diff --git a/CLAIM_INVENTORY.md b/CLAIM_INVENTORY.md index 3f8c29b20..a929c1bfc 100644 --- a/CLAIM_INVENTORY.md +++ b/CLAIM_INVENTORY.md @@ -98,6 +98,12 @@ must not be inferred from a row here. See | A reconcile capability is bound to the source whose DELEGATION it carries, not just to a scoped one | WORK_CONTEXTS.md § Triggers | `TestAChildFromOneSourcesDelegationIsRefusedOnAnother` (`pkg/adapters`) mints a real capability whose binding scopes two sources, presents it through `authenticateSourceOperationContext`, and asserts the delegation's own source is admitted and the other refused; red under both mutations (dropping the gate, and re-discarding the delegation) | implemented | accounts | | One occurrence's enqueue key is scoped by organization and source | accounts/AGENTS.md § A datasource source is refreshed by three things | `TestReconcileOccurrenceKeyIsScopedByOrgAndSource` (`pkg/business`): two organizations' sources under one caller-chosen effect identity produce different keys, each key names all three parts, and two attempts of one occurrence still agree | implemented | accounts | | `DelegateSourceTriggers` is additive and refuses another member's personal source | WORK_CONTEXTS.md § Triggers | `TestDelegateSourceTriggersLeavesAnotherModulesDelegationAlone`, `TestDelegateSourceTriggersRefusesAnotherMembersPersonalSource` (`pkg/business`) assert the delegation rows: another module's survives active and owner-intact, nothing is revoked, and the owner's own call records | implemented | accounts | +| The backfill records a reference only for a SELF-ADDRESSED target, and replaces that holder's unusable one | accounts/AGENTS.md § Unattended work | `TestDelegateSourceTriggersLeavesAnotherModulesDelegationAlone` asserts a target addressed to another service gets nothing; `TestDelegateSourceTriggersReplacesTheSelfAddressedHoldersStaleDelegation` asserts a stale-digest delegation is revoked as `binding_changed` and replaced while a current one is left untouched. Both red under the matching mutation (dropping the self-addressed filter; always skipping an existing row). It narrows who may hold a CANDIDATE and establishes nothing about who executes the release — see the row below | implemented | accounts | +| A declared trigger's reference arm names only a SELF-ADDRESSED delegation, and reports whose it is | accounts/AGENTS.md § Unattended work; WORK_CONTEXTS.md § Triggers | `TestTriggerDeclarationNamesOnlyADelegationItsExecutorCanUse` (`pkg/business`) removes each of the three facts on its own — addressed to another module, a binding no longer declared, an authority that did not resolve — and asserts no identity is named; `TestTriggerDeclarationNamesTheHolderAndClaimsNoExecutor` varies the HOLDER independently (A-only, B-only, B revoked, B's binding changed) and pins the reported holder; `TestTriggerDeclarationProjectionCarriesEveryField` (`pkg/adapters`) holds every field to the wire | implemented | accounts | +| That the module which EXECUTES a declared release holds the reference | accounts/AGENTS.md § Unattended work; WORK_CONTEXTS.md § Triggers | none, and none is possible from here (#1121, F1): nothing this host holds declares who executes declared work, so a self-addressed delegation identifies a candidate and its holder, never the executor. A composed executor with no delegation on the source is refused at the mint. The read reports the holder and leaves readiness unverified | not claimed | accounts; needs a contract naming the executing principal | +| A refused reconcile pass enqueues nothing | accounts/AGENTS.md § A datasource source is refreshed by three things | `TestReconcileSourceOperation_RefusedPassEnqueuesNothing` (`pkg/business`): an effect identity re-presented for another source, and one re-presented with another request digest, are both refused with no job for them anywhere; red when the pre-check is removed | implemented | accounts | +| The stopgap sweep can be switched off, and the reader is told which schedule fires and when | accounts/AGENTS.md § Unattended work | `TestTheStopgapSweepCanBeSwitchedOff` (`pkg/business`) asserts the default is ON, that a disabled sweep enqueues nothing and bumps nothing, and that the declaration's `host_sweep_due_at` is the STORED instant and differs from the cron's; `source-trigger-schedules.container.test.tsx` asserts both rows render and that the host's row says "off" with no instant | implemented | accounts, frontend | +| `source.synced` says whether anybody was present for the pass | accounts/AGENTS.md § Unattended work | the adapter marks a delegated pass (`business.WithUnattendedPass`) and the observation records `unattended` and the delegation id, declared optional in payload v2. The actor stays the delegating person, which ADR 0008 puts in the trail deliberately | implemented | accounts | | The declaration carries the field names the executing module validates | MODULE.md § Unattended work; WORK_CONTEXTS.md § Triggers | `TestTriggerDeclarationMatchesTheContractFieldNames`, `TestTriggerDeclarationUsesDeclaredPolicyValues` (`pkg/business`) | implemented | accounts | | Only intervals a five-field cron can name are declarable; the rest are refused by name | accounts/AGENTS.md § A datasource source is refreshed by three things | `TestTriggerScheduleSpellsOnlyTheIntervalsCronCanName` (`pkg/business`) | implemented | accounts | | An occurrence under the reference arm is minted from current facts, and the next one after a revocation is refused | MODULE.md § Unattended work; WORK_CONTEXTS.md § Triggers | `TestTriggerOccurrenceMintsFromTheReferenceAndIsRefusedAfterRevocation` (`pkg/adapters`) | implemented | accounts | @@ -109,6 +115,9 @@ must not be inferred from a row here. See | No surface in this repository reaches a source sync without an effect identity | MODULE.md § Unattended work; saas-ui README § Datasources | `reconcile-is-the-only-manual-pass.test.ts` walks the TypeScript AST of `src` and the published packages and fails on any `syncSource` on a datasource client | implemented | frontend | | A person's pass is listed beside the declared schedule's occurrences, with its effect identity | MODULE.md § Unattended work | `source-trigger-schedules.container.test.tsx` asserts the manual row is in the SAME `admissions` table as the two scheduled rows, and that a recovered receipt replaces its row rather than adding one | implemented | frontend | | Every pass a source ever took, listed | — | none, and none is possible here: a receipt is recovered by identity and never enumerated, so the panel shows only the passes this browser admitted and says so | not claimed | accounts | +| A module identity minted for ONE tenant, bounded by that tenant's own installation | accounts/AGENTS.md § A module identity minted for one tenant; WORK_CONTEXTS.md § A module identity minted for one tenant | `TestSharedInstallationMintSelectsOnlyConsentingOrganization` (`pkg/business`) mints for two organizations and compares what each capability carries; `TestResolveModuleTenantIdentityAnswersWhatOneTenantsMintWouldAssert` and `TestResolveModuleTenantIdentityRefusesATenantThePinForbids` hold the operator read to the same four answers the mint gives | implemented | accounts | +| An operator can read what a module's per-tenant capability would carry, without one being issued | accounts/AGENTS.md § A module identity minted for one tenant | `module-tenant-identity-playground.container.test.tsx` records every request the page makes and asserts it is the resolution alone; the authorization table pins `ResolveModuleTenantIdentity` at `super_admin` | implemented | accounts, frontend | +| A module selecting the per-tenant mint through its published client | WORK_CONTEXTS.md § A module identity minted for one tenant | `saas-sdk-go/moduleauthority.Credentials.OrganizationID` is present in v0.1.0 (and v0.1.1/v0.1.2); each client fixes one organization and both mint request bodies carry it. NOT exercised from this repository: `qualification/module-authority` pins `v0.0.3-0.20261011073356-ac003d53e6b1`, whose mints take no organization, so the per-tenant path is proved at this host's own seam. A composed caller must still supply the tenant and the installed operation binding | implemented (client) / unexercised here | module-authority client; this repo's qualification pin; composed consumer proof remains open | | A DECLARED schedule actually coming due, in a composed environment | MODULE.md § Unattended work ("what is not proven") | none — nothing in this repository composes a module that executes declared work, and the module that fires triggers keys one installed trigger per release name while this host declares every source under one | planned | #1081 | ## Handbook and interface surfaces diff --git a/MODULE.md b/MODULE.md index 76bb62366..749d8dfe3 100644 --- a/MODULE.md +++ b/MODULE.md @@ -251,7 +251,23 @@ arm is planned and has never been emitted. The depth is in [services/accounts/AGENTS.md](./module/services/accounts/AGENTS.md#unattended-work-whose-authority-an-occurrence-runs-under) and [WORK_CONTEXTS.md](./module/WORK_CONTEXTS.md#triggers-for-work-no-person-started); -the playground is `/admin/platform/unattended-work`. +the playground is `/admin/unattended-work`. + +**A module identity minted for one tenant.** Beside the trigger identities +above, a module acting with no person present can present itself as acting +*for* a tenant rather than as itself: the headless operation mint names the +organization, and the capability's tenant is that organization, its scopes that +organization's installation narrowed to the binding's `headless_scopes`. Which +organizations it may name is the envelope's (a pinned principal names its own +tenant and no other; an unpinned one declaring `cross_tenant` names one per +mint), and each is then held to its own consent — so the bound is per tenant, +not per deployment. That is what a consumer admitting a publication for a tenant +reads the publisher's tenant from. +`PlatformAdminService/ResolveModuleTenantIdentity` and +`/admin/platform/module-identity` answer what one mint would assert, or why it +would be refused, and issue nothing. The existing client selects one tenant +through `Credentials.OrganizationID`; its operation-mint wiring is described in +[WORK_CONTEXTS.md](./module/WORK_CONTEXTS.md#a-module-identity-minted-for-one-tenant). ## The host as an OAuth 2.1 authorization server @@ -655,7 +671,8 @@ Every page lives under `frontend/code/src/app/admin/`: | `/admin/billing` | `OpenBillingPortal`, `ListInvoices` | | `/admin/platform/admins` | platform role grant/revoke | | `/admin/platform/organizations` | `ListAllOrganizations`, `GetOrganizationRoster`, `CreateOrganization` (with `owner_user_id`), `UpdateOrganization`, `AddMember`, `RemoveMember`, `DeleteOrganization` | -| `/admin/platform/unattended-work` | `ListSources`, `GetSourceTriggerDeclaration`, `DelegateSourceTriggers`, `RevokeSourceDelegation`, `ReconcileSource` — the playground for whose authority work no person started runs under | +| `/admin/unattended-work` | `ListSources`, `GetSourceTriggerDeclaration`, `DelegateSourceTriggers`, `RevokeSourceDelegation`, `ReconcileSource` — the playground for whose authority work no person started runs under | +| `/admin/platform/module-identity` | `ResolveModuleTenantIdentity` — what a module's capability for ONE tenant would carry, or why it would be refused. It issues no capability | Client-side gating uses `` (`src/components/auth/role-gate.tsx`) — display-only; backend remains authoritative. diff --git a/module/WORK_CONTEXTS.md b/module/WORK_CONTEXTS.md index ff3620faf..835e03e62 100644 --- a/module/WORK_CONTEXTS.md +++ b/module/WORK_CONTEXTS.md @@ -482,7 +482,8 @@ The host mints a child Work Context with: - owner = the module's own service principal (kind `service`), acting directly: no actor hop, as core models an owner acting, with the seal naming its installation and the build its pod runs; -- tenant = the tenant the module envelope's grant declares for that principal; +- tenant = **the organization the capability acts FOR**, which the caller names + and the envelope decides (see below); - a 60-second lifetime and the idempotent replay policy; - an authorization revision that is a digest of the module's whole derived registry entry (`business.ModuleOperationContextRevision`, never zero). @@ -532,6 +533,77 @@ A composed module reaches it through the gateway's `POST /modules/_operation-context` ([services/auth-gateway/AGENTS.md](./services/auth-gateway/AGENTS.md)), which brokers to accounts exactly as `/modules/_work-context` does. +### A module identity minted for ONE tenant + +This mint **is** the per-tenant module identity, and it is worth naming rather +than leaving as a parameter nobody documents (issue #1121). `organization_id` on +the request is the organization the capability acts for: its tenant is that +organization, so a module can present itself as *acting for a tenant* instead of +as itself. That is what a consumer admitting a publication for a tenant needs +from a publisher with nobody signed in — it takes the tenant from the verified +capability, where this host has already decided the principal may speak for it, +never from a request field it would have to trust. + +**Which organizations may be named is the envelope's, never the caller's.** +`moduleMintOrganization` decides it, identically for the identity mint and this +one: + +| The envelope declares | It may mint for | +| --- | --- | +| `tenant: ` | that organization only; another is `PermissionDenied`. `cross_tenant` beside a pin changes nothing | +| no tenant, `cross_tenant: true` | one organization per mint, named on the request | +| no tenant, no `cross_tenant` | nothing: naming an organization is not authority over it | + +**And every named organization is then held to its own consent.** The mint +re-reads the binding *after* `authorizeModuleCapabilityFromSnapshot` intersects +that organization's installation scope, so what a per-tenant capability carries +is that tenant's consent and not the deployment's: an organization that +consented to fewer headless scopes gets fewer, and one that consented to none +leaves the binding with no headless scopes and is refused. The bound is +therefore per tenant, which a single deployment-wide identity could not be. +Proved by `TestSharedInstallationMintSelectsOnlyConsentingOrganization`, which +mints for two organizations and compares what each capability carries. + +**Reading it back, and the playground.** +`PlatformAdminService/ResolveModuleTenantIdentity` answers what one mint would +assert for a module, a binding and an organization — the principal, the tenant, +the audience, the scopes, the lifetime, the revision, and whether the principal +is shared — or the refusal, in one of four forms, because what an operator does +about each is different: declare the principal, widen the envelope's tenancy, +install the module there, or consent to the binding's headless scopes there. +Beside it it answers the trail of capabilities actually issued, which is the +only record of one. `/admin/platform/module-identity` drives it. + +**It issues no capability, and that is the shape rather than a limitation.** The +mint authenticates with the module pod's projected ServiceAccount token held +against the build its authority document approves; a browser has none, and a +surface that answered an operator with a module's capability would be a second +spelling of that module's identity. So the read resolves the decision from the +same declared facts and stops before the signature. + +**Selecting a tenant through the published client.** +`saas-sdk-go/moduleauthority` already exposes `Credentials.OrganizationID` +(including v0.1.0). Construct a separate client for each organization: both +`ModuleWorkContext` and `MintModuleOperationContext` send that selector. For an +outbound operation use `MintModuleOperationContext` with the installed binding; +`ModuleWorkContext` addresses the host's capability broker and is not authority +to call a different audience. The operation result names its tenant and +principal; a publisher must hold that tenant to its committed change and use +that principal as its source. This is consumer wiring, not a missing mint. + +**What this repository does not exercise.** `qualification/module-authority` +still pins `v0.0.3-0.20261011073356-ac003d53e6b1`, a pre-0.1.0 pseudo-version +whose mints take no organization at all — so the per-tenant mint is proved +against this host's own seam and not through the published client. Raising that +pin, with a qualification case that mints for two organizations through it, is +the gap that remains here. + +The operator page and its issued-capability trail distinguish a read not yet +requested, loading, a failed read and a successful empty result. A forbidden +read clears retained identity snapshots, so later refresh failures cannot +redisplay authority the viewer was refused. Transient failures retain a prior +successful answer with a stale-data notice. + ## Operation contexts from a source delegation A datasource source's sync is neither of the cases above. It runs as a module @@ -764,6 +836,26 @@ observe — hence `TestTriggerDeclarationMatchesTheContractFieldNames`, which pins the document's names *and values* and records the other column beside them. +**What the host does about a schedule is reported separately from what the +schedule says, for every source.** The stopgap sweep reconciles an active source +whose stored instant has elapsed, whether or not that source declares a trigger +— an interval no five-field cron can express is undeclarable and still swept — +so the declaration read carries `host_sweep_enabled` and `host_sweep_due_at` +beside the cron for the undeclarable case as well. And a sweep that is switched +off says only that this host stopped: whether a module consumes the declaration +is not something this host verifies, so neither the read nor the operator view +asserts it. + +**A declared reference is a candidate, not a readiness claim** (#1121, F1). The +host sets the reference arm for a self-addressed delegation — the only shape a +source-id reference can serve — and reports whose delegation it is +(`identity_holder`). It does **not** establish that the module which executes +this release holds one: nothing the host has declares who that is, those +bindings are generic, and a deployment may have several. A composed executor +with no delegation on the source is refused at the mint +(`ErrSourceDelegationMissing`), so the read names the holder and leaves executor +readiness unverified rather than calling the source bound. + **Exactly one identity, and the two are not alternatives of equal standing.** - `source` — **the grant reference, and the contract.** It names a @@ -849,7 +941,7 @@ against them. The children are read from `saas.datasource.delegation.used`, because that trail is the only record of one — a capability lives about a minute and nothing caches it — so a revoked reference shows up as the next occurrence having no child at all. The playground that drives the whole walk is -`/admin/platform/unattended-work`. +`/admin/unattended-work`. **What the reconcile trigger's occurrences admit, and the scope that binds them.** `DatasourceService/ReconcileSource` and `LookupReconcileSource` are diff --git a/module/configurations/local/application.env b/module/configurations/local/application.env index 586d72f66..7071c1ee7 100644 --- a/module/configurations/local/application.env +++ b/module/configurations/local/application.env @@ -34,3 +34,24 @@ APP_BASE_URL= # Interactive links use the origin above. A background-only production origin may # be supplied by deployment configuration. BOOTSTRAP_ADMIN_EMAIL= + +# Whether this host fires the datasource reconcile schedule itself. +# +# Every connected source DECLARES its reconcile schedule as a trigger a composed +# module that executes declared work is meant to fire, and this host sweeps the +# same schedule as an explicitly labelled STOPGAP, because nothing consumes that +# declaration yet (module/services/accounts/code/pkg/business/datasource_deliveries.go). +# +# While both exist they must not both run: they enqueue under different +# idempotency keys, so nothing collapses them into one job, and the per-source +# FIFO key only makes the second serialise behind the first — survivable for a +# GitHub source, a second full re-send of the whole source for a pull provider. +# So a composition that installs a module consuming the declaration sets this to +# `false`, and that is the only supported way to turn the sweep off. +# +# ON unless this reads `false`: that is what every deployment does today, and a +# default that silently stopped every scheduled reconcile would make a lost +# webhook permanent and leave a pull provider refreshing only on "Sync now". +# A declared non-empty value wins over the process environment, as with every +# key in a configuration group. +DATASOURCE_RECONCILE_SWEEP_ENABLED=true diff --git a/module/contracts/api/accounts/authority/contract.binpb b/module/contracts/api/accounts/authority/contract.binpb index e77b4eeff..70814cf1f 100644 Binary files a/module/contracts/api/accounts/authority/contract.binpb and b/module/contracts/api/accounts/authority/contract.binpb differ diff --git a/module/contracts/api/accounts/authority/proto/saas/accounts/v1/datasource.proto b/module/contracts/api/accounts/authority/proto/saas/accounts/v1/datasource.proto index 5b952cf9d..d64bd7cc9 100644 --- a/module/contracts/api/accounts/authority/proto/saas/accounts/v1/datasource.proto +++ b/module/contracts/api/accounts/authority/proto/saas/accounts/v1/datasource.proto @@ -1034,6 +1034,24 @@ message RevokeSourceDelegationResponse { // the capability that admitted it and revoking the delegation refuses the // next occurrence. // +// IT IS SET ONLY FOR A DELEGATION SOME DECLARED EXECUTOR COULD USE, which +// is weaker than naming the one that will. A mint by source id resolves +// the active delegation of the CALLING module, and the capability is +// addressed to the binding's declared audience, which the executing module +// must itself admit — so the one shape a declared reference can serve is a +// delegation whose binding names its own module as the audience. A +// delegation held by one module and addressed to another is reachable only +// through the delegation-id exchange, which no reference this host +// declares can name. +// +// WHICH module that is, this host does not know: nothing it holds declares +// who executes declared work. `identity_holder` on the declaration read +// reports whose delegation the reference resolves to, and executor +// readiness is deliberately not claimed — a composed executor with no +// delegation on this source is refused at the mint +// (ErrSourceDelegationMissing), and a host that called the source "bound" +// would have been telling an operator the opposite. +// // IT IS NOT OPAQUE, and revocation is therefore not permanent. The value // is the source's own id, and a mint resolves whichever delegation of that // source is active, so revoking one and then RECONNECTING the source @@ -1048,11 +1066,15 @@ message RevokeSourceDelegationResponse { // binding's headless scopes — an ordinary token admission, bounded by the // capability's own short lifetime. // -// IT IS PLANNED, and no declaration this host builds has ever set it. It -// cannot serve the reconcile trigger: the headless mint lives 60 seconds -// against that trigger's 10-minute declared deadline, and the capability -// is the module's own principal while ReconcileSource requires an -// organization member. +// IT IS PLANNED, and no declaration this host builds has ever set it, so +// nothing anywhere has proved it against a trigger. It cannot serve the +// reconcile trigger: the headless mint lives 60 seconds against that +// trigger's 10-minute declared deadline, and the capability is the +// module's own principal while ReconcileSource requires an organization +// member. That mint IS the per-tenant module identity a module publishing +// for one tenant presents (PlatformAdminService.ResolveModuleTenantIdentity +// reads what it would assert); what it is not is an identity for this +// trigger's occurrences. // // THE NAMES ARE THE INSTALLATION DOCUMENT'S, not this host's and not the // executing module's read API's. That distinction is load-bearing: the module @@ -1177,6 +1199,35 @@ message SourceTriggerDeclaration { // schedule is disabled, or its interval is not one a five-field cron can // express. Empty means the declaration above is complete. string undeclarable_reason = 8; + // host_sweep_enabled says whether THIS HOST still fires the schedule it + // declares, as a labelled stopgap for the absence of a module that consumes + // the declaration, and host_sweep_due_at the instant it will next sweep on. + // + // THAT INSTANT IS NOT next_occurrence_at, and the two are reported + // separately because they share a period and not a phase. The declared cron + // for a sub-hourly interval is `*/M * * * *`, which comes due on the quarter + // or half hour; the sweep fires on the source's stored instant, which every + // pass moves to `now + interval` — an arbitrary offset inside the period. A + // reader shown only the cron's instant was reading what the declaration + // SAYS while the pass that will actually happen was at another minute. + // + // host_sweep_due_at is unset when the sweep is off, or when the source is + // held off its schedule: then there is no pass this host will take. + bool host_sweep_enabled = 9; + google.protobuf.Timestamp host_sweep_due_at = 10; + // identity_holder is the module whose delegation the reference arm resolved + // to when this declaration was built. The arm cannot carry it — the + // reference value is the source id — so it is reported beside it. + // + // IT IS NOT THE EXECUTING MODULE. Nothing this host holds declares which + // module executes declared work: a self-addressed delegation binding is + // generic and a deployment may have several. So this says "a reference on + // this source would resolve to module A's self-addressed delegation", and + // whether A is the module that installs this release is unverified here. A + // reader that took it for executor readiness would be told a source was + // ready while every occurrence of another executor's trigger was refused at + // the mint. Empty when the arm names no identity. + string identity_holder = 11; } message DelegateSourceTriggersRequest { diff --git a/module/contracts/api/accounts/authority/proto/saas/accounts/v1/platform_admin.proto b/module/contracts/api/accounts/authority/proto/saas/accounts/v1/platform_admin.proto index 4e955b079..271f1452b 100644 --- a/module/contracts/api/accounts/authority/proto/saas/accounts/v1/platform_admin.proto +++ b/module/contracts/api/accounts/authority/proto/saas/accounts/v1/platform_admin.proto @@ -576,6 +576,100 @@ message PutModuleEnvelopeResponse { ModuleEnvelope envelope = 1; } +// --------------------------------------------------------------------------- +// A module identity minted for ONE tenant. +// +// A composed module acting with no person present mints a Work Context for one +// of its installed operation bindings (MintModuleOperationContext) and names +// the organization it is acting FOR. That is what lets a module present itself +// as acting for a tenant rather than as itself: the capability's tenant is the +// organization named, its scopes are that organization's installation narrowed +// to the binding's headless_scopes, it lives a minute, and every issuance is +// recorded. +// +// Which organizations it may name is not the caller's to choose. A principal +// the envelope PINS to a tenant may name that tenant and no other; an unpinned +// principal declaring cross_tenant may name an organization that has a live +// installation consenting to the binding, and nothing else. An organization +// whose installation consents to less gets less, and one that consents to +// nothing is refused — so the bound is per tenant, not per deployment. +// +// This read answers what that mint would assert, for an operator, WITHOUT +// issuing a capability. A browser holds no module identity (the mint requires +// the pod's projected ServiceAccount token, held against the build its +// authority document approves), and a path that handed an operator a module's +// capability would be a second spelling of that identity — so there is +// deliberately no such path, here or anywhere. +// --------------------------------------------------------------------------- + +message ResolveModuleTenantIdentityRequest { + // prefix is the module principal's registration prefix and binding the key + // of its operation_audiences entry. + string prefix = 1 [(buf.validate.field).string = { + min_len: 1 + max_len: 63 + pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$" + }]; + string binding = 2 [(buf.validate.field).string = { + min_len: 1 + max_len: 128 + }]; + // organization_id is the tenant the capability would act for. + string organization_id = 3 [(buf.validate.field).string.uuid = true]; +} + +// ModuleTenantIdentity is what one per-tenant mint would assert. Every field is +// the host's: nothing here is requestable. +message ModuleTenantIdentity { + // principal_id is the module's own service principal, which owns the + // capability and acts directly — there is no person and no actor hop. + string principal_id = 1; + // tenant is the organization it would act for, and audience the service the + // binding declares it may call. A binding whose audience is the module's own + // prefix is one the module admits itself, which is how unattended work is + // admitted by the module that executes it. + string tenant = 2; + string audience = 3; + // scopes is exactly what the capability would carry, as + // `kind:action[:resource]`: the binding's headless_scopes narrowed by THIS + // organization's installation scope. Never its invoke_scopes, which describe + // authority exercised on a person's behalf. + repeated string scopes = 4; + // lifetime_seconds is the fixed lifetime every such capability carries. + int64 lifetime_seconds = 5; + // revision is the authorization revision it would be sealed with: a digest + // of the module's whole effective entry, so any change to the entry stops + // confirming every capability minted under the old one. + uint64 revision = 6; + // shared says the principal is unpinned and declares cross_tenant, so it may + // act for more than one organization. A pinned principal reads false and can + // only ever name the tenant its envelope declares. + bool shared = 7; +} + +// ModuleTenantIdentityMint is one capability actually issued, as the audit +// trail recorded it. There is no other record: a capability lives a minute and +// nothing caches one. +message ModuleTenantIdentityMint { + string record = 1; + string tenant = 2; + string binding = 3; + string audience = 4; + repeated string scopes = 5; + google.protobuf.Timestamp minted_at = 6; +} + +message ResolveModuleTenantIdentityResponse { + // identity is set when a mint for this organization would be issued; refusal + // says why it would not. Exactly one is present, and a refusal is a decision + // about declared authority rather than an outage. + ModuleTenantIdentity identity = 1; + string refusal = 2; + // recent is the trail of capabilities this module was actually issued for + // this organization, newest first. + repeated ModuleTenantIdentityMint recent = 3; +} + // PlatformAdminService — cross-tenant operations for platform operators. // All RPCs require a platform_role in the JWT claims. service PlatformAdminService { @@ -1041,4 +1135,22 @@ service PlatformAdminService { body: "*" }; } + + // ResolveModuleTenantIdentity answers what a per-tenant module operation + // context would assert for one module, one of its bindings and one + // organization — or why it would be refused. It issues no capability. + rpc ResolveModuleTenantIdentity(ResolveModuleTenantIdentityRequest) returns (ResolveModuleTenantIdentityResponse) { + option (saas.policy.v1.method_policy) = { + exposure: EXPOSURE_AUTHENTICATED + tenant: TENANT_REQUIREMENT_NONE + mfa: MFA_REQUIREMENT_NONE + audit: {emission: AUDIT_EMISSION_NONE} + idempotency: IDEMPOTENCY_REQUIREMENT_FORBIDDEN + rate_limit: RATE_LIMIT_CLASS_SENSITIVE + request_sensitivity: SENSITIVITY_CONFIDENTIAL + response_sensitivity: SENSITIVITY_CONFIDENTIAL + platform_role: PLATFORM_ROLE_REQUIREMENT_SUPER_ADMIN + }; + option (google.api.http) = {get: "/v1/platform/module-tenant-identity"}; + } } diff --git a/module/contracts/api/accounts/connect/contract.binpb b/module/contracts/api/accounts/connect/contract.binpb index e77b4eeff..70814cf1f 100644 Binary files a/module/contracts/api/accounts/connect/contract.binpb and b/module/contracts/api/accounts/connect/contract.binpb differ diff --git a/module/contracts/api/accounts/connect/proto/saas/accounts/v1/datasource.proto b/module/contracts/api/accounts/connect/proto/saas/accounts/v1/datasource.proto index 5b952cf9d..d64bd7cc9 100644 --- a/module/contracts/api/accounts/connect/proto/saas/accounts/v1/datasource.proto +++ b/module/contracts/api/accounts/connect/proto/saas/accounts/v1/datasource.proto @@ -1034,6 +1034,24 @@ message RevokeSourceDelegationResponse { // the capability that admitted it and revoking the delegation refuses the // next occurrence. // +// IT IS SET ONLY FOR A DELEGATION SOME DECLARED EXECUTOR COULD USE, which +// is weaker than naming the one that will. A mint by source id resolves +// the active delegation of the CALLING module, and the capability is +// addressed to the binding's declared audience, which the executing module +// must itself admit — so the one shape a declared reference can serve is a +// delegation whose binding names its own module as the audience. A +// delegation held by one module and addressed to another is reachable only +// through the delegation-id exchange, which no reference this host +// declares can name. +// +// WHICH module that is, this host does not know: nothing it holds declares +// who executes declared work. `identity_holder` on the declaration read +// reports whose delegation the reference resolves to, and executor +// readiness is deliberately not claimed — a composed executor with no +// delegation on this source is refused at the mint +// (ErrSourceDelegationMissing), and a host that called the source "bound" +// would have been telling an operator the opposite. +// // IT IS NOT OPAQUE, and revocation is therefore not permanent. The value // is the source's own id, and a mint resolves whichever delegation of that // source is active, so revoking one and then RECONNECTING the source @@ -1048,11 +1066,15 @@ message RevokeSourceDelegationResponse { // binding's headless scopes — an ordinary token admission, bounded by the // capability's own short lifetime. // -// IT IS PLANNED, and no declaration this host builds has ever set it. It -// cannot serve the reconcile trigger: the headless mint lives 60 seconds -// against that trigger's 10-minute declared deadline, and the capability -// is the module's own principal while ReconcileSource requires an -// organization member. +// IT IS PLANNED, and no declaration this host builds has ever set it, so +// nothing anywhere has proved it against a trigger. It cannot serve the +// reconcile trigger: the headless mint lives 60 seconds against that +// trigger's 10-minute declared deadline, and the capability is the +// module's own principal while ReconcileSource requires an organization +// member. That mint IS the per-tenant module identity a module publishing +// for one tenant presents (PlatformAdminService.ResolveModuleTenantIdentity +// reads what it would assert); what it is not is an identity for this +// trigger's occurrences. // // THE NAMES ARE THE INSTALLATION DOCUMENT'S, not this host's and not the // executing module's read API's. That distinction is load-bearing: the module @@ -1177,6 +1199,35 @@ message SourceTriggerDeclaration { // schedule is disabled, or its interval is not one a five-field cron can // express. Empty means the declaration above is complete. string undeclarable_reason = 8; + // host_sweep_enabled says whether THIS HOST still fires the schedule it + // declares, as a labelled stopgap for the absence of a module that consumes + // the declaration, and host_sweep_due_at the instant it will next sweep on. + // + // THAT INSTANT IS NOT next_occurrence_at, and the two are reported + // separately because they share a period and not a phase. The declared cron + // for a sub-hourly interval is `*/M * * * *`, which comes due on the quarter + // or half hour; the sweep fires on the source's stored instant, which every + // pass moves to `now + interval` — an arbitrary offset inside the period. A + // reader shown only the cron's instant was reading what the declaration + // SAYS while the pass that will actually happen was at another minute. + // + // host_sweep_due_at is unset when the sweep is off, or when the source is + // held off its schedule: then there is no pass this host will take. + bool host_sweep_enabled = 9; + google.protobuf.Timestamp host_sweep_due_at = 10; + // identity_holder is the module whose delegation the reference arm resolved + // to when this declaration was built. The arm cannot carry it — the + // reference value is the source id — so it is reported beside it. + // + // IT IS NOT THE EXECUTING MODULE. Nothing this host holds declares which + // module executes declared work: a self-addressed delegation binding is + // generic and a deployment may have several. So this says "a reference on + // this source would resolve to module A's self-addressed delegation", and + // whether A is the module that installs this release is unverified here. A + // reader that took it for executor readiness would be told a source was + // ready while every occurrence of another executor's trigger was refused at + // the mint. Empty when the arm names no identity. + string identity_holder = 11; } message DelegateSourceTriggersRequest { diff --git a/module/contracts/api/accounts/connect/proto/saas/accounts/v1/platform_admin.proto b/module/contracts/api/accounts/connect/proto/saas/accounts/v1/platform_admin.proto index 4e955b079..271f1452b 100644 --- a/module/contracts/api/accounts/connect/proto/saas/accounts/v1/platform_admin.proto +++ b/module/contracts/api/accounts/connect/proto/saas/accounts/v1/platform_admin.proto @@ -576,6 +576,100 @@ message PutModuleEnvelopeResponse { ModuleEnvelope envelope = 1; } +// --------------------------------------------------------------------------- +// A module identity minted for ONE tenant. +// +// A composed module acting with no person present mints a Work Context for one +// of its installed operation bindings (MintModuleOperationContext) and names +// the organization it is acting FOR. That is what lets a module present itself +// as acting for a tenant rather than as itself: the capability's tenant is the +// organization named, its scopes are that organization's installation narrowed +// to the binding's headless_scopes, it lives a minute, and every issuance is +// recorded. +// +// Which organizations it may name is not the caller's to choose. A principal +// the envelope PINS to a tenant may name that tenant and no other; an unpinned +// principal declaring cross_tenant may name an organization that has a live +// installation consenting to the binding, and nothing else. An organization +// whose installation consents to less gets less, and one that consents to +// nothing is refused — so the bound is per tenant, not per deployment. +// +// This read answers what that mint would assert, for an operator, WITHOUT +// issuing a capability. A browser holds no module identity (the mint requires +// the pod's projected ServiceAccount token, held against the build its +// authority document approves), and a path that handed an operator a module's +// capability would be a second spelling of that identity — so there is +// deliberately no such path, here or anywhere. +// --------------------------------------------------------------------------- + +message ResolveModuleTenantIdentityRequest { + // prefix is the module principal's registration prefix and binding the key + // of its operation_audiences entry. + string prefix = 1 [(buf.validate.field).string = { + min_len: 1 + max_len: 63 + pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$" + }]; + string binding = 2 [(buf.validate.field).string = { + min_len: 1 + max_len: 128 + }]; + // organization_id is the tenant the capability would act for. + string organization_id = 3 [(buf.validate.field).string.uuid = true]; +} + +// ModuleTenantIdentity is what one per-tenant mint would assert. Every field is +// the host's: nothing here is requestable. +message ModuleTenantIdentity { + // principal_id is the module's own service principal, which owns the + // capability and acts directly — there is no person and no actor hop. + string principal_id = 1; + // tenant is the organization it would act for, and audience the service the + // binding declares it may call. A binding whose audience is the module's own + // prefix is one the module admits itself, which is how unattended work is + // admitted by the module that executes it. + string tenant = 2; + string audience = 3; + // scopes is exactly what the capability would carry, as + // `kind:action[:resource]`: the binding's headless_scopes narrowed by THIS + // organization's installation scope. Never its invoke_scopes, which describe + // authority exercised on a person's behalf. + repeated string scopes = 4; + // lifetime_seconds is the fixed lifetime every such capability carries. + int64 lifetime_seconds = 5; + // revision is the authorization revision it would be sealed with: a digest + // of the module's whole effective entry, so any change to the entry stops + // confirming every capability minted under the old one. + uint64 revision = 6; + // shared says the principal is unpinned and declares cross_tenant, so it may + // act for more than one organization. A pinned principal reads false and can + // only ever name the tenant its envelope declares. + bool shared = 7; +} + +// ModuleTenantIdentityMint is one capability actually issued, as the audit +// trail recorded it. There is no other record: a capability lives a minute and +// nothing caches one. +message ModuleTenantIdentityMint { + string record = 1; + string tenant = 2; + string binding = 3; + string audience = 4; + repeated string scopes = 5; + google.protobuf.Timestamp minted_at = 6; +} + +message ResolveModuleTenantIdentityResponse { + // identity is set when a mint for this organization would be issued; refusal + // says why it would not. Exactly one is present, and a refusal is a decision + // about declared authority rather than an outage. + ModuleTenantIdentity identity = 1; + string refusal = 2; + // recent is the trail of capabilities this module was actually issued for + // this organization, newest first. + repeated ModuleTenantIdentityMint recent = 3; +} + // PlatformAdminService — cross-tenant operations for platform operators. // All RPCs require a platform_role in the JWT claims. service PlatformAdminService { @@ -1041,4 +1135,22 @@ service PlatformAdminService { body: "*" }; } + + // ResolveModuleTenantIdentity answers what a per-tenant module operation + // context would assert for one module, one of its bindings and one + // organization — or why it would be refused. It issues no capability. + rpc ResolveModuleTenantIdentity(ResolveModuleTenantIdentityRequest) returns (ResolveModuleTenantIdentityResponse) { + option (saas.policy.v1.method_policy) = { + exposure: EXPOSURE_AUTHENTICATED + tenant: TENANT_REQUIREMENT_NONE + mfa: MFA_REQUIREMENT_NONE + audit: {emission: AUDIT_EMISSION_NONE} + idempotency: IDEMPOTENCY_REQUIREMENT_FORBIDDEN + rate_limit: RATE_LIMIT_CLASS_SENSITIVE + request_sensitivity: SENSITIVITY_CONFIDENTIAL + response_sensitivity: SENSITIVITY_CONFIDENTIAL + platform_role: PLATFORM_ROLE_REQUIREMENT_SUPER_ADMIN + }; + option (google.api.http) = {get: "/v1/platform/module-tenant-identity"}; + } } diff --git a/module/contracts/api/catalog.codefly.json b/module/contracts/api/catalog.codefly.json index d7de608f7..03b42b5d1 100644 --- a/module/contracts/api/catalog.codefly.json +++ b/module/contracts/api/catalog.codefly.json @@ -10,7 +10,7 @@ "kind": "protobuf", "package": "saas.accounts.v1", "path": "contracts/api/accounts/authority/contract.binpb", - "digest": "sha256:510daf371e882d8baa728008078001faf736f541f5d78c1396dfdf59b9d4ebe3", + "digest": "sha256:c57b6743854c84738f0f1454e6c93349eced569d0351a91a62786ba08c1bc806", "services": [ { "name": "ModuleCapabilitiesService", @@ -65,7 +65,7 @@ "kind": "protobuf", "package": "saas.accounts.v1", "path": "contracts/api/accounts/connect/contract.binpb", - "digest": "sha256:510daf371e882d8baa728008078001faf736f541f5d78c1396dfdf59b9d4ebe3", + "digest": "sha256:c57b6743854c84738f0f1454e6c93349eced569d0351a91a62786ba08c1bc806", "services": [ { "name": "APIKeyService", @@ -409,6 +409,7 @@ "/saas.accounts.v1.PlatformAdminService/OverrideEntitlement", "/saas.accounts.v1.PlatformAdminService/PutModuleEnvelope", "/saas.accounts.v1.PlatformAdminService/ReplayJob", + "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity", "/saas.accounts.v1.PlatformAdminService/RevokePlatformRole", "/saas.accounts.v1.PlatformAdminService/RevokeSession", "/saas.accounts.v1.PlatformAdminService/SearchUsers", diff --git a/module/contracts/reference/frontend/package.json b/module/contracts/reference/frontend/package.json index bc1de1537..acea1cb9f 100644 --- a/module/contracts/reference/frontend/package.json +++ b/module/contracts/reference/frontend/package.json @@ -18,8 +18,8 @@ "build": "tsc -p tsconfig.json" }, "dependencies": { - "@codefly-dev/saas-plugin-contract": "2.4.4", - "@codefly-dev/saas-plugin-react": "0.4.5" + "@codefly-dev/saas-plugin-contract": "2.5.0", + "@codefly-dev/saas-plugin-react": "0.4.6" }, "peerDependencies": { "react": ">=19.2 <20" diff --git a/module/docs/frontend-plugin-architecture.md b/module/docs/frontend-plugin-architecture.md index 4e6218c4c..67f16b295 100644 --- a/module/docs/frontend-plugin-architecture.md +++ b/module/docs/frontend-plugin-architecture.md @@ -87,8 +87,17 @@ silently falls back to sample data. package and read by both the browser transport and the BFF: safe segments, with a Google custom verb allowed on the last one and its colon forwarded literal, and a Connect procedure of a service the requirement declared. Both - REST and Connect bindings are therefore reachable from a contributed page, and - neither side can admit a shape the other refuses. + REST and Connect bindings are therefore reachable from a contributed page. + **The host is the authority and the client is agreement, so the two are not + symmetric.