + t.Fatal(err) + } + for _, method := range []string{"", otherSetupMethod, authority.InstallationStepRPCMethod} { + if _, _, _, err := h.svc.CheckMethod(h.ctx, issued.Token, "store", method, true); err == nil { + t.Fatalf("admitted %q", method) + } + } + if _, _, _, err := h.svc.CheckMethod(h.ctx, step.Token, "store", setupMethod, false); err == nil { + t.Fatal("callback became data authority") + } + if _, err := h.svc.Verify(h.ctx, issued.Token, "store"); err == nil { + t.Fatal("ordinary verify accepted setup") + } + if _, err := h.svc.IssueChild(h.ctx, issued.Token, authority.Workload{Module: "store"}, authority.IssueRequest{Binding: "self", Audience: "store"}); err == nil { + t.Fatal("setup fanout accepted") + } + for name, req := range map[string]authority.IssueRequest{ + "foreign org": {Binding: "store", Organization: acme}, "foreign audience": {Binding: "store", Audience: "legacy-store"}, + "foreign binding": {Binding: "legacy"}, "ordinary operation": {Binding: "store", Operation: "invoke"}, + "foreign owner": {Binding: "store", Scopes: authority.Scopes{owned(kind, "other", []string{"create"})}}, + "wrong action": {Binding: "store", Scopes: authority.Scopes{sc(kind, "read")}}, + } { + t.Run(name, func(t *testing.T) { + if _, err := issue(req, setupMethod, "b"); err == nil { + t.Fatal("accepted") + } + }) + } + if _, err := issue(r, otherSetupMethod, "b"); err == nil { + t.Fatal("undeclared equal-scope method accepted") + } + if _, err := issue(r, setupMethod, "a"); err == nil { + t.Fatal("wrong workload accepted") + } + h.now = time.Unix(issued.Context.GetExpiresAtUnix(), 0) + if _, _, _, err := h.svc.CheckMethod(h.ctx, issued.Token, "store", setupMethod, false); err == nil { + t.Fatal("exact expiry accepted") + } + h.now = h.now.Add(-time.Second) + admin := h.admin(globex) + if _, err := h.svc.Install(h.ctx, admin, globex, "b", "", admin.ID, approval, func(context.Context, domain.Installation) error { return nil }); err != nil { + t.Fatal(err) + } + if _, _, _, err := h.svc.CheckMethod(h.ctx, issued.Token, "store", setupMethod, false); err == nil { + t.Fatal("setup survives activation") + } + if _, err := h.svc.IssueForInstallation(h.ctx, authority.Workload{Module: "b"}, a.InstallationID, authority.IssueRequest{Binding: "store"}); err == nil { + t.Fatal("setup created standing grant") + } +} + +// Capability withdrawal is permanent for the old evidence, even when the +// destination later restores the same owner-aware declaration. +func TestSetupOwnerCapabilityWithdrawalCannotReviveOldEvidence(t *testing.T) { + h, a, _ := pendingSetup(t) + step := issueStep(t, h, a) + issued, err := h.svc.IssueForInstallationSetup(h.ctx, authority.Workload{Module: "b"}, step.Token, setupMethod, authority.IssueRequest{Binding: "store"}) + if err != nil { + t.Fatal(err) + } + if _, _, _, err := h.svc.CheckMethod(h.ctx, issued.Token, "legacy-store", setupMethod, false); err == nil { + t.Fatal("wrong audience accepted") + } + destination := domain.Module{Name: "store", Principal: "store", Kind: domain.KindModule, Generation: 3, + ResourceKinds: authority.Scopes{sc(kind, "admin", "create", "read", "write")}, + Methods: map[string]domain.MethodPolicy{setupMethod: {Requires: authority.Scopes{sc(kind, "create")}}, otherSetupMethod: {Requires: authority.Scopes{sc(kind, "create")}}}} + if _, err := h.svc.ApplyModule(h.ctx, destination); err != nil { + t.Fatal(err) + } + if _, _, _, err := h.svc.CheckMethod(h.ctx, issued.Token, "store", setupMethod, false); err == nil { + t.Fatal("withdrawn owner capability accepted") + } + destination.Generation++ + destination.OwnerAwareResourceKinds = []string{kind} + if _, err := h.svc.ApplyModule(h.ctx, destination); err != nil { + t.Fatal(err) + } + if _, _, _, err := h.svc.CheckMethod(h.ctx, issued.Token, "store", setupMethod, false); err == nil { + t.Fatal("restored capability revived old evidence") + } +} diff --git a/libraries/authority-core/go/authority/installation_step.go b/libraries/authority-core/go/authority/installation_step.go index a751d1c5..a575d981 100644 --- a/libraries/authority-core/go/authority/installation_step.go +++ b/libraries/authority-core/go/authority/installation_step.go @@ -33,6 +33,22 @@ type InstallationStepAttempt struct { Digest string } +// PendingInstallationStep snapshots the current attempt for a trusted host's +// synchronous dispatcher. The supplied pending installation must still match; +// this neither reviews nor consents to a changed offer. Durable dispatchers keep +// the reviewed attempt in their job instead. IssueInstallationStep rechecks it. +func (s *Service) PendingInstallationStep(ctx context.Context, expected domain.Installation) (InstallationStepAttempt, error) { + src, err := s.stepSource(ctx, expected.ID) + if err != nil { + return InstallationStepAttempt{}, err + } + a := src.attempt + if expected.Status != domain.Pending || expected.Organization != a.Organization || expected.Target != a.Target || expected.Revision != a.Revision || expected.Consent != a.Consent { + return InstallationStepAttempt{}, domain.NotNow("installation step attempt changed") + } + return a, nil +} + // IssueInstallationStep grants only delivery of this installation's setup, not // its agent role or any data access. ttl must fit the claimant's remaining lease. // Queue custody stays with the host; lease loss is not an Authority state change. diff --git a/libraries/authority-core/go/authority/issue.go b/libraries/authority-core/go/authority/issue.go index f4576265..73a4d910 100644 --- a/libraries/authority-core/go/authority/issue.go +++ b/libraries/authority-core/go/authority/issue.go @@ -407,8 +407,10 @@ func (s *Service) IssueForInstallation(ctx context.Context, w Workload, installa return err } // Everything the installation holds for itself is owner-selected. - if err := decide.OwnerAware(audience, decide.Scopes{{ResourceKind: audience.Name, ResourceOwnerId: inst.PrincipalID}}); err != nil { - return err + if audience.Kind == domain.KindSolution || (!audience.OwnerAware && len(audience.OwnerAwareResourceKinds) == 0) { + if err := decide.OwnerAware(audience, decide.Scopes{{ResourceKind: audience.Name, ResourceOwnerId: inst.PrincipalID}}); err != nil { + return err + } } agent, err := decide.RoleScopes(solution, inst, []string{inst.AgentRole}) if err != nil { @@ -568,7 +570,7 @@ func (s *Service) IssueChild(ctx context.Context, parent string, actor Workload, default: heldHere = verified.EffectiveScopes() } - if (bounded || claims.GetOwnerPrincipalKind() == "agent") && !audience.OwnerAware { + if (audience.Kind == domain.KindSolution || len(audience.OwnerAwareResourceKinds) == 0) && (bounded || claims.GetOwnerPrincipalKind() == "agent") && !audience.OwnerAware { return decide.OwnerAware(audience, decide.Scopes{{ResourceKind: audience.Name, ResourceOwnerId: claims.GetOwnerPrincipalId()}}) } if through, err = decide.ScopesFor(binding, r.Operation, "invoke"); err != nil { diff --git a/libraries/authority-core/go/authority/lifecycle.go b/libraries/authority-core/go/authority/lifecycle.go index 2addc30d..c79302ed 100644 --- a/libraries/authority-core/go/authority/lifecycle.go +++ b/libraries/authority-core/go/authority/lifecycle.go @@ -95,7 +95,7 @@ func (s *Service) ApplyModule(ctx context.Context, m domain.Module) ([]string, e } } } - if exists && previous.OwnerAware && !m.OwnerAware { + if exists && decide.OwnerAwareNarrowed(previous, m) { if err := tx.BumpOwnerAwareRevision(m.Principal); err != nil { return err } diff --git a/libraries/authority-core/go/decide/decide.go b/libraries/authority-core/go/decide/decide.go index 24d16f77..c9ccef33 100644 --- a/libraries/authority-core/go/decide/decide.go +++ b/libraries/authority-core/go/decide/decide.go @@ -194,8 +194,10 @@ func Child(binding string, throughSolution bool) error { // OwnerAware refuses owner-selected scopes to an audience that does not // declare owner-aware checking: its module could read them as the whole kind. func OwnerAware(audience domain.Module, scopes Scopes) error { - if scope.HasOwner(scopes) && !audience.OwnerAware { - return domain.Refuse("%s does not declare owner-aware checking, so it receives no owner-selected scope", audience.Principal) + for _, sc := range scopes { + if sc.GetResourceOwnerId() != "" && !audience.OwnerAware && !slices.Contains(audience.OwnerAwareResourceKinds, sc.GetResourceKind()) { + return domain.Refuse("%s does not declare owner-aware checking for %s, so it receives no owner-selected scope", audience.Principal, sc.GetResourceKind()) + } } return nil } diff --git a/libraries/authority-core/go/decide/manifest.go b/libraries/authority-core/go/decide/manifest.go index 3324ee26..c9d33f95 100644 --- a/libraries/authority-core/go/decide/manifest.go +++ b/libraries/authority-core/go/decide/manifest.go @@ -4,6 +4,7 @@ import ( "fmt" "maps" "slices" + "strings" "github.com/codefly-dev/authority/libraries/authority-core/go/domain" "github.com/codefly-dev/authority/libraries/authority-core/go/scope" @@ -27,6 +28,34 @@ func validateModule(m domain.Module) error { if m.Name == "" || m.Principal == "" || m.Generation == 0 { return domain.Refuse("a manifest names its module, its principal and a generation") } + seenKinds := map[string]bool{} + for _, kind := range m.OwnerAwareResourceKinds { + if m.OwnerAware || seenKinds[kind] || !slices.ContainsFunc(m.ResourceKinds, func(sc *basev0.WorkScopeV1) bool { return sc.GetResourceKind() == kind }) { + return domain.Refuse("owner-aware resource kinds must be unique served kinds without global owner-awareness") + } + seenKinds[kind] = true + } + seenSetup := map[string]bool{} + for _, setup := range m.Setup { + b, ok := m.Bindings[setup.Binding] + if m.Kind != domain.KindSolution || !ok || seenSetup[setup.Binding] || b.Audience == m.Principal || len(setup.Methods) == 0 || len(setup.Scopes) == 0 { + return domain.Refuse("setup requires a solution's unique foreign binding, exact methods and resolved scopes") + } + seenSetup[setup.Binding] = true + seenMethods := map[string]bool{} + for _, method := range setup.Methods { + if seenMethods[method] || strings.ContainsAny(method, "*{}") || delivery.ValidateMethodPolicy(method, false, map[string][]string{"setup": {"invoke"}}, false) != nil { + return domain.Refuse("setup requires unique exact methods") + } + seenMethods[method] = true + } + for _, text := range setup.Scopes { + kind, action, ok := strings.Cut(text, ":") + if !ok || kind == "" || action == "" || !scope.Attenuates(Scopes{{ResourceKind: kind, Actions: []string{action}}}, b.InvokeScopes) { + return domain.Refuse("setup scopes exceed the binding invoke ceiling") + } + } + } for _, method := range slices.Sorted(maps.Keys(m.Methods)) { policy := m.Methods[method] requires := map[string][]string{} @@ -113,7 +142,7 @@ func RoleGated(m domain.Module) bool { // roles cut, or a module moved between organization roles and its own. A // narrowing invalidates capabilities already issued. func Narrowed(previous, next domain.Module) bool { - if previous.OwnerAware && !next.OwnerAware { + if OwnerAwareNarrowed(previous, next) { return true } for id, old := range previous.Bindings { @@ -193,3 +222,14 @@ func Served(m domain.Module) Scopes { } return scope.Normalize(served) } + +// OwnerAwareNarrowed uses the existing audience epoch for withdrawal of any kind. +func OwnerAwareNarrowed(previous, next domain.Module) bool { + if next.OwnerAware { + return false + } + if previous.OwnerAware { + return true + } + return slices.ContainsFunc(previous.OwnerAwareResourceKinds, func(kind string) bool { return !slices.Contains(next.OwnerAwareResourceKinds, kind) }) +} diff --git a/libraries/authority-core/go/delivered/delivered.go b/libraries/authority-core/go/delivered/delivered.go index 801b5052..8b4a5d6f 100644 --- a/libraries/authority-core/go/delivered/delivered.go +++ b/libraries/authority-core/go/delivered/delivered.go @@ -8,6 +8,8 @@ package delivered import ( "crypto" + modulecontract "github.com/codefly-dev/core/contracts/module" + "reflect" "slices" "strings" @@ -32,8 +34,10 @@ type Document struct { Roles []Role OwnerAware bool // Core validates these declarations; every delivery hop carries them verbatim. - InstallationRole string - EdgeDependencies []domain.EdgeDependency + Setup []modulecontract.ResolvedSetup + OwnerAwareResourceKinds []string + InstallationRole string + EdgeDependencies []domain.EdgeDependency } // Method is one method's declaration in the document. @@ -108,6 +112,7 @@ func Module(manifest *solutionhost.ModuleManifest, doc *Document) (domain.Module return m, err } m.OwnerAware = doc.OwnerAware + m.OwnerAwareResourceKinds = slices.Clone(doc.OwnerAwareResourceKinds) m.InstallationRole = doc.InstallationRole m.EdgeDependencies = slices.Clone(doc.EdgeDependencies) return m, nil @@ -123,6 +128,12 @@ func sameInstallationDeclaration(carrier *solutionhost.Authority, doc *Document) if doc == nil { doc = &Document{} } + if !slices.Equal(carrier.OwnerAwareResourceKinds, doc.OwnerAwareResourceKinds) { + return domain.Refuse("owner_aware_resource_kinds differs between signed carriers") + } + if len(carrier.Setup) != len(doc.Setup) || (len(carrier.Setup) > 0 && !reflect.DeepEqual(carrier.Setup, doc.Setup)) { + return domain.Refuse("setup differs between signed carriers") + } if carrier.InstallationRole != doc.InstallationRole { return domain.Refuse("installation_role differs between the signed manifest and authority document") } @@ -215,6 +226,12 @@ func FromCore(in *solutionhost.ModuleManifest) domain.Module { return m } m.InstallationRole = in.Authority.InstallationRole + m.Setup = slices.Clone(in.Authority.Setup) + for i := range m.Setup { + m.Setup[i].Methods = slices.Clone(m.Setup[i].Methods) + m.Setup[i].Scopes = slices.Clone(m.Setup[i].Scopes) + } + m.OwnerAwareResourceKinds = slices.Clone(in.Authority.OwnerAwareResourceKinds) for _, edge := range in.Authority.EdgeDependencies { m.EdgeDependencies = append(m.EdgeDependencies, domain.EdgeDependency{Module: edge.Module, Presence: edge.Presence}) } diff --git a/libraries/authority-core/go/domain/domain.go b/libraries/authority-core/go/domain/domain.go index 9f208bbf..84f843cd 100644 --- a/libraries/authority-core/go/domain/domain.go +++ b/libraries/authority-core/go/domain/domain.go @@ -9,6 +9,7 @@ import ( "time" resources "github.com/codefly-dev/authority/libraries/resources/go" + modulecontract "github.com/codefly-dev/core/contracts/module" basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0" ) @@ -77,6 +78,10 @@ type Module struct { // caller; "none" selects no standing authority; otherwise it names a role. // Omit absent fields from the existing review digest's JSON representation. InstallationRole string `json:",omitempty"` + // Setup is installation-only authority, separate from all standing roles. + Setup []modulecontract.ResolvedSetup `json:",omitempty"` + // OwnerAwareResourceKinds names only the kinds whose owner selectors are enforced. + OwnerAwareResourceKinds []string `json:",omitempty"` // EdgeDependencies declares viewer-edge presence, never authority or grants. // Nil and empty are equivalent, including in the review digest. EdgeDependencies []EdgeDependency `json:",omitempty"` diff --git a/libraries/authority-core/go/memstore/memstore.go b/libraries/authority-core/go/memstore/memstore.go index a578553a..eb78a1ba 100644 --- a/libraries/authority-core/go/memstore/memstore.go +++ b/libraries/authority-core/go/memstore/memstore.go @@ -452,6 +452,12 @@ func cloneScopes(in []*basev0.WorkScopeV1) []*basev0.WorkScopeV1 { func cloneModule(m domain.Module) domain.Module { m.EdgeDependencies = slices.Clone(m.EdgeDependencies) + m.OwnerAwareResourceKinds = slices.Clone(m.OwnerAwareResourceKinds) + m.Setup = slices.Clone(m.Setup) + for i := range m.Setup { + m.Setup[i].Methods = slices.Clone(m.Setup[i].Methods) + m.Setup[i].Scopes = slices.Clone(m.Setup[i].Scopes) + } m.ResourceKinds = cloneScopes(m.ResourceKinds) bindings := make(map[string]domain.Binding, len(m.Bindings)) for id, b := range m.Bindings { diff --git a/libraries/authority-core/go/offers/offers.go b/libraries/authority-core/go/offers/offers.go index 61ffec6e..2e8d9ada 100644 --- a/libraries/authority-core/go/offers/offers.go +++ b/libraries/authority-core/go/offers/offers.go @@ -27,6 +27,14 @@ type Review struct { ToolsComposed bool InstallationRole string EdgeDependencies []domain.EdgeDependency + Setup []*Setup +} + +// Setup is temporary, installation-owned authority, never a standing role. +type Setup struct { + Binding, Module string + Methods []string + Scopes []*Scope } type Binding struct { @@ -66,6 +74,15 @@ func Project(offer authority.ReviewedOffer, bindings map[string]*runnablev0.Prep a := offer.Approval out := &Review{Target: m.Name, ToolsComposed: len(bindings) > 0, InstallationRole: m.InstallationRole, EdgeDependencies: slices.Clone(m.EdgeDependencies)} + for _, entry := range m.Setup { + b := m.Bindings[entry.Binding] + var scopes []*basev0.WorkScopeV1 + for _, text := range entry.Scopes { + kind, action, _ := strings.Cut(text, ":") + scopes = append(scopes, &basev0.WorkScopeV1{ResourceKind: kind, Actions: []string{action}}) + } + out.Setup = append(out.Setup, &Setup{Binding: entry.Binding, Module: b.Audience, Methods: slices.Clone(entry.Methods), Scopes: offerScopes(scope.Normalize(scopes), false, nil)}) + } // A member's read carries no consent tuple: only an administrator consents. if a.Digest != "" { out.Approval = &domain.ConsentApproval{TargetID: a.TargetID, Generation: a.Generation, ExpectedRevision: a.ExpectedRevision, Digest: a.Digest} diff --git a/libraries/hop/go/outbound.go b/libraries/hop/go/outbound.go index 1afa740a..1001fbe4 100644 --- a/libraries/hop/go/outbound.go +++ b/libraries/hop/go/outbound.go @@ -93,6 +93,21 @@ func (o Outbound) IssueForParent(ctx context.Context, parent, binding string, op }, opts...) } +// IssueForInstallationSetup exchanges a verified callback credential for one +// declared setup method. It grants no ordinary pending-installation authority; +// the issuer rechecks the callback, consent, destination and exact method. +func (o Outbound) IssueForInstallationSetup(ctx context.Context, stepToken, binding, method string) (Issued, error) { + credential, err := o.Credential() + if err != nil { + return Issued{}, err + } + return o.ask(ctx, binding, &authorityv1.IssueRequest{ + As: &authorityv1.IssueRequest_Setup{Setup: &authorityv1.InstallationSetupRef{StepToken: stepToken, Method: method}}, + Actor: &authorityv1.WorkloadCredential{Credential: credential}, + OperationBindingId: binding, + }) +} + // ForDelegation returns ctx carrying a Work Context issued from a delegation a // person granted this module: owned by that person, with this module as actor. // No live capability is presented; the authority re-checks the delegation and diff --git a/libraries/hop/go/outbound_test.go b/libraries/hop/go/outbound_test.go index 8744fb2b..8cc01052 100644 --- a/libraries/hop/go/outbound_test.go +++ b/libraries/hop/go/outbound_test.go @@ -98,3 +98,32 @@ func TestForModuleLeavesAnEmptyOrganizationToTheAuthority(t *testing.T) { }) } } + +func TestIssueForInstallationSetupNamesOnlyTheStepAndMethod(t *testing.T) { + a := &authority{} + credential := "first-workload" + o := Outbound{Authority: a, Credential: func() (string, error) { return credential, nil }} + for _, current := range []string{"first-workload", "rotated-workload"} { + credential = current + issued, err := o.IssueForInstallationSetup(context.Background(), "private-step", "schema-binding", "/records.v1.Schema/Define") + if err != nil { + t.Fatal(err) + } + req := a.asked + if req.GetSetup().GetStepToken() != "private-step" || req.GetSetup().GetMethod() != "/records.v1.Schema/Define" || req.GetActor().GetCredential() != current || req.GetOperationBindingId() != "schema-binding" || len(req.GetScopes()) != 0 || req.GetOrganizationId() != "" { + t.Fatalf("setup issue: %v", req) + } + ctx := metadata.NewOutgoingContext(context.Background(), metadata.Pairs("request-id", "kept", WorkContextKey, "old")) + md, _ := metadata.FromOutgoingContext(issued.Carry(ctx)) + if got := md.Get(WorkContextKey); len(got) != 1 || got[0] != "issued" { + t.Fatalf("destination credential: %v", got) + } + if got := md.Get("request-id"); len(got) != 1 || got[0] != "kept" { + t.Fatalf("metadata: %v", got) + } + } + a.err = errors.New("revoked") + if _, err := o.IssueForInstallationSetup(context.Background(), "private-step", "schema-binding", "/records.v1.Schema/Define"); !errors.Is(err, a.err) || !strings.Contains(err.Error(), "schema-binding") { + t.Fatalf("refusal: %v", err) + } +} diff --git a/modules/authority/contracts/api/catalog.codefly.json b/modules/authority/contracts/api/catalog.codefly.json index d30cff5d..6bf24298 100644 --- a/modules/authority/contracts/api/catalog.codefly.json +++ b/modules/authority/contracts/api/catalog.codefly.json @@ -43,7 +43,7 @@ "kind": "protobuf", "package": "", "path": "contracts/api/local/grpc/contract.binpb", - "digest": "sha256:b49a5399e647c61b1991fc22bf7fcf8262ab17333dbe01b4afd1d16c346f3ea7", + "digest": "sha256:80609f1725aa77b4db0b9f8e7ad922a8fabbbde191847b26fc6f6da49b3adc14", "services": [ { "name": "LocalService", diff --git a/modules/authority/contracts/api/local/grpc/contract.binpb b/modules/authority/contracts/api/local/grpc/contract.binpb index 236b452b..3dc12725 100644 Binary files a/modules/authority/contracts/api/local/grpc/contract.binpb and b/modules/authority/contracts/api/local/grpc/contract.binpb differ diff --git a/modules/authority/contracts/api/local/grpc/proto/host/authority/v1/authority.proto b/modules/authority/contracts/api/local/grpc/proto/host/authority/v1/authority.proto index 4df9e58a..5367471e 100644 --- a/modules/authority/contracts/api/local/grpc/proto/host/authority/v1/authority.proto +++ b/modules/authority/contracts/api/local/grpc/proto/host/authority/v1/authority.proto @@ -149,6 +149,9 @@ message IssueRequest { // and what its grantor holds now, so a revoked delegation or a lost role // stops the next issue, and renewing is issuing again. DelegationRef delegation = 11; + // Current authenticated install callback evidence for one declared setup + // method. Independent of standing roles; requires the solution's actor. + InstallationSetupRef setup = 13; } // The module principal that may consume the capability. string audience = 5; @@ -174,6 +177,15 @@ message IssueRequest { string operation = 12; } +// InstallationSetupRef selects one exact method from the reviewed setup grant. +// The callback token proves the current attempt; it is not data authority. +message InstallationSetupRef { + // The unexpired standard installation callback credential. + string step_token = 1; + // The exact destination method selected by the setup declaration. + string method = 2; +} + // DelegationRef names one delegation. message DelegationRef { // The delegation's id, as Delegate answered it. diff --git a/modules/authority/contracts/api/local/grpc/proto/host/composition/v1/composition.proto b/modules/authority/contracts/api/local/grpc/proto/host/composition/v1/composition.proto index f0f10078..ad131d7c 100644 --- a/modules/authority/contracts/api/local/grpc/proto/host/composition/v1/composition.proto +++ b/modules/authority/contracts/api/local/grpc/proto/host/composition/v1/composition.proto @@ -72,6 +72,21 @@ message AuthorityManifestV1 { string installation_role = 8; // Viewer-edge presence only; grants no authority. Nil and empty are equivalent. repeated EdgeDependencyV1 edge_dependencies = 9; + // Resolved installation-only grants; separate from standing roles. + repeated SetupGrantV1 setup = 10; + // Only these served kinds enforce resource-owner selectors. Mutually + // exclusive with owner_aware true; empty means none. + repeated string owner_aware_resource_kinds = 11; +} + +// SetupGrantV1 retains exact methods even when two methods share requirements. +message SetupGrantV1 { + // The required foreign invoke binding that reaches the destination. + string binding = 1; + // Exact, unique methods approved for this installation's setup only. + repeated string methods = 2; + // Callee-derived requirements as resource-kind:action, within invoke ceiling. + repeated string scopes = 3; } // EdgeDependencyV1 names the exact signed module principal. The host resolves diff --git a/modules/authority/contracts/api/local/grpc/proto/host/installation/v1/installation.proto b/modules/authority/contracts/api/local/grpc/proto/host/installation/v1/installation.proto index a2edbc62..742649aa 100644 --- a/modules/authority/contracts/api/local/grpc/proto/host/installation/v1/installation.proto +++ b/modules/authority/contracts/api/local/grpc/proto/host/installation/v1/installation.proto @@ -270,6 +270,20 @@ message ReviewedOffer { // Exact declared viewer-edge presence, covered by the reviewed digest. // Required access and per-module approval are separate host review concerns. repeated OfferDependency edge_dependencies = 8; + // Temporary installation-confined grants, not standing roles. + repeated OfferSetup setup = 9; +} + +// OfferSetup explains the exact authority usable only while setup is pending. +message OfferSetup { + // The declared binding. + string binding = 1; + // The destination principal. + string module = 2; + // The exact allowed methods, even if other methods share their scopes. + repeated string methods = 3; + // Requirements, always confined to the pending installation's owner. + repeated OfferScope scopes = 4; } // OfferDependency carries presence only, never scopes or inferred binding ids. diff --git a/modules/authority/module.package.codefly.yaml b/modules/authority/module.package.codefly.yaml index 4535268b..d232e2ba 100644 --- a/modules/authority/module.package.codefly.yaml +++ b/modules/authority/module.package.codefly.yaml @@ -26,7 +26,7 @@ services: kind: protobuf package: "" path: contracts/api/local/grpc/contract.binpb - digest: sha256:b49a5399e647c61b1991fc22bf7fcf8262ab17333dbe01b4afd1d16c346f3ea7 + digest: sha256:80609f1725aa77b4db0b9f8e7ad922a8fabbbde191847b26fc6f6da49b3adc14 - endpoint: rest kind: openapi package: api.proto diff --git a/modules/authority/services/local/code/go.mod b/modules/authority/services/local/code/go.mod index b004684d..3974a57f 100644 --- a/modules/authority/services/local/code/go.mod +++ b/modules/authority/services/local/code/go.mod @@ -36,6 +36,7 @@ require ( github.com/antlr4-go/antlr/v4 v4.13.1 // indirect github.com/cenkalti/backoff/v5 v5.0.3 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect + github.com/codefly-dev/sdk-go/workcontext v0.1.1-0.20261018052022-70dc7a546458 // indirect github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/go-openapi/analysis v1.0.1 // indirect diff --git a/modules/authority/services/local/code/go.sum b/modules/authority/services/local/code/go.sum index c679884e..77b52289 100644 --- a/modules/authority/services/local/code/go.sum +++ b/modules/authority/services/local/code/go.sum @@ -50,6 +50,8 @@ github.com/codefly-dev/gortk v0.2.0 h1:7bOlS5valYz2zil+fZctQNcPCYBcPj86abcw9N8h1 github.com/codefly-dev/gortk v0.2.0/go.mod h1:dDWUMFgAP063OCGhTEpV7FFUj9+zTcxxO/nV80VKEwg= github.com/codefly-dev/sdk-go v0.4.3 h1:f7QHqqE7xqqpglOQ2kJ+DZCO/TbrNaDEZhGZ1IOd46Q= github.com/codefly-dev/sdk-go v0.4.3/go.mod h1:gviNmTzFn5UuK0CTQTxk9h11tkNXLgKu09NzuuPX5Eo= +github.com/codefly-dev/sdk-go/workcontext v0.1.1-0.20261018052022-70dc7a546458 h1:wBOL7QsuoC0HsS43gsH2+tpsipk4os077C2VUDkMUHg= +github.com/codefly-dev/sdk-go/workcontext v0.1.1-0.20261018052022-70dc7a546458/go.mod h1:hwtrdGtgh8i2xzjgihyd4wY2u+UK7nHQz30OGKL0n+M= github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI= github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M= github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE= diff --git a/modules/authority/services/local/code/pkg/business/issuer/issuer.go b/modules/authority/services/local/code/pkg/business/issuer/issuer.go index 75b12b36..52934499 100644 --- a/modules/authority/services/local/code/pkg/business/issuer/issuer.go +++ b/modules/authority/services/local/code/pkg/business/issuer/issuer.go @@ -195,6 +195,12 @@ func (i *Issuer) issue(ctx context.Context, req *authorityv1.IssueRequest) (*aut return nil, werr } out, err = i.svc.IssueForInstallation(ctx, w, as.Installation.GetInstallationId(), r) + case *authorityv1.IssueRequest_Setup: + w, werr := i.workload(ctx, req.GetActor().GetCredential(), "setup acts through its solution's workload") + if werr != nil { + return nil, werr + } + out, err = i.svc.IssueForInstallationSetup(ctx, w, as.Setup.GetStepToken(), as.Setup.GetMethod(), r) case *authorityv1.IssueRequest_ParentToken: w, werr := i.workload(ctx, req.GetActor().GetCredential(), "a child hop names the module acting") if werr != nil { diff --git a/modules/authority/services/local/code/pkg/business/state/installation_delivery.go b/modules/authority/services/local/code/pkg/business/state/installation_delivery.go new file mode 100644 index 00000000..78103366 --- /dev/null +++ b/modules/authority/services/local/code/pkg/business/state/installation_delivery.go @@ -0,0 +1,100 @@ +package state + +import ( + "bytes" + "context" + "encoding/json" + "fmt" + "io" + "net/http" + "strconv" + "strings" + "time" + + "github.com/codefly-dev/authority/libraries/authority-core/go/authority" + "github.com/codefly-dev/core/solutionhost" + "github.com/codefly-dev/sdk-go/workcontext" +) + +// DeliverInstallation performs the local host's bounded synchronous callback. +// It uses only the currently admitted signed delivery. Retries are explicit +// repeats of Install with the same reviewed operation; this is not a job queue. +func (s *State) DeliverInstallation(ctx context.Context, inst Installation, transport workcontext.TransportSource) error { + attempt, err := s.svc.PendingInstallationStep(ctx, inst) + if err != nil { + return err + } + s.mu.RLock() + var manifest *solutionhost.ModuleManifest + for _, record := range s.deliveries { + m, e := record.carrier.Manifest() + if e != nil { + s.mu.RUnlock() + return e + } + if m.Alias == inst.Target && !m.Removed { + manifest = m + break + } + } + s.mu.RUnlock() + if manifest == nil || manifest.Generation != attempt.Generation { + return fmt.Errorf("installation requires its current signed delivery") + } + var address string + entries := 0 + for _, endpoint := range manifest.Endpoints { + switch strings.ToLower(endpoint.API) { + case "http", "https", "rest", "connect": + entries++ + if entries != 1 { + return fmt.Errorf("installation requires one unambiguous HTTP entry endpoint") + } + address = endpoint.Address + } + } + if address == "" { + return fmt.Errorf("installation has no HTTP entry endpoint") + } + if !strings.Contains(address, "://") { + address = "http://" + address + } + endpoint, err := workcontext.AdmitEndpoint(address, transport, "installation callback") + if err != nil { + return err + } + endpoint.Path, endpoint.RawPath, endpoint.RawQuery, endpoint.Fragment = "/_codefly/installations", "", "", "" + ctx, cancel := context.WithTimeout(ctx, authority.MaxInstallationStepTTL) + defer cancel() + issued, err := s.svc.IssueInstallationStep(ctx, attempt, authority.MaxInstallationStepTTL) + if err != nil { + return err + } + body, err := json.Marshal(struct { + ID string `json:"installation_id"` + Organization string `json:"organization_id"` + Revision uint64 `json:"revision"` + }{inst.ID, inst.Organization, inst.Revision}) + if err != nil { + return err + } + req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint.String(), bytes.NewReader(body)) + if err != nil { + return err + } + req.Header.Set("Content-Type", "application/json") + req.Header.Set(workcontext.HeaderName, issued.Token) + req.Header.Set(workcontext.InstallationIDHeaderName, inst.ID) + req.Header.Set(workcontext.InstallationRevisionHeaderName, strconv.FormatUint(inst.Revision, 10)) + client := &http.Client{Timeout: time.Minute, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }} + response, err := client.Do(req) + if err != nil { + return fmt.Errorf("installation callback: %w", err) + } + defer response.Body.Close() + _, _ = io.Copy(io.Discard, io.LimitReader(response.Body, 4096)) + if response.StatusCode != http.StatusNoContent { + return fmt.Errorf("installation callback returned HTTP %d", response.StatusCode) + } + return nil +} diff --git a/modules/authority/services/local/code/pkg/gen/host/authority/v1/authority.pb.go b/modules/authority/services/local/code/pkg/gen/host/authority/v1/authority.pb.go index 31cba370..7eec4e8c 100644 --- a/modules/authority/services/local/code/pkg/gen/host/authority/v1/authority.pb.go +++ b/modules/authority/services/local/code/pkg/gen/host/authority/v1/authority.pb.go @@ -41,6 +41,7 @@ type IssueRequest struct { // *IssueRequest_Installation // *IssueRequest_ParentToken // *IssueRequest_Delegation + // *IssueRequest_Setup As isIssueRequest_As `protobuf_oneof:"as"` // The module principal that may consume the capability. Audience string `protobuf:"bytes,5,opt,name=audience,proto3" json:"audience,omitempty"` @@ -150,6 +151,15 @@ func (x *IssueRequest) GetDelegation() *DelegationRef { return nil } +func (x *IssueRequest) GetSetup() *InstallationSetupRef { + if x != nil { + if x, ok := x.As.