** The browser applies the Connect rule only when the runtime was + given the installed requirements (`createPluginRuntime({ services })`); + without them it applies the generic path rule alone, because a client that + guessed would refuse routes a composition had legitimately installed. It also + never applies the serviceability rules below, which are about the resolved + allowlist entry and not about the path. So the client can admit a shape the + BFF refuses, which is the direction that is safe; the reverse — the BFF + forwarding something the client would have refused — cannot happen, because + the one path rule is the host's and the host runs it on every request. - A `connect` requirement names the services it may reach, and the list is required. The protocol puts the service name in the path, so the caller supplies it and the route prefix cannot bound it: the prefix says where the diff --git a/module/docs/frontend-plugin-bff-contract.md b/module/docs/frontend-plugin-bff-contract.md index 7befe599d..c7422ccca 100644 --- a/module/docs/frontend-plugin-bff-contract.md +++ b/module/docs/frontend-plugin-bff-contract.md @@ -28,12 +28,23 @@ host, port, module, service, endpoint, or upstream prefix from a browser. `..:recover` is a traversal wearing a verb and would bind `..` as the resource upstream. 5. The resolved allowlist entry is held to the composition's own rules a second - time, at runtime. The BFF reads the GENERATED allowlist rather than the - composition that validated it, so a build-time rule nothing re-checks is one - a stale or hand-edited projection walks straight past: a `rest` entry - declaring the origin root, and a `connect` entry declaring no services it may - reach, are both `503 backend_unavailable` — the alias cannot be served, and - no request the caller could phrase differently would change that. + time — at LOAD, where the generated allowlist is read, and again in the + handler. The BFF reads the GENERATED allowlist rather than the composition + that validated it, so a build-time rule nothing re-checks is one a stale or + hand-edited projection walks straight past, and the rule is the whole one + rather than part of it (`isServiceableFrontendService`): the prefix must be + an absolute path of safe, non-dot segments, with the origin root admitted + only on a `connect` entry; a `connect` entry must declare a non-empty list + of fully qualified services, as a list. Anything else is + `503 backend_unavailable` — the alias cannot be served, and no request the + caller could phrase differently would change that. + + Checking only against the root was not enough, and `""` is why: it is not + the root, so it passed, and every relative path then landed on the upstream + ORIGIN — `admin/secret` reached `https://upstream/admin/secret` and was + answered under the viewer's own forwarded bearer. A `connectServices` that + was not a list has a `length` and no `every`, which threw out of the handler + as a `500` instead of refusing the alias. ## Which bindings the transport carries @@ -57,11 +68,18 @@ two things: where its upstream mounts Connect, and which of that upstream's services the alias may reach. - `routePrefix` is the mount. `/` is the origin root, where the Connect protocol - puts a unary procedure and where this contract's own fixed capability - handshake has always been probed; a product path prefix such as `/v1/connect` - is a Connect mount behind a path, and the procedure lands under it. The root - is Connect-only: a REST requirement declaring it would turn its alias into a + puts a unary procedure; a product path prefix such as `/v1/connect` is a + Connect mount behind a path, and the procedure lands under it. The root is + Connect-only: a REST requirement declaring it would turn its alias into a prefix-less proxy of the whole upstream. + + **The capability handshake is a procedure of the alias like any other, so it + is probed under the mount too.** It used to be sent to the origin root + whatever the prefix said, which is right only for a root-prefixed + requirement: a backend mounting Connect under `/v1/connect` answered the + probe with its own 404, the alias was reported incompatible, and the mounted + form this host advertises could never complete a handshake. (A REST alias's + probe path is declared absolute and is not relative to the prefix.) - `connectServices` is the bound, and it is **required** and non-empty. A Connect procedure's path is `//`, so the CALLER supplies the service name — which means the prefix cannot say which diff --git a/module/module.package.codefly.yaml b/module/module.package.codefly.yaml index 5af279da3..fefbd9977 100644 --- a/module/module.package.codefly.yaml +++ b/module/module.package.codefly.yaml @@ -18,12 +18,12 @@ services: kind: protobuf package: saas.accounts.v1 path: contracts/api/accounts/authority/contract.binpb - digest: sha256:510daf371e882d8baa728008078001faf736f541f5d78c1396dfdf59b9d4ebe3 + digest: sha256:c57b6743854c84738f0f1454e6c93349eced569d0351a91a62786ba08c1bc806 - endpoint: connect kind: protobuf package: saas.accounts.v1 path: contracts/api/accounts/connect/contract.binpb - digest: sha256:510daf371e882d8baa728008078001faf736f541f5d78c1396dfdf59b9d4ebe3 + digest: sha256:c57b6743854c84738f0f1454e6c93349eced569d0351a91a62786ba08c1bc806 - name: auth-gateway endpoints: [grpc, rest] api-contracts: diff --git a/module/services/accounts/AGENTS.md b/module/services/accounts/AGENTS.md index 75b137e25..7e44c2153 100644 --- a/module/services/accounts/AGENTS.md +++ b/module/services/accounts/AGENTS.md @@ -920,6 +920,28 @@ the values and records the other column beside them). occurrence's run outlive the capability that admitted it, and makes a revocation land on the NEXT occurrence rather than behind something held from the one before. + + `DeclareSourceTrigger` sets it only for a **self-addressed** delegation + (`TriggerDelegationReference.candidateForADeclaredExecutor`, #1121): a mint by + source id resolves the delegation of the CALLING module and the capability is + addressed to the binding's audience, which the executing module must itself + admit, so that is the one shape a source-id reference can serve. It took the + first active reference from any module before, which named delegations no + trigger could ever use. + + **That is a shape, not an executor, and the read says so** (#1121, F1). + Nothing this host holds declares which module executes declared work: + self-addressed bindings are generic and a deployment may have several. So a + source whose only self-addressed delegation belongs to module A is a + *candidate* under A's name — `SourceTriggerDeclaration.IdentityHolder`, which + the arm itself cannot carry because its value is the source id — and if the + composed executor is B, holding none, B's mint resolves + `ActiveSourceDelegation(S, B)` and is refused with + `ErrSourceDelegationMissing`. Claiming "the executing module holds it" would + have told an operator a source was ready while every occurrence failed. + Resolving it properly needs the executing principal named by a contract that + does not exist yet; a sibling module's prefix is not that contract and is not + hard-coded here. - **`binding` is the installation-principal arm, and PLANNED.** It would name one of the release's bindings and mint from that binding's `headless_scopes` under the module's own principal (`MintModuleOperationContext`) — an ordinary @@ -984,8 +1006,23 @@ the values and records the other column beside them). destructive for a backfill: it took a personal source's delegation from its owner and moved every unrelated module's authority onto the administrator, failing in-flight children's re-checks. The - backfill leaves a target that already holds an active delegation untouched and - records only for a target with none, and it refuses a personal source the + backfill records **only for a SELF-ADDRESSED target** — + `SourceDelegationTarget.SelfAddressed`, the self-admitting binding below — + because that is the shape the reference it answers with can serve (#1121). It + recorded one for every module accepting delegations, handing the calling + administrator's authority over that source to modules whose delegation no + trigger of this host could name. It does **not** follow that such a target is + the module which will execute the release: nothing here declares that (F1), so + this narrows who may hold a candidate and proves nothing about who fires it. A + connect still delegates to every target: that is a person establishing the + source, and a consuming module's sync is the delegation's main purpose. + + It leaves a target's LIVE delegation untouched and records for a target with + none — or with one the module's current declaration no longer supports. A + delegation whose binding digest has moved is refused by the very next mint as + `binding_changed`, so skipping it reported "nothing was missing" over a + trigger that could never mint; it is revoked here under that same reason and + replaced in one transaction. It also refuses a personal source the caller does not own (`ErrTriggerSourcePersonal` → `PermissionDenied`, told apart from `NotFound` because the source exists and is readable) — the division `ReconcileDatasourceSource` makes on the pass itself, so a reference @@ -998,7 +1035,75 @@ the values and records the other column beside them). minted against them. The children come from `saas.datasource.delegation.used`, which is the only record of one: a capability lives about a minute and nothing caches it, so a revoked reference shows up as the next occurrence having no - child at all. The playground is `/admin/platform/unattended-work`. + child at all. The playground is `/admin/unattended-work`, under `/admin/` + rather than `/admin/platform/` because the route catalog derives a page's + access boundary from its path and every RPC behind this one is org-scoped and + `ORG_ADMIN` (#1121): while it sat under the platform prefix the catalog + derived `super_admin` and the page's own gate said `admin`. +- **The reader is also told what THIS HOST does about the schedule, and when** + (#1121). The declaration carries `host_sweep_enabled` and `host_sweep_due_at` + beside `next_occurrence_at`, because the declared cron and the stopgap sweep + share a period and NOT a phase: the cron comes due on the quarter or half + hour, the sweep fires on the source's stored instant, which every pass moves + to `now + interval`. Neither is aligned to the other on purpose — a cron + aligned to the stored instant would stop being derived from the interval + alone, and a stored instant aligned to the cron would make every source of one + provider come due in the same second. `DATASOURCE_RECONCILE_SWEEP_ENABLED` + (application group, ON unless `false`) is what an operator turns off when a + composed module starts consuming the declaration. + + **Both facts are reported for a source that declares NO trigger, too**, and + the operator view shows them there: the sweep's due query selects an active + source whose stored instant has elapsed, which has nothing to do with whether + a cron could express its interval, so a source refused as undeclarable is + still reconciled every interval. `DeclareSourceTrigger` computes + `HostSweepDueAt` before the cron check for exactly that reason, and the + projection sets both before the undeclarable return + (`TestAnUndeclarableSourceStillReportsTheHostSweep`). A surface that hid the + sweep there told an operator this host does nothing for a source it refreshes + on a timer. + + **And a disabled sweep claims nothing about anybody else.** "An executing + module fires the declaration" was a readiness claim this host cannot make + (#1121, F1); the switch says only that this host stopped. The view says that + and names the gap. + + The refusal is in `RunDatasourceReconcile` itself: the one-minute tick still fires and its + callback still runs, and the sweep returns having read nothing and enqueued + nothing. That is deliberate — a switch read only where the ticker is + installed would leave every other caller of the sweep unguarded — but it is a + sweep that does nothing, not a tick that was never scheduled. + +## A module identity minted for one tenant + +`MintModuleOperationContext` takes the organization the capability acts FOR, and +that makes it the per-tenant module identity: a module with nobody signed in can +present itself as acting for a tenant rather than as itself, which is what a +consumer admitting a publication for a tenant reads the publisher's tenant from. + +Which organizations may be named is the envelope's and never the caller's +(`moduleMintOrganization`): a principal pinned to a tenant names that tenant and +no other, an unpinned principal declaring `cross_tenant` names one per mint, and +one declaring neither names nothing. Each named organization is then held to its +own live installation, and the binding is re-read AFTER that installation's scope +narrows it — so what a per-tenant capability carries is that tenant's consent, +not the deployment's, and an organization consenting to no headless scopes is +refused. `TestSharedInstallationMintSelectsOnlyConsentingOrganization` mints for +two organizations and compares what each carries. + +`PlatformAdminService/ResolveModuleTenantIdentity` (`super_admin`) answers what +one mint would assert, or why it would be refused, plus the trail of +capabilities actually issued (`saas.module.operation_context_minted`, the only +record of one). **It issues no capability**: the mint authenticates with the +module pod's projected ServiceAccount token held against the approved build, a +browser has none, and a surface that answered an operator with a module's +capability would be a second spelling of that module's identity. The playground +is `/admin/platform/module-identity`. + +The published client selects the tenant through `Credentials.OrganizationID`, +using a separate client per organization. Outbound calls use the installed +operation binding through `MintModuleOperationContext`, as described in +[WORK_CONTEXTS.md](../WORK_CONTEXTS.md#a-module-identity-minted-for-one-tenant). ## Subject visibility is a projection, not a module's own vocabulary diff --git a/module/services/accounts/AUTHZ_MATRIX.md b/module/services/accounts/AUTHZ_MATRIX.md index 0826a35d1..668f9c3f2 100644 --- a/module/services/accounts/AUTHZ_MATRIX.md +++ b/module/services/accounts/AUTHZ_MATRIX.md @@ -2,7 +2,7 @@ > Generated from protobuf service descriptors and `saas.policy.v1.method_policy`; only the prose description is joined from `pkg/business/introspection.go`. Do not edit by hand. Run `go generate ./pkg/business` from `module/services/accounts/code`. -Inventory: **268 RPCs** across **36 services**. Missing, invalid, or unclassified procedures are denied by both Connect and gRPC interceptors. +Inventory: **269 RPCs** across **36 services**. Missing, invalid, or unclassified procedures are denied by both Connect and gRPC interceptors. The compact tier is retained for compatibility. Guards, resource bindings, audit events, limiter class, and data sensitivity are descriptor-authoritative. Domain handlers may enforce stronger state-dependent rules but may not weaken this floor. @@ -208,6 +208,7 @@ The compact tier is retained for compatibility. Guards, resource bindings, audit | `/saas.accounts.v1.PlatformAdminService/OverrideEntitlement` | unary | `POST /v1/platform/organizations/{org_id}/entitlements` | `platform_admin` | exposure=AUTHENTICATED; tenant=NONE; platform=ANY; impersonation=FORBIDDEN | — | — | SUCCESS: saas.entitlement.override | FORBIDDEN / SENSITIVE | CONFIDENTIAL → CONFIDENTIAL | Override one entitlement limit for a single organization. | | `/saas.accounts.v1.PlatformAdminService/PutModuleEnvelope` | unary | `PUT /v1/platform/module-envelope` | `platform_admin` | exposure=AUTHENTICATED; tenant=NONE; platform=SUPER_ADMIN; mfa=RECENT_STEP_UP; impersonation=FORBIDDEN | — | — | SUCCESS: saas.platform.module_envelope_written | FORBIDDEN / SENSITIVE | CONFIDENTIAL → CONFIDENTIAL | Write the next revision of the module envelope; it takes effect at the next check. | | `/saas.accounts.v1.PlatformAdminService/ReplayJob` | unary | `POST /v1/platform/jobs/{source_job_id}:replay` | `platform_admin` | exposure=AUTHENTICATED; tenant=NONE; platform=SUPER_ADMIN; mfa=RECENT_STEP_UP | — | — | SUCCESS: saas.job.replayed | REQUIRED / SENSITIVE | CONFIDENTIAL → CONFIDENTIAL | Idempotently copy dead-lettered work for another attempt. | +| `/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity` | unary | `GET /v1/platform/module-tenant-identity` | `platform_admin` | exposure=AUTHENTICATED; tenant=NONE; platform=SUPER_ADMIN | — | — | — | FORBIDDEN / SENSITIVE | CONFIDENTIAL → CONFIDENTIAL | Read what a per-tenant module operation context would assert for one module, binding and organization, or why it would be refused. | | `/saas.accounts.v1.PlatformAdminService/RevokePlatformRole` | unary | `DELETE /v1/platform/admins/{user_id}` | `platform_admin` | exposure=AUTHENTICATED; tenant=NONE; platform=SUPER_ADMIN; mfa=IF_ENROLLED_RECENT_STEP_UP; impersonation=FORBIDDEN | — | — | SUCCESS: saas.platform.role_revoked | FORBIDDEN / SENSITIVE | CONFIDENTIAL → CONFIDENTIAL | Revoke a platform role. | | `/saas.accounts.v1.PlatformAdminService/RevokeSession` | unary | `DELETE /v1/platform/sessions/{session_id}` | `platform_admin` | exposure=AUTHENTICATED; tenant=NONE; platform=SUPPORT | — | — | SUCCESS: saas.session.revoked | FORBIDDEN / SENSITIVE | CONFIDENTIAL → CONFIDENTIAL | Revoke a single session. | | `/saas.accounts.v1.PlatformAdminService/SearchUsers` | unary | `GET /v1/platform/users` | `platform_admin` | exposure=AUTHENTICATED; tenant=NONE; platform=SUPPORT | — | — | — | FORBIDDEN / SENSITIVE | CONFIDENTIAL → CONFIDENTIAL | Search across all users. | @@ -284,5 +285,5 @@ The compact tier is retained for compatibility. Guards, resource bindings, audit - `mfa`: 5 - `org_admin`: 64 - `org_member`: 56 -- `platform_admin`: 29 +- `platform_admin`: 30 - `public`: 18 diff --git a/module/services/accounts/code/pkg/adapters/datasource_trigger.go b/module/services/accounts/code/pkg/adapters/datasource_trigger.go index db9426d57..12673bd18 100644 --- a/module/services/accounts/code/pkg/adapters/datasource_trigger.go +++ b/module/services/accounts/code/pkg/adapters/datasource_trigger.go @@ -235,6 +235,8 @@ func triggerDeclarationToProto(declaration business.SourceTriggerDeclaration) *g Operation: declaration.Operation, Digest: declaration.Digest, UndeclarableReason: declaration.UndeclarableReason, + IdentityHolder: declaration.IdentityHolder, + HostSweepEnabled: declaration.HostSweepEnabled, } if declaration.LastOccurrenceAt != nil { out.LastOccurrenceAt = timestamppb.New(*declaration.LastOccurrenceAt) @@ -242,6 +244,13 @@ func triggerDeclarationToProto(declaration business.SourceTriggerDeclaration) *g if declaration.NextOccurrenceAt != nil { out.NextOccurrenceAt = timestamppb.New(*declaration.NextOccurrenceAt) } + // Both halves of "what this host will do about the schedule", and they are + // set OUTSIDE the undeclarable return below: a source that declares no + // trigger is still swept while the stopgap runs, so a reader of a parked or + // uncron-able source must still be told whether this host is firing. + if declaration.HostSweepDueAt != nil { + out.HostSweepDueAt = timestamppb.New(*declaration.HostSweepDueAt) + } if !declaration.Declarable() { return out } diff --git a/module/services/accounts/code/pkg/adapters/datasource_trigger_identity_test.go b/module/services/accounts/code/pkg/adapters/datasource_trigger_identity_test.go index e6280fa50..90e68f3d5 100644 --- a/module/services/accounts/code/pkg/adapters/datasource_trigger_identity_test.go +++ b/module/services/accounts/code/pkg/adapters/datasource_trigger_identity_test.go @@ -87,14 +87,51 @@ func TestTriggerOccurrenceMintsFromTheReferenceAndIsRefusedAfterRevocation(t *te require.Len(t, audit.of(business.EventSourceDelegationUsed), 2, "a refused occurrence mints nothing and records no child") } -// The installation-principal arm: a binding whose audience is the executing -// module's own and which declares headless scopes mints a capability for an -// occurrence with no person anywhere in it. +// A DELEGATION ONE MODULE HOLDS IS NOT A CAPABILITY ANOTHER CAN MINT +// (issue #1121, F1), at the real mint route. // -// It is the first proof and not the contract, and the assertions say why: the -// capability is owned and actored by the module's own principal, so there is -// no delegation to revoke and no authority to outlive the token — the run is -// bounded by the capability's own short lifetime. +// This is the second half of the finding the declaration half corrects. The +// counterexample: source S has a live delegation held by module A, and the +// composed executor is module B. The declaration can only name S — the +// reference value is the source id — so a host that called S "bound" would be +// claiming readiness for B. It is not: a mint by source id resolves +// ActiveSourceDelegation(S, caller) and B has none. +// +// Asserted here rather than reasoned about, because the whole correction rests +// on the mint refusing B while admitting A. +func TestAnotherModulesDelegationDoesNotMintForThisOne(t *testing.T) { + store, audit := installSourceDelegationService(t) + + // A holds the delegation and mints from the source id. + held, err := mintSourceContext("docstore", moduleToken(t, "docstore"), business.SourceDelegationRef{SourceID: delegationSource}) + require.NoError(t, err) + require.NotEmpty(t, held.GetToken()) + require.Len(t, audit.of(business.EventSourceDelegationUsed), 1) + + // B presents the same reference and is refused — as a decision, not an + // outage, so a module reading it does not retry it as transient. By source, + // "another module holds it" is indistinguishable from "nobody does", which + // is deliberate: B learns nothing about A's delegation. + _, err = mintSourceContext("reports", moduleToken(t, "reports"), business.SourceDelegationRef{SourceID: delegationSource}) + requireRefusal(t, err, codes.FailedPrecondition, SourceDelegationMissingReason) + require.Len(t, audit.of(business.EventSourceDelegationUsed), 1, + "a refused mint issues nothing and records no child") + // The delegation A holds is untouched by B's attempt. + require.NotNil(t, store.delegations[delegationID]) +} + +// The headless mint a binding with its own audience and headless scopes +// answers: a capability for work with no person anywhere in it. +// +// IT IS NOT THE INSTALLATION-BINDING ARM OF A DECLARED TRIGGER, and calling it +// "the first proof" of that arm was a leftover (issue #1112 M4, corrected in +// #1121). No declaration this host builds sets `Identity.Binding`, and this +// trigger cannot use one: the mint lives 60 seconds against a 10-minute +// declared deadline, and the capability is the module's own principal while +// ReconcileSource requires an organization member. What this test proves is the +// mint itself — the capability is owned and actored by the module's own +// principal, so there is no delegation to revoke and no authority to outlive +// the token, and the run is bounded by the capability's own short lifetime. func TestTriggerOccurrenceMintsFromTheInstallationBinding(t *testing.T) { store, audit := installModuleOperationContextService(t, executionPrincipals) installModuleWorkContextAuthority(t) diff --git a/module/services/accounts/code/pkg/adapters/datasource_trigger_projection_test.go b/module/services/accounts/code/pkg/adapters/datasource_trigger_projection_test.go new file mode 100644 index 000000000..8aebbcc03 --- /dev/null +++ b/module/services/accounts/code/pkg/adapters/datasource_trigger_projection_test.go @@ -0,0 +1,103 @@ +package adapters + +import ( + "testing" + "time" + + "accounts/pkg/business" + + "github.com/stretchr/testify/require" +) + +// EVERY FIELD OF THE DECLARATION REACHES THE WIRE (issue #1121). +// +// This test exists because a field that was never projected shipped: the +// declaration gained `HostSweepEnabled` and `HostSweepDueAt`, the panel was +// written to read them, and `triggerDeclarationToProto` was not updated — so +// the page would have told every operator that this host fires nothing, which +// is the opposite of the truth and exactly the claim the change was made to +// correct. Nothing caught it, because the panel's container test serves its own +// JSON fixture and never crosses this projection. +// +// So the assertion is deliberately field-by-field rather than "the important +// ones": a projection is a place where a value is silently dropped, and the +// only test that notices is one that names everything. +func TestTriggerDeclarationProjectionCarriesEveryField(t *testing.T) { + last := time.Date(2026, 10, 12, 9, 0, 0, 0, time.UTC) + next := time.Date(2026, 10, 12, 9, 30, 0, 0, time.UTC) + due := time.Date(2026, 10, 12, 9, 7, 0, 0, time.UTC) + declaration := business.SourceTriggerDeclaration{ + Release: business.DatasourceReconcileRelease, + Operation: business.DatasourceReconcileOperation, + Schedule: business.DeclaredTriggerSchedule{ + Cron: "*/30 * * * *", Timezone: "UTC", MissedRun: "skip", Overlap: "skip", + Deadline: 10 * time.Minute, Input: []byte(`{"org_id":"o","source_id":"s"}`), + }, + Identity: business.DeclaredTriggerIdentity{Source: "a-source"}, + IdentityHolder: "module-a", + Digest: "4f1c", + LastOccurrenceAt: &last, + NextOccurrenceAt: &next, + HostSweepEnabled: true, + HostSweepDueAt: &due, + } + + out := triggerDeclarationToProto(declaration) + + require.Equal(t, business.DatasourceReconcileRelease, out.GetRelease()) + require.Equal(t, business.DatasourceReconcileOperation, out.GetOperation()) + require.Equal(t, "4f1c", out.GetDigest()) + require.Equal(t, "*/30 * * * *", out.GetSchedule().GetCron()) + require.Equal(t, "UTC", out.GetSchedule().GetTimezone()) + require.Equal(t, "skip", out.GetSchedule().GetMissedRun()) + require.Equal(t, "skip", out.GetSchedule().GetOverlap()) + require.Equal(t, int64(10*time.Minute), out.GetSchedule().GetDeadline()) + require.JSONEq(t, `{"org_id":"o","source_id":"s"}`, out.GetSchedule().GetInputJson()) + require.Equal(t, "a-source", out.GetIdentity().GetSource()) + require.Empty(t, out.GetIdentity().GetBinding()) + // The holder is NOT the executor, and the field's own comment says so; what + // matters here is that a reader is given it at all (issue #1121, F1). + require.Equal(t, "module-a", out.GetIdentityHolder()) + require.Equal(t, last, out.GetLastOccurrenceAt().AsTime()) + require.Equal(t, next, out.GetNextOccurrenceAt().AsTime()) + // What THIS HOST will do about the schedule, which is a different fact from + // the cron above and the reason both are carried. + require.True(t, out.GetHostSweepEnabled()) + require.Equal(t, due, out.GetHostSweepDueAt().AsTime()) + require.NotEqual(t, out.GetNextOccurrenceAt().AsTime(), out.GetHostSweepDueAt().AsTime(), + "fixture: the declared instant and the swept instant must differ, which is the finding they report") +} + +// A source that declares no trigger still says what this host is doing, because +// the stopgap sweeps a source whose cron could not be spelled just the same. +// The schedule and identity are withheld; the sweep's state is not. +func TestAnUndeclarableSourceStillReportsTheHostSweep(t *testing.T) { + due := time.Date(2026, 10, 12, 9, 7, 0, 0, time.UTC) + out := triggerDeclarationToProto(business.SourceTriggerDeclaration{ + Release: business.DatasourceReconcileRelease, + Operation: business.DatasourceReconcileOperation, + UndeclarableReason: business.TriggerUndeclarableInterval, + HostSweepEnabled: true, + HostSweepDueAt: &due, + }) + + require.Equal(t, business.TriggerUndeclarableInterval, out.GetUndeclarableReason()) + require.Nil(t, out.GetSchedule(), "an undeclarable source has no schedule to project") + require.Nil(t, out.GetIdentity()) + require.True(t, out.GetHostSweepEnabled()) + require.Equal(t, due, out.GetHostSweepDueAt().AsTime()) +} + +// And with the switch off there is no instant to report: an operator must not +// be shown a pass this host will not take. +func TestASweepThatIsOffNamesNoInstant(t *testing.T) { + out := triggerDeclarationToProto(business.SourceTriggerDeclaration{ + Release: business.DatasourceReconcileRelease, + Operation: business.DatasourceReconcileOperation, + Schedule: business.DeclaredTriggerSchedule{Cron: "*/30 * * * *"}, + HostSweepEnabled: false, + }) + + require.False(t, out.GetHostSweepEnabled()) + require.Nil(t, out.GetHostSweepDueAt()) +} diff --git a/module/services/accounts/code/pkg/adapters/platform_admin_authorization_test.go b/module/services/accounts/code/pkg/adapters/platform_admin_authorization_test.go index c80996bfd..83b7cad67 100644 --- a/module/services/accounts/code/pkg/adapters/platform_admin_authorization_test.go +++ b/module/services/accounts/code/pkg/adapters/platform_admin_authorization_test.go @@ -101,6 +101,14 @@ func platformAdminHandlers() []platformAdminHandler { _, err := srv.PutModuleEnvelope(ctx, &gen.PutModuleEnvelopeRequest{Document: `{"revision":1}`}) return err }}, + // It reads what a module's per-tenant capability would carry in any + // organization, which is cross-tenant authority however read-only it is. + {"ResolveModuleTenantIdentity", "super_admin", func(ctx context.Context, srv *PlatformAdminServer) error { + _, err := srv.ResolveModuleTenantIdentity(ctx, &gen.ResolveModuleTenantIdentityRequest{ + Prefix: "example", Binding: "operate", OrganizationId: platformTargetD, + }) + return err + }}, {"ListFeatureFlags", "super_admin", func(ctx context.Context, srv *PlatformAdminServer) error { _, err := srv.ListFeatureFlags(ctx, &gen.ListFeatureFlagsRequest{}) return err diff --git a/module/services/accounts/code/pkg/adapters/platform_module_envelope_rpcs.go b/module/services/accounts/code/pkg/adapters/platform_module_envelope_rpcs.go index b77e492da..763b11f23 100644 --- a/module/services/accounts/code/pkg/adapters/platform_module_envelope_rpcs.go +++ b/module/services/accounts/code/pkg/adapters/platform_module_envelope_rpcs.go @@ -3,6 +3,7 @@ package adapters import ( "context" "errors" + "time" "connectrpc.com/connect" "google.golang.org/grpc/codes" @@ -102,3 +103,64 @@ func (h *platformAdminConnectHandler) GetModuleEnvelope(ctx context.Context, req func (h *platformAdminConnectHandler) PutModuleEnvelope(ctx context.Context, req *connect.Request[gen.PutModuleEnvelopeRequest]) (*connect.Response[gen.PutModuleEnvelopeResponse], error) { return unary(ctx, req, h.inner.PutModuleEnvelope) } + +// ResolveModuleTenantIdentity answers what a per-tenant module operation +// context would assert for one module, one of its bindings and one +// organization — or why it would be refused — for a platform super_admin. +// +// IT ISSUES NO CAPABILITY, and that is the shape rather than a limitation +// (issue #1121). The mint it describes requires the module pod's projected +// ServiceAccount token, held against the build its authority document approves; +// an operator's browser has none, and a path that answered one with a module's +// capability would be a second spelling of that module's identity. So this +// reads the decision and stops before the signature. +func (s *PlatformAdminServer) ResolveModuleTenantIdentity( + ctx context.Context, req *gen.ResolveModuleTenantIdentityRequest, +) (*gen.ResolveModuleTenantIdentityResponse, error) { + if err := Validate(req); err != nil { + return nil, err + } + actorID, err := requireAuth(ctx) + if err != nil { + return nil, err + } + if err := requirePlatformRole(ctx, actorID, "super_admin"); err != nil { + return nil, err + } + resolution, err := service.ResolveModuleTenantIdentity(ctx, req.GetPrefix(), req.GetBinding(), req.GetOrganizationId()) + if err != nil { + return nil, translateGRPCError(err) + } + response := &gen.ResolveModuleTenantIdentityResponse{ + Refusal: resolution.Refusal, + Recent: make([]*gen.ModuleTenantIdentityMint, 0, len(resolution.Recent)), + } + if identity := resolution.Identity; identity != nil { + response.Identity = &gen.ModuleTenantIdentity{ + PrincipalId: identity.PrincipalID, + Tenant: identity.Tenant, + Audience: identity.Audience, + Scopes: identity.Scopes, + LifetimeSeconds: int64(identity.Lifetime / time.Second), + Revision: identity.Revision, + Shared: identity.Shared, + } + } + for _, mint := range resolution.Recent { + response.Recent = append(response.Recent, &gen.ModuleTenantIdentityMint{ + Record: mint.Record, + Tenant: mint.Tenant, + Binding: mint.Binding, + Audience: mint.Audience, + Scopes: mint.Scopes, + MintedAt: timestamppb.New(mint.MintedAt), + }) + } + return response, nil +} + +func (h *platformAdminConnectHandler) ResolveModuleTenantIdentity( + ctx context.Context, req *connect.Request[gen.ResolveModuleTenantIdentityRequest], +) (*connect.Response[gen.ResolveModuleTenantIdentityResponse], error) { + return unary(ctx, req, h.inner.ResolveModuleTenantIdentity) +} diff --git a/module/services/accounts/code/pkg/adapters/rest_registration_catalog_gen.go b/module/services/accounts/code/pkg/adapters/rest_registration_catalog_gen.go index de22597cd..6a494434e 100644 --- a/module/services/accounts/code/pkg/adapters/rest_registration_catalog_gen.go +++ b/module/services/accounts/code/pkg/adapters/rest_registration_catalog_gen.go @@ -143,6 +143,7 @@ var catalogRESTExactRoutes = map[string]struct{}{ "GET /v1/platform/jobs": {}, "GET /v1/platform/jobs/operations": {}, "GET /v1/platform/module-envelope": {}, + "GET /v1/platform/module-tenant-identity": {}, "GET /v1/platform/sessions": {}, "GET /v1/platform/users": {}, "GET /v1/platform/waitlist": {}, diff --git a/module/services/accounts/code/pkg/adapters/source_operation_authority.go b/module/services/accounts/code/pkg/adapters/source_operation_authority.go index 50542c479..31795eff1 100644 --- a/module/services/accounts/code/pkg/adapters/source_operation_authority.go +++ b/module/services/accounts/code/pkg/adapters/source_operation_authority.go @@ -84,6 +84,12 @@ func authenticateSourceOperationContext(ctx context.Context, headers http.Header // requireCurrentAuthority above and borrows nobody's source. if delegated && delegation != nil && delegation.SourceID != "" { ctx = context.WithValue(ctx, sourceOperationDelegationKey{}, delegation.SourceID) + // And that nobody was present for this pass. The observation an + // operation emits records the delegating person as its actor, which is + // right — the authority is theirs — but says nothing about whether they + // asked for it; only this layer, which has just confirmed the + // delegation, can tell the two apart (issue #1121, m3). + ctx = business.WithUnattendedPass(ctx, delegation.ID) } return ctx, nil } diff --git a/module/services/accounts/code/pkg/business/audit_registry.go b/module/services/accounts/code/pkg/business/audit_registry.go index a6ac266ea..3bef12bd1 100644 --- a/module/services/accounts/code/pkg/business/audit_registry.go +++ b/module/services/accounts/code/pkg/business/audit_registry.go @@ -804,7 +804,16 @@ var auditEventCatalog = []AuditEventDefinition{ append(append(slices.Clone(sourceDelegationFields), str("audience"), strs("scopes"), boolean("lookup")), optionalFields(mintExecutionFields())...)...), 3), mutation(EventSourceDelegationRevoked, CategoryAccess, "A source delegation was revoked.", append(slices.Clone(sourceDelegationFields), enum("reason", SourceDelegationRevocationReasons...))...), - observation(EventDatasourceSourceSynced, CategorySystem, "A datasource sync was requested.", str("job_id"), str("repo")), + // v2 (#1121) records whether a person was present. A pass admitted by a + // source delegation authenticates as the DELEGATING person, so the actor is + // a `user` and that is correct rather than a mis-attribution — but a row + // that says only "a user requested a sync" cannot answer whether anybody + // asked for it. `unattended` and the delegation it was admitted under are + // optional because the other emitter of this event is a person's "Sync + // now", which carries neither. + revised(observation(EventDatasourceSourceSynced, CategorySystem, "A datasource sync was requested.", + append([]PayloadField{str("job_id"), str("repo")}, + optionalFields([]PayloadField{boolean("unattended"), uid("delegation_id")})...)...), 2), revised(mutation(EventDatasourceCredentialUpdated, CategorySystem, "A datasource credential was validated and replaced.", str("repo"), enum("credential_kind", "pat", "app", "public")), 2), // v2 names what was removed — v1 recorded an empty payload, so the trail diff --git a/module/services/accounts/code/pkg/business/datasource_deliveries.go b/module/services/accounts/code/pkg/business/datasource_deliveries.go index 0c203fb4a..5320676f9 100644 --- a/module/services/accounts/code/pkg/business/datasource_deliveries.go +++ b/module/services/accounts/code/pkg/business/datasource_deliveries.go @@ -892,6 +892,42 @@ func (s *Service) allocateOrdinal(ctx context.Context, sourceID string) (int64, // source. That is the cost of a double fire, and it is why this is a stopgap // to delete and not a safety net to keep. +// SetDatasourceReconcileSweep records whether THIS deployment fires the +// reconcile schedule it declares (issue #1121, N7). +// +// It exists so the declaration's consumer and the stopgap can never both run. +// While both exist they are two schedules over one source: they enqueue under +// different idempotency keys, so nothing collapses them, and the per-source +// FIFO key only makes the second serialise behind the first — survivable for +// GitHub, a second full re-send for a pull provider. The moment a composition +// installs a module that consumes the declaration it must turn this off, and +// before this there was nothing to turn off but a redeploy of a patched host. +// +// Default ON, deliberately: that is what every deployment does today, and a +// switch whose default silently stopped every scheduled reconcile would be the +// outage #1090 already caused once. +// +// The sweep itself refuses, which is where the guard belongs: a switch read +// only where the ticker is installed would leave every other caller of +// RunDatasourceReconcile unguarded, and the declaration's own read would still +// describe a sweep that is not running. The one-minute tick in work.go goes on +// firing and its callback goes on being called; what it finds is a sweep that +// reads nothing and enqueues nothing. +// +// STOPGAP (issue #1112): deleted with RunDatasourceReconcile, and listed in the +// block above. +func (s *Service) SetDatasourceReconcileSweep(enabled bool) { + s.datasourceReconcileSweepOff = !enabled +} + +// DatasourceReconcileSweepEnabled reports that switch: whether this host still +// fires the reconcile schedule it declares. +// +// STOPGAP (issue #1112). +func (s *Service) DatasourceReconcileSweepEnabled() bool { + return !s.datasourceReconcileSweepOff +} + // RunDatasourceReconcile is the periodic sweep: it enqueues reconcile work for // every active source whose schedule has elapsed and reschedules it. A GitHub // source gets a conditional reconcile on the delivery queue — the job resolves @@ -910,6 +946,12 @@ func (s *Service) allocateOrdinal(ctx context.Context, sourceID string) (int64, // deletes this. func (s *Service) RunDatasourceReconcile(ctx context.Context) (int, error) { w := wool.Get(ctx).In("RunDatasourceReconcile") + // The operator turned the stopgap off, which means something else fires + // this schedule now. Nothing, not a leftover ticker and not another caller + // added later, may sweep beside it. + if !s.DatasourceReconcileSweepEnabled() { + return 0, nil + } if s.datasourceJobs == nil { return 0, w.NewError("datasource connector is not configured") } diff --git a/module/services/accounts/code/pkg/business/datasource_deliveries_test.go b/module/services/accounts/code/pkg/business/datasource_deliveries_test.go index 802a8a490..5bffaa2c0 100644 --- a/module/services/accounts/code/pkg/business/datasource_deliveries_test.go +++ b/module/services/accounts/code/pkg/business/datasource_deliveries_test.go @@ -687,7 +687,7 @@ func TestSourceTriggerDeclaration_DeclaresOnlyASourceOnItsSchedule(t *testing.T) t.Fatal(err) } - declared := business.DeclareSourceTrigger(on, nil, nil) + declared := business.DeclareSourceTrigger(on, nil, nil, true) if !declared.Declarable() { t.Fatalf("a source on its schedule declares no trigger: %q", declared.UndeclarableReason) } @@ -699,7 +699,7 @@ func TestSourceTriggerDeclaration_DeclaresOnlyASourceOnItsSchedule(t *testing.T) t.Fatalf("declared operation = %q", declared.Operation) } - if cleared := business.DeclareSourceTrigger(off, nil, nil); cleared.Declarable() { + if cleared := business.DeclareSourceTrigger(off, nil, nil, true); cleared.Declarable() { t.Fatalf("a source off its schedule declared a trigger: %+v", cleared.Schedule) } } diff --git a/module/services/accounts/code/pkg/business/datasource_reconcile_coverage_test.go b/module/services/accounts/code/pkg/business/datasource_reconcile_coverage_test.go index 3955b29cf..66432a10f 100644 --- a/module/services/accounts/code/pkg/business/datasource_reconcile_coverage_test.go +++ b/module/services/accounts/code/pkg/business/datasource_reconcile_coverage_test.go @@ -180,6 +180,60 @@ func TestReconcileSourceOperation_TwoAttemptsOfOneOccurrenceAreOneJob(t *testing } } +// NOTHING IS ENQUEUED FOR A PASS THAT WILL BE REFUSED (issue #1121, m2/N4). +// +// The effect's binding and digest are read before the enqueue, because both +// refusals are decisions about the attempt row alone. Enqueueing and then +// refusing left a job behind for a request this host rejected — and since the +// key names the source, a re-presented identity naming a DIFFERENT source +// produced a key of its own: a real second re-send of that source rather than +// a collapsed replay. +func TestReconcileSourceOperation_RefusedPassEnqueuesNothing(t *testing.T) { + producer := &recordingProducer{} + store := newReconcileOperationStore() + svc, _ := newDatasourceService(store, producer, &fakeGitHub{defaultBranch: "main", commit: "abc"}) + + first := newUploadSource(t, svc) + second := newCrawlerSource(t, svc) + takeConnectSync(t, producer, first) + takeConnectSync(t, producer, second) + + // One occurrence of the first source, admitted and recorded. + reconcileOnce(t, svc, first.OrgID, first.ID, "occurrence-1") + if got := len(jobKeys(producer, first.ID)); got != 1 { + t.Fatalf("the admitted pass enqueued %d job(s), want 1", got) + } + + // The same identity, now naming the second source. It is refused — and the + // refusal must happen before anything reaches the queue. + digest := sha256.Sum256([]byte("occurrence-1")) + ctx := receipts.WithEffect(t.Context(), receipts.Effect{ + ID: "occurrence-1", Tenant: second.OrgID, Method: business.ReconcileSourceMethod, RequestDigest: digest[:], + }) + err := svc.ReconcileDatasourceSource(ctx, "actor", second.OrgID, second.ID, + func(context.Context, string) error { return nil }) + if err == nil { + t.Fatal("an effect identity bound to another source was admitted") + } + if jobs := jobKeys(producer, second.ID); len(jobs) != 0 { + t.Fatalf("a refused pass enqueued %d job(s) for the second source: %v", len(jobs), jobs) + } + + // And the same source with a different request digest: refused as a reuse, + // again with nothing enqueued beyond the one admitted pass. + other := sha256.Sum256([]byte("a different request")) + ctx = receipts.WithEffect(t.Context(), receipts.Effect{ + ID: "occurrence-1", Tenant: first.OrgID, Method: business.ReconcileSourceMethod, RequestDigest: other[:], + }) + if err := svc.ReconcileDatasourceSource(ctx, "actor", first.OrgID, first.ID, + func(context.Context, string) error { return nil }); err == nil { + t.Fatal("an effect identity re-presented with another request was admitted") + } + if got := len(jobKeys(producer, first.ID)); got != 1 { + t.Fatalf("a refused reuse enqueued a second job: %d", got) + } +} + // reconcileOnce runs one reconcile pass as one occurrence of the declared // trigger would: an effect identity in context, and the receipt committed by // the callback the operation hands it. diff --git a/module/services/accounts/code/pkg/business/datasource_reconcile_operation.go b/module/services/accounts/code/pkg/business/datasource_reconcile_operation.go index b9c076560..46ddedcef 100644 --- a/module/services/accounts/code/pkg/business/datasource_reconcile_operation.go +++ b/module/services/accounts/code/pkg/business/datasource_reconcile_operation.go @@ -71,6 +71,28 @@ func (s *Service) ReconcileDatasourceSource(ctx context.Context, actor, org, sou if !ok { return operationUnavailable() } + // NOTHING IS ENQUEUED FOR A PASS THAT WILL BE REFUSED (issue #1121, m2/N4). + // The effect's binding and request digest are read FIRST, in their own + // read-only transaction, because both refusals below are decisions about + // the attempt row alone: enqueueing and then refusing left a job behind for + // a request this host rejected, and since the key now names the + // organization and the source as well as the effect, a re-presented + // identity naming a different source produced a key of its own — a real + // second re-send of that source rather than a collapsed replay. + // + // This is not a second authority. The transaction below is still the + // decision: a concurrent attempt can take the row between the two reads, so + // the checks are made again where they commit. What this read adds is that + // the queue is not touched by a request already known to be refused. + if err := s.store.WithOrgTx(ctx, org, func(ctx context.Context) error { + prior, err := attempts.GetSourceOperationAttempt(ctx, org, effect.ID) + if err != nil { + return operationUnavailable() + } + return reconcileAttemptAdmits(prior, actor, source.ID, effect.RequestDigest) + }); err != nil { + return err + } // The enqueue comes before the record, and the record is what makes the // pass recoverable. That order is safe only because the enqueue is keyed by // the effect: a crash between the two leaves one job that a retry under the @@ -84,8 +106,10 @@ func (s *Service) ReconcileDatasourceSource(ctx context.Context, actor, org, sou if err != nil { return operationUnavailable() } - switch { - case prior == nil: + if err := reconcileAttemptAdmits(prior, actor, source.ID, effect.RequestDigest); err != nil { + return err + } + if prior == nil { created, err := attempts.CreateSourceOperationAttempt(ctx, SourceOperationAttempt{ OrgID: org, EffectID: effect.ID, ActorID: actor, SourceID: source.ID, Operation: reconcileSourceOperation, DeclarationDigest: ReconcileSourceMethod, @@ -94,10 +118,6 @@ func (s *Service) ReconcileDatasourceSource(ctx context.Context, actor, org, sou if err != nil || !created { return operationUnavailable() } - case prior.ActorID != actor || prior.SourceID != source.ID || prior.Operation != reconcileSourceOperation: - return operationRefused("SOURCE_EFFECT_BINDING_CHANGED") - case !bytes.Equal(prior.RequestDigest, effect.RequestDigest): - return operationRefused("SOURCE_EFFECT_REUSED") } return commit(ctx, jobID) }) @@ -111,8 +131,18 @@ func (s *Service) ReconcileDatasourceSource(ctx context.Context, actor, org, sou // durability rule rather than an oversight: "a sync was requested" observes // a handover that has already happened, so rolling it back with the write // it observes would lose the record of work that is still going to run. - s.emit(ctx, actor, "user", EventDatasourceSourceSynced, "datasource", source.ID, org, - map[string]any{"job_id": jobID, "repo": source.Repo}) + // + // The actor stays the person, because for a delegated pass the authority IS + // that person's and ADR 0008 puts them in the trail on purpose. What the + // row now also says is whether anybody was present: an unattended pass + // names the delegation it was admitted under (issue #1121, m3), so a reader + // can tell one from a person's "Sync now" without joining the mint trail + // by hand. + payload := map[string]any{"job_id": jobID, "repo": source.Repo} + if delegationID, unattended := unattendedPass(ctx); unattended { + payload["unattended"], payload["delegation_id"] = true, delegationID + } + s.emit(ctx, actor, "user", EventDatasourceSourceSynced, "datasource", source.ID, org, payload) // The schedule's own projection moves with the pass, not with a clock this // host runs: the stored instant is what the park and restore paths read as // "this source is on its schedule", and a pass that left it alone would let @@ -122,6 +152,26 @@ func (s *Service) ReconcileDatasourceSource(ctx context.Context, actor, org, sou }) } +// reconcileAttemptAdmits judges one effect identity against the attempt row +// that already holds it: absent is a first attempt, an identical binding and +// request digest is a retry of the same occurrence, and anything else is a +// refusal. +// +// One function because it is asked twice — once before the enqueue, once where +// the receipt commits — and two copies of a refusal rule are two places for the +// pre-check to start admitting what the commit refuses. +func reconcileAttemptAdmits(prior *SourceOperationAttempt, actor, sourceID string, requestDigest []byte) error { + switch { + case prior == nil: + return nil + case prior.ActorID != actor || prior.SourceID != sourceID || prior.Operation != reconcileSourceOperation: + return operationRefused("SOURCE_EFFECT_BINDING_CHANGED") + case !bytes.Equal(prior.RequestDigest, requestDigest): + return operationRefused("SOURCE_EFFECT_REUSED") + } + return nil +} + // enqueueReconcileOccurrence hands one pass to the engine the source's provider // actually syncs on, keyed by the effect so a retry is the same job. // diff --git a/module/services/accounts/code/pkg/business/datasource_trigger.go b/module/services/accounts/code/pkg/business/datasource_trigger.go index 5e8c60de3..9726dae33 100644 --- a/module/services/accounts/code/pkg/business/datasource_trigger.go +++ b/module/services/accounts/code/pkg/business/datasource_trigger.go @@ -169,8 +169,45 @@ type SourceTriggerDeclaration struct { // source, whatever admitted it. NextOccurrenceAt is the next instant the // declared cron comes due, computed from the declaration — never a stored // cursor, because the cursor belongs to the module that fires the trigger. - LastOccurrenceAt *time.Time - NextOccurrenceAt *time.Time + LastOccurrenceAt *time.Time + NextOccurrenceAt *time.Time + // HostSweepEnabled and HostSweepDueAt say what THIS HOST will do about the + // schedule, which is not the same question as what the declaration says + // (issue #1121, N6). + // + // The two share a period and NOT a phase, and reporting only the cron's + // instant said otherwise. The declared cron for a sub-hourly interval is + // `*/M * * * *`, which comes due on the quarter- or half-hour; the stopgap + // sweep fires on the STORED instant, which every pass and every bump moves + // to `now + interval` — an arbitrary offset inside the period, set by + // whenever the source was last connected or reconciled. So a reader shown + // "next occurrence 14:30" was reading the declaration's statement while the + // pass that will actually happen was at 14:07. + // + // Keeping the cron's phase and the stored instant apart is deliberate: the + // cron must not be aligned to the stored instant (the declaration is + // derived from the interval and nothing else), and the stored instant must + // not be aligned to the cron (`*/M` has no per-source spread, so every + // source of a provider would come due in the same second — a thundering + // herd on one provider, which is exactly what the sweep's natural + // scattering avoids). They are two facts, so they are reported as two. + // + // HostSweepDueAt is unset when the sweep is off, or when the source is not + // on its schedule: then there is no pass this host will take. + // + // STOPGAP (issue #1112): both go with RunDatasourceReconcile. + HostSweepEnabled bool + HostSweepDueAt *time.Time + // IdentityHolder is the module whose delegation the reference arm resolved + // to when this declaration was built, and it is reported because the arm + // itself cannot carry it: the reference value is the source id. + // + // It is NOT the executing module (issue #1121, F1). Nothing declares who + // executes declared work, so this says "module A's self-addressed + // delegation is what a reference on this source would resolve to", and + // whether A is the module that installs this release is unverified here. + // Empty when the arm names no identity. + IdentityHolder string UndeclarableReason string } @@ -202,6 +239,33 @@ type TriggerDelegationReference struct { RevokedReason string } +// candidateForADeclaredExecutor reports whether a declared trigger's reference +// arm MAY name this delegation: it is live, it has a reference value, its +// binding still confers something, and the module that holds it is the audience +// of its own binding — the only shape a source-id reference can serve, because +// a mint by source id resolves the delegation of the CALLING module and the +// capability is addressed to the binding's audience. +// +// WHAT IT DOES NOT ESTABLISH, and the name says so on purpose (issue #1121, +// F1): that the module holding it is the module which will execute this +// release. Nothing in the envelope or the derived registry declares who +// executes declared work — self-addressed bindings are generic, and a +// deployment may have several — so "module A holds a self-addressed delegation +// on source S" does not imply "the composed executor B can mint for S". B's +// mint resolves ActiveSourceDelegation(S, B) and is correctly refused with +// ErrSourceDelegationMissing; what would have been wrong is this host telling +// an operator that S was ready. +// +// So the declaration names the candidate and the read reports WHICH module +// holds it (SourceTriggerDeclaration.IdentityHolder), and neither claims +// executor readiness. Resolving it properly needs the executing principal to be +// named by a contract that does not exist yet; hard-coding a sibling module's +// prefix here is not that contract. +func (r TriggerDelegationReference) candidateForADeclaredExecutor() bool { + return r.Active && r.Reference != "" && len(r.Scopes) > 0 && + r.Audience != "" && r.Audience == r.Module +} + // TriggerChildContext is one child Work Context this host minted against a // reference, as the audit trail recorded it. There is no other record to read: // a capability lives about a minute and nothing caches one. @@ -352,10 +416,36 @@ func datasourceTriggerInput(orgID, sourceID string) []byte { // stated as planned in MODULE.md and WORK_CONTEXTS.md rather than quietly // shortened to fit. // +// ONLY A SELF-ADDRESSED DELEGATION IS NAMED, AND IT IS A CANDIDATE (issue +// #1121, m5 and F1). It used to take the first active reference from any +// module, which named delegations no trigger could ever use: a mint by source +// id resolves the active delegation OF THE CALLING MODULE +// (ActiveSourceDelegation by source and prefix) and the capability is addressed +// to the binding's declared audience, which the module admitting it must itself +// accept. Both are true of exactly one shape — a delegation whose binding names +// its own module as the audience, the self-admitting binding +// selfAdmittingBinding exists to allow. A delegation to module A addressed to +// audience B is reachable only through the delegation-id exchange, which a +// source-id reference cannot name. +// +// THAT IS A SHAPE, NOT AN EXECUTOR. Nothing this host holds declares which +// module executes declared work — self-addressed bindings are generic and a +// deployment may have several — so a source whose only such delegation belongs +// to module A is a candidate under A's name, and if the composed executor is B, +// holding none, B's mint is refused with ErrSourceDelegationMissing. The +// declaration therefore reports WHOSE delegation it resolved to +// (SourceTriggerDeclaration.IdentityHolder) and claims nothing about readiness; +// see candidateForADeclaredExecutor, which carries the whole argument. +// +// An active delegation with no resolvable scopes is not a candidate either: the +// module no longer declares the binding it was recorded against, so the next +// mint revokes it as binding_changed. +// // THE REFERENCE IS THE SOURCE ID, AND REVOCATION IS THEREFORE NOT DURABLE // (issue #1112, M3). Every delegation on one source reads back under the same -// reference value, so this loop names whichever module holds an active one; -// and because a mint resolves the active delegation from the source afresh, a +// reference value, so the resolution below cannot distinguish two delegations +// of one source by reference value; and because a mint resolves the active +// delegation from the source afresh, a // reconnect that records a new delegation re-arms an installed trigger with no // explicit re-delegation. The durable shape is an opaque, delegation-level // reference, which this host's own mint already accepts (SourceDelegationRef's @@ -365,16 +455,27 @@ func datasourceTriggerInput(orgID, sourceID string) []byte { // from what it sent, so a delegation id in this field is rejected by the // caller, not by this host. Named in WORK_CONTEXTS.md § Triggers as that // facade's gap. -func DeclareSourceTrigger(source *DatasourceSource, references []TriggerDelegationReference, lastOccurrence *time.Time) SourceTriggerDeclaration { +func DeclareSourceTrigger( + source *DatasourceSource, references []TriggerDelegationReference, + lastOccurrence *time.Time, hostSweep bool, +) SourceTriggerDeclaration { declaration := SourceTriggerDeclaration{ Release: DatasourceReconcileRelease, Operation: DatasourceReconcileOperation, LastOccurrenceAt: lastOccurrence, + HostSweepEnabled: hostSweep, } if source == nil { declaration.UndeclarableReason = TriggerUndeclarableNoSchedule return declaration } + // The instant the stopgap will sweep on, which is the stored one and not + // the cron's — see the field's note. A source held off its schedule has a + // cleared instant, so there is no pass to report. + if hostSweep && source.Status == DatasourceStatusActive && source.NextReconcileAt != nil { + due := source.NextReconcileAt.UTC() + declaration.HostSweepDueAt = &due + } cron, reason := datasourceTriggerCron(source.ReconcileInterval, source.ID) if reason != "" { declaration.UndeclarableReason = reason @@ -396,11 +497,15 @@ func DeclareSourceTrigger(source *DatasourceSource, references []TriggerDelegati Deadline: DatasourceTriggerDeadline, Input: datasourceTriggerInput(source.OrgID, source.ID), } - // Whichever module holds an active delegation, because every delegation on - // one source carries the same reference value — see the M3 note above. + // A delegation a declared executor COULD use — the self-addressed one, for + // the reasons in candidateForADeclaredExecutor, which also says why this is + // not proof that the composed executor holds it. The holder travels with it + // so a reader is told whose delegation the reference resolves to today + // rather than being left to infer an executor. for _, reference := range references { - if reference.Active && reference.Reference != "" { + if reference.candidateForADeclaredExecutor() { declaration.Identity = DeclaredTriggerIdentity{Source: reference.Reference} + declaration.IdentityHolder = reference.Module break } } @@ -586,7 +691,8 @@ func (s *Service) GetSourceTriggerDeclaration(ctx context.Context, orgID, source if err != nil { return SourceTriggerDeclaration{}, nil, nil, err } - return DeclareSourceTrigger(source, references, source.LastSyncedAt), references, children, nil + return DeclareSourceTrigger(source, references, source.LastSyncedAt, s.DatasourceReconcileSweepEnabled()), + references, children, nil } // DelegateSourceTriggers records the delegation a declared release's triggers diff --git a/module/services/accounts/code/pkg/business/datasource_trigger_delegate_test.go b/module/services/accounts/code/pkg/business/datasource_trigger_delegate_test.go index 602ba6ebd..0e0c87c3c 100644 --- a/module/services/accounts/code/pkg/business/datasource_trigger_delegate_test.go +++ b/module/services/accounts/code/pkg/business/datasource_trigger_delegate_test.go @@ -25,9 +25,21 @@ import ( "github.com/stretchr/testify/require" ) -// Two modules, each with one binding that accepts a delegation. Two rather -// than one because the harm is to the delegation this call did NOT come to -// record. +// Three modules, each with one binding that accepts a delegation, and they are +// not interchangeable. +// +// `docstore` and `reportstore` are CONSUMING modules: their bindings name +// another service as the audience, which is what a person's connect delegates +// to. `runtime` is the module that EXECUTES declared work: its binding names +// its own prefix, because it mints the capability for an occurrence and then +// admits that capability as its own incoming execution context. +// +// The distinction is what the backfill is narrowed to (issue #1121, N8): a +// trigger's reference arm is a source id, a mint by source id resolves the +// delegation of the CALLING module, and the capability is addressed to the +// binding's audience — so only the self-admitting shape can serve one. A +// delegation recorded for a consuming module is the administrator's authority +// handed to a module whose delegation no trigger of this host could name. const delegateTriggerPrincipals = `{` + `"docstore":{"workload":{"service_account":"docstore","namespace":"acme-prod","container":"app"},` + `"tenant":"` + testOrg + `","operation_audiences":{"source-sync":{"audience":"ingestservice",` + @@ -36,6 +48,11 @@ const delegateTriggerPrincipals = `{` + `"reportstore":{"workload":{"service_account":"reportstore","namespace":"acme-prod","container":"app"},` + `"tenant":"` + testOrg + `","operation_audiences":{"source-sync":{"audience":"reportservice",` + `"invoke_scopes":[{"resource_kind":"collections","actions":["read","write"]}],` + + `"source_delegation_scopes":[{"resource_kind":"collections","actions":["write"]}]}}},` + + `"runtime":{"workload":{"service_account":"runtime","namespace":"acme-prod","container":"app"},` + + `"tenant":"` + testOrg + `","operation_audiences":{"occurrences":{"audience":"runtime",` + + `"invoke_scopes":[{"resource_kind":"collections","actions":["read","write"]}],` + + `"headless_scopes":[{"resource_kind":"collections","actions":["read"]}],` + `"source_delegation_scopes":[{"resource_kind":"collections","actions":["write"]}]}}}}` // A delegation another module already holds survives an administrator's @@ -70,14 +87,72 @@ func TestDelegateSourceTriggersLeavesAnotherModulesDelegationAlone(t *testing.T) require.Equal(t, "connecting-member", after.PrincipalID, "an administrator's reference operation re-owned another module's delegation") - // And the module that had none got one — that IS the point of the call. - recorded := store.activeFor(source.ID, "reportstore") - require.NotNil(t, recorded, "the module with no delegation did not get one") + // And the EXECUTING module, which had none, got one — that IS the point of + // the call: the reference a declared release's trigger names. + recorded := store.activeFor(source.ID, "runtime") + require.NotNil(t, recorded, "the executing module with no delegation did not get one") require.Equal(t, "an-administrator", recorded.PrincipalID) - // Exactly one delegation per module, and no replacement anywhere. + + // The other CONSUMING module did not (issue #1121, N8). It accepts + // delegations, and it had none, and the old backfill recorded one anyway — + // handing the administrator's authority over this source to a module whose + // delegation no trigger of this host can name. A person's connect is what + // delegates to a consuming module, and that path is unchanged. + require.Nil(t, store.activeFor(source.ID, "reportstore"), + "the backfill recorded a reference for a module that executes no declared work") + + // No replacement anywhere. require.Equal(t, 0, store.revocations, "a backfill revoked something") } +// A delegation the HOLDER's own current declaration no longer supports is not +// "nothing was missing" (issue #1121, N8). Holder, not executor: a +// self-addressed target is one that COULD serve a trigger, never one proved to +// fire the release (F1). +// +// A delegation carries a digest of its binding's audience and delegation +// scopes, and the very next mint revokes one whose binding has changed +// (`binding_changed`). The backfill used to skip any target holding an active +// row, so an operator pressing the button over a source whose self-addressed +// holder's binding had moved was told nothing was missing — over a trigger that +// could never mint. It is revoked here, under the same reason the mint would use, and +// a fresh one is recorded in the same transaction. +func TestDelegateSourceTriggersReplacesTheSelfAddressedHoldersStaleDelegation(t *testing.T) { + store := newDelegateTriggerStore(t) + svc, _ := newDatasourceService(store, &recordingProducer{}, &fakeGitHub{defaultBranch: "main", commit: "abc"}) + source := githubSource(t, svc, "main", nil, "") + registry, err := moduleregistrytest.Parse(delegateTriggerPrincipals) + require.NoError(t, err) + svc.SetModuleCapabilities(nil, nil, registry) + + // The holder's delegation as recorded against an EARLIER shape of its + // binding: same binding id, a digest that no longer matches. + stale := store.insert(source.ID, "connecting-member", "runtime", registry) + stale.BindingDigest = "0" + stale.BindingDigest[1:] + + _, err = svc.DelegateSourceTriggers(context.Background(), "an-administrator", testOrg, source.ID) + require.NoError(t, err) + + gone := store.get(stale.ID) + require.NotNil(t, gone) + require.False(t, gone.Active(), "a delegation the next mint would revoke was left in place") + require.Equal(t, business.SourceDelegationBindingChanged, gone.RevokedReason, + "it is revoked for the reason the mint itself would record") + + fresh := store.activeFor(source.ID, "runtime") + require.NotNil(t, fresh, "nothing replaced the unusable delegation") + require.NotEqual(t, stale.ID, fresh.ID) + require.Equal(t, "an-administrator", fresh.PrincipalID) + + // And a delegation that IS current is still left exactly as it is: the + // revocation above is not the connect path creeping back. + store.revocations = 0 + _, err = svc.DelegateSourceTriggers(context.Background(), "another-administrator", testOrg, source.ID) + require.NoError(t, err) + require.Equal(t, 0, store.revocations, "a current delegation was replaced") + require.Equal(t, fresh.ID, store.activeFor(source.ID, "runtime").ID) +} + // A personal source is its owner's. An administrator is refused rather than // recording a reference whose authority is theirs. // @@ -106,7 +181,10 @@ func TestDelegateSourceTriggersRefusesAnotherMembersPersonalSource(t *testing.T) // reference borrows is exactly theirs. _, err = svc.DelegateSourceTriggers(context.Background(), "the-owner", testOrg, source.ID) require.NoError(t, err) - require.Len(t, store.delegations, 2, "the owner's own reference operation recorded nothing") + // One row: the executing module's. The two consuming modules get nothing + // from a backfill (issue #1121, N8). + require.Len(t, store.delegations, 1, "the owner's own reference operation recorded nothing") + require.NotNil(t, store.activeFor(source.ID, "runtime")) } // delegateTriggerStore is the datasource fake plus the delegation rows and the diff --git a/module/services/accounts/code/pkg/business/datasource_trigger_test.go b/module/services/accounts/code/pkg/business/datasource_trigger_test.go index 58722c0e7..20736f7b9 100644 --- a/module/services/accounts/code/pkg/business/datasource_trigger_test.go +++ b/module/services/accounts/code/pkg/business/datasource_trigger_test.go @@ -140,17 +140,17 @@ func TestTriggerScheduleSpellsOnlyTheIntervalsCronCanName(t *testing.T) { 15 * time.Minute: "*/15 * * * *", time.Minute: "*/1 * * * *", } { - declared := business.DeclareSourceTrigger(source(interval), nil, nil) + declared := business.DeclareSourceTrigger(source(interval), nil, nil, true) require.True(t, declared.Declarable(), "%s: %s", interval, declared.UndeclarableReason) require.Equal(t, want, declared.Schedule.Cron, "interval %s", interval) } // A day, and a divisor of a day, are expressible; the minute (and hour) are // derived from the source so every source of one provider does not come due // in the same second. - daily := business.DeclareSourceTrigger(source(24*time.Hour), nil, nil) + daily := business.DeclareSourceTrigger(source(24*time.Hour), nil, nil, true) require.True(t, daily.Declarable()) require.Regexp(t, `^\d+ \d+ \* \* \*$`, daily.Schedule.Cron) - twelveHourly := business.DeclareSourceTrigger(source(12*time.Hour), nil, nil) + twelveHourly := business.DeclareSourceTrigger(source(12*time.Hour), nil, nil, true) require.True(t, twelveHourly.Declarable()) require.Regexp(t, `^\d+ \*/12 \* \* \*$`, twelveHourly.Schedule.Cron) @@ -161,11 +161,11 @@ func TestTriggerScheduleSpellsOnlyTheIntervalsCronCanName(t *testing.T) { 5 * time.Hour, // does not divide a day 48 * time.Hour, // beyond a day, which cron names by date, not by period } { - declared := business.DeclareSourceTrigger(source(interval), nil, nil) + declared := business.DeclareSourceTrigger(source(interval), nil, nil, true) require.False(t, declared.Declarable(), "interval %s was spelled %q", interval, declared.Schedule.Cron) require.Equal(t, business.TriggerUndeclarableInterval, declared.UndeclarableReason, "interval %s", interval) } - disabled := business.DeclareSourceTrigger(&business.DatasourceSource{ID: "s", OrgID: "org", Status: "active"}, nil, nil) + disabled := business.DeclareSourceTrigger(&business.DatasourceSource{ID: "s", OrgID: "org", Status: "active"}, nil, nil, true) require.Equal(t, business.TriggerUndeclarableNoSchedule, disabled.UndeclarableReason) } @@ -179,20 +179,23 @@ func TestTriggerDeclarationPrefersTheReferenceArmAndFingerprintsItself(t *testin ID: "2a3f5c1e-0000-4000-8000-000000000002", OrgID: "org", Status: "active", ReconcileInterval: 30 * time.Minute, NextReconcileAt: &next, } - live := []business.TriggerDelegationReference{{Reference: source.ID, DelegationID: "d1", Active: true}} - revoked := []business.TriggerDelegationReference{{Reference: source.ID, DelegationID: "d1", Active: false}} + // The executing module's own delegation: its binding names itself as the + // audience, which is the only shape a source-id reference can serve (see + // executorReference below). + live := []business.TriggerDelegationReference{executorReference(source.ID, true)} + revoked := []business.TriggerDelegationReference{executorReference(source.ID, false)} - referenced := business.DeclareSourceTrigger(source, live, nil) + referenced := business.DeclareSourceTrigger(source, live, nil, true) require.Equal(t, source.ID, referenced.Identity.Source) require.True(t, referenced.Identity.Reference()) // A revoked reference is not one: the declaration names no identity, which // an installing module refuses rather than running the work as itself. - withoutIdentity := business.DeclareSourceTrigger(source, revoked, nil) + withoutIdentity := business.DeclareSourceTrigger(source, revoked, nil, true) require.False(t, withoutIdentity.Identity.Declared()) source.ReconcileInterval = 15 * time.Minute - edited := business.DeclareSourceTrigger(source, live, nil) + edited := business.DeclareSourceTrigger(source, live, nil, true) require.NotEqual(t, referenced.Digest, edited.Digest, "an interval edit re-declares the trigger") // The next occurrence is computed from the declared cron, and nothing else: @@ -202,6 +205,82 @@ func TestTriggerDeclarationPrefersTheReferenceArmAndFingerprintsItself(t *testin require.Zero(t, edited.NextOccurrenceAt.Minute()%15) } +// executorReference is a delegation a declared executor COULD use: the module +// holds it itself, its binding still confers something, and that binding names +// its own module as the audience. +func executorReference(sourceID string, active bool) business.TriggerDelegationReference { + return selfAddressedReference(sourceID, "runtime", active) +} + +// selfAddressedReference is the same shape under a named holder, for the cases +// that turn on WHICH module holds it. +func selfAddressedReference(sourceID, module string, active bool) business.TriggerDelegationReference { + return business.TriggerDelegationReference{ + Reference: sourceID, DelegationID: "d-" + module, Module: module, Binding: "occurrences", + Audience: module, Scopes: []string{"collections:write"}, Active: active, + } +} + +// ONLY THE EXECUTING MODULE'S DELEGATION IS NAMED (issue #1121, m5). +// +// The reference arm is a source id, and a mint by source id resolves the +// active delegation OF THE CALLING MODULE — so a delegation held by a module +// that does not fire this trigger can never admit one of its occurrences. It +// used to be taken anyway, as long as it was active and had a reference value, +// which is the worst shape a declaration can be in: the page reads "bound" and +// every occurrence is refused at the mint. +// +// Each case below is one of the three facts the resolution needs, removed on +// its own, so no single assertion carries the test. +func TestTriggerDeclarationNamesOnlyADelegationItsExecutorCanUse(t *testing.T) { + next := time.Now().Add(time.Hour) + source := &business.DatasourceSource{ + ID: "2a3f5c1e-0000-4000-8000-000000000003", OrgID: "org", + Status: "active", ReconcileInterval: 30 * time.Minute, NextReconcileAt: &next, + } + + usable := executorReference(source.ID, true) + require.Equal(t, source.ID, business.DeclareSourceTrigger(source, []business.TriggerDelegationReference{usable}, nil, true).Identity.Source) + + // A delegation held by one module and addressed to another. It is a real, + // live delegation — the shape every consuming module's sync uses — and it + // is reachable only through the delegation-id exchange, which no reference + // this host declares can name. + addressedElsewhere := usable + addressedElsewhere.Audience = "somebody-else" + + // A delegation whose binding the module no longer declares: the read + // resolves no scopes for it, and the next mint revokes it as + // binding_changed. "Active" is not the same as "usable". + bindingGone := usable + bindingGone.Scopes = nil + + // And a delegation whose authority could not be resolved at all, which the + // read reports as an empty audience rather than by omitting the row. + unresolved := usable + unresolved.Audience = "" + + for name, references := range map[string][]business.TriggerDelegationReference{ + "another module's delegation": {addressedElsewhere}, + "a binding no longer declared": {bindingGone}, + "an authority that did not resolve": {unresolved}, + // Several unusable ones do not add up to a usable one. + "all of them together": {addressedElsewhere, bindingGone, unresolved}, + } { + t.Run(name, func(t *testing.T) { + declared := business.DeclareSourceTrigger(source, references, nil, true) + require.True(t, declared.Declarable(), "the schedule is still declared; only the identity is missing") + require.False(t, declared.Identity.Declared(), + "a declaration naming an identity its executor cannot mint reads as bound and refuses every occurrence") + }) + } + + // The usable one is found whatever order the read returns, and the + // unusable ones never shadow it. + mixed := business.DeclareSourceTrigger(source, []business.TriggerDelegationReference{addressedElsewhere, usable}, nil, true) + require.Equal(t, source.ID, mixed.Identity.Source) +} + // THE STOPGAP SWEEP IS CONFINED TO THE FILES THAT DELETE IT (issue #1112). // // The host fires this schedule again, as a labelled stopgap, because nothing @@ -386,18 +465,154 @@ func TestStopgapSweepLeavesTheDeclarationUnchanged(t *testing.T) { source := githubSource(t, svc, "main", nil, "") setNextReconcile(t, store, source.ID, time.Now().Add(-time.Minute)) - before := business.DeclareSourceTrigger(storedSource(t, store, source.ID), nil, nil) + before := business.DeclareSourceTrigger(storedSource(t, store, source.ID), nil, nil, true) require.True(t, before.Declarable()) _, err := svc.RunDatasourceReconcile(t.Context()) require.NoError(t, err) - after := business.DeclareSourceTrigger(storedSource(t, store, source.ID), nil, nil) + after := business.DeclareSourceTrigger(storedSource(t, store, source.ID), nil, nil, true) require.True(t, after.Declarable(), "the sweep took the source off its declared schedule") require.Equal(t, before.Schedule.Cron, after.Schedule.Cron) require.Equal(t, before.Digest, after.Digest, "the sweep moved the declaration an installation pinned") } +// A SELF-ADDRESSED DELEGATION DOES NOT IDENTIFY THE EXECUTOR (issue #1121, F1). +// +// The predicate above establishes the SHAPE a source-id reference can serve. It +// cannot establish who will execute the release, because nothing this host +// holds declares that: a self-addressed binding is generic and a deployment may +// have several. So the counterexample the review built is real — module A holds +// a self-addressed delegation on source S, the composed executor is B, which +// holds none, and B's mint resolves ActiveSourceDelegation(S, B) and is refused. +// +// What this host must therefore NOT do is tell an operator that S is ready. It +// names the candidate, reports WHOSE delegation it is, and claims nothing about +// the executor. These cases vary the holder independently of any executor, which +// is the axis the first version of this test did not vary at all. +func TestTriggerDeclarationNamesTheHolderAndClaimsNoExecutor(t *testing.T) { + next := time.Now().Add(time.Hour) + source := &business.DatasourceSource{ + ID: "2a3f5c1e-0000-4000-8000-000000000005", OrgID: "org", + Status: "active", ReconcileInterval: 30 * time.Minute, NextReconcileAt: &next, + } + // Two modules, each self-addressed, which the registry accepts generically: + // A holds a delegation on this source, B does not. + holderA := selfAddressedReference(source.ID, "module-a", true) + + // A ONLY: the declaration names the candidate and says it is A's. It must + // not be read as "the executor holds one" — if the composed executor is B, + // every occurrence is refused at the mint, and this host cannot tell. + onlyA := business.DeclareSourceTrigger(source, []business.TriggerDelegationReference{holderA}, nil, true) + require.Equal(t, source.ID, onlyA.Identity.Source, "the candidate is still declared; it is the only shape a reference can take") + require.Equal(t, "module-a", onlyA.IdentityHolder, "a reader must be told whose delegation the reference resolves to") + + // B's own current delegation yields the positive claim under B's name — + // the same declared reference value, a different holder, which is exactly + // the fact the arm cannot carry and the read must. + holderB := selfAddressedReference(source.ID, "module-b", true) + onlyB := business.DeclareSourceTrigger(source, []business.TriggerDelegationReference{holderB}, nil, true) + require.Equal(t, source.ID, onlyB.Identity.Source) + require.Equal(t, "module-b", onlyB.IdentityHolder) + require.Equal(t, onlyA.Identity.Source, onlyB.Identity.Source, + "the reference value is the source id, so A's and B's are indistinguishable in the arm — which is why the holder is reported beside it") + + // Revoking B's delegation removes the claim entirely rather than falling + // back to A: a declaration is built from the references as they are. + revokedB := selfAddressedReference(source.ID, "module-b", false) + goneB := business.DeclareSourceTrigger(source, []business.TriggerDelegationReference{revokedB}, nil, true) + require.False(t, goneB.Identity.Declared(), "a revoked delegation is not a candidate") + require.Empty(t, goneB.IdentityHolder, "no identity means no holder to name") + + // And a binding B's module no longer declares: the read resolves no scopes, + // so the next mint would revoke it as binding_changed. + staleB := selfAddressedReference(source.ID, "module-b", true) + staleB.Scopes = nil + changedB := business.DeclareSourceTrigger(source, []business.TriggerDelegationReference{staleB}, nil, true) + require.False(t, changedB.Identity.Declared()) + require.Empty(t, changedB.IdentityHolder) + + // With both present the holder named is one of the two that actually hold + // one — never a module that holds none. + both := business.DeclareSourceTrigger(source, []business.TriggerDelegationReference{holderA, holderB}, nil, true) + require.Contains(t, []string{"module-a", "module-b"}, both.IdentityHolder) +} + +// THE STOPGAP SWEEP HAS A SWITCH, AND IT IS ONE FACT (issue #1121, N7). +// +// The declaration's consumer and the sweep must never both run: they enqueue +// under different idempotency keys, so nothing collapses them, and the +// per-source FIFO key only makes the second serialise behind the first — a +// second full re-send for a pull provider. Before this there was nothing to +// turn off but a redeployed, patched host. +// +// The switch is read in two places and they must agree: the tick is not +// installed AND the sweep itself refuses. A host that only dropped the tick +// would still sweep from any other caller, and would still describe a sweep +// that is not running. +func TestTheStopgapSweepCanBeSwitchedOff(t *testing.T) { + producer := &recordingProducer{} + store := newDatasourceFakeStore() + svc, _ := newDatasourceService(store, producer, &fakeGitHub{defaultBranch: "main", commit: "abc"}) + + source := githubSource(t, svc, "main", nil, "") + due := time.Now().Add(-time.Minute) + setNextReconcile(t, store, source.ID, due) + + // Default ON: that is what every deployment does today, and a default that + // silently stopped every scheduled reconcile is the outage #1090 caused. + require.True(t, svc.DatasourceReconcileSweepEnabled()) + + svc.SetDatasourceReconcileSweep(false) + require.False(t, svc.DatasourceReconcileSweepEnabled()) + enqueued, err := svc.RunDatasourceReconcile(t.Context()) + require.NoError(t, err, "a disabled sweep is not an error; it is a sweep that does not happen") + require.Zero(t, enqueued) + require.Empty(t, jobKeys(producer, source.ID), "a disabled sweep enqueued work") + + // And it did not move the source's schedule either: a host that is not + // firing must not consume the instant something else fires on. + require.Equal(t, due.UTC().Truncate(time.Second), + storedSource(t, store, source.ID).NextReconcileAt.UTC().Truncate(time.Second), + "a disabled sweep bumped the schedule") + + // The declaration says which of the two is acting, and the instant each + // acts on. They share a period and NOT a phase: the cron comes due on the + // half hour while the sweep fires on the stored instant. + off := business.DeclareSourceTrigger(storedSource(t, store, source.ID), nil, nil, false) + require.False(t, off.HostSweepEnabled) + require.Nil(t, off.HostSweepDueAt, "a host that takes no pass must not name an instant for one") + require.NotNil(t, off.NextOccurrenceAt, "the declaration is unchanged by the switch") + + on := business.DeclareSourceTrigger(storedSource(t, store, source.ID), nil, nil, true) + require.True(t, on.HostSweepEnabled) + require.NotNil(t, on.HostSweepDueAt) + require.Equal(t, due.UTC().Truncate(time.Second), on.HostSweepDueAt.UTC().Truncate(time.Second), + "the sweep's instant is the stored one, not the cron's") + require.NotEqual(t, on.HostSweepDueAt.Truncate(time.Minute), on.NextOccurrenceAt.Truncate(time.Minute), + "fixture: the two instants must differ, which is the whole point of reporting both") + + // Switched back on, the same due row is swept. + svc.SetDatasourceReconcileSweep(true) + enqueued, err = svc.RunDatasourceReconcile(t.Context()) + require.NoError(t, err) + require.Equal(t, 1, enqueued) +} + +// A parked source names no sweep instant either: the stored instant is cleared, +// which is what the park and restore paths use as the switch, and there is then +// no pass for this host to take. +func TestAParkedSourceNamesNoSweepInstant(t *testing.T) { + parked := &business.DatasourceSource{ + ID: "2a3f5c1e-0000-4000-8000-000000000004", OrgID: "org", + Status: "active", ReconcileInterval: 30 * time.Minute, + } + declared := business.DeclareSourceTrigger(parked, nil, nil, true) + require.False(t, declared.Declarable()) + require.True(t, declared.HostSweepEnabled, "the switch is a deployment fact, not a per-source one") + require.Nil(t, declared.HostSweepDueAt) +} + // One occurrence's enqueue key names the ORGANIZATION and the SOURCE as well as // the effect (issue #1112, m2 — and N4 on PR #1115, which found the fix // untested). diff --git a/module/services/accounts/code/pkg/business/introspection.go b/module/services/accounts/code/pkg/business/introspection.go index 1496655b1..a655e4e9a 100644 --- a/module/services/accounts/code/pkg/business/introspection.go +++ b/module/services/accounts/code/pkg/business/introspection.go @@ -277,6 +277,7 @@ var rpcDescriptions = withWorkContextConsumerDescriptions(map[string]string{ "PlatformAdminService/ListPlatformCatalogue": "List every composed module and solution with its declared, running and installed state.", "PlatformAdminService/GetModuleEnvelope": "Read the current module envelope, the authority ceiling every module principal is derived inside.", "PlatformAdminService/PutModuleEnvelope": "Write the next revision of the module envelope; it takes effect at the next check.", + "PlatformAdminService/ResolveModuleTenantIdentity": "Read what a per-tenant module operation context would assert for one module, binding and organization, or why it would be refused.", "PlatformAdminService/StopImpersonation": "End the caller's own impersonation session.", "PlatformAdminService/SuspendUser": "Suspend a user account.", "PlatformAdminService/UnsuspendUser": "Restore a suspended user.", diff --git a/module/services/accounts/code/pkg/business/module_operation_context.go b/module/services/accounts/code/pkg/business/module_operation_context.go index 550ead5da..3fb924b68 100644 --- a/module/services/accounts/code/pkg/business/module_operation_context.go +++ b/module/services/accounts/code/pkg/business/module_operation_context.go @@ -55,6 +55,24 @@ func (a ModuleOperationContextAuthority) WireScopes() []*gen.WorkContextScope { // binding's headless_scopes and nothing else: invoke_scopes describe what the // module may do on a person's behalf and are never reused for work that has no // person, so a binding that declares no headless_scopes is refused (fail closed). +// +// IT IS ALSO THE PER-TENANT MODULE IDENTITY, and that is worth naming rather +// than leaving as an incidental parameter (issue #1121). requestedOrganization +// is the organization the capability acts FOR: its tenant is that +// organization, so a module can present itself as acting for a tenant instead +// of as itself, which is what a consumer admitting a publication for a tenant +// needs from a publisher that has no person present. +// +// Which organizations may be named is the envelope's to decide and never the +// caller's (moduleMintOrganization): a principal PINNED to a tenant may name +// that tenant and no other, and an unpinned principal declaring cross_tenant +// may name one organization per mint. Both are then held to that organization's +// own live installation, and the binding is re-read AFTER the installation +// scope narrows it (authorizeModuleCapabilityFromSnapshot) — so the scopes a +// per-tenant capability carries are that tenant's consent and not the +// deployment's, and an organization consenting to nothing leaves the binding +// with no headless scopes and is refused. The bound is per tenant, which is +// the whole point: one identity per deployment could not be. func (s *Service) ModuleAuthorizeOperationContext( ctx context.Context, prefix, serviceAccountToken, bindingID string, requestedOrganization ...string, ) (ModuleOperationContextAuthority, error) { diff --git a/module/services/accounts/code/pkg/business/module_tenant_identity.go b/module/services/accounts/code/pkg/business/module_tenant_identity.go new file mode 100644 index 000000000..a20ecb6e2 --- /dev/null +++ b/module/services/accounts/code/pkg/business/module_tenant_identity.go @@ -0,0 +1,186 @@ +package business + +import ( + "context" + "errors" + "slices" + "time" +) + +// What a per-tenant module identity would assert, read for an operator. +// +// A composed module acting with no person present mints a Work Context for one +// of its installed operation bindings and names the organization it acts FOR +// (ModuleAuthorizeOperationContext). That capability is the per-tenant module +// identity: its tenant is the organization named, its scopes are that +// organization's installation narrowed to the binding's headless_scopes, it +// lives ModuleOperationContextTTL, and every issuance is recorded. +// +// This answers what that mint WOULD assert, and issues nothing. The mint needs +// the module pod's projected ServiceAccount token held against the build its +// authority document approves, which an operator's browser does not have and +// must never be given a way around: a path that handed an operator a module's +// capability would be a second spelling of that module's identity. So the +// resolution deliberately stops one step short of the signature, and takes the +// same decision from the same declared facts the mint takes it from — not a +// second copy of the rule, because every refusal below is the mint's own +// function answering. + +// ModuleTenantIdentity is what one per-tenant mint would assert. +type ModuleTenantIdentity struct { + PrincipalID string + Tenant string + Audience string + // Scopes is what the capability would carry, as `kind:action[:resource]`. + Scopes []string + Lifetime time.Duration + Revision uint64 + // Shared says the principal is unpinned and declares cross_tenant, so it + // may act for more than one organization. A pinned principal can only ever + // name the tenant its envelope declares. + Shared bool +} + +// ModuleTenantIdentityMint is one capability actually issued, from the trail +// that records every mint. There is no other record of one. +type ModuleTenantIdentityMint struct { + Record string + Tenant string + Binding string + Audience string + Scopes []string + MintedAt time.Time +} + +// ModuleTenantIdentityResolution is the answer: either what would be minted, or +// why nothing would be. +type ModuleTenantIdentityResolution struct { + Identity *ModuleTenantIdentity + Refusal string + Recent []ModuleTenantIdentityMint +} + +// The refusals, in the operator's words rather than as an error code. Each one +// is a decision about declared authority — never an outage to retry. +const ( + // ModuleTenantIdentityUndeclared: no such module principal is derived from + // the current envelope, so nothing can be minted under that prefix at all. + ModuleTenantIdentityUndeclared = "no module principal is declared under this prefix" + // ModuleTenantIdentityTenantRefused: the envelope pins this principal to + // another tenant, or leaves it unpinned without cross_tenant — either way + // it may not act for the organization named. + ModuleTenantIdentityTenantRefused = "this module may not act for that organization: its envelope pins it elsewhere, or does not declare cross_tenant" + // ModuleTenantIdentityNotInstalled: the organization has no live + // installation consenting to this module. + ModuleTenantIdentityNotInstalled = "the organization has no live installation of this module" + // ModuleTenantIdentityBindingRefused: the binding is not declared, or + // declares no headless_scopes, or this organization's installation scope + // leaves it with none — the last being the per-tenant bound doing its job. + ModuleTenantIdentityBindingRefused = "this binding is not mintable for that organization with no person present: it declares no headless scopes, or the organization's installation consents to none of them" +) + +// ResolveModuleTenantIdentity answers what a per-tenant module operation +// context would assert for one module, one of its bindings and one +// organization — or why it would be refused — and the capabilities that module +// was actually issued for that organization. +// +// The decision order is the mint's, and each step answers a different question +// an operator asks: is the principal declared at all, may it act for this +// organization, does this organization install it, and does the binding confer +// anything headless HERE. Collapsing them into one refusal would answer none +// of them. +func (s *Service) ResolveModuleTenantIdentity( + ctx context.Context, prefix, bindingID, orgID string, +) (ModuleTenantIdentityResolution, error) { + if prefix == "" || bindingID == "" || orgID == "" { + return ModuleTenantIdentityResolution{}, errors.New("module prefix, binding and organization are required") + } + ctx, releaseAuthority, fenceErr := s.BeginModuleAuthorityUse(ctx) + if fenceErr != nil { + return ModuleTenantIdentityResolution{}, fenceErr + } + defer releaseAuthority() + + // The trail is read whatever the answer: an operator looking at a module + // that may no longer act for an organization still needs to see what it was + // issued while it could. + recent, err := s.moduleTenantIdentityMints(ctx, prefix, orgID) + if err != nil { + return ModuleTenantIdentityResolution{}, err + } + resolution := ModuleTenantIdentityResolution{Recent: recent} + + snapshot := s.moduleRegistrySnapshot() + principalID := ModulePrincipalID(prefix) + declared, isModule := snapshot.registry[principalID] + if !isModule || declared.Prefix == "" { + resolution.Refusal = ModuleTenantIdentityUndeclared + return resolution, nil + } + // The envelope's own rule about which organizations this principal may + // name, asked of the function the mint asks (never a second reading of + // `tenant` and `cross_tenant` here). + if _, err := moduleMintOrganization(declared, []string{orgID}); err != nil { + resolution.Refusal = ModuleTenantIdentityTenantRefused + return resolution, nil + } + installed, _, err := s.authorizeModuleCapabilityFromSnapshot(ctx, snapshot, + ModuleCaller{PrincipalID: principalID, BoundOrg: orgID}) + if err != nil { + // A module the organization does not install is a declared refusal, not + // a failure of this read; anything else (an unreadable envelope + // revision, a fence) is the caller's to see as it is. + if errors.Is(err, ErrModuleInstallationInactive) || errors.Is(err, ErrModuleTenantNotCurrent) { + resolution.Refusal = ModuleTenantIdentityNotInstalled + return resolution, nil + } + return ModuleTenantIdentityResolution{}, err + } + // AFTER the installation scope narrowed it. A binding with headless scopes + // the deployment declares but this organization did not consent to has none + // here, and that is the per-tenant bound rather than an edge case. + grant := installed.Grant + binding, bound := grant.OperationAudiences[bindingID] + if !bound || len(binding.HeadlessScopes) == 0 || + validateOperationAudiences(grant.Prefix, map[string]ModuleOperationAudience{bindingID: binding}) != nil { + resolution.Refusal = ModuleTenantIdentityBindingRefused + return resolution, nil + } + resolution.Identity = &ModuleTenantIdentity{ + PrincipalID: principalID, + Tenant: orgID, + Audience: binding.Audience, + Scopes: operationScopeGrants(binding.HeadlessScopes), + Lifetime: ModuleOperationContextTTL, + Revision: ModuleOperationContextRevision(grant), + Shared: declared.Tenant == "" && declared.CrossTenant, + } + return resolution, nil +} + +// moduleTenantIdentityMints reads the capabilities one module was issued for +// one organization, newest first, from the trail that records every mint. +func (s *Service) moduleTenantIdentityMints( + ctx context.Context, prefix, orgID string, +) ([]ModuleTenantIdentityMint, error) { + entries, _, _, err := s.QueryAuditLog(ctx, AuditQuery{ + OrgID: orgID, + EventType: string(EventModuleOperationContextMint), + Resource: "module", + ResourceID: prefix, + PageSize: 25, + }) + if err != nil { + return nil, err + } + mints := make([]ModuleTenantIdentityMint, 0, len(entries)) + for _, entry := range entries { + mint := ModuleTenantIdentityMint{Record: entry.ID, MintedAt: entry.CreatedAt} + mint.Tenant, _ = entry.Payload["tenant"].(string) + mint.Binding, _ = entry.Payload["binding_id"].(string) + mint.Audience, _ = entry.Payload["audience"].(string) + mint.Scopes = slices.Clip(auditStringList(entry.Payload["scopes"])) + mints = append(mints, mint) + } + return mints, nil +} diff --git a/module/services/accounts/code/pkg/business/module_tenant_identity_test.go b/module/services/accounts/code/pkg/business/module_tenant_identity_test.go new file mode 100644 index 000000000..70870c9d4 --- /dev/null +++ b/module/services/accounts/code/pkg/business/module_tenant_identity_test.go @@ -0,0 +1,162 @@ +//go:build pure + +package business + +import ( + "context" + "testing" + + "github.com/google/uuid" + "github.com/stretchr/testify/require" +) + +// A MODULE IDENTITY MINTED FOR ONE TENANT, read for an operator (issue #1121). +// +// The capability itself is the headless operation mint naming an organization, +// and that it mints per tenant — with that tenant's own installation narrowing +// what it carries — is proved against the mint in +// TestSharedInstallationMintSelectsOnlyConsentingOrganization. What is tested +// here is the READ an operator drives the playground from: it must answer from +// the same declared facts the mint decides on, and it must issue nothing. +// +// The refusals are four separate answers because they are four different things +// an operator does about them: declare the principal, widen the envelope's +// tenancy, install the module in that organization, or consent to the binding's +// headless scopes there. One collapsed refusal would answer none of them. + +// perTenantIdentityFixture is the shared-principal deployment: one module +// unpinned and cross-tenant, installed in two organizations, whose binding +// declares headless scopes — and whose second organization consented to fewer +// of them. A third organization has no installation at all. +func perTenantIdentityFixture(t *testing.T) (*Service, string, string, string) { + t.Helper() + s, live, caller := dynamicInstallationFixture() + grant := s.ModulePrincipals()[caller.PrincipalID] + binding := grant.OperationAudiences["operate"] + binding.HeadlessScopes = cloneOperationScopes(binding.InvokeScopes) + grant.OperationAudiences["operate"] = binding + live.rows["org-a/principal"].Scope = FullInstallationScope(grant) + // The second organization's installation consents to a narrower binding, + // which is what makes the bound per tenant rather than per deployment. + narrowed := live.rows["org-b/principal"].Scope.OperationAudiences["operate"] + narrowed.HeadlessScopes = cloneOperationScopes(narrowed.InvokeScopes) + live.rows["org-b/principal"].Scope.OperationAudiences["operate"] = narrowed + + id := ModulePrincipalID(grant.Prefix) + first, second, third := uuid.NewString(), uuid.NewString(), uuid.NewString() + live.rows[first+"/"+id] = live.rows["org-a/principal"] + live.rows[second+"/"+id] = live.rows["org-b/principal"] + // Unpinned and cross-tenant: the shape a module that acts for many tenants + // is declared in, and the only one that may name an organization per mint. + grant.Tenant = "" + s.SetModulePrincipals(ModulePrincipalRegistry{id: grant}) + // The resolution also reads the trail of capabilities actually issued, in + // the organization's own transaction. The store is swapped rather than the + // read made optional: a read that swallowed its own failure would report + // "no capability was ever issued" over a database that could not answer. + s.store = perTenantIdentityStore{Store: s.store} + return s, first, second, third +} + +// perTenantIdentityStore answers the organization-scoped audit read with an +// empty trail. Empty rather than seeded: what the trail CONTAINS is the audit +// log's own contract, tested next door; what matters here is that the +// resolution asks for it inside the organization's transaction and does not +// invent a tenant for the question. +type perTenantIdentityStore struct{ Store } + +func (perTenantIdentityStore) WithOrgTx(ctx context.Context, _ string, fn func(context.Context) error) error { + return fn(ctx) +} + +func (perTenantIdentityStore) QueryAuditLog(context.Context, AuditQuery) ([]AuditEntry, string, int32, error) { + return nil, "", 0, nil +} + +func TestResolveModuleTenantIdentityAnswersWhatOneTenantsMintWouldAssert(t *testing.T) { + s, first, second, third := perTenantIdentityFixture(t) + ctx := context.Background() + + full, err := s.ResolveModuleTenantIdentity(ctx, "example", "operate", first) + require.NoError(t, err) + require.Empty(t, full.Refusal) + require.NotNil(t, full.Identity) + require.Equal(t, ModulePrincipalID("example"), full.Identity.PrincipalID) + require.Equal(t, first, full.Identity.Tenant, "the capability acts FOR the organization named") + require.Equal(t, "example.api", full.Identity.Audience) + require.Equal(t, ModuleOperationContextTTL, full.Identity.Lifetime) + require.NotZero(t, full.Identity.Revision) + require.True(t, full.Identity.Shared, "an unpinned cross-tenant principal may act for more than one organization") + require.Equal(t, []string{ + "records:read:one", "records:read:two", "records:write:one", "records:write:two", + }, full.Identity.Scopes) + + // THE SAME MODULE, THE SAME BINDING, A DIFFERENT TENANT: fewer scopes, + // because that organization's installation consented to fewer. This is the + // property a single deployment-wide identity cannot have. + narrowed, err := s.ResolveModuleTenantIdentity(ctx, "example", "operate", second) + require.NoError(t, err) + require.NotNil(t, narrowed.Identity) + require.Equal(t, second, narrowed.Identity.Tenant) + require.Equal(t, []string{"records:read:one"}, narrowed.Identity.Scopes) + require.NotEqual(t, full.Identity.Scopes, narrowed.Identity.Scopes, + "the two tenants' capabilities carried the same authority, so nothing is bounded per tenant") + + // An organization with no live installation: the module may act for a + // tenant only where that tenant installed it. + absent, err := s.ResolveModuleTenantIdentity(ctx, "example", "operate", third) + require.NoError(t, err) + require.Nil(t, absent.Identity) + require.Equal(t, ModuleTenantIdentityNotInstalled, absent.Refusal) + + // A binding that is not declared, and one that declares no headless + // scopes: neither is mintable with no person present. + undeclared, err := s.ResolveModuleTenantIdentity(ctx, "example", "absent", first) + require.NoError(t, err) + require.Equal(t, ModuleTenantIdentityBindingRefused, undeclared.Refusal) + + // A prefix no module principal is declared under. + unknown, err := s.ResolveModuleTenantIdentity(ctx, "nobody", "operate", first) + require.NoError(t, err) + require.Equal(t, ModuleTenantIdentityUndeclared, unknown.Refusal) + + // And the arguments it cannot answer without. + _, err = s.ResolveModuleTenantIdentity(ctx, "", "operate", first) + require.Error(t, err) + _, err = s.ResolveModuleTenantIdentity(ctx, "example", "operate", "") + require.Error(t, err) +} + +// A PINNED PRINCIPAL MAY ACT FOR ITS OWN TENANT AND NO OTHER. +// +// The pin is the bound, so the refusal for another organization is the +// envelope's decision and not a missing feature: a module that should act for +// many tenants is declared unpinned and cross-tenant, which is the fixture +// above. Reported as its own refusal because what an operator does about it — +// change the envelope — is not what they do about a missing installation. +func TestResolveModuleTenantIdentityRefusesATenantThePinForbids(t *testing.T) { + s, first, second, _ := perTenantIdentityFixture(t) + grant := s.ModulePrincipals()[ModulePrincipalID("example")] + grant.Tenant = first + s.SetModulePrincipals(ModulePrincipalRegistry{ModulePrincipalID("example"): grant}) + ctx := context.Background() + + own, err := s.ResolveModuleTenantIdentity(ctx, "example", "operate", first) + require.NoError(t, err) + require.NotNil(t, own.Identity) + require.False(t, own.Identity.Shared, "a pinned principal acts for one organization, and the read says so") + + other, err := s.ResolveModuleTenantIdentity(ctx, "example", "operate", second) + require.NoError(t, err) + require.Nil(t, other.Identity) + require.Equal(t, ModuleTenantIdentityTenantRefused, other.Refusal) + + // Unpinned but NOT cross-tenant is refused the same way: naming an + // organization is not authority over it, and a shared mint needs the + // declaration that says so. + grant.Tenant, grant.CrossTenant = "", false + s.SetModulePrincipals(ModulePrincipalRegistry{ModulePrincipalID("example"): grant}) + neither, err := s.ResolveModuleTenantIdentity(ctx, "example", "operate", first) + require.NoError(t, err) + require.Equal(t, ModuleTenantIdentityTenantRefused, neither.Refusal) +} diff --git a/module/services/accounts/code/pkg/business/service.go b/module/services/accounts/code/pkg/business/service.go index c5ac4a1c5..58cd0ee92 100644 --- a/module/services/accounts/code/pkg/business/service.go +++ b/module/services/accounts/code/pkg/business/service.go @@ -93,16 +93,18 @@ type Service struct { githubAppClientID string // the App's OAuth client, which identifies the person returning from an install githubAppClientSecret string // its secret; without the pair, an installation cannot be attributed to a caller //nolint:lll // the mount this mirrors is a single deployment switch; splitting the note loses the pairing - datasourceWebhookMounted bool // whether THIS deployment mounted the per-source push receiver; a stored per-source secret verifies nothing without it - datasourceTicketSigner *datasourceTicketSigner // mints/verifies opaque content tickets for oversized change-set blobs - newGitHubClient func(token string) GitHubContentClient - newAPIClient func(cfg APIDatasourceConfig, credential string) APIContentClient - newCrawlerClient func(cfg CrawlerDatasourceConfig) CrawlerContentClient - newUploadClient func(cfg UploadDatasourceConfig, secretAccessKey string) UploadContentClient - newOAuth2Refresh OAuth2RefreshFunc // refreshes an OAuth 2.0 API source's access token - moduleProducer jobs.Producer // request-scoped, transactional outbox producer for the module-facing surface - moduleJobStore jobs.Store // privileged worker store (claim/finalize) for the module-facing surface - eventTransport events.Transport // domain-event pub/sub transport (transactional outbox + relay); nil denies publish/replay + datasourceWebhookMounted bool // whether THIS deployment mounted the per-source push receiver; a stored per-source secret verifies nothing without it + //nolint:lll // one deployment switch; the stopgap it disables is named in datasource_deliveries.go + datasourceReconcileSweepOff bool // STOPGAP switch (#1121): true stops this host firing the reconcile schedule it DECLARES + datasourceTicketSigner *datasourceTicketSigner // mints/verifies opaque content tickets for oversized change-set blobs + newGitHubClient func(token string) GitHubContentClient + newAPIClient func(cfg APIDatasourceConfig, credential string) APIContentClient + newCrawlerClient func(cfg CrawlerDatasourceConfig) CrawlerContentClient + newUploadClient func(cfg UploadDatasourceConfig, secretAccessKey string) UploadContentClient + newOAuth2Refresh OAuth2RefreshFunc // refreshes an OAuth 2.0 API source's access token + moduleProducer jobs.Producer // request-scoped, transactional outbox producer for the module-facing surface + moduleJobStore jobs.Store // privileged worker store (claim/finalize) for the module-facing surface + eventTransport events.Transport // domain-event pub/sub transport (transactional outbox + relay); nil denies publish/replay // Outbound API operation and OAuth provider dependencies. newOAuth2AuthorizationCode func(context.Context, apisource.OAuth2Config, string, string, string, string) (*apisource.OAuth2Token, error) diff --git a/module/services/accounts/code/pkg/business/source_delegation.go b/module/services/accounts/code/pkg/business/source_delegation.go index 6841e4dc2..fed37a228 100644 --- a/module/services/accounts/code/pkg/business/source_delegation.go +++ b/module/services/accounts/code/pkg/business/source_delegation.go @@ -229,6 +229,27 @@ type SourceDelegationTarget struct { Binding ModuleOperationAudience } +// SelfAddressed reports whether this target's binding is one the module holding +// it can admit as its OWN incoming execution context: its audience is its own +// declared prefix. +// +// It is the shape a declared trigger's reference arm can serve (issue #1121, +// N8), and nothing more than that: a trigger's reference is a source id, a mint +// by source id resolves the active delegation of the CALLING module, and the +// capability is addressed to the binding's audience — so a delegation to module +// A addressed to audience B can serve a trigger only through the delegation-id +// exchange, which no reference this host declares can reach. See +// selfAdmittingBinding for why naming your own prefix is admitted at all. +// +// IT DOES NOT IDENTIFY THE EXECUTOR (issue #1121, F1). Nothing this host holds +// declares which module executes declared work, and these bindings are generic, +// so a self-addressed target is a candidate the backfill may record for — never +// a module proved to install and fire the release. The name says "self +// addressed" because that is the fact it tests. +func (t SourceDelegationTarget) SelfAddressed() bool { + return t.Binding.Audience != "" && t.Binding.Audience == t.Prefix +} + // SourceDelegationTargets lists, sorted by module prefix, the binding of every // declared module that accepts source delegations. The declaration is the // opt-in; the module's declared tenancy is deliberately not consulted, because @@ -267,9 +288,21 @@ const ( // theirs. sourceDelegationReplace sourceDelegationRecordMode = iota // sourceDelegationBackfill is a reference recorded for a source that is - // ALREADY connected (DelegateSourceTriggers). It revokes nothing: a target - // already holding an active delegation is left exactly as it is, and only a - // target with none gets one. + // ALREADY connected (DelegateSourceTriggers). It leaves a target's live + // delegation exactly as it is, and only a target with none — or with one + // its module's current declaration no longer supports — gets one. + // + // It is also narrowed to SELF-ADDRESSED targets + // (SourceDelegationTarget.SelfAddressed), because that is the shape the + // reference a declared release's trigger names can serve. It used to record + // one for every module accepting delegations, which hands the calling + // administrator's authority over that source to modules whose delegation no + // trigger of this host could ever name — authority nobody asked to grant + // (issue #1121, N8). It does not follow that a self-addressed target is the + // module which will execute the release; nothing here declares that (F1). + // A connect still delegates to every target: that is a person establishing + // the source, and the consuming module's sync is the delegation's main + // purpose. // // The distinction is issue #1112, M2. The backfill used to run the replace // mode, which took every delegation on the source, marked it `replaced` and @@ -312,12 +345,34 @@ func (s *Service) recordSourceDelegationsTx( recorded := 0 for _, target := range targets { if mode == sourceDelegationBackfill { + if !target.SelfAddressed() { + continue + } existing, err := s.store.ActiveSourceDelegation(ctx, sourceID, target.Prefix) if err != nil { return recorded, fmt.Errorf("read active source delegation: %w", err) } + // A live delegation is the operator's answer that nothing was + // missing — but only while the module's current declaration still + // supports it. One recorded against a binding that has since + // changed its audience or its delegation scopes (or that is gone) + // is refused by the very next mint, which revokes it as + // `binding_changed`: leaving it in place reported "nothing was + // missing" over a source whose trigger could never mint + // (issue #1121, N8). So it is revoked here, for the same reason and + // under the same name, and the fresh one is recorded in the same + // transaction. Nothing live is re-owned — a delegation conferring + // nothing is not authority anybody holds. if existing != nil { - continue + if existing.BindingID == target.BindingID && + existing.BindingDigest == SourceDelegationBindingDigest(target.Binding) { + continue + } + if err := s.revokeSourceDelegationsTx(ctx, actorID, SourceDelegationFilter{ + OrgID: orgID, SourceID: sourceID, ModulePrefix: target.Prefix, + }, SourceDelegationBindingChanged); err != nil { + return recorded, err + } } } else { replaced, err := s.store.RevokeSourceDelegations(ctx, SourceDelegationFilter{ diff --git a/module/services/accounts/code/pkg/business/source_delegation_self_exchange_test.go b/module/services/accounts/code/pkg/business/source_delegation_self_exchange_test.go new file mode 100644 index 000000000..3e50caec4 --- /dev/null +++ b/module/services/accounts/code/pkg/business/source_delegation_self_exchange_test.go @@ -0,0 +1,106 @@ +package business + +import ( + "context" + "testing" + + "github.com/stretchr/testify/require" +) + +// The exchange when the DELEGATOR IS THE CALLER (issue #1121, m1). +// +// This is the shape unattended work runs in, and until now it was reached only +// through fixtures that happen to declare a self-audience — where a successful +// parse says nothing about why the audience link held. The link is the whole +// reason a reference is safe to hold: a delegation is a grant to one binding of +// one module, that binding declares the audience it may call, and only the +// module named as that audience may present the reference. For a module that +// executes a declared release the audience is itself — it mints the capability +// and then admits it as its own incoming execution context — so delegator and +// caller are one principal and the comparison is `prefix == prefix`. +// +// Asserted here directly, on the exchange, with the two neighbouring states +// that must still refuse: an audience naming somebody else, and a caller +// naming a binding of its own that the delegation does not authorize. +func TestADelegatorExchangesItsOwnReferenceWhenItIsTheAudience(t *testing.T) { + exchange := func(t *testing.T, audience string) (SourceOperationContextAuthority, error) { + t.Helper() + read := []ModuleOperationScope{{ResourceKind: "collections", Actions: []string{"read"}}} + write := []ModuleOperationScope{{ResourceKind: "collections", Actions: []string{"write"}}} + both := []ModuleOperationScope{{ResourceKind: "collections", Actions: []string{"read", "write"}}} + // One binding, declaring BOTH grants: the delegation scopes a person's + // connect records against, and the audience the executing module admits + // its own occurrences under. That pairing is what selfAdmittingBinding + // allows, and it is why a composition can run unattended work at all. + occurrences := ModuleOperationAudience{ + Audience: audience, InvokeScopes: both, LookupScopes: read, SourceDelegationScopes: write, + } + runtime := ModulePrincipalGrant{ + Prefix: "runtime", Tenant: testEnvelopeTenant, + OperationAudiences: map[string]ModuleOperationAudience{"occurrences": occurrences}, + } + store := &referenceExchangeStore{delegation: &SourceDelegation{ + ID: "example-delegation", OrgID: testEnvelopeTenant, PrincipalID: "example-person", + SourceID: "example-source", ModulePrefix: "runtime", BindingID: "occurrences", + BindingDigest: SourceDelegationBindingDigest(occurrences), + }} + s := &Service{store: store} + s.SetModuleAuthorityReads(reviewLiveAuthority{service: s}, nil) + s.SetModuleEnvelopeStore(&fakeEnvelopeStore{latest: 1}) + s.InstallDerivedModulePrincipals(ModulePrincipalRegistry{ModulePrincipalID("runtime"): runtime}, 1, nil) + caller := ModuleCaller{PrincipalID: ModulePrincipalID("runtime"), BoundOrg: testEnvelopeTenant} + return s.AuthorizeDelegationReferenceExchange(context.Background(), caller, store.delegation.ID, "occurrences", false) + } + + authority, err := exchange(t, "runtime") + require.NoError(t, err, "the module that executes the release is the audience its own delegation names") + // The capability is the person's, used by the module: exactly what the + // parent-token arm produces, so no consumer can tell which arm admitted it. + require.Equal(t, "example-person", authority.OwnerPrincipalID) + require.Equal(t, ModulePrincipalID("runtime"), authority.PrincipalID) + require.Equal(t, "runtime", authority.ModulePrefix) + require.Equal(t, "runtime", authority.Audience) + require.Equal(t, testEnvelopeTenant, authority.Tenant, "the tenant is the delegation's organization, never the caller's request") + require.Equal(t, "example-delegation", authority.Delegation.ID) + // What the person delegated, and what this one call may do with it: the + // binding's delegation scopes, and the caller's invoke reach narrowed to + // them. Write and not read: a self-exchange is not a wider grant. + require.Equal(t, []ModuleOperationScope{{ResourceKind: "collections", Actions: []string{"write"}}}, authority.Scopes) + require.Equal(t, []ModuleOperationScope{{ResourceKind: "collections", Actions: []string{"write"}}}, authority.ActorScopes) + + // The same registry with the audience naming somebody else: the caller is + // no longer the audience of the delegation it holds, and holding the + // delegation is not what authorizes presenting it. + _, err = exchange(t, "somebody-else") + require.ErrorIs(t, err, ErrSourceDelegationInvalid, + "a module that is not the audience cannot exchange its own delegation") +} + +// A caller that is the audience but names a binding of its own the delegation +// does not authorize is refused: the binding half of the link is checked +// separately from the audience half. +func TestASelfExchangeStillNeedsTheBindingItNames(t *testing.T) { + read := []ModuleOperationScope{{ResourceKind: "collections", Actions: []string{"read"}}} + write := []ModuleOperationScope{{ResourceKind: "collections", Actions: []string{"write"}}} + both := []ModuleOperationScope{{ResourceKind: "collections", Actions: []string{"read", "write"}}} + occurrences := ModuleOperationAudience{ + Audience: "runtime", InvokeScopes: both, LookupScopes: read, SourceDelegationScopes: write, + } + runtime := ModulePrincipalGrant{ + Prefix: "runtime", Tenant: testEnvelopeTenant, + OperationAudiences: map[string]ModuleOperationAudience{"occurrences": occurrences}, + } + store := &referenceExchangeStore{delegation: &SourceDelegation{ + ID: "example-delegation", OrgID: testEnvelopeTenant, PrincipalID: "example-person", + SourceID: "example-source", ModulePrefix: "runtime", BindingID: "occurrences", + BindingDigest: SourceDelegationBindingDigest(occurrences), + }} + s := &Service{store: store} + s.SetModuleAuthorityReads(reviewLiveAuthority{service: s}, nil) + s.SetModuleEnvelopeStore(&fakeEnvelopeStore{latest: 1}) + s.InstallDerivedModulePrincipals(ModulePrincipalRegistry{ModulePrincipalID("runtime"): runtime}, 1, nil) + caller := ModuleCaller{PrincipalID: ModulePrincipalID("runtime"), BoundOrg: testEnvelopeTenant} + + _, err := s.AuthorizeDelegationReferenceExchange(context.Background(), caller, store.delegation.ID, "not-declared", false) + require.ErrorIs(t, err, ErrSourceDelegationInvalid, "a binding the module does not declare authorizes nothing") +} diff --git a/module/services/accounts/code/pkg/business/source_operation_receipts.go b/module/services/accounts/code/pkg/business/source_operation_receipts.go index 90141879c..9215dc736 100644 --- a/module/services/accounts/code/pkg/business/source_operation_receipts.go +++ b/module/services/accounts/code/pkg/business/source_operation_receipts.go @@ -77,6 +77,35 @@ func (s *Service) SourceOperationAttemptForActor(ctx context.Context, actor, org return attempt, err } +// unattendedPassKey carries the delegation a source operation was admitted +// under, when one admitted it. +// +// It exists for the audit trail (issue #1121, m3). A delegated pass +// authenticates as the DELEGATING PERSON — that is the reference arm's whole +// design, and ADR 0008 puts that person and their chain in the trail +// deliberately — so the actor is a `user` and is not a mis-attribution. What +// the row could not say is that nobody was present for it: the two passes stamp +// an identical request identity, and business cannot tell them apart from +// anything else on the context. The adapter can: it has just confirmed the +// delegation. So it says so, here, and the observation records it. +type unattendedPassKey struct{} + +// WithUnattendedPass marks this request as a pass admitted by the delegation +// `delegationID`, with no person present. Called by the authority layer that +// confirmed the delegation, never from a request field. +func WithUnattendedPass(ctx context.Context, delegationID string) context.Context { + if delegationID == "" { + return ctx + } + return context.WithValue(ctx, unattendedPassKey{}, delegationID) +} + +// unattendedPass reports the delegation this pass was admitted under, if any. +func unattendedPass(ctx context.Context) (string, bool) { + id, ok := ctx.Value(unattendedPassKey{}).(string) + return id, ok && id != "" +} + // A request may wait behind another holder of its effect id. Recheck authority // after that wait, immediately before the SDK reads or replays a receipt. type sourceOperationRecheckKey struct{} diff --git a/module/services/accounts/code/pkg/cataloggen/frontend_plugins_test.go b/module/services/accounts/code/pkg/cataloggen/frontend_plugins_test.go index 6c89a77bf..b3bc74afb 100644 --- a/module/services/accounts/code/pkg/cataloggen/frontend_plugins_test.go +++ b/module/services/accounts/code/pkg/cataloggen/frontend_plugins_test.go @@ -69,8 +69,8 @@ func TestFrontendPageDiscoveryPinsAccessAndMatch(t *testing.T) { "/admin/platform/feature-flags", "/admin/platform/jobs", "/admin/platform/organizations", + "/admin/platform/module-identity", "/admin/platform/plugin-transport", - "/admin/platform/unattended-work", "/admin/platform/waitlist", "/admin/roles", "/admin/roles/{roleId}", @@ -79,6 +79,10 @@ func TestFrontendPageDiscoveryPinsAccessAndMatch(t *testing.T) { "/admin/sso", "/admin/teams", "/admin/teams/{teamId}", + // Under /admin/, so the access boundary the generator derives is `admin` + // — the same one the page's own gate declares (issue #1121). Under + // /admin/platform/ it derived `super_admin` and the two disagreed. + "/admin/unattended-work", "/admin/users", "/admin/users/{userId}", "/admin/webhooks", diff --git a/module/services/accounts/code/pkg/gen/saas/accounts/v1/accountsv1connect/platform_admin.connect.go b/module/services/accounts/code/pkg/gen/saas/accounts/v1/accountsv1connect/platform_admin.connect.go index c6525c822..ed8a50363 100644 --- a/module/services/accounts/code/pkg/gen/saas/accounts/v1/accountsv1connect/platform_admin.connect.go +++ b/module/services/accounts/code/pkg/gen/saas/accounts/v1/accountsv1connect/platform_admin.connect.go @@ -112,6 +112,9 @@ const ( // PlatformAdminServicePutModuleEnvelopeProcedure is the fully-qualified name of the // PlatformAdminService's PutModuleEnvelope RPC. PlatformAdminServicePutModuleEnvelopeProcedure = "/saas.accounts.v1.PlatformAdminService/PutModuleEnvelope" + // PlatformAdminServiceResolveModuleTenantIdentityProcedure is the fully-qualified name of the + // PlatformAdminService's ResolveModuleTenantIdentity RPC. + PlatformAdminServiceResolveModuleTenantIdentityProcedure = "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity" ) // PlatformAdminServiceClient is a client for the saas.accounts.v1.PlatformAdminService service. @@ -174,6 +177,10 @@ type PlatformAdminServiceClient interface { // effect at the next check with no restart: the module registry is derived // again from it, so a narrowing removes what the new ceiling no longer allows. PutModuleEnvelope(context.Context, *connect.Request[v1.PutModuleEnvelopeRequest]) (*connect.Response[v1.PutModuleEnvelopeResponse], error) + // ResolveModuleTenantIdentity answers what a per-tenant module operation + // context would assert for one module, one of its bindings and one + // organization — or why it would be refused. It issues no capability. + ResolveModuleTenantIdentity(context.Context, *connect.Request[v1.ResolveModuleTenantIdentityRequest]) (*connect.Response[v1.ResolveModuleTenantIdentityResponse], error) } // NewPlatformAdminServiceClient constructs a client for the saas.accounts.v1.PlatformAdminService @@ -337,36 +344,43 @@ func NewPlatformAdminServiceClient(httpClient connect.HTTPClient, baseURL string connect.WithSchema(platformAdminServiceMethods.ByName("PutModuleEnvelope")), connect.WithClientOptions(opts...), ), + resolveModuleTenantIdentity: connect.NewClient[v1.ResolveModuleTenantIdentityRequest, v1.ResolveModuleTenantIdentityResponse]( + httpClient, + baseURL+PlatformAdminServiceResolveModuleTenantIdentityProcedure, + connect.WithSchema(platformAdminServiceMethods.ByName("ResolveModuleTenantIdentity")), + connect.WithClientOptions(opts...), + ), } } // platformAdminServiceClient implements PlatformAdminServiceClient. type platformAdminServiceClient struct { - searchUsers *connect.Client[v1.SearchUsersRequest, v1.SearchUsersResponse] - suspendUser *connect.Client[v1.SuspendUserRequest, emptypb.Empty] - unsuspendUser *connect.Client[v1.UnsuspendUserRequest, emptypb.Empty] - impersonateUser *connect.Client[v1.ImpersonateUserRequest, v1.ImpersonateUserResponse] - stopImpersonation *connect.Client[v1.StopImpersonationRequest, v1.StopImpersonationResponse] - listActiveSessions *connect.Client[v1.ListActiveSessionsRequest, v1.ListActiveSessionsResponse] - revokeSession *connect.Client[v1.RevokeSessionRequest, emptypb.Empty] - getOrgEntitlements *connect.Client[v1.GetOrgEntitlementsRequest, v1.GetOrgEntitlementsResponse] - overrideEntitlement *connect.Client[v1.OverrideEntitlementRequest, v1.OverrideEntitlementResponse] - grantPlatformRole *connect.Client[v1.GrantPlatformRoleRequest, emptypb.Empty] - revokePlatformRole *connect.Client[v1.RevokePlatformRoleRequest, emptypb.Empty] - listPlatformAdmins *connect.Client[v1.ListPlatformAdminsRequest, v1.ListPlatformAdminsResponse] - listAllOrganizations *connect.Client[v1.ListAllOrganizationsRequest, v1.ListAllOrganizationsResponse] - getOrganizationRoster *connect.Client[v1.GetOrganizationRosterRequest, v1.GetOrganizationRosterResponse] - listFeatureFlags *connect.Client[v1.ListFeatureFlagsRequest, v1.ListFeatureFlagsResponse] - upsertFeatureFlag *connect.Client[v1.UpsertFeatureFlagRequest, v1.UpsertFeatureFlagResponse] - getJobOperations *connect.Client[v11.GetJobOperationsRequest, v11.GetJobOperationsResponse] - listJobs *connect.Client[v11.ListJobsRequest, v11.ListJobsResponse] - getJob *connect.Client[v11.GetJobRequest, v11.GetJobResponse] - replayJob *connect.Client[v11.ReplayJobRequest, v11.ReplayJobResponse] - getEventOperations *connect.Client[v12.GetEventOperationsRequest, v12.GetEventOperationsResponse] - listEventSubscriptions *connect.Client[v12.ListEventSubscriptionsRequest, v12.ListEventSubscriptionsResponse] - listPlatformCatalogue *connect.Client[v1.ListPlatformCatalogueRequest, v1.ListPlatformCatalogueResponse] - getModuleEnvelope *connect.Client[v1.GetModuleEnvelopeRequest, v1.GetModuleEnvelopeResponse] - putModuleEnvelope *connect.Client[v1.PutModuleEnvelopeRequest, v1.PutModuleEnvelopeResponse] + searchUsers *connect.Client[v1.SearchUsersRequest, v1.SearchUsersResponse] + suspendUser *connect.Client[v1.SuspendUserRequest, emptypb.Empty] + unsuspendUser *connect.Client[v1.UnsuspendUserRequest, emptypb.Empty] + impersonateUser *connect.Client[v1.ImpersonateUserRequest, v1.ImpersonateUserResponse] + stopImpersonation *connect.Client[v1.StopImpersonationRequest, v1.StopImpersonationResponse] + listActiveSessions *connect.Client[v1.ListActiveSessionsRequest, v1.ListActiveSessionsResponse] + revokeSession *connect.Client[v1.RevokeSessionRequest, emptypb.Empty] + getOrgEntitlements *connect.Client[v1.GetOrgEntitlementsRequest, v1.GetOrgEntitlementsResponse] + overrideEntitlement *connect.Client[v1.OverrideEntitlementRequest, v1.OverrideEntitlementResponse] + grantPlatformRole *connect.Client[v1.GrantPlatformRoleRequest, emptypb.Empty] + revokePlatformRole *connect.Client[v1.RevokePlatformRoleRequest, emptypb.Empty] + listPlatformAdmins *connect.Client[v1.ListPlatformAdminsRequest, v1.ListPlatformAdminsResponse] + listAllOrganizations *connect.Client[v1.ListAllOrganizationsRequest, v1.ListAllOrganizationsResponse] + getOrganizationRoster *connect.Client[v1.GetOrganizationRosterRequest, v1.GetOrganizationRosterResponse] + listFeatureFlags *connect.Client[v1.ListFeatureFlagsRequest, v1.ListFeatureFlagsResponse] + upsertFeatureFlag *connect.Client[v1.UpsertFeatureFlagRequest, v1.UpsertFeatureFlagResponse] + getJobOperations *connect.Client[v11.GetJobOperationsRequest, v11.GetJobOperationsResponse] + listJobs *connect.Client[v11.ListJobsRequest, v11.ListJobsResponse] + getJob *connect.Client[v11.GetJobRequest, v11.GetJobResponse] + replayJob *connect.Client[v11.ReplayJobRequest, v11.ReplayJobResponse] + getEventOperations *connect.Client[v12.GetEventOperationsRequest, v12.GetEventOperationsResponse] + listEventSubscriptions *connect.Client[v12.ListEventSubscriptionsRequest, v12.ListEventSubscriptionsResponse] + listPlatformCatalogue *connect.Client[v1.ListPlatformCatalogueRequest, v1.ListPlatformCatalogueResponse] + getModuleEnvelope *connect.Client[v1.GetModuleEnvelopeRequest, v1.GetModuleEnvelopeResponse] + putModuleEnvelope *connect.Client[v1.PutModuleEnvelopeRequest, v1.PutModuleEnvelopeResponse] + resolveModuleTenantIdentity *connect.Client[v1.ResolveModuleTenantIdentityRequest, v1.ResolveModuleTenantIdentityResponse] } // SearchUsers calls saas.accounts.v1.PlatformAdminService.SearchUsers. @@ -496,6 +510,12 @@ func (c *platformAdminServiceClient) PutModuleEnvelope(ctx context.Context, req return c.putModuleEnvelope.CallUnary(ctx, req) } +// ResolveModuleTenantIdentity calls +// saas.accounts.v1.PlatformAdminService.ResolveModuleTenantIdentity. +func (c *platformAdminServiceClient) ResolveModuleTenantIdentity(ctx context.Context, req *connect.Request[v1.ResolveModuleTenantIdentityRequest]) (*connect.Response[v1.ResolveModuleTenantIdentityResponse], error) { + return c.resolveModuleTenantIdentity.CallUnary(ctx, req) +} + // PlatformAdminServiceHandler is an implementation of the saas.accounts.v1.PlatformAdminService // service. type PlatformAdminServiceHandler interface { @@ -557,6 +577,10 @@ type PlatformAdminServiceHandler interface { // effect at the next check with no restart: the module registry is derived // again from it, so a narrowing removes what the new ceiling no longer allows. PutModuleEnvelope(context.Context, *connect.Request[v1.PutModuleEnvelopeRequest]) (*connect.Response[v1.PutModuleEnvelopeResponse], error) + // ResolveModuleTenantIdentity answers what a per-tenant module operation + // context would assert for one module, one of its bindings and one + // organization — or why it would be refused. It issues no capability. + ResolveModuleTenantIdentity(context.Context, *connect.Request[v1.ResolveModuleTenantIdentityRequest]) (*connect.Response[v1.ResolveModuleTenantIdentityResponse], error) } // NewPlatformAdminServiceHandler builds an HTTP handler from the service implementation. It returns @@ -716,6 +740,12 @@ func NewPlatformAdminServiceHandler(svc PlatformAdminServiceHandler, opts ...con connect.WithSchema(platformAdminServiceMethods.ByName("PutModuleEnvelope")), connect.WithHandlerOptions(opts...), ) + platformAdminServiceResolveModuleTenantIdentityHandler := connect.NewUnaryHandler( + PlatformAdminServiceResolveModuleTenantIdentityProcedure, + svc.ResolveModuleTenantIdentity, + connect.WithSchema(platformAdminServiceMethods.ByName("ResolveModuleTenantIdentity")), + connect.WithHandlerOptions(opts...), + ) return "/saas.accounts.v1.PlatformAdminService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { switch r.URL.Path { case PlatformAdminServiceSearchUsersProcedure: @@ -768,6 +798,8 @@ func NewPlatformAdminServiceHandler(svc PlatformAdminServiceHandler, opts ...con platformAdminServiceGetModuleEnvelopeHandler.ServeHTTP(w, r) case PlatformAdminServicePutModuleEnvelopeProcedure: platformAdminServicePutModuleEnvelopeHandler.ServeHTTP(w, r) + case PlatformAdminServiceResolveModuleTenantIdentityProcedure: + platformAdminServiceResolveModuleTenantIdentityHandler.ServeHTTP(w, r) default: http.NotFound(w, r) } @@ -876,3 +908,7 @@ func (UnimplementedPlatformAdminServiceHandler) GetModuleEnvelope(context.Contex func (UnimplementedPlatformAdminServiceHandler) PutModuleEnvelope(context.Context, *connect.Request[v1.PutModuleEnvelopeRequest]) (*connect.Response[v1.PutModuleEnvelopeResponse], error) { return nil, connect.NewError(connect.CodeUnimplemented, errors.New("saas.accounts.v1.PlatformAdminService.PutModuleEnvelope is not implemented")) } + +func (UnimplementedPlatformAdminServiceHandler) ResolveModuleTenantIdentity(context.Context, *connect.Request[v1.ResolveModuleTenantIdentityRequest]) (*connect.Response[v1.ResolveModuleTenantIdentityResponse], error) { + return nil, connect.NewError(connect.CodeUnimplemented, errors.New("saas.accounts.v1.PlatformAdminService.ResolveModuleTenantIdentity is not implemented")) +} diff --git a/module/services/accounts/code/pkg/gen/saas/accounts/v1/datasource.pb.go b/module/services/accounts/code/pkg/gen/saas/accounts/v1/datasource.pb.go index c7a189207..1b0f52190 100644 --- a/module/services/accounts/code/pkg/gen/saas/accounts/v1/datasource.pb.go +++ b/module/services/accounts/code/pkg/gen/saas/accounts/v1/datasource.pb.go @@ -5496,6 +5496,24 @@ func (x *RevokeSourceDelegationResponse) GetDelegation() *SourceDelegation { // the capability that admitted it and revoking the delegation refuses the // next occurrence. // +// IT IS SET ONLY FOR A DELEGATION SOME DECLARED EXECUTOR COULD USE, which +// is weaker than naming the one that will. A mint by source id resolves +// the active delegation of the CALLING module, and the capability is +// addressed to the binding's declared audience, which the executing module +// must itself admit — so the one shape a declared reference can serve is a +// delegation whose binding names its own module as the audience. A +// delegation held by one module and addressed to another is reachable only +// through the delegation-id exchange, which no reference this host +// declares can name. +// +// WHICH module that is, this host does not know: nothing it holds declares +// who executes declared work. `identity_holder` on the declaration read +// reports whose delegation the reference resolves to, and executor +// readiness is deliberately not claimed — a composed executor with no +// delegation on this source is refused at the mint +// (ErrSourceDelegationMissing), and a host that called the source "bound" +// would have been telling an operator the opposite. +// // IT IS NOT OPAQUE, and revocation is therefore not permanent. The value // is the source's own id, and a mint resolves whichever delegation of that // source is active, so revoking one and then RECONNECTING the source @@ -5511,11 +5529,15 @@ func (x *RevokeSourceDelegationResponse) GetDelegation() *SourceDelegation { // binding's headless scopes — an ordinary token admission, bounded by the // capability's own short lifetime. // -// IT IS PLANNED, and no declaration this host builds has ever set it. It -// cannot serve the reconcile trigger: the headless mint lives 60 seconds -// against that trigger's 10-minute declared deadline, and the capability -// is the module's own principal while ReconcileSource requires an -// organization member. +// IT IS PLANNED, and no declaration this host builds has ever set it, so +// nothing anywhere has proved it against a trigger. It cannot serve the +// reconcile trigger: the headless mint lives 60 seconds against that +// trigger's 10-minute declared deadline, and the capability is the +// module's own principal while ReconcileSource requires an organization +// member. That mint IS the per-tenant module identity a module publishing +// for one tenant presents (PlatformAdminService.ResolveModuleTenantIdentity +// reads what it would assert); what it is not is an identity for this +// trigger's occurrences. // // THE NAMES ARE THE INSTALLATION DOCUMENT'S, not this host's and not the // executing module's read API's. That distinction is load-bearing: the module @@ -5969,8 +5991,37 @@ type SourceTriggerDeclaration struct { // schedule is disabled, or its interval is not one a five-field cron can // express. Empty means the declaration above is complete. UndeclarableReason string `protobuf:"bytes,8,opt,name=undeclarable_reason,json=undeclarableReason,proto3" json:"undeclarable_reason,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + // host_sweep_enabled says whether THIS HOST still fires the schedule it + // declares, as a labelled stopgap for the absence of a module that consumes + // the declaration, and host_sweep_due_at the instant it will next sweep on. + // + // THAT INSTANT IS NOT next_occurrence_at, and the two are reported + // separately because they share a period and not a phase. The declared cron + // for a sub-hourly interval is `*/M * * * *`, which comes due on the quarter + // or half hour; the sweep fires on the source's stored instant, which every + // pass moves to `now + interval` — an arbitrary offset inside the period. A + // reader shown only the cron's instant was reading what the declaration + // SAYS while the pass that will actually happen was at another minute. + // + // host_sweep_due_at is unset when the sweep is off, or when the source is + // held off its schedule: then there is no pass this host will take. + HostSweepEnabled bool `protobuf:"varint,9,opt,name=host_sweep_enabled,json=hostSweepEnabled,proto3" json:"host_sweep_enabled,omitempty"` + HostSweepDueAt *timestamppb.Timestamp `protobuf:"bytes,10,opt,name=host_sweep_due_at,json=hostSweepDueAt,proto3" json:"host_sweep_due_at,omitempty"` + // identity_holder is the module whose delegation the reference arm resolved + // to when this declaration was built. The arm cannot carry it — the + // reference value is the source id — so it is reported beside it. + // + // IT IS NOT THE EXECUTING MODULE. Nothing this host holds declares which + // module executes declared work: a self-addressed delegation binding is + // generic and a deployment may have several. So this says "a reference on + // this source would resolve to module A's self-addressed delegation", and + // whether A is the module that installs this release is unverified here. A + // reader that took it for executor readiness would be told a source was + // ready while every occurrence of another executor's trigger was refused at + // the mint. Empty when the arm names no identity. + IdentityHolder string `protobuf:"bytes,11,opt,name=identity_holder,json=identityHolder,proto3" json:"identity_holder,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *SourceTriggerDeclaration) Reset() { @@ -6059,6 +6110,27 @@ func (x *SourceTriggerDeclaration) GetUndeclarableReason() string { return "" } +func (x *SourceTriggerDeclaration) GetHostSweepEnabled() bool { + if x != nil { + return x.HostSweepEnabled + } + return false +} + +func (x *SourceTriggerDeclaration) GetHostSweepDueAt() *timestamppb.Timestamp { + if x != nil { + return x.HostSweepDueAt + } + return nil +} + +func (x *SourceTriggerDeclaration) GetIdentityHolder() string { + if x != nil { + return x.IdentityHolder + } + return "" +} + type DelegateSourceTriggersRequest struct { state protoimpl.MessageState `protogen:"open.v1"` OrgId string `protobuf:"bytes,1,opt,name=org_id,json=orgId,proto3" json:"org_id,omitempty"` @@ -7586,7 +7658,7 @@ const file_saas_accounts_v1_datasource_proto_rawDesc = "" + "\x06scopes\x18\x05 \x03(\tR\x06scopes\x12\x16\n" + "\x06lookup\x18\x06 \x01(\bR\x06lookup\x127\n" + "\tminted_at\x18\a \x01(\v2\x1a.google.protobuf.TimestampR\bmintedAt\x12\x16\n" + - "\x06record\x18\b \x01(\tR\x06record\"\xb5\x03\n" + + "\x06record\x18\b \x01(\tR\x06record\"\xd3\x04\n" + "\x18SourceTriggerDeclaration\x12\x18\n" + "\arelease\x18\x01 \x01(\tR\arelease\x12\x1c\n" + "\toperation\x18\x02 \x01(\tR\toperation\x12E\n" + @@ -7595,7 +7667,11 @@ const file_saas_accounts_v1_datasource_proto_rawDesc = "" + "\x06digest\x18\x05 \x01(\tR\x06digest\x12H\n" + "\x12last_occurrence_at\x18\x06 \x01(\v2\x1a.google.protobuf.TimestampR\x10lastOccurrenceAt\x12H\n" + "\x12next_occurrence_at\x18\a \x01(\v2\x1a.google.protobuf.TimestampR\x10nextOccurrenceAt\x12/\n" + - "\x13undeclarable_reason\x18\b \x01(\tR\x12undeclarableReason\"g\n" + + "\x13undeclarable_reason\x18\b \x01(\tR\x12undeclarableReason\x12,\n" + + "\x12host_sweep_enabled\x18\t \x01(\bR\x10hostSweepEnabled\x12E\n" + + "\x11host_sweep_due_at\x18\n" + + " \x01(\v2\x1a.google.protobuf.TimestampR\x0ehostSweepDueAt\x12'\n" + + "\x0fidentity_holder\x18\v \x01(\tR\x0eidentityHolder\"g\n" + "\x1dDelegateSourceTriggersRequest\x12\x1f\n" + "\x06org_id\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x05orgId\x12%\n" + "\tsource_id\x18\x02 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\bsourceId\"p\n" + @@ -8062,88 +8138,89 @@ var file_saas_accounts_v1_datasource_proto_depIdxs = []int32{ 79, // 76: saas.accounts.v1.SourceTriggerDeclaration.identity:type_name -> saas.accounts.v1.TriggerIdentity 103, // 77: saas.accounts.v1.SourceTriggerDeclaration.last_occurrence_at:type_name -> google.protobuf.Timestamp 103, // 78: saas.accounts.v1.SourceTriggerDeclaration.next_occurrence_at:type_name -> google.protobuf.Timestamp - 81, // 79: saas.accounts.v1.DelegateSourceTriggersResponse.delegations:type_name -> saas.accounts.v1.TriggerDelegationReference - 83, // 80: saas.accounts.v1.GetSourceTriggerDeclarationResponse.declaration:type_name -> saas.accounts.v1.SourceTriggerDeclaration - 81, // 81: saas.accounts.v1.GetSourceTriggerDeclarationResponse.delegations:type_name -> saas.accounts.v1.TriggerDelegationReference - 82, // 82: saas.accounts.v1.GetSourceTriggerDeclarationResponse.children:type_name -> saas.accounts.v1.TriggerChildContext - 107, // 83: saas.accounts.v1.SourceOperation.input_schema:type_name -> google.protobuf.Struct - 107, // 84: saas.accounts.v1.SourceOperation.output_schema:type_name -> google.protobuf.Struct - 13, // 85: saas.accounts.v1.SourceOperation.effect:type_name -> saas.accounts.v1.SourceOperation.Effect - 91, // 86: saas.accounts.v1.DeclareSourceOperationsRequest.operations:type_name -> saas.accounts.v1.SourceOperation - 91, // 87: saas.accounts.v1.DeclareSourceOperationsResponse.operations:type_name -> saas.accounts.v1.SourceOperation - 91, // 88: saas.accounts.v1.ListSourceOperationsResponse.operations:type_name -> saas.accounts.v1.SourceOperation - 97, // 89: saas.accounts.v1.InvokeSourceOperationResponse.receipt:type_name -> saas.accounts.v1.SourceOperationReceipt - 100, // 90: saas.accounts.v1.DatasourceService.PruneSourceOperationReceipts:input_type -> saas.accounts.v1.PruneSourceOperationReceiptsRequest - 102, // 91: saas.accounts.v1.DatasourceService.LookupPruneSourceOperationReceipts:input_type -> saas.accounts.v1.LookupPruneSourceOperationReceiptsRequest - 96, // 92: saas.accounts.v1.DatasourceService.InvokeSourceOperation:input_type -> saas.accounts.v1.InvokeSourceOperationRequest - 99, // 93: saas.accounts.v1.DatasourceService.LookupInvokeSourceOperation:input_type -> saas.accounts.v1.LookupInvokeSourceOperationRequest - 94, // 94: saas.accounts.v1.DatasourceService.ListSourceOperations:input_type -> saas.accounts.v1.ListSourceOperationsRequest - 92, // 95: saas.accounts.v1.DatasourceService.DeclareSourceOperations:input_type -> saas.accounts.v1.DeclareSourceOperationsRequest - 20, // 96: saas.accounts.v1.DatasourceService.AddGitHubSource:input_type -> saas.accounts.v1.AddGitHubSourceRequest - 22, // 97: saas.accounts.v1.DatasourceService.AddSource:input_type -> saas.accounts.v1.AddSourceRequest - 27, // 98: saas.accounts.v1.DatasourceService.GetDatasourceCatalog:input_type -> saas.accounts.v1.GetDatasourceCatalogRequest - 29, // 99: saas.accounts.v1.DatasourceService.ListSources:input_type -> saas.accounts.v1.ListSourcesRequest - 31, // 100: saas.accounts.v1.DatasourceService.GetSource:input_type -> saas.accounts.v1.GetSourceRequest - 33, // 101: saas.accounts.v1.DatasourceService.SyncSource:input_type -> saas.accounts.v1.SyncSourceRequest - 35, // 102: saas.accounts.v1.DatasourceService.GetSourceSync:input_type -> saas.accounts.v1.GetSourceSyncRequest - 41, // 103: saas.accounts.v1.DatasourceService.DeleteSource:input_type -> saas.accounts.v1.DeleteSourceRequest - 44, // 104: saas.accounts.v1.DatasourceService.BeginGitHubAppSetup:input_type -> saas.accounts.v1.BeginGitHubAppSetupRequest - 46, // 105: saas.accounts.v1.DatasourceService.CompleteGitHubAppSetup:input_type -> saas.accounts.v1.CompleteGitHubAppSetupRequest - 48, // 106: saas.accounts.v1.DatasourceService.MigrateGitHubSourceToApp:input_type -> saas.accounts.v1.MigrateGitHubSourceToAppRequest - 54, // 107: saas.accounts.v1.DatasourceService.BeginDatasourceAccountLink:input_type -> saas.accounts.v1.BeginDatasourceAccountLinkRequest - 56, // 108: saas.accounts.v1.DatasourceService.CompleteDatasourceAccountLink:input_type -> saas.accounts.v1.CompleteDatasourceAccountLinkRequest - 58, // 109: saas.accounts.v1.DatasourceService.ListMyDatasourceAccountLinks:input_type -> saas.accounts.v1.ListMyDatasourceAccountLinksRequest - 60, // 110: saas.accounts.v1.DatasourceService.DeleteDatasourceAccountLink:input_type -> saas.accounts.v1.DeleteDatasourceAccountLinkRequest - 62, // 111: saas.accounts.v1.DatasourceService.GetDatasourceDirectory:input_type -> saas.accounts.v1.GetDatasourceDirectoryRequest - 64, // 112: saas.accounts.v1.DatasourceService.BindDatasourceGroup:input_type -> saas.accounts.v1.BindDatasourceGroupRequest - 66, // 113: saas.accounts.v1.DatasourceService.UnbindDatasourceGroup:input_type -> saas.accounts.v1.UnbindDatasourceGroupRequest - 68, // 114: saas.accounts.v1.DatasourceService.ClaimDatasourceDomain:input_type -> saas.accounts.v1.ClaimDatasourceDomainRequest - 70, // 115: saas.accounts.v1.DatasourceService.VerifyDatasourceDomain:input_type -> saas.accounts.v1.VerifyDatasourceDomainRequest - 72, // 116: saas.accounts.v1.DatasourceService.DeleteDatasourceDomain:input_type -> saas.accounts.v1.DeleteDatasourceDomainRequest - 75, // 117: saas.accounts.v1.DatasourceService.ListSourceDelegations:input_type -> saas.accounts.v1.ListSourceDelegationsRequest - 77, // 118: saas.accounts.v1.DatasourceService.RevokeSourceDelegation:input_type -> saas.accounts.v1.RevokeSourceDelegationRequest - 84, // 119: saas.accounts.v1.DatasourceService.DelegateSourceTriggers:input_type -> saas.accounts.v1.DelegateSourceTriggersRequest - 86, // 120: saas.accounts.v1.DatasourceService.GetSourceTriggerDeclaration:input_type -> saas.accounts.v1.GetSourceTriggerDeclarationRequest - 88, // 121: saas.accounts.v1.DatasourceService.ReconcileSource:input_type -> saas.accounts.v1.ReconcileSourceRequest - 90, // 122: saas.accounts.v1.DatasourceService.LookupReconcileSource:input_type -> saas.accounts.v1.LookupReconcileSourceRequest - 101, // 123: saas.accounts.v1.DatasourceService.PruneSourceOperationReceipts:output_type -> saas.accounts.v1.PruneSourceOperationReceiptsResponse - 101, // 124: saas.accounts.v1.DatasourceService.LookupPruneSourceOperationReceipts:output_type -> saas.accounts.v1.PruneSourceOperationReceiptsResponse - 98, // 125: saas.accounts.v1.DatasourceService.InvokeSourceOperation:output_type -> saas.accounts.v1.InvokeSourceOperationResponse - 98, // 126: saas.accounts.v1.DatasourceService.LookupInvokeSourceOperation:output_type -> saas.accounts.v1.InvokeSourceOperationResponse - 95, // 127: saas.accounts.v1.DatasourceService.ListSourceOperations:output_type -> saas.accounts.v1.ListSourceOperationsResponse - 93, // 128: saas.accounts.v1.DatasourceService.DeclareSourceOperations:output_type -> saas.accounts.v1.DeclareSourceOperationsResponse - 21, // 129: saas.accounts.v1.DatasourceService.AddGitHubSource:output_type -> saas.accounts.v1.AddGitHubSourceResponse - 23, // 130: saas.accounts.v1.DatasourceService.AddSource:output_type -> saas.accounts.v1.AddSourceResponse - 28, // 131: saas.accounts.v1.DatasourceService.GetDatasourceCatalog:output_type -> saas.accounts.v1.GetDatasourceCatalogResponse - 30, // 132: saas.accounts.v1.DatasourceService.ListSources:output_type -> saas.accounts.v1.ListSourcesResponse - 32, // 133: saas.accounts.v1.DatasourceService.GetSource:output_type -> saas.accounts.v1.GetSourceResponse - 34, // 134: saas.accounts.v1.DatasourceService.SyncSource:output_type -> saas.accounts.v1.SyncSourceResponse - 40, // 135: saas.accounts.v1.DatasourceService.GetSourceSync:output_type -> saas.accounts.v1.GetSourceSyncResponse - 42, // 136: saas.accounts.v1.DatasourceService.DeleteSource:output_type -> saas.accounts.v1.DeleteSourceResponse - 45, // 137: saas.accounts.v1.DatasourceService.BeginGitHubAppSetup:output_type -> saas.accounts.v1.BeginGitHubAppSetupResponse - 47, // 138: saas.accounts.v1.DatasourceService.CompleteGitHubAppSetup:output_type -> saas.accounts.v1.CompleteGitHubAppSetupResponse - 49, // 139: saas.accounts.v1.DatasourceService.MigrateGitHubSourceToApp:output_type -> saas.accounts.v1.MigrateGitHubSourceToAppResponse - 55, // 140: saas.accounts.v1.DatasourceService.BeginDatasourceAccountLink:output_type -> saas.accounts.v1.BeginDatasourceAccountLinkResponse - 57, // 141: saas.accounts.v1.DatasourceService.CompleteDatasourceAccountLink:output_type -> saas.accounts.v1.CompleteDatasourceAccountLinkResponse - 59, // 142: saas.accounts.v1.DatasourceService.ListMyDatasourceAccountLinks:output_type -> saas.accounts.v1.ListMyDatasourceAccountLinksResponse - 61, // 143: saas.accounts.v1.DatasourceService.DeleteDatasourceAccountLink:output_type -> saas.accounts.v1.DeleteDatasourceAccountLinkResponse - 63, // 144: saas.accounts.v1.DatasourceService.GetDatasourceDirectory:output_type -> saas.accounts.v1.GetDatasourceDirectoryResponse - 65, // 145: saas.accounts.v1.DatasourceService.BindDatasourceGroup:output_type -> saas.accounts.v1.BindDatasourceGroupResponse - 67, // 146: saas.accounts.v1.DatasourceService.UnbindDatasourceGroup:output_type -> saas.accounts.v1.UnbindDatasourceGroupResponse - 69, // 147: saas.accounts.v1.DatasourceService.ClaimDatasourceDomain:output_type -> saas.accounts.v1.ClaimDatasourceDomainResponse - 71, // 148: saas.accounts.v1.DatasourceService.VerifyDatasourceDomain:output_type -> saas.accounts.v1.VerifyDatasourceDomainResponse - 73, // 149: saas.accounts.v1.DatasourceService.DeleteDatasourceDomain:output_type -> saas.accounts.v1.DeleteDatasourceDomainResponse - 76, // 150: saas.accounts.v1.DatasourceService.ListSourceDelegations:output_type -> saas.accounts.v1.ListSourceDelegationsResponse - 78, // 151: saas.accounts.v1.DatasourceService.RevokeSourceDelegation:output_type -> saas.accounts.v1.RevokeSourceDelegationResponse - 85, // 152: saas.accounts.v1.DatasourceService.DelegateSourceTriggers:output_type -> saas.accounts.v1.DelegateSourceTriggersResponse - 87, // 153: saas.accounts.v1.DatasourceService.GetSourceTriggerDeclaration:output_type -> saas.accounts.v1.GetSourceTriggerDeclarationResponse - 89, // 154: saas.accounts.v1.DatasourceService.ReconcileSource:output_type -> saas.accounts.v1.ReconcileSourceResponse - 89, // 155: saas.accounts.v1.DatasourceService.LookupReconcileSource:output_type -> saas.accounts.v1.ReconcileSourceResponse - 123, // [123:156] is the sub-list for method output_type - 90, // [90:123] is the sub-list for method input_type - 90, // [90:90] is the sub-list for extension type_name - 90, // [90:90] is the sub-list for extension extendee - 0, // [0:90] is the sub-list for field type_name + 103, // 79: saas.accounts.v1.SourceTriggerDeclaration.host_sweep_due_at:type_name -> google.protobuf.Timestamp + 81, // 80: saas.accounts.v1.DelegateSourceTriggersResponse.delegations:type_name -> saas.accounts.v1.TriggerDelegationReference + 83, // 81: saas.accounts.v1.GetSourceTriggerDeclarationResponse.declaration:type_name -> saas.accounts.v1.SourceTriggerDeclaration + 81, // 82: saas.accounts.v1.GetSourceTriggerDeclarationResponse.delegations:type_name -> saas.accounts.v1.TriggerDelegationReference + 82, // 83: saas.accounts.v1.GetSourceTriggerDeclarationResponse.children:type_name -> saas.accounts.v1.TriggerChildContext + 107, // 84: saas.accounts.v1.SourceOperation.input_schema:type_name -> google.protobuf.Struct + 107, // 85: saas.accounts.v1.SourceOperation.output_schema:type_name -> google.protobuf.Struct + 13, // 86: saas.accounts.v1.SourceOperation.effect:type_name -> saas.accounts.v1.SourceOperation.Effect + 91, // 87: saas.accounts.v1.DeclareSourceOperationsRequest.operations:type_name -> saas.accounts.v1.SourceOperation + 91, // 88: saas.accounts.v1.DeclareSourceOperationsResponse.operations:type_name -> saas.accounts.v1.SourceOperation + 91, // 89: saas.accounts.v1.ListSourceOperationsResponse.operations:type_name -> saas.accounts.v1.SourceOperation + 97, // 90: saas.accounts.v1.InvokeSourceOperationResponse.receipt:type_name -> saas.accounts.v1.SourceOperationReceipt + 100, // 91: saas.accounts.v1.DatasourceService.PruneSourceOperationReceipts:input_type -> saas.accounts.v1.PruneSourceOperationReceiptsRequest + 102, // 92: saas.accounts.v1.DatasourceService.LookupPruneSourceOperationReceipts:input_type -> saas.accounts.v1.LookupPruneSourceOperationReceiptsRequest + 96, // 93: saas.accounts.v1.DatasourceService.InvokeSourceOperation:input_type -> saas.accounts.v1.InvokeSourceOperationRequest + 99, // 94: saas.accounts.v1.DatasourceService.LookupInvokeSourceOperation:input_type -> saas.accounts.v1.LookupInvokeSourceOperationRequest + 94, // 95: saas.accounts.v1.DatasourceService.ListSourceOperations:input_type -> saas.accounts.v1.ListSourceOperationsRequest + 92, // 96: saas.accounts.v1.DatasourceService.DeclareSourceOperations:input_type -> saas.accounts.v1.DeclareSourceOperationsRequest + 20, // 97: saas.accounts.v1.DatasourceService.AddGitHubSource:input_type -> saas.accounts.v1.AddGitHubSourceRequest + 22, // 98: saas.accounts.v1.DatasourceService.AddSource:input_type -> saas.accounts.v1.AddSourceRequest + 27, // 99: saas.accounts.v1.DatasourceService.GetDatasourceCatalog:input_type -> saas.accounts.v1.GetDatasourceCatalogRequest + 29, // 100: saas.accounts.v1.DatasourceService.ListSources:input_type -> saas.accounts.v1.ListSourcesRequest + 31, // 101: saas.accounts.v1.DatasourceService.GetSource:input_type -> saas.accounts.v1.GetSourceRequest + 33, // 102: saas.accounts.v1.DatasourceService.SyncSource:input_type -> saas.accounts.v1.SyncSourceRequest + 35, // 103: saas.accounts.v1.DatasourceService.GetSourceSync:input_type -> saas.accounts.v1.GetSourceSyncRequest + 41, // 104: saas.accounts.v1.DatasourceService.DeleteSource:input_type -> saas.accounts.v1.DeleteSourceRequest + 44, // 105: saas.accounts.v1.DatasourceService.BeginGitHubAppSetup:input_type -> saas.accounts.v1.BeginGitHubAppSetupRequest + 46, // 106: saas.accounts.v1.DatasourceService.CompleteGitHubAppSetup:input_type -> saas.accounts.v1.CompleteGitHubAppSetupRequest + 48, // 107: saas.accounts.v1.DatasourceService.MigrateGitHubSourceToApp:input_type -> saas.accounts.v1.MigrateGitHubSourceToAppRequest + 54, // 108: saas.accounts.v1.DatasourceService.BeginDatasourceAccountLink:input_type -> saas.accounts.v1.BeginDatasourceAccountLinkRequest + 56, // 109: saas.accounts.v1.DatasourceService.CompleteDatasourceAccountLink:input_type -> saas.accounts.v1.CompleteDatasourceAccountLinkRequest + 58, // 110: saas.accounts.v1.DatasourceService.ListMyDatasourceAccountLinks:input_type -> saas.accounts.v1.ListMyDatasourceAccountLinksRequest + 60, // 111: saas.accounts.v1.DatasourceService.DeleteDatasourceAccountLink:input_type -> saas.accounts.v1.DeleteDatasourceAccountLinkRequest + 62, // 112: saas.accounts.v1.DatasourceService.GetDatasourceDirectory:input_type -> saas.accounts.v1.GetDatasourceDirectoryRequest + 64, // 113: saas.accounts.v1.DatasourceService.BindDatasourceGroup:input_type -> saas.accounts.v1.BindDatasourceGroupRequest + 66, // 114: saas.accounts.v1.DatasourceService.UnbindDatasourceGroup:input_type -> saas.accounts.v1.UnbindDatasourceGroupRequest + 68, // 115: saas.accounts.v1.DatasourceService.ClaimDatasourceDomain:input_type -> saas.accounts.v1.ClaimDatasourceDomainRequest + 70, // 116: saas.accounts.v1.DatasourceService.VerifyDatasourceDomain:input_type -> saas.accounts.v1.VerifyDatasourceDomainRequest + 72, // 117: saas.accounts.v1.DatasourceService.DeleteDatasourceDomain:input_type -> saas.accounts.v1.DeleteDatasourceDomainRequest + 75, // 118: saas.accounts.v1.DatasourceService.ListSourceDelegations:input_type -> saas.accounts.v1.ListSourceDelegationsRequest + 77, // 119: saas.accounts.v1.DatasourceService.RevokeSourceDelegation:input_type -> saas.accounts.v1.RevokeSourceDelegationRequest + 84, // 120: saas.accounts.v1.DatasourceService.DelegateSourceTriggers:input_type -> saas.accounts.v1.DelegateSourceTriggersRequest + 86, // 121: saas.accounts.v1.DatasourceService.GetSourceTriggerDeclaration:input_type -> saas.accounts.v1.GetSourceTriggerDeclarationRequest + 88, // 122: saas.accounts.v1.DatasourceService.ReconcileSource:input_type -> saas.accounts.v1.ReconcileSourceRequest + 90, // 123: saas.accounts.v1.DatasourceService.LookupReconcileSource:input_type -> saas.accounts.v1.LookupReconcileSourceRequest + 101, // 124: saas.accounts.v1.DatasourceService.PruneSourceOperationReceipts:output_type -> saas.accounts.v1.PruneSourceOperationReceiptsResponse + 101, // 125: saas.accounts.v1.DatasourceService.LookupPruneSourceOperationReceipts:output_type -> saas.accounts.v1.PruneSourceOperationReceiptsResponse + 98, // 126: saas.accounts.v1.DatasourceService.InvokeSourceOperation:output_type -> saas.accounts.v1.InvokeSourceOperationResponse + 98, // 127: saas.accounts.v1.DatasourceService.LookupInvokeSourceOperation:output_type -> saas.accounts.v1.InvokeSourceOperationResponse + 95, // 128: saas.accounts.v1.DatasourceService.ListSourceOperations:output_type -> saas.accounts.v1.ListSourceOperationsResponse + 93, // 129: saas.accounts.v1.DatasourceService.DeclareSourceOperations:output_type -> saas.accounts.v1.DeclareSourceOperationsResponse + 21, // 130: saas.accounts.v1.DatasourceService.AddGitHubSource:output_type -> saas.accounts.v1.AddGitHubSourceResponse + 23, // 131: saas.accounts.v1.DatasourceService.AddSource:output_type -> saas.accounts.v1.AddSourceResponse + 28, // 132: saas.accounts.v1.DatasourceService.GetDatasourceCatalog:output_type -> saas.accounts.v1.GetDatasourceCatalogResponse + 30, // 133: saas.accounts.v1.DatasourceService.ListSources:output_type -> saas.accounts.v1.ListSourcesResponse + 32, // 134: saas.accounts.v1.DatasourceService.GetSource:output_type -> saas.accounts.v1.GetSourceResponse + 34, // 135: saas.accounts.v1.DatasourceService.SyncSource:output_type -> saas.accounts.v1.SyncSourceResponse + 40, // 136: saas.accounts.v1.DatasourceService.GetSourceSync:output_type -> saas.accounts.v1.GetSourceSyncResponse + 42, // 137: saas.accounts.v1.DatasourceService.DeleteSource:output_type -> saas.accounts.v1.DeleteSourceResponse + 45, // 138: saas.accounts.v1.DatasourceService.BeginGitHubAppSetup:output_type -> saas.accounts.v1.BeginGitHubAppSetupResponse + 47, // 139: saas.accounts.v1.DatasourceService.CompleteGitHubAppSetup:output_type -> saas.accounts.v1.CompleteGitHubAppSetupResponse + 49, // 140: saas.accounts.v1.DatasourceService.MigrateGitHubSourceToApp:output_type -> saas.accounts.v1.MigrateGitHubSourceToAppResponse + 55, // 141: saas.accounts.v1.DatasourceService.BeginDatasourceAccountLink:output_type -> saas.accounts.v1.BeginDatasourceAccountLinkResponse + 57, // 142: saas.accounts.v1.DatasourceService.CompleteDatasourceAccountLink:output_type -> saas.accounts.v1.CompleteDatasourceAccountLinkResponse + 59, // 143: saas.accounts.v1.DatasourceService.ListMyDatasourceAccountLinks:output_type -> saas.accounts.v1.ListMyDatasourceAccountLinksResponse + 61, // 144: saas.accounts.v1.DatasourceService.DeleteDatasourceAccountLink:output_type -> saas.accounts.v1.DeleteDatasourceAccountLinkResponse + 63, // 145: saas.accounts.v1.DatasourceService.GetDatasourceDirectory:output_type -> saas.accounts.v1.GetDatasourceDirectoryResponse + 65, // 146: saas.accounts.v1.DatasourceService.BindDatasourceGroup:output_type -> saas.accounts.v1.BindDatasourceGroupResponse + 67, // 147: saas.accounts.v1.DatasourceService.UnbindDatasourceGroup:output_type -> saas.accounts.v1.UnbindDatasourceGroupResponse + 69, // 148: saas.accounts.v1.DatasourceService.ClaimDatasourceDomain:output_type -> saas.accounts.v1.ClaimDatasourceDomainResponse + 71, // 149: saas.accounts.v1.DatasourceService.VerifyDatasourceDomain:output_type -> saas.accounts.v1.VerifyDatasourceDomainResponse + 73, // 150: saas.accounts.v1.DatasourceService.DeleteDatasourceDomain:output_type -> saas.accounts.v1.DeleteDatasourceDomainResponse + 76, // 151: saas.accounts.v1.DatasourceService.ListSourceDelegations:output_type -> saas.accounts.v1.ListSourceDelegationsResponse + 78, // 152: saas.accounts.v1.DatasourceService.RevokeSourceDelegation:output_type -> saas.accounts.v1.RevokeSourceDelegationResponse + 85, // 153: saas.accounts.v1.DatasourceService.DelegateSourceTriggers:output_type -> saas.accounts.v1.DelegateSourceTriggersResponse + 87, // 154: saas.accounts.v1.DatasourceService.GetSourceTriggerDeclaration:output_type -> saas.accounts.v1.GetSourceTriggerDeclarationResponse + 89, // 155: saas.accounts.v1.DatasourceService.ReconcileSource:output_type -> saas.accounts.v1.ReconcileSourceResponse + 89, // 156: saas.accounts.v1.DatasourceService.LookupReconcileSource:output_type -> saas.accounts.v1.ReconcileSourceResponse + 124, // [124:157] is the sub-list for method output_type + 91, // [91:124] is the sub-list for method input_type + 91, // [91:91] is the sub-list for extension type_name + 91, // [91:91] is the sub-list for extension extendee + 0, // [0:91] is the sub-list for field type_name } func init() { file_saas_accounts_v1_datasource_proto_init() } diff --git a/module/services/accounts/code/pkg/gen/saas/accounts/v1/platform_admin.pb.go b/module/services/accounts/code/pkg/gen/saas/accounts/v1/platform_admin.pb.go index e6eaf12db..06c099f99 100644 --- a/module/services/accounts/code/pkg/gen/saas/accounts/v1/platform_admin.pb.go +++ b/module/services/accounts/code/pkg/gen/saas/accounts/v1/platform_admin.pb.go @@ -3751,6 +3751,332 @@ func (x *PutModuleEnvelopeResponse) GetEnvelope() *ModuleEnvelope { return nil } +type ResolveModuleTenantIdentityRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + // prefix is the module principal's registration prefix and binding the key + // of its operation_audiences entry. + Prefix string `protobuf:"bytes,1,opt,name=prefix,proto3" json:"prefix,omitempty"` + Binding string `protobuf:"bytes,2,opt,name=binding,proto3" json:"binding,omitempty"` + // organization_id is the tenant the capability would act for. + OrganizationId string `protobuf:"bytes,3,opt,name=organization_id,json=organizationId,proto3" json:"organization_id,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ResolveModuleTenantIdentityRequest) Reset() { + *x = ResolveModuleTenantIdentityRequest{} + mi := &file_saas_accounts_v1_platform_admin_proto_msgTypes[52] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ResolveModuleTenantIdentityRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ResolveModuleTenantIdentityRequest) ProtoMessage() {} + +func (x *ResolveModuleTenantIdentityRequest) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_platform_admin_proto_msgTypes[52] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ResolveModuleTenantIdentityRequest.ProtoReflect.Descriptor instead. +func (*ResolveModuleTenantIdentityRequest) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_platform_admin_proto_rawDescGZIP(), []int{52} +} + +func (x *ResolveModuleTenantIdentityRequest) GetPrefix() string { + if x != nil { + return x.Prefix + } + return "" +} + +func (x *ResolveModuleTenantIdentityRequest) GetBinding() string { + if x != nil { + return x.Binding + } + return "" +} + +func (x *ResolveModuleTenantIdentityRequest) GetOrganizationId() string { + if x != nil { + return x.OrganizationId + } + return "" +} + +// ModuleTenantIdentity is what one per-tenant mint would assert. Every field is +// the host's: nothing here is requestable. +type ModuleTenantIdentity struct { + state protoimpl.MessageState `protogen:"open.v1"` + // principal_id is the module's own service principal, which owns the + // capability and acts directly — there is no person and no actor hop. + PrincipalId string `protobuf:"bytes,1,opt,name=principal_id,json=principalId,proto3" json:"principal_id,omitempty"` + // tenant is the organization it would act for, and audience the service the + // binding declares it may call. A binding whose audience is the module's own + // prefix is one the module admits itself, which is how unattended work is + // admitted by the module that executes it. + Tenant string `protobuf:"bytes,2,opt,name=tenant,proto3" json:"tenant,omitempty"` + Audience string `protobuf:"bytes,3,opt,name=audience,proto3" json:"audience,omitempty"` + // scopes is exactly what the capability would carry, as + // `kind:action[:resource]`: the binding's headless_scopes narrowed by THIS + // organization's installation scope. Never its invoke_scopes, which describe + // authority exercised on a person's behalf. + Scopes []string `protobuf:"bytes,4,rep,name=scopes,proto3" json:"scopes,omitempty"` + // lifetime_seconds is the fixed lifetime every such capability carries. + LifetimeSeconds int64 `protobuf:"varint,5,opt,name=lifetime_seconds,json=lifetimeSeconds,proto3" json:"lifetime_seconds,omitempty"` + // revision is the authorization revision it would be sealed with: a digest + // of the module's whole effective entry, so any change to the entry stops + // confirming every capability minted under the old one. + Revision uint64 `protobuf:"varint,6,opt,name=revision,proto3" json:"revision,omitempty"` + // shared says the principal is unpinned and declares cross_tenant, so it may + // act for more than one organization. A pinned principal reads false and can + // only ever name the tenant its envelope declares. + Shared bool `protobuf:"varint,7,opt,name=shared,proto3" json:"shared,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ModuleTenantIdentity) Reset() { + *x = ModuleTenantIdentity{} + mi := &file_saas_accounts_v1_platform_admin_proto_msgTypes[53] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ModuleTenantIdentity) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ModuleTenantIdentity) ProtoMessage() {} + +func (x *ModuleTenantIdentity) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_platform_admin_proto_msgTypes[53] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ModuleTenantIdentity.ProtoReflect.Descriptor instead. +func (*ModuleTenantIdentity) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_platform_admin_proto_rawDescGZIP(), []int{53} +} + +func (x *ModuleTenantIdentity) GetPrincipalId() string { + if x != nil { + return x.PrincipalId + } + return "" +} + +func (x *ModuleTenantIdentity) GetTenant() string { + if x != nil { + return x.Tenant + } + return "" +} + +func (x *ModuleTenantIdentity) GetAudience() string { + if x != nil { + return x.Audience + } + return "" +} + +func (x *ModuleTenantIdentity) GetScopes() []string { + if x != nil { + return x.Scopes + } + return nil +} + +func (x *ModuleTenantIdentity) GetLifetimeSeconds() int64 { + if x != nil { + return x.LifetimeSeconds + } + return 0 +} + +func (x *ModuleTenantIdentity) GetRevision() uint64 { + if x != nil { + return x.Revision + } + return 0 +} + +func (x *ModuleTenantIdentity) GetShared() bool { + if x != nil { + return x.Shared + } + return false +} + +// ModuleTenantIdentityMint is one capability actually issued, as the audit +// trail recorded it. There is no other record: a capability lives a minute and +// nothing caches one. +type ModuleTenantIdentityMint struct { + state protoimpl.MessageState `protogen:"open.v1"` + Record string `protobuf:"bytes,1,opt,name=record,proto3" json:"record,omitempty"` + Tenant string `protobuf:"bytes,2,opt,name=tenant,proto3" json:"tenant,omitempty"` + Binding string `protobuf:"bytes,3,opt,name=binding,proto3" json:"binding,omitempty"` + Audience string `protobuf:"bytes,4,opt,name=audience,proto3" json:"audience,omitempty"` + Scopes []string `protobuf:"bytes,5,rep,name=scopes,proto3" json:"scopes,omitempty"` + MintedAt *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=minted_at,json=mintedAt,proto3" json:"minted_at,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ModuleTenantIdentityMint) Reset() { + *x = ModuleTenantIdentityMint{} + mi := &file_saas_accounts_v1_platform_admin_proto_msgTypes[54] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ModuleTenantIdentityMint) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ModuleTenantIdentityMint) ProtoMessage() {} + +func (x *ModuleTenantIdentityMint) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_platform_admin_proto_msgTypes[54] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ModuleTenantIdentityMint.ProtoReflect.Descriptor instead. +func (*ModuleTenantIdentityMint) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_platform_admin_proto_rawDescGZIP(), []int{54} +} + +func (x *ModuleTenantIdentityMint) GetRecord() string { + if x != nil { + return x.Record + } + return "" +} + +func (x *ModuleTenantIdentityMint) GetTenant() string { + if x != nil { + return x.Tenant + } + return "" +} + +func (x *ModuleTenantIdentityMint) GetBinding() string { + if x != nil { + return x.Binding + } + return "" +} + +func (x *ModuleTenantIdentityMint) GetAudience() string { + if x != nil { + return x.Audience + } + return "" +} + +func (x *ModuleTenantIdentityMint) GetScopes() []string { + if x != nil { + return x.Scopes + } + return nil +} + +func (x *ModuleTenantIdentityMint) GetMintedAt() *timestamppb.Timestamp { + if x != nil { + return x.MintedAt + } + return nil +} + +type ResolveModuleTenantIdentityResponse struct { + state protoimpl.MessageState `protogen:"open.v1"` + // identity is set when a mint for this organization would be issued; refusal + // says why it would not. Exactly one is present, and a refusal is a decision + // about declared authority rather than an outage. + Identity *ModuleTenantIdentity `protobuf:"bytes,1,opt,name=identity,proto3" json:"identity,omitempty"` + Refusal string `protobuf:"bytes,2,opt,name=refusal,proto3" json:"refusal,omitempty"` + // recent is the trail of capabilities this module was actually issued for + // this organization, newest first. + Recent []*ModuleTenantIdentityMint `protobuf:"bytes,3,rep,name=recent,proto3" json:"recent,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ResolveModuleTenantIdentityResponse) Reset() { + *x = ResolveModuleTenantIdentityResponse{} + mi := &file_saas_accounts_v1_platform_admin_proto_msgTypes[55] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ResolveModuleTenantIdentityResponse) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ResolveModuleTenantIdentityResponse) ProtoMessage() {} + +func (x *ResolveModuleTenantIdentityResponse) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_platform_admin_proto_msgTypes[55] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ResolveModuleTenantIdentityResponse.ProtoReflect.Descriptor instead. +func (*ResolveModuleTenantIdentityResponse) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_platform_admin_proto_rawDescGZIP(), []int{55} +} + +func (x *ResolveModuleTenantIdentityResponse) GetIdentity() *ModuleTenantIdentity { + if x != nil { + return x.Identity + } + return nil +} + +func (x *ResolveModuleTenantIdentityResponse) GetRefusal() string { + if x != nil { + return x.Refusal + } + return "" +} + +func (x *ResolveModuleTenantIdentityResponse) GetRecent() []*ModuleTenantIdentityMint { + if x != nil { + return x.Recent + } + return nil +} + var File_saas_accounts_v1_platform_admin_proto protoreflect.FileDescriptor const file_saas_accounts_v1_platform_admin_proto_rawDesc = "" + @@ -3993,7 +4319,31 @@ const file_saas_accounts_v1_platform_admin_proto_rawDesc = "" + "\x11expected_revision\x18\x01 \x01(\x03B\a\xbaH\x04\"\x02(\x00R\x10expectedRevision\x12'\n" + "\bdocument\x18\x02 \x01(\tB\v\xbaH\br\x06\x10\x01(\x80\x80@R\bdocument\"Y\n" + "\x19PutModuleEnvelopeResponse\x12<\n" + - "\benvelope\x18\x01 \x01(\v2 .saas.accounts.v1.ModuleEnvelopeR\benvelope*~\n" + + "\benvelope\x18\x01 \x01(\v2 .saas.accounts.v1.ModuleEnvelopeR\benvelope\"\xc3\x01\n" + + "\"ResolveModuleTenantIdentityRequest\x12D\n" + + "\x06prefix\x18\x01 \x01(\tB,\xbaH)r'\x10\x01\x18?2!^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$R\x06prefix\x12$\n" + + "\abinding\x18\x02 \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\x80\x01R\abinding\x121\n" + + "\x0forganization_id\x18\x03 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x0eorganizationId\"\xe4\x01\n" + + "\x14ModuleTenantIdentity\x12!\n" + + "\fprincipal_id\x18\x01 \x01(\tR\vprincipalId\x12\x16\n" + + "\x06tenant\x18\x02 \x01(\tR\x06tenant\x12\x1a\n" + + "\baudience\x18\x03 \x01(\tR\baudience\x12\x16\n" + + "\x06scopes\x18\x04 \x03(\tR\x06scopes\x12)\n" + + "\x10lifetime_seconds\x18\x05 \x01(\x03R\x0flifetimeSeconds\x12\x1a\n" + + "\brevision\x18\x06 \x01(\x04R\brevision\x12\x16\n" + + "\x06shared\x18\a \x01(\bR\x06shared\"\xd1\x01\n" + + "\x18ModuleTenantIdentityMint\x12\x16\n" + + "\x06record\x18\x01 \x01(\tR\x06record\x12\x16\n" + + "\x06tenant\x18\x02 \x01(\tR\x06tenant\x12\x18\n" + + "\abinding\x18\x03 \x01(\tR\abinding\x12\x1a\n" + + "\baudience\x18\x04 \x01(\tR\baudience\x12\x16\n" + + "\x06scopes\x18\x05 \x03(\tR\x06scopes\x127\n" + + "\tminted_at\x18\x06 \x01(\v2\x1a.google.protobuf.TimestampR\bmintedAt\"\xc7\x01\n" + + "#ResolveModuleTenantIdentityResponse\x12B\n" + + "\bidentity\x18\x01 \x01(\v2&.saas.accounts.v1.ModuleTenantIdentityR\bidentity\x12\x18\n" + + "\arefusal\x18\x02 \x01(\tR\arefusal\x12B\n" + + "\x06recent\x18\x03 \x03(\v2*.saas.accounts.v1.ModuleTenantIdentityMintR\x06recent*~\n" + "\x12CatalogueEntryKind\x12$\n" + " CATALOGUE_ENTRY_KIND_UNSPECIFIED\x10\x00\x12\x1f\n" + "\x1bCATALOGUE_ENTRY_KIND_MODULE\x10\x01\x12!\n" + @@ -4007,7 +4357,7 @@ const file_saas_accounts_v1_platform_admin_proto_rawDesc = "" + "&CATALOGUE_OBSERVED_VERDICT_UNSPECIFIED\x10\x00\x121\n" + "-CATALOGUE_OBSERVED_VERDICT_RUNNING_AUTHORIZED\x10\x01\x12.