(*IssueRequest_Setup); ok { + return x.Setup + } + } + return nil +} + func (x *IssueRequest) GetAudience() string { if x != nil { return x.Audience @@ -234,6 +244,12 @@ type IssueRequest_Delegation struct { Delegation *DelegationRef `protobuf:"bytes,11,opt,name=delegation,proto3,oneof"` } +type IssueRequest_Setup struct { + // Current authenticated install callback evidence for one declared setup + // method. Independent of standing roles; requires the solution's actor. + Setup *InstallationSetupRef `protobuf:"bytes,13,opt,name=setup,proto3,oneof"` +} + func (*IssueRequest_Person) isIssueRequest_As() {} func (*IssueRequest_Workload) isIssueRequest_As() {} @@ -244,6 +260,64 @@ func (*IssueRequest_ParentToken) isIssueRequest_As() {} func (*IssueRequest_Delegation) isIssueRequest_As() {} +func (*IssueRequest_Setup) isIssueRequest_As() {} + +// InstallationSetupRef selects one exact method from the reviewed setup grant. +// The callback token proves the current attempt; it is not data authority. +type InstallationSetupRef struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The unexpired standard installation callback credential. + StepToken string `protobuf:"bytes,1,opt,name=step_token,json=stepToken,proto3" json:"step_token,omitempty"` + // The exact destination method selected by the setup declaration. + Method string `protobuf:"bytes,2,opt,name=method,proto3" json:"method,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *InstallationSetupRef) Reset() { + *x = InstallationSetupRef{} + mi := &file_host_authority_v1_authority_proto_msgTypes[1] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *InstallationSetupRef) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*InstallationSetupRef) ProtoMessage() {} + +func (x *InstallationSetupRef) ProtoReflect() protoreflect.Message { + mi := &file_host_authority_v1_authority_proto_msgTypes[1] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use InstallationSetupRef.ProtoReflect.Descriptor instead. +func (*InstallationSetupRef) Descriptor() ([]byte, []int) { + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{1} +} + +func (x *InstallationSetupRef) GetStepToken() string { + if x != nil { + return x.StepToken + } + return "" +} + +func (x *InstallationSetupRef) GetMethod() string { + if x != nil { + return x.Method + } + return "" +} + // DelegationRef names one delegation. type DelegationRef struct { state protoimpl.MessageState `protogen:"open.v1"` @@ -255,7 +329,7 @@ type DelegationRef struct { func (x *DelegationRef) Reset() { *x = DelegationRef{} - mi := &file_host_authority_v1_authority_proto_msgTypes[1] + mi := &file_host_authority_v1_authority_proto_msgTypes[2] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -267,7 +341,7 @@ func (x *DelegationRef) String() string { func (*DelegationRef) ProtoMessage() {} func (x *DelegationRef) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[1] + mi := &file_host_authority_v1_authority_proto_msgTypes[2] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -280,7 +354,7 @@ func (x *DelegationRef) ProtoReflect() protoreflect.Message { // Deprecated: Use DelegationRef.ProtoReflect.Descriptor instead. func (*DelegationRef) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{1} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{2} } func (x *DelegationRef) GetDelegationId() string { @@ -310,7 +384,7 @@ type DelegateRequest struct { func (x *DelegateRequest) Reset() { *x = DelegateRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[2] + mi := &file_host_authority_v1_authority_proto_msgTypes[3] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -322,7 +396,7 @@ func (x *DelegateRequest) String() string { func (*DelegateRequest) ProtoMessage() {} func (x *DelegateRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[2] + mi := &file_host_authority_v1_authority_proto_msgTypes[3] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -335,7 +409,7 @@ func (x *DelegateRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DelegateRequest.ProtoReflect.Descriptor instead. func (*DelegateRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{2} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{3} } func (x *DelegateRequest) GetModule() string { @@ -387,7 +461,7 @@ type Delegation struct { func (x *Delegation) Reset() { *x = Delegation{} - mi := &file_host_authority_v1_authority_proto_msgTypes[3] + mi := &file_host_authority_v1_authority_proto_msgTypes[4] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -399,7 +473,7 @@ func (x *Delegation) String() string { func (*Delegation) ProtoMessage() {} func (x *Delegation) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[3] + mi := &file_host_authority_v1_authority_proto_msgTypes[4] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -412,7 +486,7 @@ func (x *Delegation) ProtoReflect() protoreflect.Message { // Deprecated: Use Delegation.ProtoReflect.Descriptor instead. func (*Delegation) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{3} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{4} } func (x *Delegation) GetDelegationId() string { @@ -484,7 +558,7 @@ type GetDelegationRequest struct { func (x *GetDelegationRequest) Reset() { *x = GetDelegationRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[4] + mi := &file_host_authority_v1_authority_proto_msgTypes[5] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -496,7 +570,7 @@ func (x *GetDelegationRequest) String() string { func (*GetDelegationRequest) ProtoMessage() {} func (x *GetDelegationRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[4] + mi := &file_host_authority_v1_authority_proto_msgTypes[5] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -509,7 +583,7 @@ func (x *GetDelegationRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDelegationRequest.ProtoReflect.Descriptor instead. func (*GetDelegationRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{4} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{5} } func (x *GetDelegationRequest) GetDelegationId() string { @@ -537,7 +611,7 @@ type RevokeDelegationRequest struct { func (x *RevokeDelegationRequest) Reset() { *x = RevokeDelegationRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[5] + mi := &file_host_authority_v1_authority_proto_msgTypes[6] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -549,7 +623,7 @@ func (x *RevokeDelegationRequest) String() string { func (*RevokeDelegationRequest) ProtoMessage() {} func (x *RevokeDelegationRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[5] + mi := &file_host_authority_v1_authority_proto_msgTypes[6] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -562,7 +636,7 @@ func (x *RevokeDelegationRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RevokeDelegationRequest.ProtoReflect.Descriptor instead. func (*RevokeDelegationRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{5} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{6} } func (x *RevokeDelegationRequest) GetDelegationId() string { @@ -582,7 +656,7 @@ type RevokeDelegationResponse struct { func (x *RevokeDelegationResponse) Reset() { *x = RevokeDelegationResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[6] + mi := &file_host_authority_v1_authority_proto_msgTypes[7] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -594,7 +668,7 @@ func (x *RevokeDelegationResponse) String() string { func (*RevokeDelegationResponse) ProtoMessage() {} func (x *RevokeDelegationResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[6] + mi := &file_host_authority_v1_authority_proto_msgTypes[7] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -607,7 +681,7 @@ func (x *RevokeDelegationResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RevokeDelegationResponse.ProtoReflect.Descriptor instead. func (*RevokeDelegationResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{6} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{7} } func (x *RevokeDelegationResponse) GetDelegation() *Delegation { @@ -628,7 +702,7 @@ type PersonSession struct { func (x *PersonSession) Reset() { *x = PersonSession{} - mi := &file_host_authority_v1_authority_proto_msgTypes[7] + mi := &file_host_authority_v1_authority_proto_msgTypes[8] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -640,7 +714,7 @@ func (x *PersonSession) String() string { func (*PersonSession) ProtoMessage() {} func (x *PersonSession) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[7] + mi := &file_host_authority_v1_authority_proto_msgTypes[8] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -653,7 +727,7 @@ func (x *PersonSession) ProtoReflect() protoreflect.Message { // Deprecated: Use PersonSession.ProtoReflect.Descriptor instead. func (*PersonSession) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{7} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{8} } // WorkloadCredential proves which module a running process is: the native @@ -669,7 +743,7 @@ type WorkloadCredential struct { func (x *WorkloadCredential) Reset() { *x = WorkloadCredential{} - mi := &file_host_authority_v1_authority_proto_msgTypes[8] + mi := &file_host_authority_v1_authority_proto_msgTypes[9] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -681,7 +755,7 @@ func (x *WorkloadCredential) String() string { func (*WorkloadCredential) ProtoMessage() {} func (x *WorkloadCredential) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[8] + mi := &file_host_authority_v1_authority_proto_msgTypes[9] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -694,7 +768,7 @@ func (x *WorkloadCredential) ProtoReflect() protoreflect.Message { // Deprecated: Use WorkloadCredential.ProtoReflect.Descriptor instead. func (*WorkloadCredential) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{8} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{9} } func (x *WorkloadCredential) GetCredential() string { @@ -715,7 +789,7 @@ type InstallationRef struct { func (x *InstallationRef) Reset() { *x = InstallationRef{} - mi := &file_host_authority_v1_authority_proto_msgTypes[9] + mi := &file_host_authority_v1_authority_proto_msgTypes[10] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -727,7 +801,7 @@ func (x *InstallationRef) String() string { func (*InstallationRef) ProtoMessage() {} func (x *InstallationRef) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[9] + mi := &file_host_authority_v1_authority_proto_msgTypes[10] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -740,7 +814,7 @@ func (x *InstallationRef) ProtoReflect() protoreflect.Message { // Deprecated: Use InstallationRef.ProtoReflect.Descriptor instead. func (*InstallationRef) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{9} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{10} } func (x *InstallationRef) GetInstallationId() string { @@ -765,7 +839,7 @@ type IssueResponse struct { func (x *IssueResponse) Reset() { *x = IssueResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[10] + mi := &file_host_authority_v1_authority_proto_msgTypes[11] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -777,7 +851,7 @@ func (x *IssueResponse) String() string { func (*IssueResponse) ProtoMessage() {} func (x *IssueResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[10] + mi := &file_host_authority_v1_authority_proto_msgTypes[11] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -790,7 +864,7 @@ func (x *IssueResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use IssueResponse.ProtoReflect.Descriptor instead. func (*IssueResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{10} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{11} } func (x *IssueResponse) GetToken() string { @@ -852,7 +926,7 @@ type CheckRequest struct { func (x *CheckRequest) Reset() { *x = CheckRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[11] + mi := &file_host_authority_v1_authority_proto_msgTypes[12] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -864,7 +938,7 @@ func (x *CheckRequest) String() string { func (*CheckRequest) ProtoMessage() {} func (x *CheckRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[11] + mi := &file_host_authority_v1_authority_proto_msgTypes[12] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -877,7 +951,7 @@ func (x *CheckRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CheckRequest.ProtoReflect.Descriptor instead. func (*CheckRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{11} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{12} } func (x *CheckRequest) GetToken() string { @@ -924,7 +998,7 @@ type CheckResponse struct { func (x *CheckResponse) Reset() { *x = CheckResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[12] + mi := &file_host_authority_v1_authority_proto_msgTypes[13] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -936,7 +1010,7 @@ func (x *CheckResponse) String() string { func (*CheckResponse) ProtoMessage() {} func (x *CheckResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[12] + mi := &file_host_authority_v1_authority_proto_msgTypes[13] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -949,7 +1023,7 @@ func (x *CheckResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use CheckResponse.ProtoReflect.Descriptor instead. func (*CheckResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{12} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{13} } func (x *CheckResponse) GetContext() *WorkContextV1 { @@ -982,7 +1056,7 @@ type KeysRequest struct { func (x *KeysRequest) Reset() { *x = KeysRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[13] + mi := &file_host_authority_v1_authority_proto_msgTypes[14] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -994,7 +1068,7 @@ func (x *KeysRequest) String() string { func (*KeysRequest) ProtoMessage() {} func (x *KeysRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[13] + mi := &file_host_authority_v1_authority_proto_msgTypes[14] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1007,7 +1081,7 @@ func (x *KeysRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use KeysRequest.ProtoReflect.Descriptor instead. func (*KeysRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{13} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{14} } // KeysResponse is the issuer and its keys. @@ -1032,7 +1106,7 @@ type KeysResponse struct { func (x *KeysResponse) Reset() { *x = KeysResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[14] + mi := &file_host_authority_v1_authority_proto_msgTypes[15] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1044,7 +1118,7 @@ func (x *KeysResponse) String() string { func (*KeysResponse) ProtoMessage() {} func (x *KeysResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[14] + mi := &file_host_authority_v1_authority_proto_msgTypes[15] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1057,7 +1131,7 @@ func (x *KeysResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use KeysResponse.ProtoReflect.Descriptor instead. func (*KeysResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{14} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{15} } func (x *KeysResponse) GetIssuer() string { @@ -1100,7 +1174,7 @@ type PublicKey struct { func (x *PublicKey) Reset() { *x = PublicKey{} - mi := &file_host_authority_v1_authority_proto_msgTypes[15] + mi := &file_host_authority_v1_authority_proto_msgTypes[16] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1112,7 +1186,7 @@ func (x *PublicKey) String() string { func (*PublicKey) ProtoMessage() {} func (x *PublicKey) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[15] + mi := &file_host_authority_v1_authority_proto_msgTypes[16] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1125,7 +1199,7 @@ func (x *PublicKey) ProtoReflect() protoreflect.Message { // Deprecated: Use PublicKey.ProtoReflect.Descriptor instead. func (*PublicKey) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{15} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{16} } func (x *PublicKey) GetKeyId() string { @@ -1180,7 +1254,7 @@ type RegisterAdmissionKeyRequest struct { func (x *RegisterAdmissionKeyRequest) Reset() { *x = RegisterAdmissionKeyRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[16] + mi := &file_host_authority_v1_authority_proto_msgTypes[17] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1192,7 +1266,7 @@ func (x *RegisterAdmissionKeyRequest) String() string { func (*RegisterAdmissionKeyRequest) ProtoMessage() {} func (x *RegisterAdmissionKeyRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[16] + mi := &file_host_authority_v1_authority_proto_msgTypes[17] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1205,7 +1279,7 @@ func (x *RegisterAdmissionKeyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RegisterAdmissionKeyRequest.ProtoReflect.Descriptor instead. func (*RegisterAdmissionKeyRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{16} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{17} } func (x *RegisterAdmissionKeyRequest) GetActor() *WorkloadCredential { @@ -1242,7 +1316,7 @@ type RegisterAdmissionKeyResponse struct { func (x *RegisterAdmissionKeyResponse) Reset() { *x = RegisterAdmissionKeyResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[17] + mi := &file_host_authority_v1_authority_proto_msgTypes[18] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1254,7 +1328,7 @@ func (x *RegisterAdmissionKeyResponse) String() string { func (*RegisterAdmissionKeyResponse) ProtoMessage() {} func (x *RegisterAdmissionKeyResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[17] + mi := &file_host_authority_v1_authority_proto_msgTypes[18] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1267,7 +1341,7 @@ func (x *RegisterAdmissionKeyResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RegisterAdmissionKeyResponse.ProtoReflect.Descriptor instead. func (*RegisterAdmissionKeyResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{17} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{18} } func (x *RegisterAdmissionKeyResponse) GetKey() *PublicKey { @@ -1301,7 +1375,7 @@ type ListResourcesRequest struct { func (x *ListResourcesRequest) Reset() { *x = ListResourcesRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[18] + mi := &file_host_authority_v1_authority_proto_msgTypes[19] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1313,7 +1387,7 @@ func (x *ListResourcesRequest) String() string { func (*ListResourcesRequest) ProtoMessage() {} func (x *ListResourcesRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[18] + mi := &file_host_authority_v1_authority_proto_msgTypes[19] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1326,7 +1400,7 @@ func (x *ListResourcesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListResourcesRequest.ProtoReflect.Descriptor instead. func (*ListResourcesRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{18} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{19} } func (x *ListResourcesRequest) GetToken() string { @@ -1369,7 +1443,7 @@ type ListResourcesResponse struct { func (x *ListResourcesResponse) Reset() { *x = ListResourcesResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[19] + mi := &file_host_authority_v1_authority_proto_msgTypes[20] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1381,7 +1455,7 @@ func (x *ListResourcesResponse) String() string { func (*ListResourcesResponse) ProtoMessage() {} func (x *ListResourcesResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[19] + mi := &file_host_authority_v1_authority_proto_msgTypes[20] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1394,7 +1468,7 @@ func (x *ListResourcesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListResourcesResponse.ProtoReflect.Descriptor instead. func (*ListResourcesResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{19} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{20} } func (x *ListResourcesResponse) GetGrants() []*ResourceGrant { @@ -1421,7 +1495,7 @@ type AttachResourceRequest struct { func (x *AttachResourceRequest) Reset() { *x = AttachResourceRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[20] + mi := &file_host_authority_v1_authority_proto_msgTypes[21] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1433,7 +1507,7 @@ func (x *AttachResourceRequest) String() string { func (*AttachResourceRequest) ProtoMessage() {} func (x *AttachResourceRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[20] + mi := &file_host_authority_v1_authority_proto_msgTypes[21] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1446,7 +1520,7 @@ func (x *AttachResourceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use AttachResourceRequest.ProtoReflect.Descriptor instead. func (*AttachResourceRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{20} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{21} } func (x *AttachResourceRequest) GetToken() string { @@ -1488,7 +1562,7 @@ type AttachResourceResponse struct { func (x *AttachResourceResponse) Reset() { *x = AttachResourceResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[21] + mi := &file_host_authority_v1_authority_proto_msgTypes[22] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1500,7 +1574,7 @@ func (x *AttachResourceResponse) String() string { func (*AttachResourceResponse) ProtoMessage() {} func (x *AttachResourceResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[21] + mi := &file_host_authority_v1_authority_proto_msgTypes[22] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1513,7 +1587,7 @@ func (x *AttachResourceResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use AttachResourceResponse.ProtoReflect.Descriptor instead. func (*AttachResourceResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{21} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{22} } func (x *AttachResourceResponse) GetInstallationId() string { @@ -1540,7 +1614,7 @@ type DetachResourceRequest struct { func (x *DetachResourceRequest) Reset() { *x = DetachResourceRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[22] + mi := &file_host_authority_v1_authority_proto_msgTypes[23] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1552,7 +1626,7 @@ func (x *DetachResourceRequest) String() string { func (*DetachResourceRequest) ProtoMessage() {} func (x *DetachResourceRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[22] + mi := &file_host_authority_v1_authority_proto_msgTypes[23] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1565,7 +1639,7 @@ func (x *DetachResourceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DetachResourceRequest.ProtoReflect.Descriptor instead. func (*DetachResourceRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{22} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{23} } func (x *DetachResourceRequest) GetActor() *WorkloadCredential { @@ -1607,7 +1681,7 @@ type DetachResourceResponse struct { func (x *DetachResourceResponse) Reset() { *x = DetachResourceResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[23] + mi := &file_host_authority_v1_authority_proto_msgTypes[24] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1619,7 +1693,7 @@ func (x *DetachResourceResponse) String() string { func (*DetachResourceResponse) ProtoMessage() {} func (x *DetachResourceResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[23] + mi := &file_host_authority_v1_authority_proto_msgTypes[24] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1632,7 +1706,7 @@ func (x *DetachResourceResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DetachResourceResponse.ProtoReflect.Descriptor instead. func (*DetachResourceResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{23} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{24} } func (x *DetachResourceResponse) GetInstallationId() string { @@ -1664,7 +1738,7 @@ type AuthorizeTransferRequest struct { func (x *AuthorizeTransferRequest) Reset() { *x = AuthorizeTransferRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[24] + mi := &file_host_authority_v1_authority_proto_msgTypes[25] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1676,7 +1750,7 @@ func (x *AuthorizeTransferRequest) String() string { func (*AuthorizeTransferRequest) ProtoMessage() {} func (x *AuthorizeTransferRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[24] + mi := &file_host_authority_v1_authority_proto_msgTypes[25] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1689,7 +1763,7 @@ func (x *AuthorizeTransferRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use AuthorizeTransferRequest.ProtoReflect.Descriptor instead. func (*AuthorizeTransferRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{24} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{25} } func (x *AuthorizeTransferRequest) GetToken() string { @@ -1747,7 +1821,7 @@ type AuthorizeTransferResponse struct { func (x *AuthorizeTransferResponse) Reset() { *x = AuthorizeTransferResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[25] + mi := &file_host_authority_v1_authority_proto_msgTypes[26] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1759,7 +1833,7 @@ func (x *AuthorizeTransferResponse) String() string { func (*AuthorizeTransferResponse) ProtoMessage() {} func (x *AuthorizeTransferResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[25] + mi := &file_host_authority_v1_authority_proto_msgTypes[26] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1772,7 +1846,7 @@ func (x *AuthorizeTransferResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use AuthorizeTransferResponse.ProtoReflect.Descriptor instead. func (*AuthorizeTransferResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{25} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{26} } func (x *AuthorizeTransferResponse) GetPrincipalId() string { @@ -1809,7 +1883,7 @@ type ResourceGrant struct { func (x *ResourceGrant) Reset() { *x = ResourceGrant{} - mi := &file_host_authority_v1_authority_proto_msgTypes[26] + mi := &file_host_authority_v1_authority_proto_msgTypes[27] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1821,7 +1895,7 @@ func (x *ResourceGrant) String() string { func (*ResourceGrant) ProtoMessage() {} func (x *ResourceGrant) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[26] + mi := &file_host_authority_v1_authority_proto_msgTypes[27] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1834,7 +1908,7 @@ func (x *ResourceGrant) ProtoReflect() protoreflect.Message { // Deprecated: Use ResourceGrant.ProtoReflect.Descriptor instead. func (*ResourceGrant) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{26} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{27} } func (x *ResourceGrant) GetMatch() isResourceGrant_Match { @@ -1924,7 +1998,7 @@ var File_host_authority_v1_authority_proto protoreflect.FileDescriptor const file_host_authority_v1_authority_proto_rawDesc = "" + "\n" + - "!host/authority/v1/authority.proto\x12\x11host.authority.v1\x1a\x1cgoogle/api/annotations.proto\x1a$host/authority/v1/work_context.proto\"\xf3\x04\n" + + "!host/authority/v1/authority.proto\x12\x11host.authority.v1\x1a\x1cgoogle/api/annotations.proto\x1a$host/authority/v1/work_context.proto\"\xb4\x05\n" + "\fIssueRequest\x12:\n" + "\x06person\x18\x01 \x01(\v2 .host.authority.v1.PersonSessionH\x00R\x06person\x12C\n" + "\bworkload\x18\x02 \x01(\v2%.host.authority.v1.WorkloadCredentialH\x00R\bworkload\x12H\n" + @@ -1932,7 +2006,8 @@ const file_host_authority_v1_authority_proto_rawDesc = "" + "\fparent_token\x18\x04 \x01(\tH\x00R\vparentToken\x12B\n" + "\n" + "delegation\x18\v \x01(\v2 .host.authority.v1.DelegationRefH\x00R\n" + - "delegation\x12\x1a\n" + + "delegation\x12?\n" + + "\x05setup\x18\r \x01(\v2'.host.authority.v1.InstallationSetupRefH\x00R\x05setup\x12\x1a\n" + "\baudience\x18\x05 \x01(\tR\baudience\x126\n" + "\x06scopes\x18\x06 \x03(\v2\x1e.host.authority.v1.WorkScopeV1R\x06scopes\x12\x1f\n" + "\vttl_seconds\x18\a \x01(\x03R\n" + @@ -1942,7 +2017,11 @@ const file_host_authority_v1_authority_proto_rawDesc = "" + "\x05actor\x18\n" + " \x01(\v2%.host.authority.v1.WorkloadCredentialR\x05actor\x12\x1c\n" + "\toperation\x18\f \x01(\tR\toperationB\x04\n" + - "\x02as\"4\n" + + "\x02as\"M\n" + + "\x14InstallationSetupRef\x12\x1d\n" + + "\n" + + "step_token\x18\x01 \x01(\tR\tstepToken\x12\x16\n" + + "\x06method\x18\x02 \x01(\tR\x06method\"4\n" + "\rDelegationRef\x12#\n" + "\rdelegation_id\x18\x01 \x01(\tR\fdelegationId\"\x9c\x01\n" + "\x0fDelegateRequest\x12\x16\n" + @@ -2076,86 +2155,88 @@ func file_host_authority_v1_authority_proto_rawDescGZIP() []byte { return file_host_authority_v1_authority_proto_rawDescData } -var file_host_authority_v1_authority_proto_msgTypes = make([]protoimpl.MessageInfo, 27) +var file_host_authority_v1_authority_proto_msgTypes = make([]protoimpl.MessageInfo, 28) var file_host_authority_v1_authority_proto_goTypes = []any{ (*IssueRequest)(nil), // 0: host.authority.v1.IssueRequest - (*DelegationRef)(nil), // 1: host.authority.v1.DelegationRef - (*DelegateRequest)(nil), // 2: host.authority.v1.DelegateRequest - (*Delegation)(nil), // 3: host.authority.v1.Delegation - (*GetDelegationRequest)(nil), // 4: host.authority.v1.GetDelegationRequest - (*RevokeDelegationRequest)(nil), // 5: host.authority.v1.RevokeDelegationRequest - (*RevokeDelegationResponse)(nil), // 6: host.authority.v1.RevokeDelegationResponse - (*PersonSession)(nil), // 7: host.authority.v1.PersonSession - (*WorkloadCredential)(nil), // 8: host.authority.v1.WorkloadCredential - (*InstallationRef)(nil), // 9: host.authority.v1.InstallationRef - (*IssueResponse)(nil), // 10: host.authority.v1.IssueResponse - (*CheckRequest)(nil), // 11: host.authority.v1.CheckRequest - (*CheckResponse)(nil), // 12: host.authority.v1.CheckResponse - (*KeysRequest)(nil), // 13: host.authority.v1.KeysRequest - (*KeysResponse)(nil), // 14: host.authority.v1.KeysResponse - (*PublicKey)(nil), // 15: host.authority.v1.PublicKey - (*RegisterAdmissionKeyRequest)(nil), // 16: host.authority.v1.RegisterAdmissionKeyRequest - (*RegisterAdmissionKeyResponse)(nil), // 17: host.authority.v1.RegisterAdmissionKeyResponse - (*ListResourcesRequest)(nil), // 18: host.authority.v1.ListResourcesRequest - (*ListResourcesResponse)(nil), // 19: host.authority.v1.ListResourcesResponse - (*AttachResourceRequest)(nil), // 20: host.authority.v1.AttachResourceRequest - (*AttachResourceResponse)(nil), // 21: host.authority.v1.AttachResourceResponse - (*DetachResourceRequest)(nil), // 22: host.authority.v1.DetachResourceRequest - (*DetachResourceResponse)(nil), // 23: host.authority.v1.DetachResourceResponse - (*AuthorizeTransferRequest)(nil), // 24: host.authority.v1.AuthorizeTransferRequest - (*AuthorizeTransferResponse)(nil), // 25: host.authority.v1.AuthorizeTransferResponse - (*ResourceGrant)(nil), // 26: host.authority.v1.ResourceGrant - (*WorkScopeV1)(nil), // 27: host.authority.v1.WorkScopeV1 - (*WorkContextV1)(nil), // 28: host.authority.v1.WorkContextV1 + (*InstallationSetupRef)(nil), // 1: host.authority.v1.InstallationSetupRef + (*DelegationRef)(nil), // 2: host.authority.v1.DelegationRef + (*DelegateRequest)(nil), // 3: host.authority.v1.DelegateRequest + (*Delegation)(nil), // 4: host.authority.v1.Delegation + (*GetDelegationRequest)(nil), // 5: host.authority.v1.GetDelegationRequest + (*RevokeDelegationRequest)(nil), // 6: host.authority.v1.RevokeDelegationRequest + (*RevokeDelegationResponse)(nil), // 7: host.authority.v1.RevokeDelegationResponse + (*PersonSession)(nil), // 8: host.authority.v1.PersonSession + (*WorkloadCredential)(nil), // 9: host.authority.v1.WorkloadCredential + (*InstallationRef)(nil), // 10: host.authority.v1.InstallationRef + (*IssueResponse)(nil), // 11: host.authority.v1.IssueResponse + (*CheckRequest)(nil), // 12: host.authority.v1.CheckRequest + (*CheckResponse)(nil), // 13: host.authority.v1.CheckResponse + (*KeysRequest)(nil), // 14: host.authority.v1.KeysRequest + (*KeysResponse)(nil), // 15: host.authority.v1.KeysResponse + (*PublicKey)(nil), // 16: host.authority.v1.PublicKey + (*RegisterAdmissionKeyRequest)(nil), // 17: host.authority.v1.RegisterAdmissionKeyRequest + (*RegisterAdmissionKeyResponse)(nil), // 18: host.authority.v1.RegisterAdmissionKeyResponse + (*ListResourcesRequest)(nil), // 19: host.authority.v1.ListResourcesRequest + (*ListResourcesResponse)(nil), // 20: host.authority.v1.ListResourcesResponse + (*AttachResourceRequest)(nil), // 21: host.authority.v1.AttachResourceRequest + (*AttachResourceResponse)(nil), // 22: host.authority.v1.AttachResourceResponse + (*DetachResourceRequest)(nil), // 23: host.authority.v1.DetachResourceRequest + (*DetachResourceResponse)(nil), // 24: host.authority.v1.DetachResourceResponse + (*AuthorizeTransferRequest)(nil), // 25: host.authority.v1.AuthorizeTransferRequest + (*AuthorizeTransferResponse)(nil), // 26: host.authority.v1.AuthorizeTransferResponse + (*ResourceGrant)(nil), // 27: host.authority.v1.ResourceGrant + (*WorkScopeV1)(nil), // 28: host.authority.v1.WorkScopeV1 + (*WorkContextV1)(nil), // 29: host.authority.v1.WorkContextV1 } var file_host_authority_v1_authority_proto_depIdxs = []int32{ - 7, // 0: host.authority.v1.IssueRequest.person:type_name -> host.authority.v1.PersonSession - 8, // 1: host.authority.v1.IssueRequest.workload:type_name -> host.authority.v1.WorkloadCredential - 9, // 2: host.authority.v1.IssueRequest.installation:type_name -> host.authority.v1.InstallationRef - 1, // 3: host.authority.v1.IssueRequest.delegation:type_name -> host.authority.v1.DelegationRef - 27, // 4: host.authority.v1.IssueRequest.scopes:type_name -> host.authority.v1.WorkScopeV1 - 8, // 5: host.authority.v1.IssueRequest.actor:type_name -> host.authority.v1.WorkloadCredential - 27, // 6: host.authority.v1.DelegateRequest.scopes:type_name -> host.authority.v1.WorkScopeV1 - 27, // 7: host.authority.v1.Delegation.scopes:type_name -> host.authority.v1.WorkScopeV1 - 8, // 8: host.authority.v1.GetDelegationRequest.actor:type_name -> host.authority.v1.WorkloadCredential - 3, // 9: host.authority.v1.RevokeDelegationResponse.delegation:type_name -> host.authority.v1.Delegation - 28, // 10: host.authority.v1.IssueResponse.context:type_name -> host.authority.v1.WorkContextV1 - 28, // 11: host.authority.v1.CheckResponse.context:type_name -> host.authority.v1.WorkContextV1 - 15, // 12: host.authority.v1.KeysResponse.keys:type_name -> host.authority.v1.PublicKey - 15, // 13: host.authority.v1.KeysResponse.admission_keys:type_name -> host.authority.v1.PublicKey - 8, // 14: host.authority.v1.RegisterAdmissionKeyRequest.actor:type_name -> host.authority.v1.WorkloadCredential - 15, // 15: host.authority.v1.RegisterAdmissionKeyResponse.key:type_name -> host.authority.v1.PublicKey - 26, // 16: host.authority.v1.ListResourcesResponse.grants:type_name -> host.authority.v1.ResourceGrant - 8, // 17: host.authority.v1.AttachResourceRequest.actor:type_name -> host.authority.v1.WorkloadCredential - 8, // 18: host.authority.v1.DetachResourceRequest.actor:type_name -> host.authority.v1.WorkloadCredential - 8, // 19: host.authority.v1.AuthorizeTransferRequest.actor:type_name -> host.authority.v1.WorkloadCredential - 0, // 20: host.authority.v1.AuthorityService.Issue:input_type -> host.authority.v1.IssueRequest - 11, // 21: host.authority.v1.AuthorityService.Check:input_type -> host.authority.v1.CheckRequest - 13, // 22: host.authority.v1.AuthorityService.Keys:input_type -> host.authority.v1.KeysRequest - 16, // 23: host.authority.v1.AuthorityService.RegisterAdmissionKey:input_type -> host.authority.v1.RegisterAdmissionKeyRequest - 18, // 24: host.authority.v1.AuthorityService.ListResources:input_type -> host.authority.v1.ListResourcesRequest - 20, // 25: host.authority.v1.AuthorityService.AttachResource:input_type -> host.authority.v1.AttachResourceRequest - 22, // 26: host.authority.v1.AuthorityService.DetachResource:input_type -> host.authority.v1.DetachResourceRequest - 24, // 27: host.authority.v1.AuthorityService.AuthorizeTransfer:input_type -> host.authority.v1.AuthorizeTransferRequest - 2, // 28: host.authority.v1.AuthorityService.Delegate:input_type -> host.authority.v1.DelegateRequest - 5, // 29: host.authority.v1.AuthorityService.RevokeDelegation:input_type -> host.authority.v1.RevokeDelegationRequest - 4, // 30: host.authority.v1.AuthorityService.GetDelegation:input_type -> host.authority.v1.GetDelegationRequest - 10, // 31: host.authority.v1.AuthorityService.Issue:output_type -> host.authority.v1.IssueResponse - 12, // 32: host.authority.v1.AuthorityService.Check:output_type -> host.authority.v1.CheckResponse - 14, // 33: host.authority.v1.AuthorityService.Keys:output_type -> host.authority.v1.KeysResponse - 17, // 34: host.authority.v1.AuthorityService.RegisterAdmissionKey:output_type -> host.authority.v1.RegisterAdmissionKeyResponse - 19, // 35: host.authority.v1.AuthorityService.ListResources:output_type -> host.authority.v1.ListResourcesResponse - 21, // 36: host.authority.v1.AuthorityService.AttachResource:output_type -> host.authority.v1.AttachResourceResponse - 23, // 37: host.authority.v1.AuthorityService.DetachResource:output_type -> host.authority.v1.DetachResourceResponse - 25, // 38: host.authority.v1.AuthorityService.AuthorizeTransfer:output_type -> host.authority.v1.AuthorizeTransferResponse - 3, // 39: host.authority.v1.AuthorityService.Delegate:output_type -> host.authority.v1.Delegation - 6, // 40: host.authority.v1.AuthorityService.RevokeDelegation:output_type -> host.authority.v1.RevokeDelegationResponse - 3, // 41: host.authority.v1.AuthorityService.GetDelegation:output_type -> host.authority.v1.Delegation - 31, // [31:42] is the sub-list for method output_type - 20, // [20:31] is the sub-list for method input_type - 20, // [20:20] is the sub-list for extension type_name - 20, // [20:20] is the sub-list for extension extendee - 0, // [0:20] is the sub-list for field type_name + 8, // 0: host.authority.v1.IssueRequest.person:type_name -> host.authority.v1.PersonSession + 9, // 1: host.authority.v1.IssueRequest.workload:type_name -> host.authority.v1.WorkloadCredential + 10, // 2: host.authority.v1.IssueRequest.installation:type_name -> host.authority.v1.InstallationRef + 2, // 3: host.authority.v1.IssueRequest.delegation:type_name -> host.authority.v1.DelegationRef + 1, // 4: host.authority.v1.IssueRequest.setup:type_name -> host.authority.v1.InstallationSetupRef + 28, // 5: host.authority.v1.IssueRequest.scopes:type_name -> host.authority.v1.WorkScopeV1 + 9, // 6: host.authority.v1.IssueRequest.actor:type_name -> host.authority.v1.WorkloadCredential + 28, // 7: host.authority.v1.DelegateRequest.scopes:type_name -> host.authority.v1.WorkScopeV1 + 28, // 8: host.authority.v1.Delegation.scopes:type_name -> host.authority.v1.WorkScopeV1 + 9, // 9: host.authority.v1.GetDelegationRequest.actor:type_name -> host.authority.v1.WorkloadCredential + 4, // 10: host.authority.v1.RevokeDelegationResponse.delegation:type_name -> host.authority.v1.Delegation + 29, // 11: host.authority.v1.IssueResponse.context:type_name -> host.authority.v1.WorkContextV1 + 29, // 12: host.authority.v1.CheckResponse.context:type_name -> host.authority.v1.WorkContextV1 + 16, // 13: host.authority.v1.KeysResponse.keys:type_name -> host.authority.v1.PublicKey + 16, // 14: host.authority.v1.KeysResponse.admission_keys:type_name -> host.authority.v1.PublicKey + 9, // 15: host.authority.v1.RegisterAdmissionKeyRequest.actor:type_name -> host.authority.v1.WorkloadCredential + 16, // 16: host.authority.v1.RegisterAdmissionKeyResponse.key:type_name -> host.authority.v1.PublicKey + 27, // 17: host.authority.v1.ListResourcesResponse.grants:type_name -> host.authority.v1.ResourceGrant + 9, // 18: host.authority.v1.AttachResourceRequest.actor:type_name -> host.authority.v1.WorkloadCredential + 9, // 19: host.authority.v1.DetachResourceRequest.actor:type_name -> host.authority.v1.WorkloadCredential + 9, // 20: host.authority.v1.AuthorizeTransferRequest.actor:type_name -> host.authority.v1.WorkloadCredential + 0, // 21: host.authority.v1.AuthorityService.Issue:input_type -> host.authority.v1.IssueRequest + 12, // 22: host.authority.v1.AuthorityService.Check:input_type -> host.authority.v1.CheckRequest + 14, // 23: host.authority.v1.AuthorityService.Keys:input_type -> host.authority.v1.KeysRequest + 17, // 24: host.authority.v1.AuthorityService.RegisterAdmissionKey:input_type -> host.authority.v1.RegisterAdmissionKeyRequest + 19, // 25: host.authority.v1.AuthorityService.ListResources:input_type -> host.authority.v1.ListResourcesRequest + 21, // 26: host.authority.v1.AuthorityService.AttachResource:input_type -> host.authority.v1.AttachResourceRequest + 23, // 27: host.authority.v1.AuthorityService.DetachResource:input_type -> host.authority.v1.DetachResourceRequest + 25, // 28: host.authority.v1.AuthorityService.AuthorizeTransfer:input_type -> host.authority.v1.AuthorizeTransferRequest + 3, // 29: host.authority.v1.AuthorityService.Delegate:input_type -> host.authority.v1.DelegateRequest + 6, // 30: host.authority.v1.AuthorityService.RevokeDelegation:input_type -> host.authority.v1.RevokeDelegationRequest + 5, // 31: host.authority.v1.AuthorityService.GetDelegation:input_type -> host.authority.v1.GetDelegationRequest + 11, // 32: host.authority.v1.AuthorityService.Issue:output_type -> host.authority.v1.IssueResponse + 13, // 33: host.authority.v1.AuthorityService.Check:output_type -> host.authority.v1.CheckResponse + 15, // 34: host.authority.v1.AuthorityService.Keys:output_type -> host.authority.v1.KeysResponse + 18, // 35: host.authority.v1.AuthorityService.RegisterAdmissionKey:output_type -> host.authority.v1.RegisterAdmissionKeyResponse + 20, // 36: host.authority.v1.AuthorityService.ListResources:output_type -> host.authority.v1.ListResourcesResponse + 22, // 37: host.authority.v1.AuthorityService.AttachResource:output_type -> host.authority.v1.AttachResourceResponse + 24, // 38: host.authority.v1.AuthorityService.DetachResource:output_type -> host.authority.v1.DetachResourceResponse + 26, // 39: host.authority.v1.AuthorityService.AuthorizeTransfer:output_type -> host.authority.v1.AuthorizeTransferResponse + 4, // 40: host.authority.v1.AuthorityService.Delegate:output_type -> host.authority.v1.Delegation + 7, // 41: host.authority.v1.AuthorityService.RevokeDelegation:output_type -> host.authority.v1.RevokeDelegationResponse + 4, // 42: host.authority.v1.AuthorityService.GetDelegation:output_type -> host.authority.v1.Delegation + 32, // [32:43] is the sub-list for method output_type + 21, // [21:32] is the sub-list for method input_type + 21, // [21:21] is the sub-list for extension type_name + 21, // [21:21] is the sub-list for extension extendee + 0, // [0:21] is the sub-list for field type_name } func init() { file_host_authority_v1_authority_proto_init() } @@ -2170,8 +2251,9 @@ func file_host_authority_v1_authority_proto_init() { (*IssueRequest_Installation)(nil), (*IssueRequest_ParentToken)(nil), (*IssueRequest_Delegation)(nil), + (*IssueRequest_Setup)(nil), } - file_host_authority_v1_authority_proto_msgTypes[26].OneofWrappers = []any{ + file_host_authority_v1_authority_proto_msgTypes[27].OneofWrappers = []any{ (*ResourceGrant_All)(nil), (*ResourceGrant_Id)(nil), (*ResourceGrant_Prefix)(nil), @@ -2183,7 +2265,7 @@ func file_host_authority_v1_authority_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_host_authority_v1_authority_proto_rawDesc), len(file_host_authority_v1_authority_proto_rawDesc)), NumEnums: 0, - NumMessages: 27, + NumMessages: 28, NumExtensions: 0, NumServices: 1, }, diff --git a/modules/authority/services/local/code/pkg/gen/host/composition/v1/composition.pb.go b/modules/authority/services/local/code/pkg/gen/host/composition/v1/composition.pb.go index 92bcc01f..a3f0259e 100644 --- a/modules/authority/services/local/code/pkg/gen/host/composition/v1/composition.pb.go +++ b/modules/authority/services/local/code/pkg/gen/host/composition/v1/composition.pb.go @@ -147,8 +147,13 @@ type AuthorityManifestV1 struct { InstallationRole string `protobuf:"bytes,8,opt,name=installation_role,json=installationRole,proto3" json:"installation_role,omitempty"` // Viewer-edge presence only; grants no authority. Nil and empty are equivalent. EdgeDependencies []*EdgeDependencyV1 `protobuf:"bytes,9,rep,name=edge_dependencies,json=edgeDependencies,proto3" json:"edge_dependencies,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + // Resolved installation-only grants; separate from standing roles. + Setup []*SetupGrantV1 `protobuf:"bytes,10,rep,name=setup,proto3" json:"setup,omitempty"` + // Only these served kinds enforce resource-owner selectors. Mutually + // exclusive with owner_aware true; empty means none. + OwnerAwareResourceKinds []string `protobuf:"bytes,11,rep,name=owner_aware_resource_kinds,json=ownerAwareResourceKinds,proto3" json:"owner_aware_resource_kinds,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *AuthorityManifestV1) Reset() { @@ -244,6 +249,84 @@ func (x *AuthorityManifestV1) GetEdgeDependencies() []*EdgeDependencyV1 { return nil } +func (x *AuthorityManifestV1) GetSetup() []*SetupGrantV1 { + if x != nil { + return x.Setup + } + return nil +} + +func (x *AuthorityManifestV1) GetOwnerAwareResourceKinds() []string { + if x != nil { + return x.OwnerAwareResourceKinds + } + return nil +} + +// SetupGrantV1 retains exact methods even when two methods share requirements. +type SetupGrantV1 struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The required foreign invoke binding that reaches the destination. + Binding string `protobuf:"bytes,1,opt,name=binding,proto3" json:"binding,omitempty"` + // Exact, unique methods approved for this installation's setup only. + Methods []string `protobuf:"bytes,2,rep,name=methods,proto3" json:"methods,omitempty"` + // Callee-derived requirements as resource-kind:action, within invoke ceiling. + Scopes []string `protobuf:"bytes,3,rep,name=scopes,proto3" json:"scopes,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *SetupGrantV1) Reset() { + *x = SetupGrantV1{} + mi := &file_host_composition_v1_composition_proto_msgTypes[2] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *SetupGrantV1) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*SetupGrantV1) ProtoMessage() {} + +func (x *SetupGrantV1) ProtoReflect() protoreflect.Message { + mi := &file_host_composition_v1_composition_proto_msgTypes[2] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use SetupGrantV1.ProtoReflect.Descriptor instead. +func (*SetupGrantV1) Descriptor() ([]byte, []int) { + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{2} +} + +func (x *SetupGrantV1) GetBinding() string { + if x != nil { + return x.Binding + } + return "" +} + +func (x *SetupGrantV1) GetMethods() []string { + if x != nil { + return x.Methods + } + return nil +} + +func (x *SetupGrantV1) GetScopes() []string { + if x != nil { + return x.Scopes + } + return nil +} + // EdgeDependencyV1 names the exact signed module principal. The host resolves // it to a live catalogue target; it is not a target UUID, route alias or binding id. type EdgeDependencyV1 struct { @@ -257,7 +340,7 @@ type EdgeDependencyV1 struct { func (x *EdgeDependencyV1) Reset() { *x = EdgeDependencyV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[2] + mi := &file_host_composition_v1_composition_proto_msgTypes[3] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -269,7 +352,7 @@ func (x *EdgeDependencyV1) String() string { func (*EdgeDependencyV1) ProtoMessage() {} func (x *EdgeDependencyV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[2] + mi := &file_host_composition_v1_composition_proto_msgTypes[3] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -282,7 +365,7 @@ func (x *EdgeDependencyV1) ProtoReflect() protoreflect.Message { // Deprecated: Use EdgeDependencyV1.ProtoReflect.Descriptor instead. func (*EdgeDependencyV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{2} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{3} } func (x *EdgeDependencyV1) GetModule() string { @@ -317,7 +400,7 @@ type MethodPolicyV1 struct { func (x *MethodPolicyV1) Reset() { *x = MethodPolicyV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[3] + mi := &file_host_composition_v1_composition_proto_msgTypes[4] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -329,7 +412,7 @@ func (x *MethodPolicyV1) String() string { func (*MethodPolicyV1) ProtoMessage() {} func (x *MethodPolicyV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[3] + mi := &file_host_composition_v1_composition_proto_msgTypes[4] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -342,7 +425,7 @@ func (x *MethodPolicyV1) ProtoReflect() protoreflect.Message { // Deprecated: Use MethodPolicyV1.ProtoReflect.Descriptor instead. func (*MethodPolicyV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{3} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{4} } func (x *MethodPolicyV1) GetMethod() string { @@ -378,7 +461,7 @@ type SignedManifestV1 struct { func (x *SignedManifestV1) Reset() { *x = SignedManifestV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[4] + mi := &file_host_composition_v1_composition_proto_msgTypes[5] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -390,7 +473,7 @@ func (x *SignedManifestV1) String() string { func (*SignedManifestV1) ProtoMessage() {} func (x *SignedManifestV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[4] + mi := &file_host_composition_v1_composition_proto_msgTypes[5] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -403,7 +486,7 @@ func (x *SignedManifestV1) ProtoReflect() protoreflect.Message { // Deprecated: Use SignedManifestV1.ProtoReflect.Descriptor instead. func (*SignedManifestV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{4} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{5} } func (x *SignedManifestV1) GetDocument() []byte { @@ -435,7 +518,7 @@ type ApplyManifestResponse struct { func (x *ApplyManifestResponse) Reset() { *x = ApplyManifestResponse{} - mi := &file_host_composition_v1_composition_proto_msgTypes[5] + mi := &file_host_composition_v1_composition_proto_msgTypes[6] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -447,7 +530,7 @@ func (x *ApplyManifestResponse) String() string { func (*ApplyManifestResponse) ProtoMessage() {} func (x *ApplyManifestResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[5] + mi := &file_host_composition_v1_composition_proto_msgTypes[6] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -460,7 +543,7 @@ func (x *ApplyManifestResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ApplyManifestResponse.ProtoReflect.Descriptor instead. func (*ApplyManifestResponse) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{5} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{6} } func (x *ApplyManifestResponse) GetPrincipal() string { @@ -512,7 +595,7 @@ type ModuleManifestV1 struct { func (x *ModuleManifestV1) Reset() { *x = ModuleManifestV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[6] + mi := &file_host_composition_v1_composition_proto_msgTypes[7] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -524,7 +607,7 @@ func (x *ModuleManifestV1) String() string { func (*ModuleManifestV1) ProtoMessage() {} func (x *ModuleManifestV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[6] + mi := &file_host_composition_v1_composition_proto_msgTypes[7] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -537,7 +620,7 @@ func (x *ModuleManifestV1) ProtoReflect() protoreflect.Message { // Deprecated: Use ModuleManifestV1.ProtoReflect.Descriptor instead. func (*ModuleManifestV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{6} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{7} } func (x *ModuleManifestV1) GetModule() string { @@ -616,7 +699,7 @@ type RoleV1 struct { func (x *RoleV1) Reset() { *x = RoleV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[7] + mi := &file_host_composition_v1_composition_proto_msgTypes[8] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -628,7 +711,7 @@ func (x *RoleV1) String() string { func (*RoleV1) ProtoMessage() {} func (x *RoleV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[7] + mi := &file_host_composition_v1_composition_proto_msgTypes[8] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -641,7 +724,7 @@ func (x *RoleV1) ProtoReflect() protoreflect.Message { // Deprecated: Use RoleV1.ProtoReflect.Descriptor instead. func (*RoleV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{7} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{8} } func (x *RoleV1) GetName() string { @@ -687,7 +770,7 @@ type BindingV1 struct { func (x *BindingV1) Reset() { *x = BindingV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[8] + mi := &file_host_composition_v1_composition_proto_msgTypes[9] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -699,7 +782,7 @@ func (x *BindingV1) String() string { func (*BindingV1) ProtoMessage() {} func (x *BindingV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[8] + mi := &file_host_composition_v1_composition_proto_msgTypes[9] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -712,7 +795,7 @@ func (x *BindingV1) ProtoReflect() protoreflect.Message { // Deprecated: Use BindingV1.ProtoReflect.Descriptor instead. func (*BindingV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{8} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{9} } func (x *BindingV1) GetId() string { @@ -763,7 +846,7 @@ type ResourceKindV1 struct { func (x *ResourceKindV1) Reset() { *x = ResourceKindV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[9] + mi := &file_host_composition_v1_composition_proto_msgTypes[10] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -775,7 +858,7 @@ func (x *ResourceKindV1) String() string { func (*ResourceKindV1) ProtoMessage() {} func (x *ResourceKindV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[9] + mi := &file_host_composition_v1_composition_proto_msgTypes[10] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -788,7 +871,7 @@ func (x *ResourceKindV1) ProtoReflect() protoreflect.Message { // Deprecated: Use ResourceKindV1.ProtoReflect.Descriptor instead. func (*ResourceKindV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{9} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{10} } func (x *ResourceKindV1) GetKind() string { @@ -818,7 +901,7 @@ type PageV1 struct { func (x *PageV1) Reset() { *x = PageV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[10] + mi := &file_host_composition_v1_composition_proto_msgTypes[11] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -830,7 +913,7 @@ func (x *PageV1) String() string { func (*PageV1) ProtoMessage() {} func (x *PageV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[10] + mi := &file_host_composition_v1_composition_proto_msgTypes[11] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -843,7 +926,7 @@ func (x *PageV1) ProtoReflect() protoreflect.Message { // Deprecated: Use PageV1.ProtoReflect.Descriptor instead. func (*PageV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{10} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{11} } func (x *PageV1) GetTitle() string { @@ -871,7 +954,7 @@ const file_host_composition_v1_composition_proto_rawDesc = "" + "\n" + "credential\x18\x03 \x01(\tR\n" + "credential\x12C\n" + - "\tauthority\x18\x04 \x01(\v2%.host.composition.v1.SignedManifestV1R\tauthority\"\xda\x03\n" + + "\tauthority\x18\x04 \x01(\v2%.host.composition.v1.SignedManifestV1R\tauthority\"\xd0\x04\n" + "\x13AuthorityManifestV1\x12\x16\n" + "\x06module\x18\x01 \x01(\tR\x06module\x12\x1e\n" + "\n" + @@ -884,7 +967,14 @@ const file_host_composition_v1_composition_proto_rawDesc = "" + "\vowner_aware\x18\a \x01(\bR\n" + "ownerAware\x12+\n" + "\x11installation_role\x18\b \x01(\tR\x10installationRole\x12R\n" + - "\x11edge_dependencies\x18\t \x03(\v2%.host.composition.v1.EdgeDependencyV1R\x10edgeDependencies\"F\n" + + "\x11edge_dependencies\x18\t \x03(\v2%.host.composition.v1.EdgeDependencyV1R\x10edgeDependencies\x127\n" + + "\x05setup\x18\n" + + " \x03(\v2!.host.composition.v1.SetupGrantV1R\x05setup\x12;\n" + + "\x1aowner_aware_resource_kinds\x18\v \x03(\tR\x17ownerAwareResourceKinds\"Z\n" + + "\fSetupGrantV1\x12\x18\n" + + "\abinding\x18\x01 \x01(\tR\abinding\x12\x18\n" + + "\amethods\x18\x02 \x03(\tR\amethods\x12\x16\n" + + "\x06scopes\x18\x03 \x03(\tR\x06scopes\"F\n" + "\x10EdgeDependencyV1\x12\x16\n" + "\x06module\x18\x01 \x01(\tR\x06module\x12\x1a\n" + "\bpresence\x18\x02 \x01(\tR\bpresence\"\x92\x01\n" + @@ -943,46 +1033,48 @@ func file_host_composition_v1_composition_proto_rawDescGZIP() []byte { return file_host_composition_v1_composition_proto_rawDescData } -var file_host_composition_v1_composition_proto_msgTypes = make([]protoimpl.MessageInfo, 11) +var file_host_composition_v1_composition_proto_msgTypes = make([]protoimpl.MessageInfo, 12) var file_host_composition_v1_composition_proto_goTypes = []any{ (*ApplyManifestRequest)(nil), // 0: host.composition.v1.ApplyManifestRequest (*AuthorityManifestV1)(nil), // 1: host.composition.v1.AuthorityManifestV1 - (*EdgeDependencyV1)(nil), // 2: host.composition.v1.EdgeDependencyV1 - (*MethodPolicyV1)(nil), // 3: host.composition.v1.MethodPolicyV1 - (*SignedManifestV1)(nil), // 4: host.composition.v1.SignedManifestV1 - (*ApplyManifestResponse)(nil), // 5: host.composition.v1.ApplyManifestResponse - (*ModuleManifestV1)(nil), // 6: host.composition.v1.ModuleManifestV1 - (*RoleV1)(nil), // 7: host.composition.v1.RoleV1 - (*BindingV1)(nil), // 8: host.composition.v1.BindingV1 - (*ResourceKindV1)(nil), // 9: host.composition.v1.ResourceKindV1 - (*PageV1)(nil), // 10: host.composition.v1.PageV1 - (*v1.WorkScopeV1)(nil), // 11: host.authority.v1.WorkScopeV1 + (*SetupGrantV1)(nil), // 2: host.composition.v1.SetupGrantV1 + (*EdgeDependencyV1)(nil), // 3: host.composition.v1.EdgeDependencyV1 + (*MethodPolicyV1)(nil), // 4: host.composition.v1.MethodPolicyV1 + (*SignedManifestV1)(nil), // 5: host.composition.v1.SignedManifestV1 + (*ApplyManifestResponse)(nil), // 6: host.composition.v1.ApplyManifestResponse + (*ModuleManifestV1)(nil), // 7: host.composition.v1.ModuleManifestV1 + (*RoleV1)(nil), // 8: host.composition.v1.RoleV1 + (*BindingV1)(nil), // 9: host.composition.v1.BindingV1 + (*ResourceKindV1)(nil), // 10: host.composition.v1.ResourceKindV1 + (*PageV1)(nil), // 11: host.composition.v1.PageV1 + (*v1.WorkScopeV1)(nil), // 12: host.authority.v1.WorkScopeV1 } var file_host_composition_v1_composition_proto_depIdxs = []int32{ - 6, // 0: host.composition.v1.ApplyManifestRequest.manifest:type_name -> host.composition.v1.ModuleManifestV1 - 4, // 1: host.composition.v1.ApplyManifestRequest.carrier:type_name -> host.composition.v1.SignedManifestV1 - 4, // 2: host.composition.v1.ApplyManifestRequest.authority:type_name -> host.composition.v1.SignedManifestV1 - 3, // 3: host.composition.v1.AuthorityManifestV1.methods:type_name -> host.composition.v1.MethodPolicyV1 - 11, // 4: host.composition.v1.AuthorityManifestV1.scope_ceilings:type_name -> host.authority.v1.WorkScopeV1 - 7, // 5: host.composition.v1.AuthorityManifestV1.roles:type_name -> host.composition.v1.RoleV1 - 2, // 6: host.composition.v1.AuthorityManifestV1.edge_dependencies:type_name -> host.composition.v1.EdgeDependencyV1 - 11, // 7: host.composition.v1.MethodPolicyV1.requires:type_name -> host.authority.v1.WorkScopeV1 - 8, // 8: host.composition.v1.ModuleManifestV1.bindings:type_name -> host.composition.v1.BindingV1 - 9, // 9: host.composition.v1.ModuleManifestV1.resource_kinds:type_name -> host.composition.v1.ResourceKindV1 - 10, // 10: host.composition.v1.ModuleManifestV1.page:type_name -> host.composition.v1.PageV1 - 7, // 11: host.composition.v1.ModuleManifestV1.roles:type_name -> host.composition.v1.RoleV1 - 11, // 12: host.composition.v1.RoleV1.scopes:type_name -> host.authority.v1.WorkScopeV1 - 11, // 13: host.composition.v1.RoleV1.installation_owned_scopes:type_name -> host.authority.v1.WorkScopeV1 - 11, // 14: host.composition.v1.BindingV1.invoke_scopes:type_name -> host.authority.v1.WorkScopeV1 - 11, // 15: host.composition.v1.BindingV1.headless_scopes:type_name -> host.authority.v1.WorkScopeV1 - 11, // 16: host.composition.v1.BindingV1.lookup_scopes:type_name -> host.authority.v1.WorkScopeV1 - 0, // 17: host.composition.v1.CompositionService.ApplyManifest:input_type -> host.composition.v1.ApplyManifestRequest - 5, // 18: host.composition.v1.CompositionService.ApplyManifest:output_type -> host.composition.v1.ApplyManifestResponse - 18, // [18:19] is the sub-list for method output_type - 17, // [17:18] is the sub-list for method input_type - 17, // [17:17] is the sub-list for extension type_name - 17, // [17:17] is the sub-list for extension extendee - 0, // [0:17] is the sub-list for field type_name + 7, // 0: host.composition.v1.ApplyManifestRequest.manifest:type_name -> host.composition.v1.ModuleManifestV1 + 5, // 1: host.composition.v1.ApplyManifestRequest.carrier:type_name -> host.composition.v1.SignedManifestV1 + 5, // 2: host.composition.v1.ApplyManifestRequest.authority:type_name -> host.composition.v1.SignedManifestV1 + 4, // 3: host.composition.v1.AuthorityManifestV1.methods:type_name -> host.composition.v1.MethodPolicyV1 + 12, // 4: host.composition.v1.AuthorityManifestV1.scope_ceilings:type_name -> host.authority.v1.WorkScopeV1 + 8, // 5: host.composition.v1.AuthorityManifestV1.roles:type_name -> host.composition.v1.RoleV1 + 3, // 6: host.composition.v1.AuthorityManifestV1.edge_dependencies:type_name -> host.composition.v1.EdgeDependencyV1 + 2, // 7: host.composition.v1.AuthorityManifestV1.setup:type_name -> host.composition.v1.SetupGrantV1 + 12, // 8: host.composition.v1.MethodPolicyV1.requires:type_name -> host.authority.v1.WorkScopeV1 + 9, // 9: host.composition.v1.ModuleManifestV1.bindings:type_name -> host.composition.v1.BindingV1 + 10, // 10: host.composition.v1.ModuleManifestV1.resource_kinds:type_name -> host.composition.v1.ResourceKindV1 + 11, // 11: host.composition.v1.ModuleManifestV1.page:type_name -> host.composition.v1.PageV1 + 8, // 12: host.composition.v1.ModuleManifestV1.roles:type_name -> host.composition.v1.RoleV1 + 12, // 13: host.composition.v1.RoleV1.scopes:type_name -> host.authority.v1.WorkScopeV1 + 12, // 14: host.composition.v1.RoleV1.installation_owned_scopes:type_name -> host.authority.v1.WorkScopeV1 + 12, // 15: host.composition.v1.BindingV1.invoke_scopes:type_name -> host.authority.v1.WorkScopeV1 + 12, // 16: host.composition.v1.BindingV1.headless_scopes:type_name -> host.authority.v1.WorkScopeV1 + 12, // 17: host.composition.v1.BindingV1.lookup_scopes:type_name -> host.authority.v1.WorkScopeV1 + 0, // 18: host.composition.v1.CompositionService.ApplyManifest:input_type -> host.composition.v1.ApplyManifestRequest + 6, // 19: host.composition.v1.CompositionService.ApplyManifest:output_type -> host.composition.v1.ApplyManifestResponse + 19, // [19:20] is the sub-list for method output_type + 18, // [18:19] is the sub-list for method input_type + 18, // [18:18] is the sub-list for extension type_name + 18, // [18:18] is the sub-list for extension extendee + 0, // [0:18] is the sub-list for field type_name } func init() { file_host_composition_v1_composition_proto_init() } @@ -996,7 +1088,7 @@ func file_host_composition_v1_composition_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_host_composition_v1_composition_proto_rawDesc), len(file_host_composition_v1_composition_proto_rawDesc)), NumEnums: 0, - NumMessages: 11, + NumMessages: 12, NumExtensions: 0, NumServices: 1, }, diff --git a/modules/authority/services/local/code/pkg/gen/host/installation/v1/installation.pb.go b/modules/authority/services/local/code/pkg/gen/host/installation/v1/installation.pb.go index c1513bb3..a4febb74 100644 --- a/modules/authority/services/local/code/pkg/gen/host/installation/v1/installation.pb.go +++ b/modules/authority/services/local/code/pkg/gen/host/installation/v1/installation.pb.go @@ -1229,8 +1229,10 @@ type ReviewedOffer struct { // Exact declared viewer-edge presence, covered by the reviewed digest. // Required access and per-module approval are separate host review concerns. EdgeDependencies []*OfferDependency `protobuf:"bytes,8,rep,name=edge_dependencies,json=edgeDependencies,proto3" json:"edge_dependencies,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + // Temporary installation-confined grants, not standing roles. + Setup []*OfferSetup `protobuf:"bytes,9,rep,name=setup,proto3" json:"setup,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *ReviewedOffer) Reset() { @@ -1319,6 +1321,86 @@ func (x *ReviewedOffer) GetEdgeDependencies() []*OfferDependency { return nil } +func (x *ReviewedOffer) GetSetup() []*OfferSetup { + if x != nil { + return x.Setup + } + return nil +} + +// OfferSetup explains the exact authority usable only while setup is pending. +type OfferSetup struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The declared binding. + Binding string `protobuf:"bytes,1,opt,name=binding,proto3" json:"binding,omitempty"` + // The destination principal. + Module string `protobuf:"bytes,2,opt,name=module,proto3" json:"module,omitempty"` + // The exact allowed methods, even if other methods share their scopes. + Methods []string `protobuf:"bytes,3,rep,name=methods,proto3" json:"methods,omitempty"` + // Requirements, always confined to the pending installation's owner. + Scopes []*OfferScope `protobuf:"bytes,4,rep,name=scopes,proto3" json:"scopes,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *OfferSetup) Reset() { + *x = OfferSetup{} + mi := &file_host_installation_v1_installation_proto_msgTypes[19] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *OfferSetup) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*OfferSetup) ProtoMessage() {} + +func (x *OfferSetup) ProtoReflect() protoreflect.Message { + mi := &file_host_installation_v1_installation_proto_msgTypes[19] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use OfferSetup.ProtoReflect.Descriptor instead. +func (*OfferSetup) Descriptor() ([]byte, []int) { + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{19} +} + +func (x *OfferSetup) GetBinding() string { + if x != nil { + return x.Binding + } + return "" +} + +func (x *OfferSetup) GetModule() string { + if x != nil { + return x.Module + } + return "" +} + +func (x *OfferSetup) GetMethods() []string { + if x != nil { + return x.Methods + } + return nil +} + +func (x *OfferSetup) GetScopes() []*OfferScope { + if x != nil { + return x.Scopes + } + return nil +} + // OfferDependency carries presence only, never scopes or inferred binding ids. // Module is the exact signed principal, resolved by the host to its live target. type OfferDependency struct { @@ -1331,7 +1413,7 @@ type OfferDependency struct { func (x *OfferDependency) Reset() { *x = OfferDependency{} - mi := &file_host_installation_v1_installation_proto_msgTypes[19] + mi := &file_host_installation_v1_installation_proto_msgTypes[20] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1343,7 +1425,7 @@ func (x *OfferDependency) String() string { func (*OfferDependency) ProtoMessage() {} func (x *OfferDependency) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[19] + mi := &file_host_installation_v1_installation_proto_msgTypes[20] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1356,7 +1438,7 @@ func (x *OfferDependency) ProtoReflect() protoreflect.Message { // Deprecated: Use OfferDependency.ProtoReflect.Descriptor instead. func (*OfferDependency) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{19} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{20} } func (x *OfferDependency) GetModule() string { @@ -1386,7 +1468,7 @@ type OfferBinding struct { func (x *OfferBinding) Reset() { *x = OfferBinding{} - mi := &file_host_installation_v1_installation_proto_msgTypes[20] + mi := &file_host_installation_v1_installation_proto_msgTypes[21] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1398,7 +1480,7 @@ func (x *OfferBinding) String() string { func (*OfferBinding) ProtoMessage() {} func (x *OfferBinding) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[20] + mi := &file_host_installation_v1_installation_proto_msgTypes[21] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1411,7 +1493,7 @@ func (x *OfferBinding) ProtoReflect() protoreflect.Message { // Deprecated: Use OfferBinding.ProtoReflect.Descriptor instead. func (*OfferBinding) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{20} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{21} } func (x *OfferBinding) GetBinding() string { @@ -1449,7 +1531,7 @@ type OfferRole struct { func (x *OfferRole) Reset() { *x = OfferRole{} - mi := &file_host_installation_v1_installation_proto_msgTypes[21] + mi := &file_host_installation_v1_installation_proto_msgTypes[22] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1461,7 +1543,7 @@ func (x *OfferRole) String() string { func (*OfferRole) ProtoMessage() {} func (x *OfferRole) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[21] + mi := &file_host_installation_v1_installation_proto_msgTypes[22] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1474,7 +1556,7 @@ func (x *OfferRole) ProtoReflect() protoreflect.Message { // Deprecated: Use OfferRole.ProtoReflect.Descriptor instead. func (*OfferRole) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{21} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{22} } func (x *OfferRole) GetName() string { @@ -1514,7 +1596,7 @@ type OfferScope struct { func (x *OfferScope) Reset() { *x = OfferScope{} - mi := &file_host_installation_v1_installation_proto_msgTypes[22] + mi := &file_host_installation_v1_installation_proto_msgTypes[23] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1526,7 +1608,7 @@ func (x *OfferScope) String() string { func (*OfferScope) ProtoMessage() {} func (x *OfferScope) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[22] + mi := &file_host_installation_v1_installation_proto_msgTypes[23] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1539,7 +1621,7 @@ func (x *OfferScope) ProtoReflect() protoreflect.Message { // Deprecated: Use OfferScope.ProtoReflect.Descriptor instead. func (*OfferScope) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{22} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{23} } func (x *OfferScope) GetResourceKind() string { @@ -1587,7 +1669,7 @@ type OfferCapability struct { func (x *OfferCapability) Reset() { *x = OfferCapability{} - mi := &file_host_installation_v1_installation_proto_msgTypes[23] + mi := &file_host_installation_v1_installation_proto_msgTypes[24] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1599,7 +1681,7 @@ func (x *OfferCapability) String() string { func (*OfferCapability) ProtoMessage() {} func (x *OfferCapability) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[23] + mi := &file_host_installation_v1_installation_proto_msgTypes[24] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1612,7 +1694,7 @@ func (x *OfferCapability) ProtoReflect() protoreflect.Message { // Deprecated: Use OfferCapability.ProtoReflect.Descriptor instead. func (*OfferCapability) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{23} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{24} } func (x *OfferCapability) GetModule() string { @@ -1658,7 +1740,7 @@ type OfferTool struct { func (x *OfferTool) Reset() { *x = OfferTool{} - mi := &file_host_installation_v1_installation_proto_msgTypes[24] + mi := &file_host_installation_v1_installation_proto_msgTypes[25] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1670,7 +1752,7 @@ func (x *OfferTool) String() string { func (*OfferTool) ProtoMessage() {} func (x *OfferTool) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[24] + mi := &file_host_installation_v1_installation_proto_msgTypes[25] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1683,7 +1765,7 @@ func (x *OfferTool) ProtoReflect() protoreflect.Message { // Deprecated: Use OfferTool.ProtoReflect.Descriptor instead. func (*OfferTool) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{24} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{25} } func (x *OfferTool) GetName() string { @@ -1719,7 +1801,7 @@ type ListHeldRequest struct { func (x *ListHeldRequest) Reset() { *x = ListHeldRequest{} - mi := &file_host_installation_v1_installation_proto_msgTypes[25] + mi := &file_host_installation_v1_installation_proto_msgTypes[26] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1731,7 +1813,7 @@ func (x *ListHeldRequest) String() string { func (*ListHeldRequest) ProtoMessage() {} func (x *ListHeldRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[25] + mi := &file_host_installation_v1_installation_proto_msgTypes[26] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1744,7 +1826,7 @@ func (x *ListHeldRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListHeldRequest.ProtoReflect.Descriptor instead. func (*ListHeldRequest) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{25} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{26} } func (x *ListHeldRequest) GetOrganizationId() string { @@ -1766,7 +1848,7 @@ type ListHeldResponse struct { func (x *ListHeldResponse) Reset() { *x = ListHeldResponse{} - mi := &file_host_installation_v1_installation_proto_msgTypes[26] + mi := &file_host_installation_v1_installation_proto_msgTypes[27] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1778,7 +1860,7 @@ func (x *ListHeldResponse) String() string { func (*ListHeldResponse) ProtoMessage() {} func (x *ListHeldResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[26] + mi := &file_host_installation_v1_installation_proto_msgTypes[27] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1791,7 +1873,7 @@ func (x *ListHeldResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListHeldResponse.ProtoReflect.Descriptor instead. func (*ListHeldResponse) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{26} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{27} } func (x *ListHeldResponse) GetInstallations() []*HeldInstallation { @@ -1814,7 +1896,7 @@ type HeldInstallation struct { func (x *HeldInstallation) Reset() { *x = HeldInstallation{} - mi := &file_host_installation_v1_installation_proto_msgTypes[27] + mi := &file_host_installation_v1_installation_proto_msgTypes[28] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1826,7 +1908,7 @@ func (x *HeldInstallation) String() string { func (*HeldInstallation) ProtoMessage() {} func (x *HeldInstallation) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[27] + mi := &file_host_installation_v1_installation_proto_msgTypes[28] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1839,7 +1921,7 @@ func (x *HeldInstallation) ProtoReflect() protoreflect.Message { // Deprecated: Use HeldInstallation.ProtoReflect.Descriptor instead. func (*HeldInstallation) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{27} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{28} } func (x *HeldInstallation) GetInstallation() *Installation { @@ -1939,7 +2021,7 @@ const file_host_installation_v1_installation_proto_rawDesc = "" + "\x06target\x18\x01 \x01(\tR\x06target\x12\x1e\n" + "\n" + "generation\x18\x02 \x01(\x04R\n" + - "generation\"\xcf\x03\n" + + "generation\"\x87\x04\n" + "\rReviewedOffer\x12A\n" + "\bapproval\x18\x01 \x01(\v2%.host.installation.v1.ConsentApprovalR\bapproval\x12\x16\n" + "\x06target\x18\x02 \x01(\tR\x06target\x125\n" + @@ -1948,7 +2030,14 @@ const file_host_installation_v1_installation_proto_rawDesc = "" + "\aceiling\x18\x05 \x03(\v2\".host.installation.v1.OfferBindingR\aceiling\x12%\n" + "\x0etools_composed\x18\x06 \x01(\bR\rtoolsComposed\x12+\n" + "\x11installation_role\x18\a \x01(\tR\x10installationRole\x12R\n" + - "\x11edge_dependencies\x18\b \x03(\v2%.host.installation.v1.OfferDependencyR\x10edgeDependencies\"E\n" + + "\x11edge_dependencies\x18\b \x03(\v2%.host.installation.v1.OfferDependencyR\x10edgeDependencies\x126\n" + + "\x05setup\x18\t \x03(\v2 .host.installation.v1.OfferSetupR\x05setup\"\x92\x01\n" + + "\n" + + "OfferSetup\x12\x18\n" + + "\abinding\x18\x01 \x01(\tR\abinding\x12\x16\n" + + "\x06module\x18\x02 \x01(\tR\x06module\x12\x18\n" + + "\amethods\x18\x03 \x03(\tR\amethods\x128\n" + + "\x06scopes\x18\x04 \x03(\v2 .host.installation.v1.OfferScopeR\x06scopes\"E\n" + "\x0fOfferDependency\x12\x16\n" + "\x06module\x18\x01 \x01(\tR\x06module\x12\x1a\n" + "\bpresence\x18\x02 \x01(\tR\bpresence\"z\n" + @@ -2012,7 +2101,7 @@ func file_host_installation_v1_installation_proto_rawDescGZIP() []byte { } var file_host_installation_v1_installation_proto_enumTypes = make([]protoimpl.EnumInfo, 1) -var file_host_installation_v1_installation_proto_msgTypes = make([]protoimpl.MessageInfo, 28) +var file_host_installation_v1_installation_proto_msgTypes = make([]protoimpl.MessageInfo, 29) var file_host_installation_v1_installation_proto_goTypes = []any{ (Installation_Status)(0), // 0: host.installation.v1.Installation.Status (*CurrentInstallationRequest)(nil), // 1: host.installation.v1.CurrentInstallationRequest @@ -2034,15 +2123,16 @@ var file_host_installation_v1_installation_proto_goTypes = []any{ (*ListOffersResponse)(nil), // 17: host.installation.v1.ListOffersResponse (*Offer)(nil), // 18: host.installation.v1.Offer (*ReviewedOffer)(nil), // 19: host.installation.v1.ReviewedOffer - (*OfferDependency)(nil), // 20: host.installation.v1.OfferDependency - (*OfferBinding)(nil), // 21: host.installation.v1.OfferBinding - (*OfferRole)(nil), // 22: host.installation.v1.OfferRole - (*OfferScope)(nil), // 23: host.installation.v1.OfferScope - (*OfferCapability)(nil), // 24: host.installation.v1.OfferCapability - (*OfferTool)(nil), // 25: host.installation.v1.OfferTool - (*ListHeldRequest)(nil), // 26: host.installation.v1.ListHeldRequest - (*ListHeldResponse)(nil), // 27: host.installation.v1.ListHeldResponse - (*HeldInstallation)(nil), // 28: host.installation.v1.HeldInstallation + (*OfferSetup)(nil), // 20: host.installation.v1.OfferSetup + (*OfferDependency)(nil), // 21: host.installation.v1.OfferDependency + (*OfferBinding)(nil), // 22: host.installation.v1.OfferBinding + (*OfferRole)(nil), // 23: host.installation.v1.OfferRole + (*OfferScope)(nil), // 24: host.installation.v1.OfferScope + (*OfferCapability)(nil), // 25: host.installation.v1.OfferCapability + (*OfferTool)(nil), // 26: host.installation.v1.OfferTool + (*ListHeldRequest)(nil), // 27: host.installation.v1.ListHeldRequest + (*ListHeldResponse)(nil), // 28: host.installation.v1.ListHeldResponse + (*HeldInstallation)(nil), // 29: host.installation.v1.HeldInstallation } var file_host_installation_v1_installation_proto_depIdxs = []int32{ 5, // 0: host.installation.v1.InstallRequest.approval:type_name -> host.installation.v1.ConsentApproval @@ -2052,44 +2142,46 @@ var file_host_installation_v1_installation_proto_depIdxs = []int32{ 13, // 4: host.installation.v1.InstallationNotice.installation:type_name -> host.installation.v1.Installation 18, // 5: host.installation.v1.ListOffersResponse.offers:type_name -> host.installation.v1.Offer 5, // 6: host.installation.v1.ReviewedOffer.approval:type_name -> host.installation.v1.ConsentApproval - 22, // 7: host.installation.v1.ReviewedOffer.roles:type_name -> host.installation.v1.OfferRole + 23, // 7: host.installation.v1.ReviewedOffer.roles:type_name -> host.installation.v1.OfferRole 13, // 8: host.installation.v1.ReviewedOffer.installation:type_name -> host.installation.v1.Installation - 21, // 9: host.installation.v1.ReviewedOffer.ceiling:type_name -> host.installation.v1.OfferBinding - 20, // 10: host.installation.v1.ReviewedOffer.edge_dependencies:type_name -> host.installation.v1.OfferDependency - 23, // 11: host.installation.v1.OfferBinding.scopes:type_name -> host.installation.v1.OfferScope - 23, // 12: host.installation.v1.OfferRole.scopes:type_name -> host.installation.v1.OfferScope - 24, // 13: host.installation.v1.OfferRole.capabilities:type_name -> host.installation.v1.OfferCapability - 23, // 14: host.installation.v1.OfferCapability.requires:type_name -> host.installation.v1.OfferScope - 25, // 15: host.installation.v1.OfferCapability.tools:type_name -> host.installation.v1.OfferTool - 28, // 16: host.installation.v1.ListHeldResponse.installations:type_name -> host.installation.v1.HeldInstallation - 13, // 17: host.installation.v1.HeldInstallation.installation:type_name -> host.installation.v1.Installation - 1, // 18: host.installation.v1.InstallationService.Current:input_type -> host.installation.v1.CurrentInstallationRequest - 3, // 19: host.installation.v1.InstallationService.Install:input_type -> host.installation.v1.InstallRequest - 4, // 20: host.installation.v1.InstallationService.Review:input_type -> host.installation.v1.ReviewRequest - 6, // 21: host.installation.v1.InstallationService.GrantRole:input_type -> host.installation.v1.GrantRoleRequest - 7, // 22: host.installation.v1.InstallationService.RevokeRole:input_type -> host.installation.v1.RevokeRoleRequest - 8, // 23: host.installation.v1.InstallationService.ListRoleGrants:input_type -> host.installation.v1.ListRoleGrantsRequest - 11, // 24: host.installation.v1.InstallationService.List:input_type -> host.installation.v1.ListRequest - 26, // 25: host.installation.v1.InstallationService.ListHeld:input_type -> host.installation.v1.ListHeldRequest - 14, // 26: host.installation.v1.InstallableService.Install:input_type -> host.installation.v1.InstallationNotice - 16, // 27: host.installation.v1.OfferService.ListOffers:input_type -> host.installation.v1.ListOffersRequest - 4, // 28: host.installation.v1.OfferService.ReviewOffer:input_type -> host.installation.v1.ReviewRequest - 2, // 29: host.installation.v1.InstallationService.Current:output_type -> host.installation.v1.CurrentInstallation - 13, // 30: host.installation.v1.InstallationService.Install:output_type -> host.installation.v1.Installation - 5, // 31: host.installation.v1.InstallationService.Review:output_type -> host.installation.v1.ConsentApproval - 13, // 32: host.installation.v1.InstallationService.GrantRole:output_type -> host.installation.v1.Installation - 13, // 33: host.installation.v1.InstallationService.RevokeRole:output_type -> host.installation.v1.Installation - 9, // 34: host.installation.v1.InstallationService.ListRoleGrants:output_type -> host.installation.v1.ListRoleGrantsResponse - 12, // 35: host.installation.v1.InstallationService.List:output_type -> host.installation.v1.ListResponse - 27, // 36: host.installation.v1.InstallationService.ListHeld:output_type -> host.installation.v1.ListHeldResponse - 15, // 37: host.installation.v1.InstallableService.Install:output_type -> host.installation.v1.InstallationAck - 17, // 38: host.installation.v1.OfferService.ListOffers:output_type -> host.installation.v1.ListOffersResponse - 19, // 39: host.installation.v1.OfferService.ReviewOffer:output_type -> host.installation.v1.ReviewedOffer - 29, // [29:40] is the sub-list for method output_type - 18, // [18:29] is the sub-list for method input_type - 18, // [18:18] is the sub-list for extension type_name - 18, // [18:18] is the sub-list for extension extendee - 0, // [0:18] is the sub-list for field type_name + 22, // 9: host.installation.v1.ReviewedOffer.ceiling:type_name -> host.installation.v1.OfferBinding + 21, // 10: host.installation.v1.ReviewedOffer.edge_dependencies:type_name -> host.installation.v1.OfferDependency + 20, // 11: host.installation.v1.ReviewedOffer.setup:type_name -> host.installation.v1.OfferSetup + 24, // 12: host.installation.v1.OfferSetup.scopes:type_name -> host.installation.v1.OfferScope + 24, // 13: host.installation.v1.OfferBinding.scopes:type_name -> host.installation.v1.OfferScope + 24, // 14: host.installation.v1.OfferRole.scopes:type_name -> host.installation.v1.OfferScope + 25, // 15: host.installation.v1.OfferRole.capabilities:type_name -> host.installation.v1.OfferCapability + 24, // 16: host.installation.v1.OfferCapability.requires:type_name -> host.installation.v1.OfferScope + 26, // 17: host.installation.v1.OfferCapability.tools:type_name -> host.installation.v1.OfferTool + 29, // 18: host.installation.v1.ListHeldResponse.installations:type_name -> host.installation.v1.HeldInstallation + 13, // 19: host.installation.v1.HeldInstallation.installation:type_name -> host.installation.v1.Installation + 1, // 20: host.installation.v1.InstallationService.Current:input_type -> host.installation.v1.CurrentInstallationRequest + 3, // 21: host.installation.v1.InstallationService.Install:input_type -> host.installation.v1.InstallRequest + 4, // 22: host.installation.v1.InstallationService.Review:input_type -> host.installation.v1.ReviewRequest + 6, // 23: host.installation.v1.InstallationService.GrantRole:input_type -> host.installation.v1.GrantRoleRequest + 7, // 24: host.installation.v1.InstallationService.RevokeRole:input_type -> host.installation.v1.RevokeRoleRequest + 8, // 25: host.installation.v1.InstallationService.ListRoleGrants:input_type -> host.installation.v1.ListRoleGrantsRequest + 11, // 26: host.installation.v1.InstallationService.List:input_type -> host.installation.v1.ListRequest + 27, // 27: host.installation.v1.InstallationService.ListHeld:input_type -> host.installation.v1.ListHeldRequest + 14, // 28: host.installation.v1.InstallableService.Install:input_type -> host.installation.v1.InstallationNotice + 16, // 29: host.installation.v1.OfferService.ListOffers:input_type -> host.installation.v1.ListOffersRequest + 4, // 30: host.installation.v1.OfferService.ReviewOffer:input_type -> host.installation.v1.ReviewRequest + 2, // 31: host.installation.v1.InstallationService.Current:output_type -> host.installation.v1.CurrentInstallation + 13, // 32: host.installation.v1.InstallationService.Install:output_type -> host.installation.v1.Installation + 5, // 33: host.installation.v1.InstallationService.Review:output_type -> host.installation.v1.ConsentApproval + 13, // 34: host.installation.v1.InstallationService.GrantRole:output_type -> host.installation.v1.Installation + 13, // 35: host.installation.v1.InstallationService.RevokeRole:output_type -> host.installation.v1.Installation + 9, // 36: host.installation.v1.InstallationService.ListRoleGrants:output_type -> host.installation.v1.ListRoleGrantsResponse + 12, // 37: host.installation.v1.InstallationService.List:output_type -> host.installation.v1.ListResponse + 28, // 38: host.installation.v1.InstallationService.ListHeld:output_type -> host.installation.v1.ListHeldResponse + 15, // 39: host.installation.v1.InstallableService.Install:output_type -> host.installation.v1.InstallationAck + 17, // 40: host.installation.v1.OfferService.ListOffers:output_type -> host.installation.v1.ListOffersResponse + 19, // 41: host.installation.v1.OfferService.ReviewOffer:output_type -> host.installation.v1.ReviewedOffer + 31, // [31:42] is the sub-list for method output_type + 20, // [20:31] is the sub-list for method input_type + 20, // [20:20] is the sub-list for extension type_name + 20, // [20:20] is the sub-list for extension extendee + 0, // [0:20] is the sub-list for field type_name } func init() { file_host_installation_v1_installation_proto_init() } @@ -2103,7 +2195,7 @@ func file_host_installation_v1_installation_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_host_installation_v1_installation_proto_rawDesc), len(file_host_installation_v1_installation_proto_rawDesc)), NumEnums: 1, - NumMessages: 28, + NumMessages: 29, NumExtensions: 0, NumServices: 3, }, diff --git a/modules/authority/services/local/code/plugins/composition/installation_dispatch_test.go b/modules/authority/services/local/code/plugins/composition/installation_dispatch_test.go new file mode 100644 index 00000000..075eda44 --- /dev/null +++ b/modules/authority/services/local/code/plugins/composition/installation_dispatch_test.go @@ -0,0 +1,256 @@ +package composition + +import ( + "context" + "encoding/json" + "fmt" + "net/http" + "net/http/httptest" + "strconv" + "sync/atomic" + "testing" + "time" + + "gateway/pkg/business/state" + "gateway/pkg/business/testkit" + authorityv1 "gateway/pkg/gen/host/authority/v1" + compositionv1 "gateway/pkg/gen/host/composition/v1" + installationv1 "gateway/pkg/gen/host/installation/v1" + installationplugin "gateway/plugins/installation" + "github.com/codefly-dev/authority/libraries/authority-core/go/authority" + "github.com/codefly-dev/authority/libraries/authority-core/go/domain" + "github.com/codefly-dev/core/solutionhost" + wc "github.com/codefly-dev/sdk-go/workcontext" + "github.com/google/uuid" + "google.golang.org/grpc/metadata" +) + +type localTransport struct{} + +func (localTransport) WorkspaceValueIfSet(string, string) (string, bool, error) { + return "", false, nil +} +func (localTransport) IsLocalRun() bool { return true } + +func dispatchOffer(t *testing.T, endpoints []solutionhost.Endpoint) (*Plugin, *testkit.Kit, authority.Person, domain.ConsentApproval, *compositionv1.ApplyManifestRequest) { + t.Helper() + p, k := verifying(t) + read := scope("conformance.page", "read") + req := carrier(t, k, "conformance-solution", solutionhost.KindSolution, 1, []string{"conformance.page"}, &compositionv1.AuthorityManifestV1{ScopeCeilings: []*authorityv1.WorkScopeV1{read}, Roles: []*compositionv1.RoleV1{{Name: state.InstallerRole, Scopes: []*authorityv1.WorkScopeV1{read}}, {Name: "viewer", Scopes: []*authorityv1.WorkScopeV1{read}}}}, func(m *solutionhost.ModuleManifest) { m.Endpoints = endpoints }) + if _, err := p.ApplyManifest(context.Background(), req); err != nil { + t.Fatal(err) + } + session, err := k.State.SignIn("fixture-alex") + if err != nil { + t.Fatal(err) + } + caller, err := k.State.Caller(session.ID) + if err != nil { + t.Fatal(err) + } + approval, err := k.State.Service().Review(context.Background(), caller, "acme", "conformance-solution") + if err != nil { + t.Fatal(err) + } + approval.OperationID = uuid.NewString() + return p, k, caller, approval, req +} + +func dispatchInstall(k *testkit.Kit, caller authority.Person, approval *domain.ConsentApproval) (domain.Installation, error) { + return k.State.Service().Install(context.Background(), caller, "acme", "conformance-solution", "viewer", "alex", approval, func(ctx context.Context, inst domain.Installation) error { + return k.State.DeliverInstallation(ctx, inst, localTransport{}) + }) +} + +func TestInstallationDispatchAuthenticatesAndRetriesUntilAcknowledged(t *testing.T) { + var k *testkit.Kit + var calls atomic.Int32 + var previousToken string + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + n := calls.Add(1) + if r.Method != http.MethodPost || r.URL.Path != "/_codefly/installations" || r.URL.RawQuery != "" { + t.Errorf("unexpected callback: %s %s", r.Method, r.URL.String()) + } + var body struct { + ID string `json:"installation_id"` + Organization string `json:"organization_id"` + Revision uint64 `json:"revision"` + } + if err := json.NewDecoder(r.Body).Decode(&body); err != nil { + t.Error(err) + w.WriteHeader(500) + return + } + inst, ok := k.State.Installation(body.ID) + if !ok || inst.Status != state.Pending || body.Organization != "acme" || body.Revision != inst.Revision || r.Header.Get(wc.InstallationIDHeaderName) != body.ID || r.Header.Get(wc.InstallationRevisionHeaderName) != strconv.FormatUint(body.Revision, 10) { + t.Errorf("callback not bound to pending installation: %+v %+v", body, inst) + } + token := r.Header.Get(wc.HeaderName) + checked, err := k.Issuer.Check(r.Context(), token, "conformance-solution", authority.InstallationStepHTTPMethod) + if err != nil || checked == nil { + t.Errorf("setup token failed real Check: %v", err) + } else { + claims := checked.GetContext() + scopes := claims.GetAuthorityScopes() + if claims.GetAudience() != "conformance-solution" || claims.GetOrganizationId() != body.Organization || claims.GetTenantId() != body.Organization || claims.GetSeal().GetInstallationId() != body.ID || claims.GetSeal().GetInstallationRevision() != body.Revision || len(scopes) != 1 || scopes[0].GetResourceKind() != "installations" || len(scopes[0].GetActions()) != 1 || scopes[0].GetActions()[0] != "install" || len(scopes[0].GetResourceIds()) != 1 || scopes[0].GetResourceIds()[0] != body.ID { + t.Errorf("verified claims do not match the callback: %v", claims) + } + } + if _, err := k.Issuer.Check(r.Context(), token, "conformance-solution", "POST /another"); err == nil { + t.Error("setup token admitted to another method") + } + previousToken = token + if n == 1 { + w.WriteHeader(http.StatusServiceUnavailable) + return + } + w.WriteHeader(http.StatusNoContent) + })) + defer server.Close() + _, kit, caller, approval, _ := dispatchOffer(t, []solutionhost.Endpoint{{Name: "web", Service: "api", API: "http", Address: server.URL}}) + k = kit + first, err := dispatchInstall(k, caller, &approval) + if err == nil || first.Status != domain.Pending { + t.Fatalf("first callback must remain pending: %+v %v", first, err) + } + active, err := dispatchInstall(k, caller, &approval) + if err != nil || active.Status != domain.Active || active.Revision != first.Revision || calls.Load() != 2 { + t.Fatalf("retry: %+v calls=%d err=%v", active, calls.Load(), err) + } + if _, err := k.Issuer.Check(context.Background(), previousToken, "conformance-solution", authority.InstallationStepHTTPMethod); err == nil { + t.Error("active installation retained pending setup credential") + } + if _, err := dispatchInstall(k, caller, &approval); err != nil || calls.Load() != 2 { + t.Fatalf("completed replay repeated callback: %v, calls=%d", err, calls.Load()) + } +} + +func TestInstallationDispatchRefusesMissingAmbiguousAndRedirect(t *testing.T) { + var leaked atomic.Int32 + sink := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { leaked.Add(1); w.WriteHeader(204) })) + defer sink.Close() + redirect := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + http.Redirect(w, r, sink.URL, http.StatusTemporaryRedirect) + })) + defer redirect.Close() + for _, tc := range []struct { + name string + endpoints []solutionhost.Endpoint + }{ + {"missing", nil}, + {"ambiguous", []solutionhost.Endpoint{{Name: "one", Service: "api", API: "http", Address: redirect.URL}, {Name: "two", Service: "api", API: "http", Address: sink.URL}}}, + {"redirect", []solutionhost.Endpoint{{Name: "one", Service: "api", API: "http", Address: redirect.URL}}}, + } { + t.Run(tc.name, func(t *testing.T) { + _, k, caller, approval, _ := dispatchOffer(t, tc.endpoints) + inst, err := dispatchInstall(k, caller, &approval) + if err == nil || inst.Status != domain.Pending { + t.Fatalf("unsafe dispatch accepted: %+v %v", inst, err) + } + }) + } + if got := leaked.Load(); got != 0 { + t.Error(fmt.Sprintf("redirect/ambiguous endpoint received %d callbacks", got)) + } +} + +func TestInstallationRPCDispatchFencesWithdrawalDuringCallback(t *testing.T) { + entered, release := make(chan string, 1), make(chan struct{}) + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + entered <- r.Header.Get(wc.HeaderName) + <-release + w.WriteHeader(http.StatusNoContent) + })) + defer server.Close() + p, k, _, _, req := dispatchOffer(t, []solutionhost.Endpoint{{Name: "web", Service: "api", API: "http", Address: server.URL}}) + k.State.OnInstall(func(ctx context.Context, inst state.Installation) error { + return k.State.DeliverInstallation(ctx, inst, localTransport{}) + }) + session, err := k.State.SignIn("fixture-alex") + if err != nil { + t.Fatal(err) + } + ctx := metadata.NewIncomingContext(context.Background(), metadata.Pairs("authorization", "Bearer "+session.ID)) + plugin := &installationplugin.Plugin{State: k.State} + approval, err := plugin.Review(ctx, &installationv1.ReviewRequest{OrganizationId: "acme", Target: "conformance-solution"}) + if err != nil { + t.Fatal(err) + } + approval.OperationId = uuid.NewString() + request := &installationv1.InstallRequest{OrganizationId: "acme", Target: "conformance-solution", Role: "viewer", OwnerPersonId: "alex", Approval: approval} + done := make(chan error, 1) + go func() { _, err := plugin.Install(ctx, request); done <- err }() + var token string + select { + case token = <-entered: + case err := <-done: + t.Fatalf("install ended before callback: %v", err) + case <-time.After(5 * time.Second): + t.Fatal("installation callback did not arrive") + } + if _, err := k.Issuer.Check(context.Background(), token, "conformance-solution", authority.InstallationStepHTTPMethod); err != nil { + close(release) + t.Fatalf("pending credential refused: %v", err) + } + if _, err := p.ApplyManifest(context.Background(), withdrawn(t, req)); err != nil { + close(release) + t.Fatal(err) + } + if _, err := k.Issuer.Check(context.Background(), token, "conformance-solution", authority.InstallationStepHTTPMethod); err == nil { + t.Error("withdrawn setup credential remained valid") + } + close(release) + if err := <-done; err == nil { + t.Error("stale callback acknowledged a withdrawn installation") + } + inst, ok := k.State.Installation(state.InstallationID("acme", "conformance-solution")) + if !ok || inst.Status != state.Revoked { + t.Fatalf("withdrawal did not fence activation: %+v", inst) + } + if _, err := plugin.Install(ctx, request); err == nil { + t.Error("old consent restored withdrawn installation") + } +} + +func TestInstallationDispatchRejectsStaleApprovalAfterRedelivery(t *testing.T) { + var token string + var calls atomic.Int32 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + token = r.Header.Get(wc.HeaderName) + if calls.Add(1) == 1 { + w.WriteHeader(http.StatusServiceUnavailable) + return + } + w.WriteHeader(http.StatusNoContent) + })) + defer server.Close() + endpoints := []solutionhost.Endpoint{{Name: "web", Service: "api", API: "http", Address: server.URL}} + p, k, caller, old, _ := dispatchOffer(t, endpoints) + if _, err := dispatchInstall(k, caller, &old); err == nil { + t.Fatal("failed callback activated") + } + staleToken := token + read := scope("conformance.page", "read") + replacement := carrier(t, k, "conformance-solution", solutionhost.KindSolution, 2, []string{"conformance.page"}, &compositionv1.AuthorityManifestV1{ScopeCeilings: []*authorityv1.WorkScopeV1{read}, Roles: []*compositionv1.RoleV1{{Name: state.InstallerRole, Scopes: []*authorityv1.WorkScopeV1{read}}, {Name: "viewer", Scopes: []*authorityv1.WorkScopeV1{read}}}}, func(m *solutionhost.ModuleManifest) { m.Endpoints = endpoints }) + if _, err := p.ApplyManifest(context.Background(), replacement); err != nil { + t.Fatal(err) + } + if _, err := k.Issuer.Check(context.Background(), staleToken, "conformance-solution", authority.InstallationStepHTTPMethod); err == nil { + t.Error("redelivery retained prior setup credential") + } + if _, err := dispatchInstall(k, caller, &old); err == nil { + t.Error("stale approval accepted") + } + if calls.Load() != 1 { + t.Fatal("stale approval reached callback") + } + fresh, err := k.State.Service().Review(context.Background(), caller, "acme", "conformance-solution") + if err != nil { + t.Fatal(err) + } + fresh.OperationID = uuid.NewString() + active, err := dispatchInstall(k, caller, &fresh) + if err != nil || active.Status != domain.Active || calls.Load() != 2 { + t.Fatalf("fresh consent could not converge: %+v %v calls=%d", active, err, calls.Load()) + } +} diff --git a/modules/authority/services/local/code/plugins/composition/plugin.go b/modules/authority/services/local/code/plugins/composition/plugin.go index 8cd59c98..feb4fbd4 100644 --- a/modules/authority/services/local/code/plugins/composition/plugin.go +++ b/modules/authority/services/local/code/plugins/composition/plugin.go @@ -6,7 +6,9 @@ import ( "crypto" "gateway/pkg/framework" "gateway/pkg/wiring" + modulecontract "github.com/codefly-dev/core/contracts/module" "log" + "slices" "github.com/codefly-dev/authority/libraries/authority-core/go/delivered" "github.com/codefly-dev/authority/libraries/authority-core/go/domain" @@ -139,6 +141,10 @@ func (p *Plugin) document(signed, carrier *compositionv1.SignedManifestV1, core func DocumentOf(in *compositionv1.AuthorityManifestV1) *delivered.Document { doc := &delivered.Document{Module: in.GetModule(), Generation: in.GetGeneration(), CoreManifestDigest: in.GetCoreManifestDigest(), ScopeCeilings: issuer.FromWire(in.GetScopeCeilings()), OwnerAware: in.GetOwnerAware(), InstallationRole: in.GetInstallationRole()} + doc.OwnerAwareResourceKinds = slices.Clone(in.GetOwnerAwareResourceKinds()) + for _, entry := range in.GetSetup() { + doc.Setup = append(doc.Setup, modulecontract.ResolvedSetup{Binding: entry.GetBinding(), Methods: slices.Clone(entry.GetMethods()), Scopes: slices.Clone(entry.GetScopes())}) + } for _, d := range in.GetEdgeDependencies() { doc.EdgeDependencies = append(doc.EdgeDependencies, domain.EdgeDependency{Module: d.GetModule(), Presence: d.GetPresence()}) } diff --git a/modules/authority/services/local/code/plugins/installation/offers.go b/modules/authority/services/local/code/plugins/installation/offers.go index 846b3ac4..17417948 100644 --- a/modules/authority/services/local/code/plugins/installation/offers.go +++ b/modules/authority/services/local/code/plugins/installation/offers.go @@ -107,6 +107,9 @@ func (p *Plugin) review(offer authority.ReviewedOffer, bindings map[string]*runn return nil, authorityplugin.Status(err) } out := &installationv1.ReviewedOffer{Target: projected.Target, ToolsComposed: projected.ToolsComposed, InstallationRole: projected.InstallationRole} + for _, entry := range projected.Setup { + out.Setup = append(out.Setup, &installationv1.OfferSetup{Binding: entry.Binding, Module: entry.Module, Methods: entry.Methods, Scopes: scopesToWire(entry.Scopes)}) + } for _, d := range projected.EdgeDependencies { out.EdgeDependencies = append(out.EdgeDependencies, &installationv1.OfferDependency{Module: d.Module, Presence: d.Presence}) } diff --git a/modules/authority/services/local/code/work.go b/modules/authority/services/local/code/work.go index eade8fef..a0ca4041 100644 --- a/modules/authority/services/local/code/work.go +++ b/modules/authority/services/local/code/work.go @@ -93,6 +93,9 @@ func configureLocalAuthority(ctx context.Context, _ *adapters.Configuration) (Cl if err != nil { return nil, err } + st.OnInstall(func(callCtx context.Context, inst state.Installation) error { + return st.DeliverInstallation(callCtx, inst, codefly.For(ctx)) + }) // Keys publishes the hop's admission key once the hop registers it // (RegisterAdmissionKey): nothing about the hop is configured here. wiring.Set(st, issuer.New(st, issuerName, keyID, signing.Public().(ed25519.PublicKey))) diff --git a/modules/authority/services/local/openapi/host/authority/v1/authority.swagger.json b/modules/authority/services/local/openapi/host/authority/v1/authority.swagger.json index 4ff83cda..a35b6cf0 100644 --- a/modules/authority/services/local/openapi/host/authority/v1/authority.swagger.json +++ b/modules/authority/services/local/openapi/host/authority/v1/authority.swagger.json @@ -176,6 +176,20 @@ }, "description": "InstallationRef names an installation acting for itself." }, + "v1InstallationSetupRef": { + "type": "object", + "properties": { + "stepToken": { + "type": "string", + "description": "The unexpired standard installation callback credential." + }, + "method": { + "type": "string", + "description": "The exact destination method selected by the setup declaration." + } + }, + "description": "InstallationSetupRef selects one exact method from the reviewed setup grant.\nThe callback token proves the current attempt; it is not data authority." + }, "v1IssueRequest": { "type": "object", "properties": { @@ -199,6 +213,10 @@ "$ref": "#/definitions/v1DelegationRef", "description": "A delegation a person granted the module acting (actor): the capability\nis owned by that person and carries the delegation on the module's hop.\nNo live capability is presented: the authority re-checks the delegation\nand what its grantor holds now, so a revoked delegation or a lost role\nstops the next issue, and renewing is issuing again." }, + "setup": { + "$ref": "#/definitions/v1InstallationSetupRef", + "description": "Current authenticated install callback evidence for one declared setup\nmethod. Independent of standing roles; requires the solution's actor." + }, "audience": { "type": "string", "description": "The module principal that may consume the capability." diff --git a/modules/authority/services/local/proto/host/authority/v1/authority.proto b/modules/authority/services/local/proto/host/authority/v1/authority.proto index 4df9e58a..5367471e 100644 --- a/modules/authority/services/local/proto/host/authority/v1/authority.proto +++ b/modules/authority/services/local/proto/host/authority/v1/authority.proto @@ -149,6 +149,9 @@ message IssueRequest { // and what its grantor holds now, so a revoked delegation or a lost role // stops the next issue, and renewing is issuing again. DelegationRef delegation = 11; + // Current authenticated install callback evidence for one declared setup + // method. Independent of standing roles; requires the solution's actor. + InstallationSetupRef setup = 13; } // The module principal that may consume the capability. string audience = 5; @@ -174,6 +177,15 @@ message IssueRequest { string operation = 12; } +// InstallationSetupRef selects one exact method from the reviewed setup grant. +// The callback token proves the current attempt; it is not data authority. +message InstallationSetupRef { + // The unexpired standard installation callback credential. + string step_token = 1; + // The exact destination method selected by the setup declaration. + string method = 2; +} + // DelegationRef names one delegation. message DelegationRef { // The delegation's id, as Delegate answered it. diff --git a/modules/authority/services/local/proto/host/composition/v1/composition.proto b/modules/authority/services/local/proto/host/composition/v1/composition.proto index f0f10078..ad131d7c 100644 --- a/modules/authority/services/local/proto/host/composition/v1/composition.proto +++ b/modules/authority/services/local/proto/host/composition/v1/composition.proto @@ -72,6 +72,21 @@ message AuthorityManifestV1 { string installation_role = 8; // Viewer-edge presence only; grants no authority. Nil and empty are equivalent. repeated EdgeDependencyV1 edge_dependencies = 9; + // Resolved installation-only grants; separate from standing roles. + repeated SetupGrantV1 setup = 10; + // Only these served kinds enforce resource-owner selectors. Mutually + // exclusive with owner_aware true; empty means none. + repeated string owner_aware_resource_kinds = 11; +} + +// SetupGrantV1 retains exact methods even when two methods share requirements. +message SetupGrantV1 { + // The required foreign invoke binding that reaches the destination. + string binding = 1; + // Exact, unique methods approved for this installation's setup only. + repeated string methods = 2; + // Callee-derived requirements as resource-kind:action, within invoke ceiling. + repeated string scopes = 3; } // EdgeDependencyV1 names the exact signed module principal. The host resolves diff --git a/modules/authority/services/local/proto/host/installation/v1/installation.proto b/modules/authority/services/local/proto/host/installation/v1/installation.proto index a2edbc62..742649aa 100644 --- a/modules/authority/services/local/proto/host/installation/v1/installation.proto +++ b/modules/authority/services/local/proto/host/installation/v1/installation.proto @@ -270,6 +270,20 @@ message ReviewedOffer { // Exact declared viewer-edge presence, covered by the reviewed digest. // Required access and per-module approval are separate host review concerns. repeated OfferDependency edge_dependencies = 8; + // Temporary installation-confined grants, not standing roles. + repeated OfferSetup setup = 9; +} + +// OfferSetup explains the exact authority usable only while setup is pending. +message OfferSetup { + // The declared binding. + string binding = 1; + // The destination principal. + string module = 2; + // The exact allowed methods, even if other methods share their scopes. + repeated string methods = 3; + // Requirements, always confined to the pending installation's owner. + repeated OfferScope scopes = 4; } // OfferDependency carries presence only, never scopes or inferred binding ids.