\n" + "*CATALOGUE_OBSERVED_VERDICT_RUNNING_DIFFERS\x10\x02\x123\n" + - "/CATALOGUE_OBSERVED_VERDICT_RUNNING_UNAUTHORIZED\x10\x032\xf5\"\n" + + "/CATALOGUE_OBSERVED_VERDICT_RUNNING_UNAUTHORIZED\x10\x032\xc7$\n" + "\x14PlatformAdminService\x12\x8e\x01\n" + "\vSearchUsers\x12$.saas.accounts.v1.SearchUsersRequest\x1a%.saas.accounts.v1.SearchUsersResponse\"2\xc2\xf3\x18\x14\b\x02\x10\x010\x01:\x02\x10\x01@\x01H\x05P\x03X\x03`\x03\x82\xd3\xe4\x93\x02\x14\x12\x12/v1/platform/users\x12\xab\x01\n" + "\vSuspendUser\x12$.saas.accounts.v1.SuspendUserRequest\x1a\x16.google.protobuf.Empty\"^\xc2\xf3\x18+\b\x02\x10\x010\x01:\x17\n" + @@ -4045,7 +4395,8 @@ const file_saas_accounts_v1_platform_admin_proto_rawDesc = "" + "\x15ListPlatformCatalogue\x12..saas.accounts.v1.ListPlatformCatalogueRequest\x1a/.saas.accounts.v1.ListPlatformCatalogueResponse\"6\xc2\xf3\x18\x14\b\x02\x10\x010\x01:\x02\x10\x01@\x01H\x05P\x03X\x03`\x05\x82\xd3\xe4\x93\x02\x18\x12\x16/v1/platform/catalogue\x12\xaa\x01\n" + "\x11GetModuleEnvelope\x12*.saas.accounts.v1.GetModuleEnvelopeRequest\x1a+.saas.accounts.v1.GetModuleEnvelopeResponse\"<\xc2\xf3\x18\x14\b\x02\x10\x010\x01:\x02\x10\x01@\x01H\x05P\x03X\x03`\x05\x82\xd3\xe4\x93\x02\x1e\x12\x1c/v1/platform/module-envelope\x12\xd6\x01\n" + "\x11PutModuleEnvelope\x12*.saas.accounts.v1.PutModuleEnvelopeRequest\x1a+.saas.accounts.v1.PutModuleEnvelopeResponse\"h\xc2\xf3\x18=\b\x02\x10\x010\x03:)\n" + - "%saas.platform.module_envelope_written\x10\x02@\x01H\x05P\x03X\x03`\x05x\x02\x82\xd3\xe4\x93\x02!:\x01*\x1a\x1c/v1/platform/module-envelopeB\xba\x01\n" + + "%saas.platform.module_envelope_written\x10\x02@\x01H\x05P\x03X\x03`\x05x\x02\x82\xd3\xe4\x93\x02!:\x01*\x1a\x1c/v1/platform/module-envelope\x12\xcf\x01\n" + + "\x1bResolveModuleTenantIdentity\x124.saas.accounts.v1.ResolveModuleTenantIdentityRequest\x1a5.saas.accounts.v1.ResolveModuleTenantIdentityResponse\"C\xc2\xf3\x18\x14\b\x02\x10\x010\x01:\x02\x10\x01@\x01H\x05P\x03X\x03`\x05\x82\xd3\xe4\x93\x02%\x12#/v1/platform/module-tenant-identityB\xba\x01\n" + "\x14com.saas.accounts.v1B\x12PlatformAdminProtoP\x01Z,accounts/pkg/gen/saas/accounts/v1;accountsv1\xa2\x02\x03SAX\xaa\x02\x10Saas.Accounts.V1\xca\x02\x10Saas\\Accounts\\V1\xe2\x02\x1cSaas\\Accounts\\V1\\GPBMetadata\xea\x02\x12Saas::Accounts::V1b\x06proto3" var ( @@ -4061,100 +4412,104 @@ func file_saas_accounts_v1_platform_admin_proto_rawDescGZIP() []byte { } var file_saas_accounts_v1_platform_admin_proto_enumTypes = make([]protoimpl.EnumInfo, 3) -var file_saas_accounts_v1_platform_admin_proto_msgTypes = make([]protoimpl.MessageInfo, 55) +var file_saas_accounts_v1_platform_admin_proto_msgTypes = make([]protoimpl.MessageInfo, 59) var file_saas_accounts_v1_platform_admin_proto_goTypes = []any{ - (CatalogueEntryKind)(0), // 0: saas.accounts.v1.CatalogueEntryKind - (CatalogueGapReason)(0), // 1: saas.accounts.v1.CatalogueGapReason - (CatalogueObservedVerdict)(0), // 2: saas.accounts.v1.CatalogueObservedVerdict - (*SearchUsersRequest)(nil), // 3: saas.accounts.v1.SearchUsersRequest - (*SearchUsersResponse)(nil), // 4: saas.accounts.v1.SearchUsersResponse - (*ListAllOrganizationsRequest)(nil), // 5: saas.accounts.v1.ListAllOrganizationsRequest - (*PlatformOrganization)(nil), // 6: saas.accounts.v1.PlatformOrganization - (*ListAllOrganizationsResponse)(nil), // 7: saas.accounts.v1.ListAllOrganizationsResponse - (*GetOrganizationRosterRequest)(nil), // 8: saas.accounts.v1.GetOrganizationRosterRequest - (*GetOrganizationRosterResponse)(nil), // 9: saas.accounts.v1.GetOrganizationRosterResponse - (*SuspendUserRequest)(nil), // 10: saas.accounts.v1.SuspendUserRequest - (*UnsuspendUserRequest)(nil), // 11: saas.accounts.v1.UnsuspendUserRequest - (*ImpersonateUserRequest)(nil), // 12: saas.accounts.v1.ImpersonateUserRequest - (*ImpersonateUserResponse)(nil), // 13: saas.accounts.v1.ImpersonateUserResponse - (*StopImpersonationRequest)(nil), // 14: saas.accounts.v1.StopImpersonationRequest - (*StopImpersonationResponse)(nil), // 15: saas.accounts.v1.StopImpersonationResponse - (*ListActiveSessionsRequest)(nil), // 16: saas.accounts.v1.ListActiveSessionsRequest - (*SessionInfo)(nil), // 17: saas.accounts.v1.SessionInfo - (*ListActiveSessionsResponse)(nil), // 18: saas.accounts.v1.ListActiveSessionsResponse - (*RevokeSessionRequest)(nil), // 19: saas.accounts.v1.RevokeSessionRequest - (*GetOrgEntitlementsRequest)(nil), // 20: saas.accounts.v1.GetOrgEntitlementsRequest - (*GetOrgEntitlementsResponse)(nil), // 21: saas.accounts.v1.GetOrgEntitlementsResponse - (*EntitlementInfo)(nil), // 22: saas.accounts.v1.EntitlementInfo - (*OverrideEntitlementRequest)(nil), // 23: saas.accounts.v1.OverrideEntitlementRequest - (*OverrideEntitlementResponse)(nil), // 24: saas.accounts.v1.OverrideEntitlementResponse - (*GrantPlatformRoleRequest)(nil), // 25: saas.accounts.v1.GrantPlatformRoleRequest - (*RevokePlatformRoleRequest)(nil), // 26: saas.accounts.v1.RevokePlatformRoleRequest - (*ListPlatformAdminsRequest)(nil), // 27: saas.accounts.v1.ListPlatformAdminsRequest - (*PlatformAdminEntry)(nil), // 28: saas.accounts.v1.PlatformAdminEntry - (*ListPlatformAdminsResponse)(nil), // 29: saas.accounts.v1.ListPlatformAdminsResponse - (*ListFeatureFlagsRequest)(nil), // 30: saas.accounts.v1.ListFeatureFlagsRequest - (*FeatureFlagEntry)(nil), // 31: saas.accounts.v1.FeatureFlagEntry - (*ListFeatureFlagsResponse)(nil), // 32: saas.accounts.v1.ListFeatureFlagsResponse - (*UpsertFeatureFlagRequest)(nil), // 33: saas.accounts.v1.UpsertFeatureFlagRequest - (*UpsertFeatureFlagResponse)(nil), // 34: saas.accounts.v1.UpsertFeatureFlagResponse - (*CatalogueGap)(nil), // 35: saas.accounts.v1.CatalogueGap - (*CatalogueRelease)(nil), // 36: saas.accounts.v1.CatalogueRelease - (*CatalogueDesired)(nil), // 37: saas.accounts.v1.CatalogueDesired - (*CatalogueAuthorization)(nil), // 38: saas.accounts.v1.CatalogueAuthorization - (*CatalogueNotAuthorized)(nil), // 39: saas.accounts.v1.CatalogueNotAuthorized - (*CatalogueAuthorized)(nil), // 40: saas.accounts.v1.CatalogueAuthorized - (*CatalogueApplied)(nil), // 41: saas.accounts.v1.CatalogueApplied - (*CatalogueObservedExecution)(nil), // 42: saas.accounts.v1.CatalogueObservedExecution - (*CatalogueObserved)(nil), // 43: saas.accounts.v1.CatalogueObserved - (*CatalogueWithdrawing)(nil), // 44: saas.accounts.v1.CatalogueWithdrawing - (*CatalogueRetired)(nil), // 45: saas.accounts.v1.CatalogueRetired - (*CatalogueInstallation)(nil), // 46: saas.accounts.v1.CatalogueInstallation - (*CatalogueEntry)(nil), // 47: saas.accounts.v1.CatalogueEntry - (*ListPlatformCatalogueRequest)(nil), // 48: saas.accounts.v1.ListPlatformCatalogueRequest - (*ListPlatformCatalogueResponse)(nil), // 49: saas.accounts.v1.ListPlatformCatalogueResponse - (*ModuleEnvelope)(nil), // 50: saas.accounts.v1.ModuleEnvelope - (*GetModuleEnvelopeRequest)(nil), // 51: saas.accounts.v1.GetModuleEnvelopeRequest - (*GetModuleEnvelopeResponse)(nil), // 52: saas.accounts.v1.GetModuleEnvelopeResponse - (*PutModuleEnvelopeRequest)(nil), // 53: saas.accounts.v1.PutModuleEnvelopeRequest - (*PutModuleEnvelopeResponse)(nil), // 54: saas.accounts.v1.PutModuleEnvelopeResponse - nil, // 55: saas.accounts.v1.SessionInfo.DeviceInfoEntry - nil, // 56: saas.accounts.v1.CatalogueObservedExecution.ContainerImageDigestsEntry - nil, // 57: saas.accounts.v1.ListPlatformCatalogueResponse.ApprovedInventoriesEntry - (*User)(nil), // 58: saas.accounts.v1.User - (*Organization)(nil), // 59: saas.accounts.v1.Organization - (*OrgMembership)(nil), // 60: saas.accounts.v1.OrgMembership - (*timestamppb.Timestamp)(nil), // 61: google.protobuf.Timestamp - (*Installation)(nil), // 62: saas.accounts.v1.Installation - (*CollectionReadGrant)(nil), // 63: saas.accounts.v1.CollectionReadGrant - (*SolutionRegistration)(nil), // 64: saas.accounts.v1.SolutionRegistration - (*v1.GetJobOperationsRequest)(nil), // 65: saas.jobs.v1.GetJobOperationsRequest - (*v1.ListJobsRequest)(nil), // 66: saas.jobs.v1.ListJobsRequest - (*v1.GetJobRequest)(nil), // 67: saas.jobs.v1.GetJobRequest - (*v1.ReplayJobRequest)(nil), // 68: saas.jobs.v1.ReplayJobRequest - (*v11.GetEventOperationsRequest)(nil), // 69: saas.events.v1.GetEventOperationsRequest - (*v11.ListEventSubscriptionsRequest)(nil), // 70: saas.events.v1.ListEventSubscriptionsRequest - (*emptypb.Empty)(nil), // 71: google.protobuf.Empty - (*v1.GetJobOperationsResponse)(nil), // 72: saas.jobs.v1.GetJobOperationsResponse - (*v1.ListJobsResponse)(nil), // 73: saas.jobs.v1.ListJobsResponse - (*v1.GetJobResponse)(nil), // 74: saas.jobs.v1.GetJobResponse - (*v1.ReplayJobResponse)(nil), // 75: saas.jobs.v1.ReplayJobResponse - (*v11.GetEventOperationsResponse)(nil), // 76: saas.events.v1.GetEventOperationsResponse - (*v11.ListEventSubscriptionsResponse)(nil), // 77: saas.events.v1.ListEventSubscriptionsResponse + (CatalogueEntryKind)(0), // 0: saas.accounts.v1.CatalogueEntryKind + (CatalogueGapReason)(0), // 1: saas.accounts.v1.CatalogueGapReason + (CatalogueObservedVerdict)(0), // 2: saas.accounts.v1.CatalogueObservedVerdict + (*SearchUsersRequest)(nil), // 3: saas.accounts.v1.SearchUsersRequest + (*SearchUsersResponse)(nil), // 4: saas.accounts.v1.SearchUsersResponse + (*ListAllOrganizationsRequest)(nil), // 5: saas.accounts.v1.ListAllOrganizationsRequest + (*PlatformOrganization)(nil), // 6: saas.accounts.v1.PlatformOrganization + (*ListAllOrganizationsResponse)(nil), // 7: saas.accounts.v1.ListAllOrganizationsResponse + (*GetOrganizationRosterRequest)(nil), // 8: saas.accounts.v1.GetOrganizationRosterRequest + (*GetOrganizationRosterResponse)(nil), // 9: saas.accounts.v1.GetOrganizationRosterResponse + (*SuspendUserRequest)(nil), // 10: saas.accounts.v1.SuspendUserRequest + (*UnsuspendUserRequest)(nil), // 11: saas.accounts.v1.UnsuspendUserRequest + (*ImpersonateUserRequest)(nil), // 12: saas.accounts.v1.ImpersonateUserRequest + (*ImpersonateUserResponse)(nil), // 13: saas.accounts.v1.ImpersonateUserResponse + (*StopImpersonationRequest)(nil), // 14: saas.accounts.v1.StopImpersonationRequest + (*StopImpersonationResponse)(nil), // 15: saas.accounts.v1.StopImpersonationResponse + (*ListActiveSessionsRequest)(nil), // 16: saas.accounts.v1.ListActiveSessionsRequest + (*SessionInfo)(nil), // 17: saas.accounts.v1.SessionInfo + (*ListActiveSessionsResponse)(nil), // 18: saas.accounts.v1.ListActiveSessionsResponse + (*RevokeSessionRequest)(nil), // 19: saas.accounts.v1.RevokeSessionRequest + (*GetOrgEntitlementsRequest)(nil), // 20: saas.accounts.v1.GetOrgEntitlementsRequest + (*GetOrgEntitlementsResponse)(nil), // 21: saas.accounts.v1.GetOrgEntitlementsResponse + (*EntitlementInfo)(nil), // 22: saas.accounts.v1.EntitlementInfo + (*OverrideEntitlementRequest)(nil), // 23: saas.accounts.v1.OverrideEntitlementRequest + (*OverrideEntitlementResponse)(nil), // 24: saas.accounts.v1.OverrideEntitlementResponse + (*GrantPlatformRoleRequest)(nil), // 25: saas.accounts.v1.GrantPlatformRoleRequest + (*RevokePlatformRoleRequest)(nil), // 26: saas.accounts.v1.RevokePlatformRoleRequest + (*ListPlatformAdminsRequest)(nil), // 27: saas.accounts.v1.ListPlatformAdminsRequest + (*PlatformAdminEntry)(nil), // 28: saas.accounts.v1.PlatformAdminEntry + (*ListPlatformAdminsResponse)(nil), // 29: saas.accounts.v1.ListPlatformAdminsResponse + (*ListFeatureFlagsRequest)(nil), // 30: saas.accounts.v1.ListFeatureFlagsRequest + (*FeatureFlagEntry)(nil), // 31: saas.accounts.v1.FeatureFlagEntry + (*ListFeatureFlagsResponse)(nil), // 32: saas.accounts.v1.ListFeatureFlagsResponse + (*UpsertFeatureFlagRequest)(nil), // 33: saas.accounts.v1.UpsertFeatureFlagRequest + (*UpsertFeatureFlagResponse)(nil), // 34: saas.accounts.v1.UpsertFeatureFlagResponse + (*CatalogueGap)(nil), // 35: saas.accounts.v1.CatalogueGap + (*CatalogueRelease)(nil), // 36: saas.accounts.v1.CatalogueRelease + (*CatalogueDesired)(nil), // 37: saas.accounts.v1.CatalogueDesired + (*CatalogueAuthorization)(nil), // 38: saas.accounts.v1.CatalogueAuthorization + (*CatalogueNotAuthorized)(nil), // 39: saas.accounts.v1.CatalogueNotAuthorized + (*CatalogueAuthorized)(nil), // 40: saas.accounts.v1.CatalogueAuthorized + (*CatalogueApplied)(nil), // 41: saas.accounts.v1.CatalogueApplied + (*CatalogueObservedExecution)(nil), // 42: saas.accounts.v1.CatalogueObservedExecution + (*CatalogueObserved)(nil), // 43: saas.accounts.v1.CatalogueObserved + (*CatalogueWithdrawing)(nil), // 44: saas.accounts.v1.CatalogueWithdrawing + (*CatalogueRetired)(nil), // 45: saas.accounts.v1.CatalogueRetired + (*CatalogueInstallation)(nil), // 46: saas.accounts.v1.CatalogueInstallation + (*CatalogueEntry)(nil), // 47: saas.accounts.v1.CatalogueEntry + (*ListPlatformCatalogueRequest)(nil), // 48: saas.accounts.v1.ListPlatformCatalogueRequest + (*ListPlatformCatalogueResponse)(nil), // 49: saas.accounts.v1.ListPlatformCatalogueResponse + (*ModuleEnvelope)(nil), // 50: saas.accounts.v1.ModuleEnvelope + (*GetModuleEnvelopeRequest)(nil), // 51: saas.accounts.v1.GetModuleEnvelopeRequest + (*GetModuleEnvelopeResponse)(nil), // 52: saas.accounts.v1.GetModuleEnvelopeResponse + (*PutModuleEnvelopeRequest)(nil), // 53: saas.accounts.v1.PutModuleEnvelopeRequest + (*PutModuleEnvelopeResponse)(nil), // 54: saas.accounts.v1.PutModuleEnvelopeResponse + (*ResolveModuleTenantIdentityRequest)(nil), // 55: saas.accounts.v1.ResolveModuleTenantIdentityRequest + (*ModuleTenantIdentity)(nil), // 56: saas.accounts.v1.ModuleTenantIdentity + (*ModuleTenantIdentityMint)(nil), // 57: saas.accounts.v1.ModuleTenantIdentityMint + (*ResolveModuleTenantIdentityResponse)(nil), // 58: saas.accounts.v1.ResolveModuleTenantIdentityResponse + nil, // 59: saas.accounts.v1.SessionInfo.DeviceInfoEntry + nil, // 60: saas.accounts.v1.CatalogueObservedExecution.ContainerImageDigestsEntry + nil, // 61: saas.accounts.v1.ListPlatformCatalogueResponse.ApprovedInventoriesEntry + (*User)(nil), // 62: saas.accounts.v1.User + (*Organization)(nil), // 63: saas.accounts.v1.Organization + (*OrgMembership)(nil), // 64: saas.accounts.v1.OrgMembership + (*timestamppb.Timestamp)(nil), // 65: google.protobuf.Timestamp + (*Installation)(nil), // 66: saas.accounts.v1.Installation + (*CollectionReadGrant)(nil), // 67: saas.accounts.v1.CollectionReadGrant + (*SolutionRegistration)(nil), // 68: saas.accounts.v1.SolutionRegistration + (*v1.GetJobOperationsRequest)(nil), // 69: saas.jobs.v1.GetJobOperationsRequest + (*v1.ListJobsRequest)(nil), // 70: saas.jobs.v1.ListJobsRequest + (*v1.GetJobRequest)(nil), // 71: saas.jobs.v1.GetJobRequest + (*v1.ReplayJobRequest)(nil), // 72: saas.jobs.v1.ReplayJobRequest + (*v11.GetEventOperationsRequest)(nil), // 73: saas.events.v1.GetEventOperationsRequest + (*v11.ListEventSubscriptionsRequest)(nil), // 74: saas.events.v1.ListEventSubscriptionsRequest + (*emptypb.Empty)(nil), // 75: google.protobuf.Empty + (*v1.GetJobOperationsResponse)(nil), // 76: saas.jobs.v1.GetJobOperationsResponse + (*v1.ListJobsResponse)(nil), // 77: saas.jobs.v1.ListJobsResponse + (*v1.GetJobResponse)(nil), // 78: saas.jobs.v1.GetJobResponse + (*v1.ReplayJobResponse)(nil), // 79: saas.jobs.v1.ReplayJobResponse + (*v11.GetEventOperationsResponse)(nil), // 80: saas.events.v1.GetEventOperationsResponse + (*v11.ListEventSubscriptionsResponse)(nil), // 81: saas.events.v1.ListEventSubscriptionsResponse } var file_saas_accounts_v1_platform_admin_proto_depIdxs = []int32{ - 58, // 0: saas.accounts.v1.SearchUsersResponse.users:type_name -> saas.accounts.v1.User - 59, // 1: saas.accounts.v1.PlatformOrganization.organization:type_name -> saas.accounts.v1.Organization + 62, // 0: saas.accounts.v1.SearchUsersResponse.users:type_name -> saas.accounts.v1.User + 63, // 1: saas.accounts.v1.PlatformOrganization.organization:type_name -> saas.accounts.v1.Organization 6, // 2: saas.accounts.v1.ListAllOrganizationsResponse.organizations:type_name -> saas.accounts.v1.PlatformOrganization - 60, // 3: saas.accounts.v1.GetOrganizationRosterResponse.members:type_name -> saas.accounts.v1.OrgMembership - 55, // 4: saas.accounts.v1.SessionInfo.device_info:type_name -> saas.accounts.v1.SessionInfo.DeviceInfoEntry - 61, // 5: saas.accounts.v1.SessionInfo.created_at:type_name -> google.protobuf.Timestamp - 61, // 6: saas.accounts.v1.SessionInfo.last_active_at:type_name -> google.protobuf.Timestamp - 61, // 7: saas.accounts.v1.SessionInfo.expires_at:type_name -> google.protobuf.Timestamp - 61, // 8: saas.accounts.v1.SessionInfo.idle_expires_at:type_name -> google.protobuf.Timestamp + 64, // 3: saas.accounts.v1.GetOrganizationRosterResponse.members:type_name -> saas.accounts.v1.OrgMembership + 59, // 4: saas.accounts.v1.SessionInfo.device_info:type_name -> saas.accounts.v1.SessionInfo.DeviceInfoEntry + 65, // 5: saas.accounts.v1.SessionInfo.created_at:type_name -> google.protobuf.Timestamp + 65, // 6: saas.accounts.v1.SessionInfo.last_active_at:type_name -> google.protobuf.Timestamp + 65, // 7: saas.accounts.v1.SessionInfo.expires_at:type_name -> google.protobuf.Timestamp + 65, // 8: saas.accounts.v1.SessionInfo.idle_expires_at:type_name -> google.protobuf.Timestamp 17, // 9: saas.accounts.v1.ListActiveSessionsResponse.sessions:type_name -> saas.accounts.v1.SessionInfo 22, // 10: saas.accounts.v1.GetOrgEntitlementsResponse.entitlements:type_name -> saas.accounts.v1.EntitlementInfo - 61, // 11: saas.accounts.v1.PlatformAdminEntry.granted_at:type_name -> google.protobuf.Timestamp + 65, // 11: saas.accounts.v1.PlatformAdminEntry.granted_at:type_name -> google.protobuf.Timestamp 28, // 12: saas.accounts.v1.ListPlatformAdminsResponse.admins:type_name -> saas.accounts.v1.PlatformAdminEntry 31, // 13: saas.accounts.v1.ListFeatureFlagsResponse.flags:type_name -> saas.accounts.v1.FeatureFlagEntry 1, // 14: saas.accounts.v1.CatalogueGap.reason:type_name -> saas.accounts.v1.CatalogueGapReason @@ -4165,9 +4520,9 @@ var file_saas_accounts_v1_platform_admin_proto_depIdxs = []int32{ 39, // 19: saas.accounts.v1.CatalogueAuthorized.not_authorized:type_name -> saas.accounts.v1.CatalogueNotAuthorized 35, // 20: saas.accounts.v1.CatalogueAuthorized.authorization_gap:type_name -> saas.accounts.v1.CatalogueGap 35, // 21: saas.accounts.v1.CatalogueApplied.applied_revision_gap:type_name -> saas.accounts.v1.CatalogueGap - 56, // 22: saas.accounts.v1.CatalogueObservedExecution.container_image_digests:type_name -> saas.accounts.v1.CatalogueObservedExecution.ContainerImageDigestsEntry + 60, // 22: saas.accounts.v1.CatalogueObservedExecution.container_image_digests:type_name -> saas.accounts.v1.CatalogueObservedExecution.ContainerImageDigestsEntry 35, // 23: saas.accounts.v1.CatalogueObserved.observed_revision_gap:type_name -> saas.accounts.v1.CatalogueGap - 61, // 24: saas.accounts.v1.CatalogueObserved.observed_at:type_name -> google.protobuf.Timestamp + 65, // 24: saas.accounts.v1.CatalogueObserved.observed_at:type_name -> google.protobuf.Timestamp 35, // 25: saas.accounts.v1.CatalogueObserved.observation_freshness_gap:type_name -> saas.accounts.v1.CatalogueGap 42, // 26: saas.accounts.v1.CatalogueObserved.observed_execution:type_name -> saas.accounts.v1.CatalogueObservedExecution 35, // 27: saas.accounts.v1.CatalogueObserved.observed_execution_gap:type_name -> saas.accounts.v1.CatalogueGap @@ -4176,12 +4531,12 @@ var file_saas_accounts_v1_platform_admin_proto_depIdxs = []int32{ 35, // 30: saas.accounts.v1.CatalogueWithdrawing.withdrawal_state_gap:type_name -> saas.accounts.v1.CatalogueGap 35, // 31: saas.accounts.v1.CatalogueWithdrawing.credential_revocation_state_gap:type_name -> saas.accounts.v1.CatalogueGap 35, // 32: saas.accounts.v1.CatalogueRetired.retirement_state_gap:type_name -> saas.accounts.v1.CatalogueGap - 62, // 33: saas.accounts.v1.CatalogueInstallation.installation:type_name -> saas.accounts.v1.Installation + 66, // 33: saas.accounts.v1.CatalogueInstallation.installation:type_name -> saas.accounts.v1.Installation 36, // 34: saas.accounts.v1.CatalogueInstallation.agent_release:type_name -> saas.accounts.v1.CatalogueRelease 35, // 35: saas.accounts.v1.CatalogueInstallation.agent_release_gap:type_name -> saas.accounts.v1.CatalogueGap 35, // 36: saas.accounts.v1.CatalogueInstallation.revision_gap:type_name -> saas.accounts.v1.CatalogueGap - 63, // 37: saas.accounts.v1.CatalogueInstallation.granted_teams:type_name -> saas.accounts.v1.CollectionReadGrant - 63, // 38: saas.accounts.v1.CatalogueInstallation.inherited_teams:type_name -> saas.accounts.v1.CollectionReadGrant + 67, // 37: saas.accounts.v1.CatalogueInstallation.granted_teams:type_name -> saas.accounts.v1.CollectionReadGrant + 67, // 38: saas.accounts.v1.CatalogueInstallation.inherited_teams:type_name -> saas.accounts.v1.CollectionReadGrant 0, // 39: saas.accounts.v1.CatalogueEntry.kind:type_name -> saas.accounts.v1.CatalogueEntryKind 35, // 40: saas.accounts.v1.CatalogueEntry.publisher_gap:type_name -> saas.accounts.v1.CatalogueGap 37, // 41: saas.accounts.v1.CatalogueEntry.desired:type_name -> saas.accounts.v1.CatalogueDesired @@ -4191,68 +4546,73 @@ var file_saas_accounts_v1_platform_admin_proto_depIdxs = []int32{ 44, // 45: saas.accounts.v1.CatalogueEntry.withdrawing:type_name -> saas.accounts.v1.CatalogueWithdrawing 45, // 46: saas.accounts.v1.CatalogueEntry.retired:type_name -> saas.accounts.v1.CatalogueRetired 35, // 47: saas.accounts.v1.CatalogueEntry.build_size_gap:type_name -> saas.accounts.v1.CatalogueGap - 64, // 48: saas.accounts.v1.CatalogueEntry.registration:type_name -> saas.accounts.v1.SolutionRegistration + 68, // 48: saas.accounts.v1.CatalogueEntry.registration:type_name -> saas.accounts.v1.SolutionRegistration 46, // 49: saas.accounts.v1.CatalogueEntry.installations:type_name -> saas.accounts.v1.CatalogueInstallation 47, // 50: saas.accounts.v1.ListPlatformCatalogueResponse.entries:type_name -> saas.accounts.v1.CatalogueEntry - 57, // 51: saas.accounts.v1.ListPlatformCatalogueResponse.approved_inventories:type_name -> saas.accounts.v1.ListPlatformCatalogueResponse.ApprovedInventoriesEntry - 61, // 52: saas.accounts.v1.ModuleEnvelope.written_at:type_name -> google.protobuf.Timestamp + 61, // 51: saas.accounts.v1.ListPlatformCatalogueResponse.approved_inventories:type_name -> saas.accounts.v1.ListPlatformCatalogueResponse.ApprovedInventoriesEntry + 65, // 52: saas.accounts.v1.ModuleEnvelope.written_at:type_name -> google.protobuf.Timestamp 50, // 53: saas.accounts.v1.GetModuleEnvelopeResponse.envelope:type_name -> saas.accounts.v1.ModuleEnvelope 50, // 54: saas.accounts.v1.PutModuleEnvelopeResponse.envelope:type_name -> saas.accounts.v1.ModuleEnvelope - 3, // 55: saas.accounts.v1.PlatformAdminService.SearchUsers:input_type -> saas.accounts.v1.SearchUsersRequest - 10, // 56: saas.accounts.v1.PlatformAdminService.SuspendUser:input_type -> saas.accounts.v1.SuspendUserRequest - 11, // 57: saas.accounts.v1.PlatformAdminService.UnsuspendUser:input_type -> saas.accounts.v1.UnsuspendUserRequest - 12, // 58: saas.accounts.v1.PlatformAdminService.ImpersonateUser:input_type -> saas.accounts.v1.ImpersonateUserRequest - 14, // 59: saas.accounts.v1.PlatformAdminService.StopImpersonation:input_type -> saas.accounts.v1.StopImpersonationRequest - 16, // 60: saas.accounts.v1.PlatformAdminService.ListActiveSessions:input_type -> saas.accounts.v1.ListActiveSessionsRequest - 19, // 61: saas.accounts.v1.PlatformAdminService.RevokeSession:input_type -> saas.accounts.v1.RevokeSessionRequest - 20, // 62: saas.accounts.v1.PlatformAdminService.GetOrgEntitlements:input_type -> saas.accounts.v1.GetOrgEntitlementsRequest - 23, // 63: saas.accounts.v1.PlatformAdminService.OverrideEntitlement:input_type -> saas.accounts.v1.OverrideEntitlementRequest - 25, // 64: saas.accounts.v1.PlatformAdminService.GrantPlatformRole:input_type -> saas.accounts.v1.GrantPlatformRoleRequest - 26, // 65: saas.accounts.v1.PlatformAdminService.RevokePlatformRole:input_type -> saas.accounts.v1.RevokePlatformRoleRequest - 27, // 66: saas.accounts.v1.PlatformAdminService.ListPlatformAdmins:input_type -> saas.accounts.v1.ListPlatformAdminsRequest - 5, // 67: saas.accounts.v1.PlatformAdminService.ListAllOrganizations:input_type -> saas.accounts.v1.ListAllOrganizationsRequest - 8, // 68: saas.accounts.v1.PlatformAdminService.GetOrganizationRoster:input_type -> saas.accounts.v1.GetOrganizationRosterRequest - 30, // 69: saas.accounts.v1.PlatformAdminService.ListFeatureFlags:input_type -> saas.accounts.v1.ListFeatureFlagsRequest - 33, // 70: saas.accounts.v1.PlatformAdminService.UpsertFeatureFlag:input_type -> saas.accounts.v1.UpsertFeatureFlagRequest - 65, // 71: saas.accounts.v1.PlatformAdminService.GetJobOperations:input_type -> saas.jobs.v1.GetJobOperationsRequest - 66, // 72: saas.accounts.v1.PlatformAdminService.ListJobs:input_type -> saas.jobs.v1.ListJobsRequest - 67, // 73: saas.accounts.v1.PlatformAdminService.GetJob:input_type -> saas.jobs.v1.GetJobRequest - 68, // 74: saas.accounts.v1.PlatformAdminService.ReplayJob:input_type -> saas.jobs.v1.ReplayJobRequest - 69, // 75: saas.accounts.v1.PlatformAdminService.GetEventOperations:input_type -> saas.events.v1.GetEventOperationsRequest - 70, // 76: saas.accounts.v1.PlatformAdminService.ListEventSubscriptions:input_type -> saas.events.v1.ListEventSubscriptionsRequest - 48, // 77: saas.accounts.v1.PlatformAdminService.ListPlatformCatalogue:input_type -> saas.accounts.v1.ListPlatformCatalogueRequest - 51, // 78: saas.accounts.v1.PlatformAdminService.GetModuleEnvelope:input_type -> saas.accounts.v1.GetModuleEnvelopeRequest - 53, // 79: saas.accounts.v1.PlatformAdminService.PutModuleEnvelope:input_type -> saas.accounts.v1.PutModuleEnvelopeRequest - 4, // 80: saas.accounts.v1.PlatformAdminService.SearchUsers:output_type -> saas.accounts.v1.SearchUsersResponse - 71, // 81: saas.accounts.v1.PlatformAdminService.SuspendUser:output_type -> google.protobuf.Empty - 71, // 82: saas.accounts.v1.PlatformAdminService.UnsuspendUser:output_type -> google.protobuf.Empty - 13, // 83: saas.accounts.v1.PlatformAdminService.ImpersonateUser:output_type -> saas.accounts.v1.ImpersonateUserResponse - 15, // 84: saas.accounts.v1.PlatformAdminService.StopImpersonation:output_type -> saas.accounts.v1.StopImpersonationResponse - 18, // 85: saas.accounts.v1.PlatformAdminService.ListActiveSessions:output_type -> saas.accounts.v1.ListActiveSessionsResponse - 71, // 86: saas.accounts.v1.PlatformAdminService.RevokeSession:output_type -> google.protobuf.Empty - 21, // 87: saas.accounts.v1.PlatformAdminService.GetOrgEntitlements:output_type -> saas.accounts.v1.GetOrgEntitlementsResponse - 24, // 88: saas.accounts.v1.PlatformAdminService.OverrideEntitlement:output_type -> saas.accounts.v1.OverrideEntitlementResponse - 71, // 89: saas.accounts.v1.PlatformAdminService.GrantPlatformRole:output_type -> google.protobuf.Empty - 71, // 90: saas.accounts.v1.PlatformAdminService.RevokePlatformRole:output_type -> google.protobuf.Empty - 29, // 91: saas.accounts.v1.PlatformAdminService.ListPlatformAdmins:output_type -> saas.accounts.v1.ListPlatformAdminsResponse - 7, // 92: saas.accounts.v1.PlatformAdminService.ListAllOrganizations:output_type -> saas.accounts.v1.ListAllOrganizationsResponse - 9, // 93: saas.accounts.v1.PlatformAdminService.GetOrganizationRoster:output_type -> saas.accounts.v1.GetOrganizationRosterResponse - 32, // 94: saas.accounts.v1.PlatformAdminService.ListFeatureFlags:output_type -> saas.accounts.v1.ListFeatureFlagsResponse - 34, // 95: saas.accounts.v1.PlatformAdminService.UpsertFeatureFlag:output_type -> saas.accounts.v1.UpsertFeatureFlagResponse - 72, // 96: saas.accounts.v1.PlatformAdminService.GetJobOperations:output_type -> saas.jobs.v1.GetJobOperationsResponse - 73, // 97: saas.accounts.v1.PlatformAdminService.ListJobs:output_type -> saas.jobs.v1.ListJobsResponse - 74, // 98: saas.accounts.v1.PlatformAdminService.GetJob:output_type -> saas.jobs.v1.GetJobResponse - 75, // 99: saas.accounts.v1.PlatformAdminService.ReplayJob:output_type -> saas.jobs.v1.ReplayJobResponse - 76, // 100: saas.accounts.v1.PlatformAdminService.GetEventOperations:output_type -> saas.events.v1.GetEventOperationsResponse - 77, // 101: saas.accounts.v1.PlatformAdminService.ListEventSubscriptions:output_type -> saas.events.v1.ListEventSubscriptionsResponse - 49, // 102: saas.accounts.v1.PlatformAdminService.ListPlatformCatalogue:output_type -> saas.accounts.v1.ListPlatformCatalogueResponse - 52, // 103: saas.accounts.v1.PlatformAdminService.GetModuleEnvelope:output_type -> saas.accounts.v1.GetModuleEnvelopeResponse - 54, // 104: saas.accounts.v1.PlatformAdminService.PutModuleEnvelope:output_type -> saas.accounts.v1.PutModuleEnvelopeResponse - 80, // [80:105] is the sub-list for method output_type - 55, // [55:80] is the sub-list for method input_type - 55, // [55:55] is the sub-list for extension type_name - 55, // [55:55] is the sub-list for extension extendee - 0, // [0:55] is the sub-list for field type_name + 65, // 55: saas.accounts.v1.ModuleTenantIdentityMint.minted_at:type_name -> google.protobuf.Timestamp + 56, // 56: saas.accounts.v1.ResolveModuleTenantIdentityResponse.identity:type_name -> saas.accounts.v1.ModuleTenantIdentity + 57, // 57: saas.accounts.v1.ResolveModuleTenantIdentityResponse.recent:type_name -> saas.accounts.v1.ModuleTenantIdentityMint + 3, // 58: saas.accounts.v1.PlatformAdminService.SearchUsers:input_type -> saas.accounts.v1.SearchUsersRequest + 10, // 59: saas.accounts.v1.PlatformAdminService.SuspendUser:input_type -> saas.accounts.v1.SuspendUserRequest + 11, // 60: saas.accounts.v1.PlatformAdminService.UnsuspendUser:input_type -> saas.accounts.v1.UnsuspendUserRequest + 12, // 61: saas.accounts.v1.PlatformAdminService.ImpersonateUser:input_type -> saas.accounts.v1.ImpersonateUserRequest + 14, // 62: saas.accounts.v1.PlatformAdminService.StopImpersonation:input_type -> saas.accounts.v1.StopImpersonationRequest + 16, // 63: saas.accounts.v1.PlatformAdminService.ListActiveSessions:input_type -> saas.accounts.v1.ListActiveSessionsRequest + 19, // 64: saas.accounts.v1.PlatformAdminService.RevokeSession:input_type -> saas.accounts.v1.RevokeSessionRequest + 20, // 65: saas.accounts.v1.PlatformAdminService.GetOrgEntitlements:input_type -> saas.accounts.v1.GetOrgEntitlementsRequest + 23, // 66: saas.accounts.v1.PlatformAdminService.OverrideEntitlement:input_type -> saas.accounts.v1.OverrideEntitlementRequest + 25, // 67: saas.accounts.v1.PlatformAdminService.GrantPlatformRole:input_type -> saas.accounts.v1.GrantPlatformRoleRequest + 26, // 68: saas.accounts.v1.PlatformAdminService.RevokePlatformRole:input_type -> saas.accounts.v1.RevokePlatformRoleRequest + 27, // 69: saas.accounts.v1.PlatformAdminService.ListPlatformAdmins:input_type -> saas.accounts.v1.ListPlatformAdminsRequest + 5, // 70: saas.accounts.v1.PlatformAdminService.ListAllOrganizations:input_type -> saas.accounts.v1.ListAllOrganizationsRequest + 8, // 71: saas.accounts.v1.PlatformAdminService.GetOrganizationRoster:input_type -> saas.accounts.v1.GetOrganizationRosterRequest + 30, // 72: saas.accounts.v1.PlatformAdminService.ListFeatureFlags:input_type -> saas.accounts.v1.ListFeatureFlagsRequest + 33, // 73: saas.accounts.v1.PlatformAdminService.UpsertFeatureFlag:input_type -> saas.accounts.v1.UpsertFeatureFlagRequest + 69, // 74: saas.accounts.v1.PlatformAdminService.GetJobOperations:input_type -> saas.jobs.v1.GetJobOperationsRequest + 70, // 75: saas.accounts.v1.PlatformAdminService.ListJobs:input_type -> saas.jobs.v1.ListJobsRequest + 71, // 76: saas.accounts.v1.PlatformAdminService.GetJob:input_type -> saas.jobs.v1.GetJobRequest + 72, // 77: saas.accounts.v1.PlatformAdminService.ReplayJob:input_type -> saas.jobs.v1.ReplayJobRequest + 73, // 78: saas.accounts.v1.PlatformAdminService.GetEventOperations:input_type -> saas.events.v1.GetEventOperationsRequest + 74, // 79: saas.accounts.v1.PlatformAdminService.ListEventSubscriptions:input_type -> saas.events.v1.ListEventSubscriptionsRequest + 48, // 80: saas.accounts.v1.PlatformAdminService.ListPlatformCatalogue:input_type -> saas.accounts.v1.ListPlatformCatalogueRequest + 51, // 81: saas.accounts.v1.PlatformAdminService.GetModuleEnvelope:input_type -> saas.accounts.v1.GetModuleEnvelopeRequest + 53, // 82: saas.accounts.v1.PlatformAdminService.PutModuleEnvelope:input_type -> saas.accounts.v1.PutModuleEnvelopeRequest + 55, // 83: saas.accounts.v1.PlatformAdminService.ResolveModuleTenantIdentity:input_type -> saas.accounts.v1.ResolveModuleTenantIdentityRequest + 4, // 84: saas.accounts.v1.PlatformAdminService.SearchUsers:output_type -> saas.accounts.v1.SearchUsersResponse + 75, // 85: saas.accounts.v1.PlatformAdminService.SuspendUser:output_type -> google.protobuf.Empty + 75, // 86: saas.accounts.v1.PlatformAdminService.UnsuspendUser:output_type -> google.protobuf.Empty + 13, // 87: saas.accounts.v1.PlatformAdminService.ImpersonateUser:output_type -> saas.accounts.v1.ImpersonateUserResponse + 15, // 88: saas.accounts.v1.PlatformAdminService.StopImpersonation:output_type -> saas.accounts.v1.StopImpersonationResponse + 18, // 89: saas.accounts.v1.PlatformAdminService.ListActiveSessions:output_type -> saas.accounts.v1.ListActiveSessionsResponse + 75, // 90: saas.accounts.v1.PlatformAdminService.RevokeSession:output_type -> google.protobuf.Empty + 21, // 91: saas.accounts.v1.PlatformAdminService.GetOrgEntitlements:output_type -> saas.accounts.v1.GetOrgEntitlementsResponse + 24, // 92: saas.accounts.v1.PlatformAdminService.OverrideEntitlement:output_type -> saas.accounts.v1.OverrideEntitlementResponse + 75, // 93: saas.accounts.v1.PlatformAdminService.GrantPlatformRole:output_type -> google.protobuf.Empty + 75, // 94: saas.accounts.v1.PlatformAdminService.RevokePlatformRole:output_type -> google.protobuf.Empty + 29, // 95: saas.accounts.v1.PlatformAdminService.ListPlatformAdmins:output_type -> saas.accounts.v1.ListPlatformAdminsResponse + 7, // 96: saas.accounts.v1.PlatformAdminService.ListAllOrganizations:output_type -> saas.accounts.v1.ListAllOrganizationsResponse + 9, // 97: saas.accounts.v1.PlatformAdminService.GetOrganizationRoster:output_type -> saas.accounts.v1.GetOrganizationRosterResponse + 32, // 98: saas.accounts.v1.PlatformAdminService.ListFeatureFlags:output_type -> saas.accounts.v1.ListFeatureFlagsResponse + 34, // 99: saas.accounts.v1.PlatformAdminService.UpsertFeatureFlag:output_type -> saas.accounts.v1.UpsertFeatureFlagResponse + 76, // 100: saas.accounts.v1.PlatformAdminService.GetJobOperations:output_type -> saas.jobs.v1.GetJobOperationsResponse + 77, // 101: saas.accounts.v1.PlatformAdminService.ListJobs:output_type -> saas.jobs.v1.ListJobsResponse + 78, // 102: saas.accounts.v1.PlatformAdminService.GetJob:output_type -> saas.jobs.v1.GetJobResponse + 79, // 103: saas.accounts.v1.PlatformAdminService.ReplayJob:output_type -> saas.jobs.v1.ReplayJobResponse + 80, // 104: saas.accounts.v1.PlatformAdminService.GetEventOperations:output_type -> saas.events.v1.GetEventOperationsResponse + 81, // 105: saas.accounts.v1.PlatformAdminService.ListEventSubscriptions:output_type -> saas.events.v1.ListEventSubscriptionsResponse + 49, // 106: saas.accounts.v1.PlatformAdminService.ListPlatformCatalogue:output_type -> saas.accounts.v1.ListPlatformCatalogueResponse + 52, // 107: saas.accounts.v1.PlatformAdminService.GetModuleEnvelope:output_type -> saas.accounts.v1.GetModuleEnvelopeResponse + 54, // 108: saas.accounts.v1.PlatformAdminService.PutModuleEnvelope:output_type -> saas.accounts.v1.PutModuleEnvelopeResponse + 58, // 109: saas.accounts.v1.PlatformAdminService.ResolveModuleTenantIdentity:output_type -> saas.accounts.v1.ResolveModuleTenantIdentityResponse + 84, // [84:110] is the sub-list for method output_type + 58, // [58:84] is the sub-list for method input_type + 58, // [58:58] is the sub-list for extension type_name + 58, // [58:58] is the sub-list for extension extendee + 0, // [0:58] is the sub-list for field type_name } func init() { file_saas_accounts_v1_platform_admin_proto_init() } @@ -4313,7 +4673,7 @@ func file_saas_accounts_v1_platform_admin_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_saas_accounts_v1_platform_admin_proto_rawDesc), len(file_saas_accounts_v1_platform_admin_proto_rawDesc)), NumEnums: 3, - NumMessages: 55, + NumMessages: 59, NumExtensions: 0, NumServices: 1, }, diff --git a/module/services/accounts/code/pkg/gen/saas/accounts/v1/platform_admin.pb.gw.go b/module/services/accounts/code/pkg/gen/saas/accounts/v1/platform_admin.pb.gw.go index d2280caa9..81063e18f 100644 --- a/module/services/accounts/code/pkg/gen/saas/accounts/v1/platform_admin.pb.gw.go +++ b/module/services/accounts/code/pkg/gen/saas/accounts/v1/platform_admin.pb.gw.go @@ -838,6 +838,41 @@ func local_request_PlatformAdminService_PutModuleEnvelope_0(ctx context.Context, return msg, metadata, err } +var filter_PlatformAdminService_ResolveModuleTenantIdentity_0 = &utilities.DoubleArray{Encoding: map[string]int{}, Base: []int(nil), Check: []int(nil)} + +func request_PlatformAdminService_ResolveModuleTenantIdentity_0(ctx context.Context, marshaler runtime.Marshaler, client PlatformAdminServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) { + var ( + protoReq ResolveModuleTenantIdentityRequest + metadata runtime.ServerMetadata + ) + if req.Body != nil { + _, _ = io.Copy(io.Discard, req.Body) + } + if err := req.ParseForm(); err != nil { + return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err) + } + if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_PlatformAdminService_ResolveModuleTenantIdentity_0); err != nil { + return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err) + } + msg, err := client.ResolveModuleTenantIdentity(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD)) + return msg, metadata, err +} + +func local_request_PlatformAdminService_ResolveModuleTenantIdentity_0(ctx context.Context, marshaler runtime.Marshaler, server PlatformAdminServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) { + var ( + protoReq ResolveModuleTenantIdentityRequest + metadata runtime.ServerMetadata + ) + if err := req.ParseForm(); err != nil { + return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err) + } + if err := runtime.PopulateQueryParameters(&protoReq, req.Form, filter_PlatformAdminService_ResolveModuleTenantIdentity_0); err != nil { + return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err) + } + msg, err := server.ResolveModuleTenantIdentity(ctx, &protoReq) + return msg, metadata, err +} + // RegisterPlatformAdminServiceHandlerServer registers the http handlers for service PlatformAdminService to "mux". // UnaryRPC :call PlatformAdminServiceServer directly. // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906. @@ -1304,6 +1339,26 @@ func RegisterPlatformAdminServiceHandlerServer(ctx context.Context, mux *runtime } forward_PlatformAdminService_PutModuleEnvelope_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...) }) + mux.Handle(http.MethodGet, pattern_PlatformAdminService_ResolveModuleTenantIdentity_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) { + ctx, cancel := context.WithCancel(req.Context()) + defer cancel() + var stream runtime.ServerTransportStream + ctx = grpc.NewContextWithServerTransportStream(ctx, &stream) + inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req) + annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity", runtime.WithHTTPPathPattern("/v1/platform/module-tenant-identity")) + if err != nil { + runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err) + return + } + resp, md, err := local_request_PlatformAdminService_ResolveModuleTenantIdentity_0(annotatedContext, inboundMarshaler, server, req, pathParams) + md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer()) + annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md) + if err != nil { + runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err) + return + } + forward_PlatformAdminService_ResolveModuleTenantIdentity_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...) + }) return nil } @@ -1735,57 +1790,76 @@ func RegisterPlatformAdminServiceHandlerClient(ctx context.Context, mux *runtime } forward_PlatformAdminService_PutModuleEnvelope_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...) }) + mux.Handle(http.MethodGet, pattern_PlatformAdminService_ResolveModuleTenantIdentity_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) { + ctx, cancel := context.WithCancel(req.Context()) + defer cancel() + inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req) + annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity", runtime.WithHTTPPathPattern("/v1/platform/module-tenant-identity")) + if err != nil { + runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err) + return + } + resp, md, err := request_PlatformAdminService_ResolveModuleTenantIdentity_0(annotatedContext, inboundMarshaler, client, req, pathParams) + annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md) + if err != nil { + runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err) + return + } + forward_PlatformAdminService_ResolveModuleTenantIdentity_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...) + }) return nil } var ( - pattern_PlatformAdminService_SearchUsers_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "users"}, "")) - pattern_PlatformAdminService_SuspendUser_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"v1", "platform", "users", "user_id"}, "suspend")) - pattern_PlatformAdminService_UnsuspendUser_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"v1", "platform", "users", "user_id"}, "unsuspend")) - pattern_PlatformAdminService_ImpersonateUser_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"v1", "platform", "users", "user_id"}, "impersonate")) - pattern_PlatformAdminService_StopImpersonation_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "impersonation"}, "stop")) - pattern_PlatformAdminService_ListActiveSessions_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "sessions"}, "")) - pattern_PlatformAdminService_RevokeSession_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"v1", "platform", "sessions", "session_id"}, "")) - pattern_PlatformAdminService_GetOrgEntitlements_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4}, []string{"v1", "platform", "organizations", "org_id", "entitlements"}, "")) - pattern_PlatformAdminService_OverrideEntitlement_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4}, []string{"v1", "platform", "organizations", "org_id", "entitlements"}, "")) - pattern_PlatformAdminService_GrantPlatformRole_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "admins"}, "")) - pattern_PlatformAdminService_RevokePlatformRole_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"v1", "platform", "admins", "user_id"}, "")) - pattern_PlatformAdminService_ListPlatformAdmins_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "admins"}, "")) - pattern_PlatformAdminService_ListFeatureFlags_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "feature-flags"}, "")) - pattern_PlatformAdminService_UpsertFeatureFlag_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"v1", "platform", "feature-flags", "name"}, "")) - pattern_PlatformAdminService_GetJobOperations_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "platform", "jobs", "operations"}, "")) - pattern_PlatformAdminService_ListJobs_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "jobs"}, "")) - pattern_PlatformAdminService_GetJob_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"v1", "platform", "jobs", "job_id"}, "")) - pattern_PlatformAdminService_ReplayJob_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"v1", "platform", "jobs", "source_job_id"}, "replay")) - pattern_PlatformAdminService_GetEventOperations_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "platform", "events", "operations"}, "")) - pattern_PlatformAdminService_ListEventSubscriptions_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "platform", "events", "subscriptions"}, "")) - pattern_PlatformAdminService_ListPlatformCatalogue_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "catalogue"}, "")) - pattern_PlatformAdminService_GetModuleEnvelope_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "module-envelope"}, "")) - pattern_PlatformAdminService_PutModuleEnvelope_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "module-envelope"}, "")) + pattern_PlatformAdminService_SearchUsers_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "users"}, "")) + pattern_PlatformAdminService_SuspendUser_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"v1", "platform", "users", "user_id"}, "suspend")) + pattern_PlatformAdminService_UnsuspendUser_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"v1", "platform", "users", "user_id"}, "unsuspend")) + pattern_PlatformAdminService_ImpersonateUser_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"v1", "platform", "users", "user_id"}, "impersonate")) + pattern_PlatformAdminService_StopImpersonation_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "impersonation"}, "stop")) + pattern_PlatformAdminService_ListActiveSessions_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "sessions"}, "")) + pattern_PlatformAdminService_RevokeSession_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"v1", "platform", "sessions", "session_id"}, "")) + pattern_PlatformAdminService_GetOrgEntitlements_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4}, []string{"v1", "platform", "organizations", "org_id", "entitlements"}, "")) + pattern_PlatformAdminService_OverrideEntitlement_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3, 2, 4}, []string{"v1", "platform", "organizations", "org_id", "entitlements"}, "")) + pattern_PlatformAdminService_GrantPlatformRole_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "admins"}, "")) + pattern_PlatformAdminService_RevokePlatformRole_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"v1", "platform", "admins", "user_id"}, "")) + pattern_PlatformAdminService_ListPlatformAdmins_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "admins"}, "")) + pattern_PlatformAdminService_ListFeatureFlags_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "feature-flags"}, "")) + pattern_PlatformAdminService_UpsertFeatureFlag_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"v1", "platform", "feature-flags", "name"}, "")) + pattern_PlatformAdminService_GetJobOperations_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "platform", "jobs", "operations"}, "")) + pattern_PlatformAdminService_ListJobs_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "jobs"}, "")) + pattern_PlatformAdminService_GetJob_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"v1", "platform", "jobs", "job_id"}, "")) + pattern_PlatformAdminService_ReplayJob_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 1, 0, 4, 1, 5, 3}, []string{"v1", "platform", "jobs", "source_job_id"}, "replay")) + pattern_PlatformAdminService_GetEventOperations_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "platform", "events", "operations"}, "")) + pattern_PlatformAdminService_ListEventSubscriptions_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2, 2, 3}, []string{"v1", "platform", "events", "subscriptions"}, "")) + pattern_PlatformAdminService_ListPlatformCatalogue_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "catalogue"}, "")) + pattern_PlatformAdminService_GetModuleEnvelope_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "module-envelope"}, "")) + pattern_PlatformAdminService_PutModuleEnvelope_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "module-envelope"}, "")) + pattern_PlatformAdminService_ResolveModuleTenantIdentity_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1, 2, 2}, []string{"v1", "platform", "module-tenant-identity"}, "")) ) var ( - forward_PlatformAdminService_SearchUsers_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_SuspendUser_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_UnsuspendUser_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_ImpersonateUser_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_StopImpersonation_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_ListActiveSessions_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_RevokeSession_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_GetOrgEntitlements_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_OverrideEntitlement_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_GrantPlatformRole_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_RevokePlatformRole_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_ListPlatformAdmins_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_ListFeatureFlags_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_UpsertFeatureFlag_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_GetJobOperations_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_ListJobs_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_GetJob_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_ReplayJob_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_GetEventOperations_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_ListEventSubscriptions_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_ListPlatformCatalogue_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_GetModuleEnvelope_0 = runtime.ForwardResponseMessage - forward_PlatformAdminService_PutModuleEnvelope_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_SearchUsers_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_SuspendUser_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_UnsuspendUser_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_ImpersonateUser_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_StopImpersonation_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_ListActiveSessions_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_RevokeSession_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_GetOrgEntitlements_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_OverrideEntitlement_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_GrantPlatformRole_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_RevokePlatformRole_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_ListPlatformAdmins_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_ListFeatureFlags_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_UpsertFeatureFlag_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_GetJobOperations_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_ListJobs_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_GetJob_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_ReplayJob_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_GetEventOperations_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_ListEventSubscriptions_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_ListPlatformCatalogue_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_GetModuleEnvelope_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_PutModuleEnvelope_0 = runtime.ForwardResponseMessage + forward_PlatformAdminService_ResolveModuleTenantIdentity_0 = runtime.ForwardResponseMessage ) diff --git a/module/services/accounts/code/pkg/gen/saas/accounts/v1/platform_admin_grpc.pb.go b/module/services/accounts/code/pkg/gen/saas/accounts/v1/platform_admin_grpc.pb.go index 3b68a7de0..a377abeb9 100644 --- a/module/services/accounts/code/pkg/gen/saas/accounts/v1/platform_admin_grpc.pb.go +++ b/module/services/accounts/code/pkg/gen/saas/accounts/v1/platform_admin_grpc.pb.go @@ -23,31 +23,32 @@ import ( const _ = grpc.SupportPackageIsVersion9 const ( - PlatformAdminService_SearchUsers_FullMethodName = "/saas.accounts.v1.PlatformAdminService/SearchUsers" - PlatformAdminService_SuspendUser_FullMethodName = "/saas.accounts.v1.PlatformAdminService/SuspendUser" - PlatformAdminService_UnsuspendUser_FullMethodName = "/saas.accounts.v1.PlatformAdminService/UnsuspendUser" - PlatformAdminService_ImpersonateUser_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ImpersonateUser" - PlatformAdminService_StopImpersonation_FullMethodName = "/saas.accounts.v1.PlatformAdminService/StopImpersonation" - PlatformAdminService_ListActiveSessions_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ListActiveSessions" - PlatformAdminService_RevokeSession_FullMethodName = "/saas.accounts.v1.PlatformAdminService/RevokeSession" - PlatformAdminService_GetOrgEntitlements_FullMethodName = "/saas.accounts.v1.PlatformAdminService/GetOrgEntitlements" - PlatformAdminService_OverrideEntitlement_FullMethodName = "/saas.accounts.v1.PlatformAdminService/OverrideEntitlement" - PlatformAdminService_GrantPlatformRole_FullMethodName = "/saas.accounts.v1.PlatformAdminService/GrantPlatformRole" - PlatformAdminService_RevokePlatformRole_FullMethodName = "/saas.accounts.v1.PlatformAdminService/RevokePlatformRole" - PlatformAdminService_ListPlatformAdmins_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ListPlatformAdmins" - PlatformAdminService_ListAllOrganizations_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ListAllOrganizations" - PlatformAdminService_GetOrganizationRoster_FullMethodName = "/saas.accounts.v1.PlatformAdminService/GetOrganizationRoster" - PlatformAdminService_ListFeatureFlags_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ListFeatureFlags" - PlatformAdminService_UpsertFeatureFlag_FullMethodName = "/saas.accounts.v1.PlatformAdminService/UpsertFeatureFlag" - PlatformAdminService_GetJobOperations_FullMethodName = "/saas.accounts.v1.PlatformAdminService/GetJobOperations" - PlatformAdminService_ListJobs_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ListJobs" - PlatformAdminService_GetJob_FullMethodName = "/saas.accounts.v1.PlatformAdminService/GetJob" - PlatformAdminService_ReplayJob_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ReplayJob" - PlatformAdminService_GetEventOperations_FullMethodName = "/saas.accounts.v1.PlatformAdminService/GetEventOperations" - PlatformAdminService_ListEventSubscriptions_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ListEventSubscriptions" - PlatformAdminService_ListPlatformCatalogue_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ListPlatformCatalogue" - PlatformAdminService_GetModuleEnvelope_FullMethodName = "/saas.accounts.v1.PlatformAdminService/GetModuleEnvelope" - PlatformAdminService_PutModuleEnvelope_FullMethodName = "/saas.accounts.v1.PlatformAdminService/PutModuleEnvelope" + PlatformAdminService_SearchUsers_FullMethodName = "/saas.accounts.v1.PlatformAdminService/SearchUsers" + PlatformAdminService_SuspendUser_FullMethodName = "/saas.accounts.v1.PlatformAdminService/SuspendUser" + PlatformAdminService_UnsuspendUser_FullMethodName = "/saas.accounts.v1.PlatformAdminService/UnsuspendUser" + PlatformAdminService_ImpersonateUser_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ImpersonateUser" + PlatformAdminService_StopImpersonation_FullMethodName = "/saas.accounts.v1.PlatformAdminService/StopImpersonation" + PlatformAdminService_ListActiveSessions_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ListActiveSessions" + PlatformAdminService_RevokeSession_FullMethodName = "/saas.accounts.v1.PlatformAdminService/RevokeSession" + PlatformAdminService_GetOrgEntitlements_FullMethodName = "/saas.accounts.v1.PlatformAdminService/GetOrgEntitlements" + PlatformAdminService_OverrideEntitlement_FullMethodName = "/saas.accounts.v1.PlatformAdminService/OverrideEntitlement" + PlatformAdminService_GrantPlatformRole_FullMethodName = "/saas.accounts.v1.PlatformAdminService/GrantPlatformRole" + PlatformAdminService_RevokePlatformRole_FullMethodName = "/saas.accounts.v1.PlatformAdminService/RevokePlatformRole" + PlatformAdminService_ListPlatformAdmins_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ListPlatformAdmins" + PlatformAdminService_ListAllOrganizations_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ListAllOrganizations" + PlatformAdminService_GetOrganizationRoster_FullMethodName = "/saas.accounts.v1.PlatformAdminService/GetOrganizationRoster" + PlatformAdminService_ListFeatureFlags_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ListFeatureFlags" + PlatformAdminService_UpsertFeatureFlag_FullMethodName = "/saas.accounts.v1.PlatformAdminService/UpsertFeatureFlag" + PlatformAdminService_GetJobOperations_FullMethodName = "/saas.accounts.v1.PlatformAdminService/GetJobOperations" + PlatformAdminService_ListJobs_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ListJobs" + PlatformAdminService_GetJob_FullMethodName = "/saas.accounts.v1.PlatformAdminService/GetJob" + PlatformAdminService_ReplayJob_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ReplayJob" + PlatformAdminService_GetEventOperations_FullMethodName = "/saas.accounts.v1.PlatformAdminService/GetEventOperations" + PlatformAdminService_ListEventSubscriptions_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ListEventSubscriptions" + PlatformAdminService_ListPlatformCatalogue_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ListPlatformCatalogue" + PlatformAdminService_GetModuleEnvelope_FullMethodName = "/saas.accounts.v1.PlatformAdminService/GetModuleEnvelope" + PlatformAdminService_PutModuleEnvelope_FullMethodName = "/saas.accounts.v1.PlatformAdminService/PutModuleEnvelope" + PlatformAdminService_ResolveModuleTenantIdentity_FullMethodName = "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity" ) // PlatformAdminServiceClient is the client API for PlatformAdminService service. @@ -114,6 +115,10 @@ type PlatformAdminServiceClient interface { // effect at the next check with no restart: the module registry is derived // again from it, so a narrowing removes what the new ceiling no longer allows. PutModuleEnvelope(ctx context.Context, in *PutModuleEnvelopeRequest, opts ...grpc.CallOption) (*PutModuleEnvelopeResponse, error) + // ResolveModuleTenantIdentity answers what a per-tenant module operation + // context would assert for one module, one of its bindings and one + // organization — or why it would be refused. It issues no capability. + ResolveModuleTenantIdentity(ctx context.Context, in *ResolveModuleTenantIdentityRequest, opts ...grpc.CallOption) (*ResolveModuleTenantIdentityResponse, error) } type platformAdminServiceClient struct { @@ -375,6 +380,16 @@ func (c *platformAdminServiceClient) PutModuleEnvelope(ctx context.Context, in * return out, nil } +func (c *platformAdminServiceClient) ResolveModuleTenantIdentity(ctx context.Context, in *ResolveModuleTenantIdentityRequest, opts ...grpc.CallOption) (*ResolveModuleTenantIdentityResponse, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(ResolveModuleTenantIdentityResponse) + err := c.cc.Invoke(ctx, PlatformAdminService_ResolveModuleTenantIdentity_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + // PlatformAdminServiceServer is the server API for PlatformAdminService service. // All implementations must embed UnimplementedPlatformAdminServiceServer // for forward compatibility. @@ -439,6 +454,10 @@ type PlatformAdminServiceServer interface { // effect at the next check with no restart: the module registry is derived // again from it, so a narrowing removes what the new ceiling no longer allows. PutModuleEnvelope(context.Context, *PutModuleEnvelopeRequest) (*PutModuleEnvelopeResponse, error) + // ResolveModuleTenantIdentity answers what a per-tenant module operation + // context would assert for one module, one of its bindings and one + // organization — or why it would be refused. It issues no capability. + ResolveModuleTenantIdentity(context.Context, *ResolveModuleTenantIdentityRequest) (*ResolveModuleTenantIdentityResponse, error) mustEmbedUnimplementedPlatformAdminServiceServer() } @@ -524,6 +543,9 @@ func (UnimplementedPlatformAdminServiceServer) GetModuleEnvelope(context.Context func (UnimplementedPlatformAdminServiceServer) PutModuleEnvelope(context.Context, *PutModuleEnvelopeRequest) (*PutModuleEnvelopeResponse, error) { return nil, status.Error(codes.Unimplemented, "method PutModuleEnvelope not implemented") } +func (UnimplementedPlatformAdminServiceServer) ResolveModuleTenantIdentity(context.Context, *ResolveModuleTenantIdentityRequest) (*ResolveModuleTenantIdentityResponse, error) { + return nil, status.Error(codes.Unimplemented, "method ResolveModuleTenantIdentity not implemented") +} func (UnimplementedPlatformAdminServiceServer) mustEmbedUnimplementedPlatformAdminServiceServer() {} func (UnimplementedPlatformAdminServiceServer) testEmbeddedByValue() {} @@ -995,6 +1017,24 @@ func _PlatformAdminService_PutModuleEnvelope_Handler(srv interface{}, ctx contex return interceptor(ctx, in, info, handler) } +func _PlatformAdminService_ResolveModuleTenantIdentity_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(ResolveModuleTenantIdentityRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(PlatformAdminServiceServer).ResolveModuleTenantIdentity(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: PlatformAdminService_ResolveModuleTenantIdentity_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(PlatformAdminServiceServer).ResolveModuleTenantIdentity(ctx, req.(*ResolveModuleTenantIdentityRequest)) + } + return interceptor(ctx, in, info, handler) +} + // PlatformAdminService_ServiceDesc is the grpc.ServiceDesc for PlatformAdminService service. // It's only intended for direct use with grpc.RegisterService, // and not to be introspected or modified (even as a copy) @@ -1102,6 +1142,10 @@ var PlatformAdminService_ServiceDesc = grpc.ServiceDesc{ MethodName: "PutModuleEnvelope", Handler: _PlatformAdminService_PutModuleEnvelope_Handler, }, + { + MethodName: "ResolveModuleTenantIdentity", + Handler: _PlatformAdminService_ResolveModuleTenantIdentity_Handler, + }, }, Streams: []grpc.StreamDesc{}, Metadata: "saas/accounts/v1/platform_admin.proto", diff --git a/module/services/accounts/code/work.go b/module/services/accounts/code/work.go index 9a5ff75b4..180e3230e 100644 --- a/module/services/accounts/code/work.go +++ b/module/services/accounts/code/work.go @@ -1143,6 +1143,17 @@ func doWork(ctx context.Context) (Clean, error) { perSourceWebhookMounted := strings.EqualFold( strings.TrimSpace(workspaceEnv("github-app", "DATASOURCE_GITHUB_WEBHOOK_ENABLED")), "true") service.SetDatasourceWebhookReceiverMounted(perSourceWebhookMounted) + + // Whether this host still fires the reconcile schedule it DECLARES, which + // is a labelled stopgap (business/datasource_deliveries.go) and the one + // switch a composition turns off the moment a module consumes the + // declaration — the two must never both run (issue #1121, N7). A declared + // key of the application group rather than an ambient variable, and ON + // unless it says `false`: that is what every deployment does today, and a + // default that silently stopped every scheduled reconcile is the outage + // #1090 already caused once. + service.SetDatasourceReconcileSweep(!strings.EqualFold( + strings.TrimSpace(workspaceEnv("application", "DATASOURCE_RECONCILE_SWEEP_ENABLED")), "false")) if perSourceWebhookMounted { adapters.RegisterHTTPRoute(datasource.GitHubWebhookPath, datasource.NewHandler( datasource.GitHubWebhookPath, @@ -1232,6 +1243,13 @@ func doWork(ctx context.Context) (Clean, error) { // occurrence of the declared trigger admits // DatasourceService/ReconcileSource, which reaches exactly the engines // this sweep reaches. + // Off when the operator says something else fires it. The switch is + // read once at startup and told to the service; the refusal lives in + // RunDatasourceReconcile (SetDatasourceReconcileSweep), so this + // callback still runs on every tick and finds a sweep that reads + // nothing. Guarding the sweep rather than the ticker is deliberate: a + // host that only dropped the tick would still sweep from any other + // caller. sweepReconcile := func() { if n, err := service.RunDatasourceReconcile(retentionCtx); err != nil { rw.Warn("datasource reconcile sweep failed", wool.ErrField(err)) diff --git a/module/services/accounts/generated/api-contract-surfaces.json b/module/services/accounts/generated/api-contract-surfaces.json index 5afcab925..98967d18c 100644 --- a/module/services/accounts/generated/api-contract-surfaces.json +++ b/module/services/accounts/generated/api-contract-surfaces.json @@ -388,6 +388,7 @@ "/saas.accounts.v1.PlatformAdminService/OverrideEntitlement", "/saas.accounts.v1.PlatformAdminService/PutModuleEnvelope", "/saas.accounts.v1.PlatformAdminService/ReplayJob", + "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity", "/saas.accounts.v1.PlatformAdminService/RevokePlatformRole", "/saas.accounts.v1.PlatformAdminService/RevokeSession", "/saas.accounts.v1.PlatformAdminService/SearchUsers", diff --git a/module/services/accounts/generated/authz-methods.json b/module/services/accounts/generated/authz-methods.json index 513aba766..d61a77af8 100644 --- a/module/services/accounts/generated/authz-methods.json +++ b/module/services/accounts/generated/authz-methods.json @@ -8259,6 +8259,43 @@ "policy_sha256": "ca332de30ec2ccedf0bc703de994eb50cb7f2055c2574c330b0cb421134caf25", "rate_limit_backend_failure_mode": "RATE_LIMIT_BACKEND_FAILURE_MODE_FAIL_OPEN" }, + { + "procedure": "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity", + "full_service": "saas.accounts.v1.PlatformAdminService", + "method": "ResolveModuleTenantIdentity", + "input_type": "saas.accounts.v1.ResolveModuleTenantIdentityRequest", + "output_type": "saas.accounts.v1.ResolveModuleTenantIdentityResponse", + "client_streaming": false, + "server_streaming": false, + "policy": { + "exposure": "EXPOSURE_AUTHENTICATED", + "tenant": "TENANT_REQUIREMENT_NONE", + "permissions": [], + "scopes": [], + "resource_bindings": [], + "mfa": "MFA_REQUIREMENT_NONE", + "audit": { + "events": [], + "emission": "AUDIT_EMISSION_NONE" + }, + "idempotency": "IDEMPOTENCY_REQUIREMENT_FORBIDDEN", + "rate_limit": "RATE_LIMIT_CLASS_SENSITIVE", + "request_sensitivity": "SENSITIVITY_CONFIDENTIAL", + "response_sensitivity": "SENSITIVITY_CONFIDENTIAL", + "platform_role": "PLATFORM_ROLE_REQUIREMENT_SUPER_ADMIN", + "authentication_factor_attempt": false, + "conditions": [], + "impersonation": "IMPERSONATION_REQUIREMENT_UNSPECIFIED" + }, + "policy_tier": "platform_admin", + "owner": { + "module": "saas-starter", + "service": "accounts" + }, + "source_proto": "saas/accounts/v1/platform_admin.proto", + "policy_sha256": "e3ae6ee3f1b70dbabb131e3a486c403859c0f3540c61dca8132317bd1be9d7b3", + "rate_limit_backend_failure_mode": "RATE_LIMIT_BACKEND_FAILURE_MODE_FAIL_OPEN" + }, { "procedure": "/saas.accounts.v1.PlatformAdminService/RevokePlatformRole", "full_service": "saas.accounts.v1.PlatformAdminService", diff --git a/module/services/accounts/generated/gateway-routes.json b/module/services/accounts/generated/gateway-routes.json index 70a35eb51..6c28cf34c 100644 --- a/module/services/accounts/generated/gateway-routes.json +++ b/module/services/accounts/generated/gateway-routes.json @@ -2545,6 +2545,22 @@ "rewrite_path": "/saas.accounts.v1.PlatformAdminService/ReplayJob", "remove_after": "2026-10-11" }, + { + "protocol": "GATEWAY_PROTOCOL_CONNECT", + "method": "POST", + "path": "/customers.PlatformAdminService/ResolveModuleTenantIdentity", + "match": "GATEWAY_MATCH_EXACT", + "procedure": "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity", + "owner": { + "module": "saas-starter", + "service": "accounts" + }, + "upstream_endpoint": "connect", + "exposure": "EXPOSURE_AUTHENTICATED", + "source": "GATEWAY_ROUTE_SOURCE_COMPATIBILITY_ALIAS", + "rewrite_path": "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity", + "remove_after": "2026-10-11" + }, { "protocol": "GATEWAY_PROTOCOL_CONNECT", "method": "POST", @@ -5985,6 +6001,22 @@ "rewrite_path": "", "remove_after": "" }, + { + "protocol": "GATEWAY_PROTOCOL_CONNECT", + "method": "POST", + "path": "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity", + "match": "GATEWAY_MATCH_EXACT", + "procedure": "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity", + "owner": { + "module": "saas-starter", + "service": "accounts" + }, + "upstream_endpoint": "connect", + "exposure": "EXPOSURE_AUTHENTICATED", + "source": "GATEWAY_ROUTE_SOURCE_DESCRIPTOR", + "rewrite_path": "", + "remove_after": "" + }, { "protocol": "GATEWAY_PROTOCOL_CONNECT", "method": "POST", @@ -7873,6 +7905,22 @@ "rewrite_path": "", "remove_after": "" }, + { + "protocol": "GATEWAY_PROTOCOL_REST", + "method": "GET", + "path": "/v1/platform/module-tenant-identity", + "match": "GATEWAY_MATCH_EXACT", + "procedure": "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity", + "owner": { + "module": "saas-starter", + "service": "accounts" + }, + "upstream_endpoint": "rest", + "exposure": "EXPOSURE_AUTHENTICATED", + "source": "GATEWAY_ROUTE_SOURCE_DESCRIPTOR", + "rewrite_path": "", + "remove_after": "" + }, { "protocol": "GATEWAY_PROTOCOL_REST", "method": "GET", diff --git a/module/services/accounts/generated/openapi-raw/api.swagger.json b/module/services/accounts/generated/openapi-raw/api.swagger.json index 72aaa430c..37797034a 100644 --- a/module/services/accounts/generated/openapi-raw/api.swagger.json +++ b/module/services/accounts/generated/openapi-raw/api.swagger.json @@ -4032,6 +4032,51 @@ ] } }, + "/v1/platform/module-tenant-identity": { + "get": { + "summary": "ResolveModuleTenantIdentity answers what a per-tenant module operation\ncontext would assert for one module, one of its bindings and one\norganization — or why it would be refused. It issues no capability.", + "operationId": "PlatformAdminService_ResolveModuleTenantIdentity", + "responses": { + "200": { + "description": "A successful response.", + "schema": { + "$ref": "#/definitions/v1ResolveModuleTenantIdentityResponse" + } + }, + "default": { + "description": "An unexpected error response.", + "schema": { + "$ref": "#/definitions/rpcStatus" + } + } + }, + "parameters": [ + { + "name": "prefix", + "description": "prefix is the module principal's registration prefix and binding the key\nof its operation_audiences entry.", + "in": "query", + "required": false, + "type": "string" + }, + { + "name": "binding", + "in": "query", + "required": false, + "type": "string" + }, + { + "name": "organizationId", + "description": "organization_id is the tenant the capability would act for.", + "in": "query", + "required": false, + "type": "string" + } + ], + "tags": [ + "PlatformAdminService" + ] + } + }, "/v1/platform/organizations/{orgId}/entitlements": { "get": { "summary": "Entitlements \u0026 billing", @@ -10107,6 +10152,72 @@ }, "description": "ModuleEnvelope is one revision of the module envelope: the authority ceiling a\nplatform super_admin writes, which every module principal on this host is\nderived inside. Revisions are append-only; the current ceiling is the\nhighest." }, + "v1ModuleTenantIdentity": { + "type": "object", + "properties": { + "principalId": { + "type": "string", + "description": "principal_id is the module's own service principal, which owns the\ncapability and acts directly — there is no person and no actor hop." + }, + "tenant": { + "type": "string", + "description": "tenant is the organization it would act for, and audience the service the\nbinding declares it may call. A binding whose audience is the module's own\nprefix is one the module admits itself, which is how unattended work is\nadmitted by the module that executes it." + }, + "audience": { + "type": "string" + }, + "scopes": { + "type": "array", + "items": { + "type": "string" + }, + "description": "scopes is exactly what the capability would carry, as\n`kind:action[:resource]`: the binding's headless_scopes narrowed by THIS\norganization's installation scope. Never its invoke_scopes, which describe\nauthority exercised on a person's behalf." + }, + "lifetimeSeconds": { + "type": "string", + "format": "int64", + "description": "lifetime_seconds is the fixed lifetime every such capability carries." + }, + "revision": { + "type": "string", + "format": "uint64", + "description": "revision is the authorization revision it would be sealed with: a digest\nof the module's whole effective entry, so any change to the entry stops\nconfirming every capability minted under the old one." + }, + "shared": { + "type": "boolean", + "description": "shared says the principal is unpinned and declares cross_tenant, so it may\nact for more than one organization. A pinned principal reads false and can\nonly ever name the tenant its envelope declares." + } + }, + "description": "ModuleTenantIdentity is what one per-tenant mint would assert. Every field is\nthe host's: nothing here is requestable." + }, + "v1ModuleTenantIdentityMint": { + "type": "object", + "properties": { + "record": { + "type": "string" + }, + "tenant": { + "type": "string" + }, + "binding": { + "type": "string" + }, + "audience": { + "type": "string" + }, + "scopes": { + "type": "array", + "items": { + "type": "string" + } + }, + "mintedAt": { + "type": "string", + "format": "date-time" + } + }, + "description": "ModuleTenantIdentityMint is one capability actually issued, as the audit\ntrail recorded it. There is no other record: a capability lives a minute and\nnothing caches one." + }, "v1Notification": { "type": "object", "properties": { @@ -11036,6 +11147,26 @@ "v1RequestDeletionRequest": { "type": "object" }, + "v1ResolveModuleTenantIdentityResponse": { + "type": "object", + "properties": { + "identity": { + "$ref": "#/definitions/v1ModuleTenantIdentity", + "description": "identity is set when a mint for this organization would be issued; refusal\nsays why it would not. Exactly one is present, and a refusal is a decision\nabout declared authority rather than an outage." + }, + "refusal": { + "type": "string" + }, + "recent": { + "type": "array", + "items": { + "type": "object", + "$ref": "#/definitions/v1ModuleTenantIdentityMint" + }, + "description": "recent is the trail of capabilities this module was actually issued for\nthis organization, newest first." + } + } + }, "v1Role": { "type": "object", "properties": { diff --git a/module/services/accounts/generated/rest-surface.json b/module/services/accounts/generated/rest-surface.json index 54a7998bc..2ade0c91f 100644 --- a/module/services/accounts/generated/rest-surface.json +++ b/module/services/accounts/generated/rest-surface.json @@ -997,6 +997,22 @@ "rewrite_path": "", "remove_after": "" }, + { + "protocol": "GATEWAY_PROTOCOL_REST", + "method": "GET", + "path": "/v1/platform/module-tenant-identity", + "match": "GATEWAY_MATCH_EXACT", + "procedure": "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity", + "owner": { + "module": "saas-starter", + "service": "accounts" + }, + "upstream_endpoint": "rest", + "exposure": "EXPOSURE_AUTHENTICATED", + "source": "GATEWAY_ROUTE_SOURCE_DESCRIPTOR", + "rewrite_path": "", + "remove_after": "" + }, { "protocol": "GATEWAY_PROTOCOL_REST", "method": "GET", diff --git a/module/services/accounts/generated/service-catalog.json b/module/services/accounts/generated/service-catalog.json index 0709b18c2..ba3e3a1ef 100644 --- a/module/services/accounts/generated/service-catalog.json +++ b/module/services/accounts/generated/service-catalog.json @@ -349,6 +349,7 @@ "/saas.accounts.v1.PlatformAdminService/OverrideEntitlement", "/saas.accounts.v1.PlatformAdminService/PutModuleEnvelope", "/saas.accounts.v1.PlatformAdminService/ReplayJob", + "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity", "/saas.accounts.v1.PlatformAdminService/RevokePlatformRole", "/saas.accounts.v1.PlatformAdminService/RevokeSession", "/saas.accounts.v1.PlatformAdminService/SearchUsers", @@ -10875,6 +10876,57 @@ "service": "accounts" } }, + { + "procedure": "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity", + "service": "PlatformAdminService", + "full_service": "saas.accounts.v1.PlatformAdminService", + "method": "ResolveModuleTenantIdentity", + "input_type": "saas.accounts.v1.ResolveModuleTenantIdentityRequest", + "output_type": "saas.accounts.v1.ResolveModuleTenantIdentityResponse", + "client_streaming": false, + "server_streaming": false, + "deprecated": false, + "source_proto": "saas/accounts/v1/platform_admin.proto", + "protocols": [ + "PROTOCOL_GRPC", + "PROTOCOL_CONNECT", + "PROTOCOL_REST" + ], + "http_bindings": [ + { + "method": "GET", + "path": "/v1/platform/module-tenant-identity", + "body": "", + "response_body": "" + } + ], + "policy": { + "exposure": "EXPOSURE_AUTHENTICATED", + "tenant": "TENANT_REQUIREMENT_NONE", + "permissions": [], + "scopes": [], + "resource_bindings": [], + "mfa": "MFA_REQUIREMENT_NONE", + "audit": { + "events": [], + "emission": "AUDIT_EMISSION_NONE" + }, + "idempotency": "IDEMPOTENCY_REQUIREMENT_FORBIDDEN", + "rate_limit": "RATE_LIMIT_CLASS_SENSITIVE", + "request_sensitivity": "SENSITIVITY_CONFIDENTIAL", + "response_sensitivity": "SENSITIVITY_CONFIDENTIAL", + "platform_role": "PLATFORM_ROLE_REQUIREMENT_SUPER_ADMIN", + "authentication_factor_attempt": false, + "conditions": [], + "impersonation": "IMPERSONATION_REQUIREMENT_UNSPECIFIED" + }, + "policy_tier": "platform_admin", + "description": "Read what a per-tenant module operation context would assert for one module, binding and organization, or why it would be refused.", + "owner": { + "module": "saas-starter", + "service": "accounts" + } + }, { "procedure": "/saas.accounts.v1.PlatformAdminService/RevokePlatformRole", "service": "PlatformAdminService", diff --git a/module/services/accounts/openapi/api.swagger.json b/module/services/accounts/openapi/api.swagger.json index 684ac6c2c..ab4551f9b 100644 --- a/module/services/accounts/openapi/api.swagger.json +++ b/module/services/accounts/openapi/api.swagger.json @@ -3620,6 +3620,72 @@ }, "type": "object" }, + "v1ModuleTenantIdentity": { + "description": "ModuleTenantIdentity is what one per-tenant mint would assert. Every field is\nthe host's: nothing here is requestable.", + "properties": { + "audience": { + "type": "string" + }, + "lifetimeSeconds": { + "description": "lifetime_seconds is the fixed lifetime every such capability carries.", + "format": "int64", + "type": "string" + }, + "principalId": { + "description": "principal_id is the module's own service principal, which owns the\ncapability and acts directly — there is no person and no actor hop.", + "type": "string" + }, + "revision": { + "description": "revision is the authorization revision it would be sealed with: a digest\nof the module's whole effective entry, so any change to the entry stops\nconfirming every capability minted under the old one.", + "format": "uint64", + "type": "string" + }, + "scopes": { + "description": "scopes is exactly what the capability would carry, as\n`kind:action[:resource]`: the binding's headless_scopes narrowed by THIS\norganization's installation scope. Never its invoke_scopes, which describe\nauthority exercised on a person's behalf.", + "items": { + "type": "string" + }, + "type": "array" + }, + "shared": { + "description": "shared says the principal is unpinned and declares cross_tenant, so it may\nact for more than one organization. A pinned principal reads false and can\nonly ever name the tenant its envelope declares.", + "type": "boolean" + }, + "tenant": { + "description": "tenant is the organization it would act for, and audience the service the\nbinding declares it may call. A binding whose audience is the module's own\nprefix is one the module admits itself, which is how unattended work is\nadmitted by the module that executes it.", + "type": "string" + } + }, + "type": "object" + }, + "v1ModuleTenantIdentityMint": { + "description": "ModuleTenantIdentityMint is one capability actually issued, as the audit\ntrail recorded it. There is no other record: a capability lives a minute and\nnothing caches one.", + "properties": { + "audience": { + "type": "string" + }, + "binding": { + "type": "string" + }, + "mintedAt": { + "format": "date-time", + "type": "string" + }, + "record": { + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "type": "array" + }, + "tenant": { + "type": "string" + } + }, + "type": "object" + }, "v1Notification": { "properties": { "actionUrl": { @@ -4549,6 +4615,26 @@ "v1RequestDeletionRequest": { "type": "object" }, + "v1ResolveModuleTenantIdentityResponse": { + "properties": { + "identity": { + "$ref": "#/definitions/v1ModuleTenantIdentity", + "description": "identity is set when a mint for this organization would be issued; refusal\nsays why it would not. Exactly one is present, and a refusal is a decision\nabout declared authority rather than an outage." + }, + "recent": { + "description": "recent is the trail of capabilities this module was actually issued for\nthis organization, newest first.", + "items": { + "$ref": "#/definitions/v1ModuleTenantIdentityMint", + "type": "object" + }, + "type": "array" + }, + "refusal": { + "type": "string" + } + }, + "type": "object" + }, "v1Role": { "properties": { "builtIn": { @@ -9850,6 +9936,51 @@ ] } }, + "/v1/platform/module-tenant-identity": { + "get": { + "operationId": "PlatformAdminService_ResolveModuleTenantIdentity", + "parameters": [ + { + "description": "prefix is the module principal's registration prefix and binding the key\nof its operation_audiences entry.", + "in": "query", + "name": "prefix", + "required": false, + "type": "string" + }, + { + "in": "query", + "name": "binding", + "required": false, + "type": "string" + }, + { + "description": "organization_id is the tenant the capability would act for.", + "in": "query", + "name": "organizationId", + "required": false, + "type": "string" + } + ], + "responses": { + "200": { + "description": "A successful response.", + "schema": { + "$ref": "#/definitions/v1ResolveModuleTenantIdentityResponse" + } + }, + "default": { + "description": "An unexpected error response.", + "schema": { + "$ref": "#/definitions/rpcStatus" + } + } + }, + "summary": "ResolveModuleTenantIdentity answers what a per-tenant module operation\ncontext would assert for one module, one of its bindings and one\norganization — or why it would be refused. It issues no capability.", + "tags": [ + "PlatformAdminService" + ] + } + }, "/v1/platform/organizations/{orgId}/entitlements": { "get": { "operationId": "PlatformAdminService_GetOrgEntitlements", diff --git a/module/services/accounts/proto/saas/accounts/v1/datasource.proto b/module/services/accounts/proto/saas/accounts/v1/datasource.proto index 5b952cf9d..d64bd7cc9 100644 --- a/module/services/accounts/proto/saas/accounts/v1/datasource.proto +++ b/module/services/accounts/proto/saas/accounts/v1/datasource.proto @@ -1034,6 +1034,24 @@ message RevokeSourceDelegationResponse { // the capability that admitted it and revoking the delegation refuses the // next occurrence. // +// IT IS SET ONLY FOR A DELEGATION SOME DECLARED EXECUTOR COULD USE, which +// is weaker than naming the one that will. A mint by source id resolves +// the active delegation of the CALLING module, and the capability is +// addressed to the binding's declared audience, which the executing module +// must itself admit — so the one shape a declared reference can serve is a +// delegation whose binding names its own module as the audience. A +// delegation held by one module and addressed to another is reachable only +// through the delegation-id exchange, which no reference this host +// declares can name. +// +// WHICH module that is, this host does not know: nothing it holds declares +// who executes declared work. `identity_holder` on the declaration read +// reports whose delegation the reference resolves to, and executor +// readiness is deliberately not claimed — a composed executor with no +// delegation on this source is refused at the mint +// (ErrSourceDelegationMissing), and a host that called the source "bound" +// would have been telling an operator the opposite. +// // IT IS NOT OPAQUE, and revocation is therefore not permanent. The value // is the source's own id, and a mint resolves whichever delegation of that // source is active, so revoking one and then RECONNECTING the source @@ -1048,11 +1066,15 @@ message RevokeSourceDelegationResponse { // binding's headless scopes — an ordinary token admission, bounded by the // capability's own short lifetime. // -// IT IS PLANNED, and no declaration this host builds has ever set it. It -// cannot serve the reconcile trigger: the headless mint lives 60 seconds -// against that trigger's 10-minute declared deadline, and the capability -// is the module's own principal while ReconcileSource requires an -// organization member. +// IT IS PLANNED, and no declaration this host builds has ever set it, so +// nothing anywhere has proved it against a trigger. It cannot serve the +// reconcile trigger: the headless mint lives 60 seconds against that +// trigger's 10-minute declared deadline, and the capability is the +// module's own principal while ReconcileSource requires an organization +// member. That mint IS the per-tenant module identity a module publishing +// for one tenant presents (PlatformAdminService.ResolveModuleTenantIdentity +// reads what it would assert); what it is not is an identity for this +// trigger's occurrences. // // THE NAMES ARE THE INSTALLATION DOCUMENT'S, not this host's and not the // executing module's read API's. That distinction is load-bearing: the module @@ -1177,6 +1199,35 @@ message SourceTriggerDeclaration { // schedule is disabled, or its interval is not one a five-field cron can // express. Empty means the declaration above is complete. string undeclarable_reason = 8; + // host_sweep_enabled says whether THIS HOST still fires the schedule it + // declares, as a labelled stopgap for the absence of a module that consumes + // the declaration, and host_sweep_due_at the instant it will next sweep on. + // + // THAT INSTANT IS NOT next_occurrence_at, and the two are reported + // separately because they share a period and not a phase. The declared cron + // for a sub-hourly interval is `*/M * * * *`, which comes due on the quarter + // or half hour; the sweep fires on the source's stored instant, which every + // pass moves to `now + interval` — an arbitrary offset inside the period. A + // reader shown only the cron's instant was reading what the declaration + // SAYS while the pass that will actually happen was at another minute. + // + // host_sweep_due_at is unset when the sweep is off, or when the source is + // held off its schedule: then there is no pass this host will take. + bool host_sweep_enabled = 9; + google.protobuf.Timestamp host_sweep_due_at = 10; + // identity_holder is the module whose delegation the reference arm resolved + // to when this declaration was built. The arm cannot carry it — the + // reference value is the source id — so it is reported beside it. + // + // IT IS NOT THE EXECUTING MODULE. Nothing this host holds declares which + // module executes declared work: a self-addressed delegation binding is + // generic and a deployment may have several. So this says "a reference on + // this source would resolve to module A's self-addressed delegation", and + // whether A is the module that installs this release is unverified here. A + // reader that took it for executor readiness would be told a source was + // ready while every occurrence of another executor's trigger was refused at + // the mint. Empty when the arm names no identity. + string identity_holder = 11; } message DelegateSourceTriggersRequest { diff --git a/module/services/accounts/proto/saas/accounts/v1/platform_admin.proto b/module/services/accounts/proto/saas/accounts/v1/platform_admin.proto index 4e955b079..271f1452b 100644 --- a/module/services/accounts/proto/saas/accounts/v1/platform_admin.proto +++ b/module/services/accounts/proto/saas/accounts/v1/platform_admin.proto @@ -576,6 +576,100 @@ message PutModuleEnvelopeResponse { ModuleEnvelope envelope = 1; } +// --------------------------------------------------------------------------- +// A module identity minted for ONE tenant. +// +// A composed module acting with no person present mints a Work Context for one +// of its installed operation bindings (MintModuleOperationContext) and names +// the organization it is acting FOR. That is what lets a module present itself +// as acting for a tenant rather than as itself: the capability's tenant is the +// organization named, its scopes are that organization's installation narrowed +// to the binding's headless_scopes, it lives a minute, and every issuance is +// recorded. +// +// Which organizations it may name is not the caller's to choose. A principal +// the envelope PINS to a tenant may name that tenant and no other; an unpinned +// principal declaring cross_tenant may name an organization that has a live +// installation consenting to the binding, and nothing else. An organization +// whose installation consents to less gets less, and one that consents to +// nothing is refused — so the bound is per tenant, not per deployment. +// +// This read answers what that mint would assert, for an operator, WITHOUT +// issuing a capability. A browser holds no module identity (the mint requires +// the pod's projected ServiceAccount token, held against the build its +// authority document approves), and a path that handed an operator a module's +// capability would be a second spelling of that identity — so there is +// deliberately no such path, here or anywhere. +// --------------------------------------------------------------------------- + +message ResolveModuleTenantIdentityRequest { + // prefix is the module principal's registration prefix and binding the key + // of its operation_audiences entry. + string prefix = 1 [(buf.validate.field).string = { + min_len: 1 + max_len: 63 + pattern: "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$" + }]; + string binding = 2 [(buf.validate.field).string = { + min_len: 1 + max_len: 128 + }]; + // organization_id is the tenant the capability would act for. + string organization_id = 3 [(buf.validate.field).string.uuid = true]; +} + +// ModuleTenantIdentity is what one per-tenant mint would assert. Every field is +// the host's: nothing here is requestable. +message ModuleTenantIdentity { + // principal_id is the module's own service principal, which owns the + // capability and acts directly — there is no person and no actor hop. + string principal_id = 1; + // tenant is the organization it would act for, and audience the service the + // binding declares it may call. A binding whose audience is the module's own + // prefix is one the module admits itself, which is how unattended work is + // admitted by the module that executes it. + string tenant = 2; + string audience = 3; + // scopes is exactly what the capability would carry, as + // `kind:action[:resource]`: the binding's headless_scopes narrowed by THIS + // organization's installation scope. Never its invoke_scopes, which describe + // authority exercised on a person's behalf. + repeated string scopes = 4; + // lifetime_seconds is the fixed lifetime every such capability carries. + int64 lifetime_seconds = 5; + // revision is the authorization revision it would be sealed with: a digest + // of the module's whole effective entry, so any change to the entry stops + // confirming every capability minted under the old one. + uint64 revision = 6; + // shared says the principal is unpinned and declares cross_tenant, so it may + // act for more than one organization. A pinned principal reads false and can + // only ever name the tenant its envelope declares. + bool shared = 7; +} + +// ModuleTenantIdentityMint is one capability actually issued, as the audit +// trail recorded it. There is no other record: a capability lives a minute and +// nothing caches one. +message ModuleTenantIdentityMint { + string record = 1; + string tenant = 2; + string binding = 3; + string audience = 4; + repeated string scopes = 5; + google.protobuf.Timestamp minted_at = 6; +} + +message ResolveModuleTenantIdentityResponse { + // identity is set when a mint for this organization would be issued; refusal + // says why it would not. Exactly one is present, and a refusal is a decision + // about declared authority rather than an outage. + ModuleTenantIdentity identity = 1; + string refusal = 2; + // recent is the trail of capabilities this module was actually issued for + // this organization, newest first. + repeated ModuleTenantIdentityMint recent = 3; +} + // PlatformAdminService — cross-tenant operations for platform operators. // All RPCs require a platform_role in the JWT claims. service PlatformAdminService { @@ -1041,4 +1135,22 @@ service PlatformAdminService { body: "*" }; } + + // ResolveModuleTenantIdentity answers what a per-tenant module operation + // context would assert for one module, one of its bindings and one + // organization — or why it would be refused. It issues no capability. + rpc ResolveModuleTenantIdentity(ResolveModuleTenantIdentityRequest) returns (ResolveModuleTenantIdentityResponse) { + option (saas.policy.v1.method_policy) = { + exposure: EXPOSURE_AUTHENTICATED + tenant: TENANT_REQUIREMENT_NONE + mfa: MFA_REQUIREMENT_NONE + audit: {emission: AUDIT_EMISSION_NONE} + idempotency: IDEMPOTENCY_REQUIREMENT_FORBIDDEN + rate_limit: RATE_LIMIT_CLASS_SENSITIVE + request_sensitivity: SENSITIVITY_CONFIDENTIAL + response_sensitivity: SENSITIVITY_CONFIDENTIAL + platform_role: PLATFORM_ROLE_REQUIREMENT_SUPER_ADMIN + }; + option (google.api.http) = {get: "/v1/platform/module-tenant-identity"}; + } } diff --git a/module/services/auth-gateway/code/authz_catalog_gen.go b/module/services/auth-gateway/code/authz_catalog_gen.go index e7d23045b..46e87ad69 100644 --- a/module/services/auth-gateway/code/authz_catalog_gen.go +++ b/module/services/auth-gateway/code/authz_catalog_gen.go @@ -211,6 +211,7 @@ var generatedAuthorizationByProcedure = map[string]generatedAuthorizationMetadat "/saas.accounts.v1.PlatformAdminService/OverrideEntitlement": {exposure: edgeExposureAuthenticated, rateLimitClass: edgeRateLimitClassSensitive, rateLimitBackendFailClosed: false, authenticationFactorAttempt: false, policySHA256: "3665682c29d02878db8cbfd5fee73da95fb61edf4b3a9329fcb6c13c5decaf18"}, "/saas.accounts.v1.PlatformAdminService/PutModuleEnvelope": {exposure: edgeExposureAuthenticated, rateLimitClass: edgeRateLimitClassSensitive, rateLimitBackendFailClosed: false, authenticationFactorAttempt: false, policySHA256: "f291952d9b1fbb97dad7ac5752b5f20ebc2bd30ffe47b8859cd70ac7b066f68c"}, "/saas.accounts.v1.PlatformAdminService/ReplayJob": {exposure: edgeExposureAuthenticated, rateLimitClass: edgeRateLimitClassSensitive, rateLimitBackendFailClosed: false, authenticationFactorAttempt: false, policySHA256: "ca332de30ec2ccedf0bc703de994eb50cb7f2055c2574c330b0cb421134caf25"}, + "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity": {exposure: edgeExposureAuthenticated, rateLimitClass: edgeRateLimitClassSensitive, rateLimitBackendFailClosed: false, authenticationFactorAttempt: false, policySHA256: "e3ae6ee3f1b70dbabb131e3a486c403859c0f3540c61dca8132317bd1be9d7b3"}, "/saas.accounts.v1.PlatformAdminService/RevokePlatformRole": {exposure: edgeExposureAuthenticated, rateLimitClass: edgeRateLimitClassSensitive, rateLimitBackendFailClosed: false, authenticationFactorAttempt: false, policySHA256: "5d13d1bec715a08e7cac379958c4e6ad88776a9cac020912bad2c3724e58f514"}, "/saas.accounts.v1.PlatformAdminService/RevokeSession": {exposure: edgeExposureAuthenticated, rateLimitClass: edgeRateLimitClassSensitive, rateLimitBackendFailClosed: false, authenticationFactorAttempt: false, policySHA256: "c64db604571a00374e20ee37308bfeaec9e60d025a749aed74df6ddb7c3e24a4"}, "/saas.accounts.v1.PlatformAdminService/SearchUsers": {exposure: edgeExposureAuthenticated, rateLimitClass: edgeRateLimitClassSensitive, rateLimitBackendFailClosed: false, authenticationFactorAttempt: false, policySHA256: "e8e73c253ede8c5e55cbebd2c2879342ee7110e147a6f8cbfc9e9150632551c5"}, @@ -398,6 +399,7 @@ var generatedRESTProcedureByRoute = map[string]string{ "POST /v1/platform/organizations/{org_id}/entitlements": "/saas.accounts.v1.PlatformAdminService/OverrideEntitlement", "PUT /v1/platform/module-envelope": "/saas.accounts.v1.PlatformAdminService/PutModuleEnvelope", "POST /v1/platform/jobs/{source_job_id}:replay": "/saas.accounts.v1.PlatformAdminService/ReplayJob", + "GET /v1/platform/module-tenant-identity": "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity", "DELETE /v1/platform/admins/{user_id}": "/saas.accounts.v1.PlatformAdminService/RevokePlatformRole", "DELETE /v1/platform/sessions/{session_id}": "/saas.accounts.v1.PlatformAdminService/RevokeSession", "GET /v1/platform/users": "/saas.accounts.v1.PlatformAdminService/SearchUsers", diff --git a/module/services/auth-gateway/code/routing_catalog_gen.go b/module/services/auth-gateway/code/routing_catalog_gen.go index dae8fd049..7f107ad15 100644 --- a/module/services/auth-gateway/code/routing_catalog_gen.go +++ b/module/services/auth-gateway/code/routing_catalog_gen.go @@ -165,6 +165,7 @@ func generatedCatalogConnectRoutes() []*RouteEntry { {Service: "accounts_connect", Method: "POST", Path: "/customers.PlatformAdminService/OverrideEntitlement", UpstreamPath: "/saas.accounts.v1.PlatformAdminService/OverrideEntitlement", Procedure: "/saas.accounts.v1.PlatformAdminService/OverrideEntitlement"}, {Service: "accounts_connect", Method: "POST", Path: "/customers.PlatformAdminService/PutModuleEnvelope", UpstreamPath: "/saas.accounts.v1.PlatformAdminService/PutModuleEnvelope", Procedure: "/saas.accounts.v1.PlatformAdminService/PutModuleEnvelope"}, {Service: "accounts_connect", Method: "POST", Path: "/customers.PlatformAdminService/ReplayJob", UpstreamPath: "/saas.accounts.v1.PlatformAdminService/ReplayJob", Procedure: "/saas.accounts.v1.PlatformAdminService/ReplayJob"}, + {Service: "accounts_connect", Method: "POST", Path: "/customers.PlatformAdminService/ResolveModuleTenantIdentity", UpstreamPath: "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity", Procedure: "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity"}, {Service: "accounts_connect", Method: "POST", Path: "/customers.PlatformAdminService/RevokePlatformRole", UpstreamPath: "/saas.accounts.v1.PlatformAdminService/RevokePlatformRole", Procedure: "/saas.accounts.v1.PlatformAdminService/RevokePlatformRole"}, {Service: "accounts_connect", Method: "POST", Path: "/customers.PlatformAdminService/RevokeSession", UpstreamPath: "/saas.accounts.v1.PlatformAdminService/RevokeSession", Procedure: "/saas.accounts.v1.PlatformAdminService/RevokeSession"}, {Service: "accounts_connect", Method: "POST", Path: "/customers.PlatformAdminService/SearchUsers", UpstreamPath: "/saas.accounts.v1.PlatformAdminService/SearchUsers", Procedure: "/saas.accounts.v1.PlatformAdminService/SearchUsers"}, @@ -380,6 +381,7 @@ func generatedCatalogConnectRoutes() []*RouteEntry { {Service: "accounts_connect", Method: "POST", Path: "/saas.accounts.v1.PlatformAdminService/OverrideEntitlement", UpstreamPath: "", Procedure: "/saas.accounts.v1.PlatformAdminService/OverrideEntitlement"}, {Service: "accounts_connect", Method: "POST", Path: "/saas.accounts.v1.PlatformAdminService/PutModuleEnvelope", UpstreamPath: "", Procedure: "/saas.accounts.v1.PlatformAdminService/PutModuleEnvelope"}, {Service: "accounts_connect", Method: "POST", Path: "/saas.accounts.v1.PlatformAdminService/ReplayJob", UpstreamPath: "", Procedure: "/saas.accounts.v1.PlatformAdminService/ReplayJob"}, + {Service: "accounts_connect", Method: "POST", Path: "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity", UpstreamPath: "", Procedure: "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity"}, {Service: "accounts_connect", Method: "POST", Path: "/saas.accounts.v1.PlatformAdminService/RevokePlatformRole", UpstreamPath: "", Procedure: "/saas.accounts.v1.PlatformAdminService/RevokePlatformRole"}, {Service: "accounts_connect", Method: "POST", Path: "/saas.accounts.v1.PlatformAdminService/RevokeSession", UpstreamPath: "", Procedure: "/saas.accounts.v1.PlatformAdminService/RevokeSession"}, {Service: "accounts_connect", Method: "POST", Path: "/saas.accounts.v1.PlatformAdminService/SearchUsers", UpstreamPath: "", Procedure: "/saas.accounts.v1.PlatformAdminService/SearchUsers"}, diff --git a/module/services/auth-gateway/code/routing_rest_catalog_gen.go b/module/services/auth-gateway/code/routing_rest_catalog_gen.go index 734a3759c..9a9cd80fc 100644 --- a/module/services/auth-gateway/code/routing_rest_catalog_gen.go +++ b/module/services/auth-gateway/code/routing_rest_catalog_gen.go @@ -66,6 +66,7 @@ func generatedCatalogRESTRoutes() []*RouteEntry { {Service: "accounts", Method: "GET", Path: "/v1/platform/jobs/operations", Procedure: "/saas.accounts.v1.PlatformAdminService/GetJobOperations"}, {Service: "accounts", Method: "GET", Path: "/v1/platform/jobs/{job_id}", Procedure: "/saas.accounts.v1.PlatformAdminService/GetJob"}, {Service: "accounts", Method: "GET", Path: "/v1/platform/module-envelope", Procedure: "/saas.accounts.v1.PlatformAdminService/GetModuleEnvelope"}, + {Service: "accounts", Method: "GET", Path: "/v1/platform/module-tenant-identity", Procedure: "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity"}, {Service: "accounts", Method: "GET", Path: "/v1/platform/organizations/{org_id}/entitlements", Procedure: "/saas.accounts.v1.PlatformAdminService/GetOrgEntitlements"}, {Service: "accounts", Method: "GET", Path: "/v1/platform/sessions", Procedure: "/saas.accounts.v1.PlatformAdminService/ListActiveSessions"}, {Service: "accounts", Method: "GET", Path: "/v1/platform/users", Procedure: "/saas.accounts.v1.PlatformAdminService/SearchUsers"}, diff --git a/module/services/frontend/code/frontend-plugin-public-api.json b/module/services/frontend/code/frontend-plugin-public-api.json index ca4dedf90..4cf8acf1e 100644 --- a/module/services/frontend/code/frontend-plugin-public-api.json +++ b/module/services/frontend/code/frontend-plugin-public-api.json @@ -4,7 +4,7 @@ "packages": { "@codefly-dev/saas-plugin-contract": { "status": "active", - "packageVersion": "2.4.4", + "packageVersion": "2.5.0", "entrypoints": [".", "./capabilities"], "entrypointExports": { ".": [ @@ -93,6 +93,8 @@ "isConnectProcedurePath", "isConnectServiceName", "isFrontendServicePath", + "isFrontendServiceRoutePrefix", + "isServiceableFrontendService", "resolveConnectProcedure", "resolveFrontendAppearance", "resolveSkinRules", @@ -122,7 +124,7 @@ }, "@codefly-dev/saas-plugin-react": { "status": "active", - "packageVersion": "0.4.5", + "packageVersion": "0.4.6", "entrypoints": [".", "./runtime", "./ui"], "entrypointExports": { ".": [ diff --git a/module/services/frontend/code/package-lock.json b/module/services/frontend/code/package-lock.json index 9edc31fe1..3a8b1ecd5 100644 --- a/module/services/frontend/code/package-lock.json +++ b/module/services/frontend/code/package-lock.json @@ -13,8 +13,8 @@ "dependencies": { "@base-ui/react": "^1.3.0", "@bufbuild/protobuf": "^2.11.0", - "@codefly-dev/saas-plugin-contract": "2.4.4", - "@codefly-dev/saas-plugin-react": "0.4.5", + "@codefly-dev/saas-plugin-contract": "2.5.0", + "@codefly-dev/saas-plugin-react": "0.4.6", "@codefly-dev/saas-sdk": "0.3.30", "@codefly-dev/saas-ui": "0.12.8", "@codefly-dev/ui": "0.12.8", @@ -15360,7 +15360,7 @@ }, "packages/codefly-ui": { "name": "@codefly-dev/ui", - "version": "0.12.11", + "version": "0.12.12", "license": "Apache-2.0", "dependencies": { "@base-ui/react": "^1.3.0", @@ -15382,8 +15382,8 @@ "tailwind-merge": "^3.5.0" }, "devDependencies": { - "@codefly-dev/saas-plugin-contract": "2.4.4", - "@codefly-dev/saas-plugin-react": "0.4.5", + "@codefly-dev/saas-plugin-contract": "2.5.0", + "@codefly-dev/saas-plugin-react": "0.4.6", "@tailwindcss/postcss": "^4", "@testing-library/react": "^16.1.0", "@types/hast": "^3.0.4", @@ -15429,7 +15429,7 @@ }, "packages/saas-plugin-contract": { "name": "@codefly-dev/saas-plugin-contract", - "version": "2.4.4", + "version": "2.5.0", "license": "Apache-2.0", "dependencies": { "@bufbuild/protobuf": "^2.11.0" @@ -15444,7 +15444,7 @@ "version": "0.1.2", "license": "Apache-2.0", "dependencies": { - "@codefly-dev/saas-plugin-contract": "2.4.4" + "@codefly-dev/saas-plugin-contract": "2.5.0" }, "devDependencies": { "@types/js-yaml": "^4.0.9", @@ -15456,10 +15456,10 @@ }, "packages/saas-plugin-react": { "name": "@codefly-dev/saas-plugin-react", - "version": "0.4.5", + "version": "0.4.6", "license": "Apache-2.0", "devDependencies": { - "@codefly-dev/saas-plugin-contract": "2.4.4", + "@codefly-dev/saas-plugin-contract": "2.5.0", "@testing-library/react": "^16.1.0", "@types/react": "19.2.17", "happy-dom": "^20.8.9", @@ -15508,7 +15508,7 @@ }, "packages/saas-ui": { "name": "@codefly-dev/saas-ui", - "version": "0.12.11", + "version": "0.12.12", "license": "Apache-2.0", "dependencies": { "@opentelemetry/api": "1.9.1", diff --git a/module/services/frontend/code/package.json b/module/services/frontend/code/package.json index adc775a8e..8a65060ee 100644 --- a/module/services/frontend/code/package.json +++ b/module/services/frontend/code/package.json @@ -37,8 +37,8 @@ "dependencies": { "@base-ui/react": "^1.3.0", "@bufbuild/protobuf": "^2.11.0", - "@codefly-dev/saas-plugin-contract": "2.4.4", - "@codefly-dev/saas-plugin-react": "0.4.5", + "@codefly-dev/saas-plugin-contract": "2.5.0", + "@codefly-dev/saas-plugin-react": "0.4.6", "@codefly-dev/saas-sdk": "0.3.30", "@codefly-dev/saas-ui": "0.12.8", "@codefly-dev/ui": "0.12.8", diff --git a/module/services/frontend/code/packages/codefly-ui/package.json b/module/services/frontend/code/packages/codefly-ui/package.json index 1c7bbdf5a..92faa8012 100644 --- a/module/services/frontend/code/packages/codefly-ui/package.json +++ b/module/services/frontend/code/packages/codefly-ui/package.json @@ -1,6 +1,6 @@ { "name": "@codefly-dev/ui", - "version": "0.12.11", + "version": "0.12.12", "description": "The shared, versioned Codefly SaaS frontend kit: the plugin host and the tokens-as-data skin mechanism, standalone so the host and Module-Federation remotes import and dedupe one copy.", "repository": { "type": "git", @@ -116,8 +116,8 @@ "react": ">=19.2 <20" }, "devDependencies": { - "@codefly-dev/saas-plugin-contract": "2.4.4", - "@codefly-dev/saas-plugin-react": "0.4.5", + "@codefly-dev/saas-plugin-contract": "2.5.0", + "@codefly-dev/saas-plugin-react": "0.4.6", "@testing-library/react": "^16.1.0", "@tailwindcss/postcss": "^4", "@types/react": "^19.2.17", diff --git a/module/services/frontend/code/packages/saas-plugin-contract/README.md b/module/services/frontend/code/packages/saas-plugin-contract/README.md index 58a6b038c..bea8f000b 100644 --- a/module/services/frontend/code/packages/saas-plugin-contract/README.md +++ b/module/services/frontend/code/packages/saas-plugin-contract/README.md @@ -219,3 +219,33 @@ codefly generate proto --proto ./proto --output . --local --template buf.gen.loc The package root and `./capabilities` are public. The default light muted foreground uses achromatic OKLCH lightness 0.54 so small captions meet WCAG AA 4.5:1 on background, card, muted and accent surfaces. The default dark pair also satisfies this check. Custom appearances own their chosen contrast; clients should use these semantic tokens rather than inventing local caption colors. + +## Version history + +There is no separate changelog: this package's released shape is small enough +that the versions worth knowing about are the ones that changed what a +composition may declare, and that record belongs beside the rules. + +- **2.5.0** — `isFrontendServiceRoutePrefix` and `isServiceableFrontendService` + are exported: the whole route-prefix rule, and what a host may proxy at all, + as predicates both the composition and the host's runtime read. A MINOR, not + a patch, because the public surface grew; `^2` consumers take it unchanged. + The composition refuses nothing it admitted in 2.4.4 — the host's own + re-check gained the parts of the rule it was missing, which is where a stale + or hand-edited allowlist used to walk past a prefix the composition would + never have validated. +- **2.4.4** — `connectServices` became required and non-empty on a `connect` + requirement, and rejected on a `rest` one. **Released as a PATCH, and that + was a deliberate call rather than an oversight.** Semver would normally read + a validation that refuses a previously accepted declaration as breaking: a + `connect` requirement without the new field fails composition. Three facts + decided it the other way. The shape it tightens shipped one day earlier in + 2.4.3 (the root Connect prefix), so the window in which a published + composition could have declared it was a day wide; the only would-be consumer + vendored 2.4.0, which has neither the field nor the prefix; and a major would + have forced every remote's peer range off `^2` — cascading a breaking minor + through the co-versioned `0.x` kit — for a capability nobody was consuming. + The alternative to the tightening was leaving a Connect alias reaching every + service its upstream origin served, as the viewer. +- **2.4.3** — a `connect` requirement may declare the origin root (`/`) as its + route prefix, which is where the Connect protocol puts a procedure. diff --git a/module/services/frontend/code/packages/saas-plugin-contract/package.json b/module/services/frontend/code/packages/saas-plugin-contract/package.json index 27422a5bc..688b091ca 100644 --- a/module/services/frontend/code/packages/saas-plugin-contract/package.json +++ b/module/services/frontend/code/packages/saas-plugin-contract/package.json @@ -1,6 +1,6 @@ { "name": "@codefly-dev/saas-plugin-contract", - "version": "2.4.4", + "version": "2.5.0", "description": "React-free serializable frontend plugin metadata and composition for the Codefly SaaS host.", "type": "module", "sideEffects": false, diff --git a/module/services/frontend/code/packages/saas-plugin-contract/src/composition.ts b/module/services/frontend/code/packages/saas-plugin-contract/src/composition.ts index 04a0b3925..f474b9c73 100644 --- a/module/services/frontend/code/packages/saas-plugin-contract/src/composition.ts +++ b/module/services/frontend/code/packages/saas-plugin-contract/src/composition.ts @@ -15,8 +15,8 @@ import { type PresentationRequirement, } from "./contracts.js"; import { - FRONTEND_SERVICE_ROOT_PREFIX, isConnectServiceName, + isFrontendServiceRoutePrefix, } from "./transport.js"; function assertContribution( @@ -240,26 +240,12 @@ function validateServiceRequirement( service.protocol === "connect" || service.protocol === "rest", `plugin '${pluginName}' service '${service.alias}' uses unsupported protocol '${String(service.protocol)}'`, ); - const routeSegments = - typeof service.routePrefix === "string" - ? service.routePrefix.slice(1).split("/") - : []; - // The origin root is a prefix only a Connect requirement may declare, and - // declaring it is the only way to say what the Connect protocol already - // decides: a procedure's path is `//` from - // the origin, which is where this contract's own fixed capability handshake - // has always been probed. A REST requirement declaring the root would turn - // the alias into a prefix-less proxy of its whole upstream instead. - const rootPrefix = - service.protocol === "connect" && - service.routePrefix === FRONTEND_SERVICE_ROOT_PREFIX; - assertContribution( - typeof service.routePrefix === "string" && - (rootPrefix || - (SAFE_ROUTE_PREFIX.test(service.routePrefix) && - routeSegments.every( - (segment) => segment !== "." && segment !== "..", - ))), + // The prefix rule is `isFrontendServiceRoutePrefix` and is not restated + // here: the host's BFF re-checks the same rule at load and at request time, + // and the two readings drifting apart is what let a REST entry declaring + // `""` proxy its whole upstream (issue #1121). + assertContribution( + isFrontendServiceRoutePrefix(service.protocol, service.routePrefix), `plugin '${pluginName}' service '${service.alias}' route prefix '${String(service.routePrefix)}' is unsafe`, ); // On a Connect alias the caller supplies the service name in the path, diff --git a/module/services/frontend/code/packages/saas-plugin-contract/src/index.ts b/module/services/frontend/code/packages/saas-plugin-contract/src/index.ts index 215bcb813..03d270705 100644 --- a/module/services/frontend/code/packages/saas-plugin-contract/src/index.ts +++ b/module/services/frontend/code/packages/saas-plugin-contract/src/index.ts @@ -70,6 +70,8 @@ export { isConnectProcedurePath, isConnectServiceName, isFrontendServicePath, + isFrontendServiceRoutePrefix, + isServiceableFrontendService, resolveConnectProcedure, } from "./transport.js"; export type { diff --git a/module/services/frontend/code/packages/saas-plugin-contract/src/transport.ts b/module/services/frontend/code/packages/saas-plugin-contract/src/transport.ts index dc8a6f9f8..1a856492e 100644 --- a/module/services/frontend/code/packages/saas-plugin-contract/src/transport.ts +++ b/module/services/frontend/code/packages/saas-plugin-contract/src/transport.ts @@ -8,6 +8,8 @@ * the package both already depend on, so one change moves both sides. */ +import type { FrontendServiceProtocol } from "./contracts.js"; + /** A path segment with no reserved character in it. */ const SAFE_SEGMENT = /^[A-Za-z0-9._~-]+$/; @@ -38,6 +40,79 @@ const MAX_SEGMENT_LENGTH = 256; */ export const FRONTEND_SERVICE_ROOT_PREFIX = "/"; +/** + * An absolute upstream path prefix: one or more safe segments, each with no + * reserved character in it. Deliberately narrower than a URL path — a prefix is + * where the host mounts an alias, so a query, a fragment, an empty segment or a + * trailing slash are all shapes it has no meaning for. + */ +const SAFE_ROUTE_PREFIX = /^\/[A-Za-z0-9._~-]+(?:\/[A-Za-z0-9._~-]+)*$/; + +/** + * Whether this requirement's route prefix is one the host may mount, for the + * protocol it declares. It is the WHOLE rule, in one place, because two + * different readings of it are what the BFF walked past: the composition + * validated the full form at build time while the runtime re-check compared + * only against the root, so a prefix the composition would have refused — + * `""`, `/..`, `/a//b` — passed the runtime one and landed its relative path + * straight on the upstream origin. + * + * The origin root is Connect-only, and declaring it is the only way to say what + * the Connect protocol already decides: a procedure's path is + * `//` from the origin. A REST requirement + * declaring it would be a prefix-less proxy of its whole upstream, and so would + * any prefix that is not an absolute path of safe, non-dot segments. + */ +export function isFrontendServiceRoutePrefix( + protocol: FrontendServiceProtocol, + routePrefix: unknown, +): routePrefix is string { + if (typeof routePrefix !== "string") return false; + if (protocol === "connect" && routePrefix === FRONTEND_SERVICE_ROOT_PREFIX) { + return true; + } + return ( + SAFE_ROUTE_PREFIX.test(routePrefix) && + routePrefix + .slice(1) + .split("/") + .every((segment) => segment !== "." && segment !== "..") + ); +} + +/** + * What a requirement must look like for the host to proxy it at all: its prefix + * is one the protocol admits, and a Connect one declares a usable list of the + * services it may reach. + * + * Both halves are the composition's own rules, and this is the one function + * that states them — the BFF reads the GENERATED allowlist rather than the + * composition that validated it, so a build-time rule no runtime re-checks is + * one a stale or hand-edited projection walks straight past. `Array.isArray` is + * part of the rule and not defensive noise: a projection whose + * `connectServices` is a string has a `length` and no `every`, so a check that + * assumed an array threw out of the request handler as a 500 instead of + * refusing the alias as unserviceable. + */ +export function isServiceableFrontendService(service: { + protocol: FrontendServiceProtocol; + routePrefix: string; + connectServices?: readonly string[]; +}): boolean { + if (!isFrontendServiceRoutePrefix(service.protocol, service.routePrefix)) { + return false; + } + if (service.protocol !== "connect") return true; + // Connect without a declared service list reaches nothing: the path names + // the service, so an absent — or non-array — list is an unbounded alias. + const services = service.connectServices; + return ( + Array.isArray(services) && + services.length > 0 && + services.every(isConnectServiceName) + ); +} + function usableSegment(segment: string): boolean { return ( typeof segment === "string" && diff --git a/module/services/frontend/code/packages/saas-plugin-contract/test/transport.test.ts b/module/services/frontend/code/packages/saas-plugin-contract/test/transport.test.ts index 8dfb0ce41..13bb38dab 100644 --- a/module/services/frontend/code/packages/saas-plugin-contract/test/transport.test.ts +++ b/module/services/frontend/code/packages/saas-plugin-contract/test/transport.test.ts @@ -7,6 +7,8 @@ import { isConnectProcedurePath, isConnectServiceName, isFrontendServicePath, + isFrontendServiceRoutePrefix, + isServiceableFrontendService, resolveConnectProcedure, } from "../src/transport.js"; @@ -217,3 +219,118 @@ describe("the path a declared binding lands on", () => { expect(frontendServiceTargetPath("/", [])).toBe("/"); }); }); + +// THE WHOLE PREFIX RULE, IN ONE PLACE (issue #1121). +// +// The composition validated the full form at build time while the host's +// runtime re-check compared only against the root, so a prefix the composition +// would have refused passed the runtime one — and a REST entry declaring `""` +// landed every relative path on the upstream origin. Both sides read this now, +// so the table below is the rule both obey. +describe("isFrontendServiceRoutePrefix", () => { + it.each([ + ["an absolute path of safe segments", "rest", "/v1/example", true], + ["one segment", "rest", "/v1", true], + // The root is Connect-only: it says "where the Connect protocol puts a + // procedure", which is the origin. A REST alias declaring it has no + // prefix at all. + ["the root on a connect requirement", "connect", "/", true], + ["the root on a rest requirement", "rest", "/", false], + // The empty string is NOT the root, which is exactly why comparing + // against the root alone admitted it. + ["the empty string", "rest", "", false], + ["the empty string on connect", "connect", "", false], + ["a relative prefix", "rest", "v1/example", false], + ["a traversal", "rest", "/v1/../private", false], + ["a dot segment", "rest", "/v1/./private", false], + ["an empty segment", "rest", "/v1//private", false], + ["a trailing slash", "rest", "/v1/example/", false], + ["an encoded separator", "rest", "/v1/%2fprivate", false], + ["a query", "rest", "/v1/example?all=1", false], + ["a fragment", "rest", "/v1/example#x", false], + ])("%s", (_name, protocol, prefix, admitted) => { + expect( + isFrontendServiceRoutePrefix(protocol as "connect" | "rest", prefix), + ).toBe(admitted); + }); + + it("refuses anything that is not a string", () => { + for (const value of [undefined, null, 1, {}, ["/v1"]]) { + expect(isFrontendServiceRoutePrefix("rest", value)).toBe(false); + expect(isFrontendServiceRoutePrefix("connect", value)).toBe(false); + } + }); +}); + +// What a host may proxy at all, independent of the path asked for. +describe("isServiceableFrontendService", () => { + it("admits the two shapes a composition installs", () => { + expect( + isServiceableFrontendService({ + protocol: "rest", + routePrefix: "/v1/example", + }), + ).toBe(true); + expect( + isServiceableFrontendService({ + protocol: "connect", + routePrefix: "/", + connectServices: ["example.records.v1.RecordService"], + }), + ).toBe(true); + expect( + isServiceableFrontendService({ + protocol: "connect", + routePrefix: "/v1/connect", + connectServices: ["example.records.v1.RecordService"], + }), + ).toBe(true); + }); + + // The probe the review used: a REST entry whose prefix is the empty string + // proxies its whole upstream, because every relative path lands at the + // origin. `admin/secret` is a real path on a real backend. + it("refuses a rest entry with no prefix", () => { + expect( + isServiceableFrontendService({ protocol: "rest", routePrefix: "" }), + ).toBe(false); + expect(frontendServiceTargetPath("", ["admin", "secret"])).toBe( + "/admin/secret", + ); + }); + + // A Connect entry whose service list is not an array has a `length` and no + // `every`: a check that assumed an array threw out of the request handler + // as a 500 rather than refusing the alias. + it.each([ + ["a string", "example.records.v1.RecordService"], + ["an object", { 0: "example.records.v1.RecordService", length: 1 }], + ["a number", 1], + ["null", null], + ["absent", undefined], + ["empty", []], + ["an unusable name", ["not a service name"]], + ["a non-string entry", [1]], + ])("refuses a connect entry whose services are %s", (_name, services) => { + expect( + isServiceableFrontendService({ + protocol: "connect", + routePrefix: "/", + connectServices: services as unknown as readonly string[], + }), + ).toBe(false); + }); + + // On a REST alias the field is meaningless rather than disqualifying: the + // composition refuses it, and a projection carrying one is still bounded by + // its prefix. + it("ignores connect services on a rest entry", () => { + expect( + isServiceableFrontendService({ + protocol: "rest", + routePrefix: "/v1/example", + connectServices: ["nonsense"] as unknown as readonly string[], + }), + ).toBe(true); + }); +}); diff --git a/module/services/frontend/code/packages/saas-plugin-manifest/package.json b/module/services/frontend/code/packages/saas-plugin-manifest/package.json index f7fbba893..6c1350cb8 100644 --- a/module/services/frontend/code/packages/saas-plugin-manifest/package.json +++ b/module/services/frontend/code/packages/saas-plugin-manifest/package.json @@ -23,7 +23,7 @@ "test": "vitest run --config vitest.config.ts" }, "dependencies": { - "@codefly-dev/saas-plugin-contract": "2.4.4" + "@codefly-dev/saas-plugin-contract": "2.5.0" }, "devDependencies": { "ajv": "^8.17.1", diff --git a/module/services/frontend/code/packages/saas-plugin-react/package.json b/module/services/frontend/code/packages/saas-plugin-react/package.json index 1bf10c1b2..9333c49b6 100644 --- a/module/services/frontend/code/packages/saas-plugin-react/package.json +++ b/module/services/frontend/code/packages/saas-plugin-react/package.json @@ -1,6 +1,6 @@ { "name": "@codefly-dev/saas-plugin-react", - "version": "0.4.5", + "version": "0.4.6", "description": "Product-neutral React contribution composition and runtime adapters for the Codefly SaaS frontend plugin host.", "type": "module", "sideEffects": false, @@ -37,7 +37,7 @@ "react": ">=19.2 <20" }, "devDependencies": { - "@codefly-dev/saas-plugin-contract": "2.4.4", + "@codefly-dev/saas-plugin-contract": "2.5.0", "@testing-library/react": "^16.1.0", "@types/react": "19.2.17", "happy-dom": "^20.8.9", diff --git a/module/services/frontend/code/packages/saas-sdk/generated/contract/catalog.codefly.json b/module/services/frontend/code/packages/saas-sdk/generated/contract/catalog.codefly.json index 77bf35a65..ebebe679a 100644 --- a/module/services/frontend/code/packages/saas-sdk/generated/contract/catalog.codefly.json +++ b/module/services/frontend/code/packages/saas-sdk/generated/contract/catalog.codefly.json @@ -10,7 +10,7 @@ "kind": "protobuf", "package": "saas.accounts.v1", "path": "contract.binpb", - "digest": "sha256:510daf371e882d8baa728008078001faf736f541f5d78c1396dfdf59b9d4ebe3", + "digest": "sha256:c57b6743854c84738f0f1454e6c93349eced569d0351a91a62786ba08c1bc806", "services": [ { "name": "APIKeyService", @@ -354,6 +354,7 @@ "/saas.accounts.v1.PlatformAdminService/OverrideEntitlement", "/saas.accounts.v1.PlatformAdminService/PutModuleEnvelope", "/saas.accounts.v1.PlatformAdminService/ReplayJob", + "/saas.accounts.v1.PlatformAdminService/ResolveModuleTenantIdentity", "/saas.accounts.v1.PlatformAdminService/RevokePlatformRole", "/saas.accounts.v1.PlatformAdminService/RevokeSession", "/saas.accounts.v1.PlatformAdminService/SearchUsers", diff --git a/module/services/frontend/code/packages/saas-sdk/generated/contract/contract.binpb b/module/services/frontend/code/packages/saas-sdk/generated/contract/contract.binpb index e77b4eeff..70814cf1f 100644 Binary files a/module/services/frontend/code/packages/saas-sdk/generated/contract/contract.binpb and b/module/services/frontend/code/packages/saas-sdk/generated/contract/contract.binpb differ diff --git a/module/services/frontend/code/packages/saas-sdk/generated/library.codefly.yaml b/module/services/frontend/code/packages/saas-sdk/generated/library.codefly.yaml index bc180b6f2..54871ebbf 100644 --- a/module/services/frontend/code/packages/saas-sdk/generated/library.codefly.yaml +++ b/module/services/frontend/code/packages/saas-sdk/generated/library.codefly.yaml @@ -12,7 +12,7 @@ sources: module: saas-starter service: accounts endpoint: connect - contract-digest: sha256:510daf371e882d8baa728008078001faf736f541f5d78c1396dfdf59b9d4ebe3 + contract-digest: sha256:c57b6743854c84738f0f1454e6c93349eced569d0351a91a62786ba08c1bc806 services: - APIKeyService - AccessibleScopeService diff --git a/module/services/frontend/code/packages/saas-sdk/generated/typescript/src/gen/saas/accounts/v1/datasource_pb.ts b/module/services/frontend/code/packages/saas-sdk/generated/typescript/src/gen/saas/accounts/v1/datasource_pb.ts index 90ea2ca4b..7d6b14af0 100644 --- a/module/services/frontend/code/packages/saas-sdk/generated/typescript/src/gen/saas/accounts/v1/datasource_pb.ts +++ b/module/services/frontend/code/packages/saas-sdk/generated/typescript/src/gen/saas/accounts/v1/datasource_pb.ts @@ -18,7 +18,7 @@ import type { JsonObject, Message } from "@bufbuild/protobuf"; * Describes the file saas/accounts/v1/datasource.proto. */ export const file_saas_accounts_v1_datasource: GenFile = /*@__PURE__*/ - fileDesc("CiFzYWFzL2FjY291bnRzL3YxL2RhdGFzb3VyY2UucHJvdG8SEHNhYXMuYWNjb3VudHMudjEiXgoWR2l0SHViRGF0YXNvdXJjZUNvbmZpZxIMCgRyZXBvGAEgASgJEg0KBXBhdGhzGAIgAygJEg4KBmJyYW5jaBgDIAEoCRIXCg9maWxlX2V4dGVuc2lvbnMYBCADKAki9AEKD0FwaU9BdXRoMkNvbmZpZxI2CgVncmFudBgEIAEoDjInLnNhYXMuYWNjb3VudHMudjEuQXBpT0F1dGgyQ29uZmlnLkdyYW50EhEKCXRva2VuX3VybBgBIAEoCRIRCgljbGllbnRfaWQYAiABKAkSDgoGc2NvcGVzGAMgAygJInMKBUdyYW50EhUKEUdSQU5UX1VOU1BFQ0lGSUVEEAASFwoTR1JBTlRfUkVGUkVTSF9UT0tFThABEhwKGEdSQU5UX0NMSUVOVF9DUkVERU5USUFMUxACEhwKGEdSQU5UX0FVVEhPUklaQVRJT05fQ09ERRADIuoBChNBcGlEYXRhc291cmNlQ29uZmlnEhAKCGJhc2VfdXJsGAEgASgJEhUKDXJlc291cmNlX3BhdGgYAiABKAkSPAoPY3JlZGVudGlhbF9raW5kGAMgASgOMiMuc2Fhcy5hY2NvdW50cy52MS5BcGlDcmVkZW50aWFsS2luZBIZChFjcmVkZW50aWFsX2hlYWRlchgEIAEoCRIeChZjcmVkZW50aWFsX3F1ZXJ5X3BhcmFtGAUgASgJEjEKBm9hdXRoMhgGIAEoCzIhLnNhYXMuYWNjb3VudHMudjEuQXBpT0F1dGgyQ29uZmlnIkEKF0NyYXdsZXJEYXRhc291cmNlQ29uZmlnEhMKC3NpdGVtYXBfdXJsGAEgASgJEhEKCW1heF9wYWdlcxgCIAEoDSKGAQoWVXBsb2FkRGF0YXNvdXJjZUNvbmZpZxIQCghlbmRwb2ludBgBIAEoCRIOCgZyZWdpb24YAiABKAkSDgoGYnVja2V0GAMgASgJEg4KBnByZWZpeBgEIAEoCRIVCg1hY2Nlc3Nfa2V5X2lkGAUgASgJEhMKC21heF9vYmplY3RzGAYgASgNIoMHCgpEYXRhc291cmNlEgoKAmlkGAEgASgJEg4KBm9yZ19pZBgCIAEoCRI2Cghwcm92aWRlchgDIAEoDjIkLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVByb3ZpZGVyEjgKBmdpdGh1YhgFIAEoCzIoLnNhYXMuYWNjb3VudHMudjEuR2l0SHViRGF0YXNvdXJjZUNvbmZpZxIyCgZzdGF0dXMYBiABKA4yIi5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VTdGF0dXMSGgoSd2ViaG9va19jb25maWd1cmVkGAcgASgIEi4KCmNyZWF0ZWRfYXQYCCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCnVwZGF0ZWRfYXQYCSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjIKDmxhc3Rfc3luY2VkX2F0GAogASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIyCgNhcGkYCyABKAsyJS5zYWFzLmFjY291bnRzLnYxLkFwaURhdGFzb3VyY2VDb25maWcSOgoHY3Jhd2xlchgMIAEoCzIpLnNhYXMuYWNjb3VudHMudjEuQ3Jhd2xlckRhdGFzb3VyY2VDb25maWcSOAoGdXBsb2FkGA0gASgLMiguc2Fhcy5hY2NvdW50cy52MS5VcGxvYWREYXRhc291cmNlQ29uZmlnEhgKEGJvdW5kYXJ5X25vZGVfaWQYDiABKAkSNAoQbGFzdF9pbmdlc3RlZF9hdBgPIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASHAoUbGFzdF9pbmdlc3RlZF9jb21taXQYECABKAkSFQoNc3RhdHVzX3JlYXNvbhgRIAEoCRIWCg5ib3VuZGFyeV9sYWJlbBgSIAEoCRISCgpjb25mb3JtYW50GBMgASgIEhcKD2NvbmZvcm1hbmNlX2dhcBgUIAEoCRI/Cg1saXZlX2RlbGl2ZXJ5GBUgASgOMiguc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlTGl2ZURlbGl2ZXJ5EjUKEnJlY29uY2lsZV9pbnRlcnZhbBgWIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkoECAQQBVIRdGFyZ2V0X2NvbGxlY3Rpb24isgMKFkFkZEdpdEh1YlNvdXJjZVJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARI7CgRyZXBvGAIgASgJQi26SCpyKBADGP8BMiFeW0EtWmEtejAtOV8uLV0rL1tBLVphLXowLTlfLi1dKyQSIAoFcGF0aHMYAyADKAlCEbpIDpIBCxBAIgdyBRABGIAEEhgKBmJyYW5jaBgEIAEoCUIIukgFcgMY/wESJAoQYm91bmRhcnlfbm9kZV9pZBgIIAEoCUIIukgFcgOwAQFIABImChBjb2xsZWN0aW9uX2xhYmVsGAkgASgJQgq6SAdyBRABGP8BSAASHgoMYWNjZXNzX3Rva2VuGAYgASgJQgi6SAVyAxiACBIgCg53ZWJob29rX3NlY3JldBgHIAEoCUIIukgFcgMYgAgSSQoPZmlsZV9leHRlbnNpb25zGAogAygJQjC6SC2SASoQICImciQQAhghMh5eXC5bQS1aYS16MC05XVtBLVphLXowLTkuXy1dKiRCEQoIYm91bmRhcnkSBbpIAggBSgQIBRAGUhF0YXJnZXRfY29sbGVjdGlvbiJLChdBZGRHaXRIdWJTb3VyY2VSZXNwb25zZRIwCgpkYXRhc291cmNlGAEgASgLMhwuc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlIsgEChBBZGRTb3VyY2VSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESQgoIcHJvdmlkZXIYAiABKA4yJC5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VQcm92aWRlckIKukgHggEEEAEgABI6CgZnaXRodWIYBCABKAsyKC5zYWFzLmFjY291bnRzLnYxLkdpdEh1YkRhdGFzb3VyY2VDb25maWdIABI0CgNhcGkYBSABKAsyJS5zYWFzLmFjY291bnRzLnYxLkFwaURhdGFzb3VyY2VDb25maWdIABI8CgdjcmF3bGVyGAggASgLMikuc2Fhcy5hY2NvdW50cy52MS5DcmF3bGVyRGF0YXNvdXJjZUNvbmZpZ0gAEjoKBnVwbG9hZBgJIAEoCzIoLnNhYXMuYWNjb3VudHMudjEuVXBsb2FkRGF0YXNvdXJjZUNvbmZpZ0gAEiQKEGJvdW5kYXJ5X25vZGVfaWQYDCABKAlCCLpIBXIDsAEBSAESJgoQY29sbGVjdGlvbl9sYWJlbBgNIAEoCUIKukgHcgUQARj/AUgBEhwKCmNyZWRlbnRpYWwYBiABKAlCCLpIBXIDGIAgEiAKDndlYmhvb2tfc2VjcmV0GAcgASgJQgi6SAVyAxiACBImChRvYXV0aDJfY2xpZW50X3NlY3JldBgKIAEoCUIIukgFcgMYgAhCCAoGY29uZmlnQhEKCGJvdW5kYXJ5EgW6SAIIAUoECAMQBFIRdGFyZ2V0X2NvbGxlY3Rpb24iRQoRQWRkU291cmNlUmVzcG9uc2USMAoKZGF0YXNvdXJjZRgBIAEoCzIcLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZSJaChVEYXRhc291cmNlQ29uZmlnRmllbGQSCwoDa2V5GAEgASgJEhQKDGRpc3BsYXlfbmFtZRgCIAEoCRIMCgRoZWxwGAMgASgJEhAKCHJlcXVpcmVkGAQgASgIIsQBChlEYXRhc291cmNlQ29ubmVjdG9yQnVkZ2V0EhoKEm1heF9pdGVtc19wZXJfY2FsbBgBIAEoDRIaChJtYXhfYnl0ZXNfcGVyX2NhbGwYAiABKAMSFgoObWF4X2l0ZW1fYnl0ZXMYAyABKAMSHQoVb3BlcmF0aW9uc19wZXJfd2luZG93GAQgASgNEhYKDndpbmRvd19zZWNvbmRzGAUgASgDEiAKGGJhY2tncm91bmRfc2hhcmVfcGVyY2VudBgGIAEoDSKqBgocRGF0YXNvdXJjZVByb3ZpZGVyRGVzY3JpcHRvchI2Cghwcm92aWRlchgBIAEoDjIkLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVByb3ZpZGVyEhQKDGRpc3BsYXlfbmFtZRgCIAEoCRITCgtkZXNjcmlwdGlvbhgDIAEoCRI+Cg1jb25maWdfZmllbGRzGAQgAygLMicuc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlQ29uZmlnRmllbGQSGAoQc3VwcG9ydHNfd2ViaG9vaxgFIAEoCBJHChpzdXBwb3J0ZWRfY3JlZGVudGlhbF9raW5kcxgGIAMoDjIjLnNhYXMuYWNjb3VudHMudjEuQXBpQ3JlZGVudGlhbEtpbmQSEQoJY29ubmVjdG9yGAcgASgJEkEKCWludGVyZmFjZRgIIAEoDjIuLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZUNvbm5lY3RvckludGVyZmFjZRJEChBjcmVkZW50aWFsX21vZGVzGAkgAygOMiouc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlQ3JlZGVudGlhbE1vZGUSPwoNcmVhZGVyc19tb2RlbBgKIAEoDjIoLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVJlYWRlcnNNb2RlbBI7CgZidWRnZXQYCyABKAsyKy5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VDb25uZWN0b3JCdWRnZXQSEgoKY29uZm9ybWFudBgMIAEoCBIXCg9jb25mb3JtYW5jZV9nYXAYDSABKAkSGwoTYWNjZXB0c19uZXdfc291cmNlcxgOIAEoCBIgChhsaXZlX2RlbGl2ZXJ5X2NvbmZpZ3VyZWQYDyABKAgSGgoSYWNjZXB0c19vcGVyYXRpb25zGBAgASgIEhYKDm9wZXJhdGlvbnNfZ2FwGBEgASgJEhsKE29hdXRoX2F1dGhvcml6ZV91cmwYEiABKAkSFwoPb2F1dGhfdG9rZW5fdXJsGBMgASgJEhQKDG9hdXRoX3Njb3BlcxgUIAMoCSIdChtHZXREYXRhc291cmNlQ2F0YWxvZ1JlcXVlc3QiYQocR2V0RGF0YXNvdXJjZUNhdGFsb2dSZXNwb25zZRJBCglwcm92aWRlcnMYASADKAsyLi5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VQcm92aWRlckRlc2NyaXB0b3IiLgoSTGlzdFNvdXJjZXNSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQEiSAoTTGlzdFNvdXJjZXNSZXNwb25zZRIxCgtkYXRhc291cmNlcxgBIAMoCzIcLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZSJCChBHZXRTb3VyY2VSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESFAoCaWQYAiABKAlCCLpIBXIDsAEBIkUKEUdldFNvdXJjZVJlc3BvbnNlEjAKCmRhdGFzb3VyY2UYASABKAsyHC5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2UidgoRU3luY1NvdXJjZVJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIUCgJpZBgCIAEoCUIIukgFcgOwAQESHgoMYWNjZXNzX3Rva2VuGAMgASgJQgi6SAVyAxiAIBIRCglyZWNvbm5lY3QYBCABKAgiJAoSU3luY1NvdXJjZVJlc3BvbnNlEg4KBmpvYl9pZBgBIAEoCSJqChRHZXRTb3VyY2VTeW5jUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhsKCXNvdXJjZV9pZBgCIAEoCUIIukgFcgOwAQESGwoGam9iX2lkGAMgASgJQgu6SAjYAQFyA7ABASKVAQoSU291cmNlU3luY0RlbGl2ZXJ5EhgKBmpvYl9pZBgBIAEoCUIIukgFcgOwAQESLQoFc3RhdGUYAiABKA4yFi5zYWFzLmpvYnMudjEuSm9iU3RhdGVCBrpIA8gBARI2CglleGVjdXRpb24YAyABKAsyIy5zYWFzLmpvYnMudjEuSm9iRXhlY3V0aW9uUmVmZXJlbmNlIosBChFTb3VyY2VTeW5jQ2hhbmdlcxINCgVmaWxlcxgBIAEoDRINCgVhZGRlZBgCIAEoDRIQCghtb2RpZmllZBgDIAEoDRIPCgdkZWxldGVkGAQgASgNEhMKC3NwbGl0X2tub3duGAUgASgIEhAKCHNuYXBzaG90GAYgASgIEg4KBmNvbW1pdBgHIAEoCSKtAQoRU291cmNlU3luY0ZhaWx1cmUSOQoGcmVhc29uGAEgASgOMikuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VTeW5jRmFpbHVyZVJlYXNvbhIMCgRjb2RlGAIgASgJEg8KB21lc3NhZ2UYAyABKAkSEAoIcmV0cnlpbmcYBCABKAgSLAoIcmV0cnlfYXQYBSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIoQEChJTb3VyY2VTeW5jUHJvZ3Jlc3MSMAoFcGhhc2UYASABKA4yIS5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVN5bmNQaGFzZRI0Cgd0cmlnZ2VyGAIgASgOMiMuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VTeW5jVHJpZ2dlchItCglxdWV1ZWRfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi8KC2ZldGNoaW5nX2F0GAQgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIvCgtjb21waWxlZF9hdBgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASMQoNaGFuZGVkX29mZl9hdBgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLwoLZmluaXNoZWRfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjQKB2NoYW5nZXMYCCABKAsyIy5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVN5bmNDaGFuZ2VzEjQKB2ZhaWx1cmUYCSABKAsyIy5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVN5bmNGYWlsdXJlEg8KB2F0dGVtcHQYCiABKA0SFAoMbWF4X2F0dGVtcHRzGAsgASgNItIBChVHZXRTb3VyY2VTeW5jUmVzcG9uc2USGAoGam9iX2lkGAEgASgJQgi6SAVyA7ABARItCgVzdGF0ZRgCIAEoDjIWLnNhYXMuam9icy52MS5Kb2JTdGF0ZUIGukgDyAEBEjgKCmRlbGl2ZXJpZXMYAyADKAsyJC5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVN5bmNEZWxpdmVyeRI2Cghwcm9ncmVzcxgEIAEoCzIkLnNhYXMuYWNjb3VudHMudjEuU291cmNlU3luY1Byb2dyZXNzIkUKE0RlbGV0ZVNvdXJjZVJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIUCgJpZBgCIAEoCUIIukgFcgOwAQEiFgoURGVsZXRlU291cmNlUmVzcG9uc2UiVgoTR2l0SHViQXBwUmVwb3NpdG9yeRIMCgRyZXBvGAEgASgJEhYKDmRlZmF1bHRfYnJhbmNoGAIgASgJEhkKEWFscmVhZHlfY29ubmVjdGVkGAMgASgIIjYKGkJlZ2luR2l0SHViQXBwU2V0dXBSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQEicQobQmVnaW5HaXRIdWJBcHBTZXR1cFJlc3BvbnNlEhMKC2luc3RhbGxfdXJsGAEgASgJEg0KBXN0YXRlGAIgASgJEi4KCmV4cGlyZXNfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIpwBCh1Db21wbGV0ZUdpdEh1YkFwcFNldHVwUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhkKBXN0YXRlGAIgASgJQgq6SAdyBRABGP8BEiwKD2luc3RhbGxhdGlvbl9pZBgDIAEoCUITukgQcg4QARggMgheWzAtOV0rJBIYCgRjb2RlGAQgASgJQgq6SAdyBRABGP8BInYKHkNvbXBsZXRlR2l0SHViQXBwU2V0dXBSZXNwb25zZRIXCg9pbnN0YWxsYXRpb25faWQYASABKAkSOwoMcmVwb3NpdG9yaWVzGAIgAygLMiUuc2Fhcy5hY2NvdW50cy52MS5HaXRIdWJBcHBSZXBvc2l0b3J5IlEKH01pZ3JhdGVHaXRIdWJTb3VyY2VUb0FwcFJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIUCgJpZBgCIAEoCUIIukgFcgOwAQEiVAogTWlncmF0ZUdpdEh1YlNvdXJjZVRvQXBwUmVzcG9uc2USMAoKZGF0YXNvdXJjZRgBIAEoCzIcLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZSLEAQoVRGF0YXNvdXJjZUFjY291bnRMaW5rEgoKAmlkGAEgASgJEg4KBm9yZ19pZBgCIAEoCRIPCgd1c2VyX2lkGAMgASgJEhEKCWNvbm5lY3RvchgEIAEoCRIbChNwcm92aWRlcl9hY2NvdW50X2lkGAUgASgJEh4KFnByb3ZpZGVyX2FjY291bnRfbG9naW4YBiABKAkSLgoKY3JlYXRlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAitwEKFkRhdGFzb3VyY2VHcm91cEJpbmRpbmcSCgoCaWQYASABKAkSDgoGb3JnX2lkGAIgASgJEhEKCWNvbm5lY3RvchgDIAEoCRIZChFwcm92aWRlcl9ncm91cF9pZBgEIAEoCRIPCgd0ZWFtX2lkGAUgASgJEhIKCmNyZWF0ZWRfYnkYBiABKAkSLgoKY3JlYXRlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAilAIKGERhdGFzb3VyY2VWZXJpZmllZERvbWFpbhIKCgJpZBgBIAEoCRIOCgZvcmdfaWQYAiABKAkSDgoGZG9tYWluGAMgASgJEjgKBnN0YXR1cxgEIAEoDjIoLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZURvbWFpblN0YXR1cxIXCg90eHRfcmVjb3JkX25hbWUYBSABKAkSGAoQdHh0X3JlY29yZF92YWx1ZRgGIAEoCRIvCgt2ZXJpZmllZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLgoKY3JlYXRlZF9hdBgIIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiMwoXRGF0YXNvdXJjZURpcmVjdG9yeVRlYW0SCgoCaWQYASABKAkSDAoEbmFtZRgCIAEoCSKmAQohQmVnaW5EYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESNAoJY29ubmVjdG9yGAIgASgJQiG6SB5yHBACGCAyFl5bYS16XVthLXowLTktXXsxLDMxfSQSHgoMcmVkaXJlY3RfdXJpGAMgASgJQgi6SAVyAxiAEBIRCglzb3VyY2VfaWQYBCABKAkiegoiQmVnaW5EYXRhc291cmNlQWNjb3VudExpbmtSZXNwb25zZRIVCg1hdXRob3JpemVfdXJsGAEgASgJEg0KBXN0YXRlGAIgASgJEi4KCmV4cGlyZXNfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wInUKJENvbXBsZXRlRGF0YXNvdXJjZUFjY291bnRMaW5rUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhkKBXN0YXRlGAIgASgJQgq6SAdyBRABGIBAEhgKBGNvZGUYAyABKAlCCrpIB3IFEAEY/wEiXgolQ29tcGxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXNwb25zZRI1CgRsaW5rGAEgASgLMicuc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlQWNjb3VudExpbmsiPwojTGlzdE15RGF0YXNvdXJjZUFjY291bnRMaW5rc1JlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABASJeCiRMaXN0TXlEYXRhc291cmNlQWNjb3VudExpbmtzUmVzcG9uc2USNgoFbGlua3MYASADKAsyJy5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VBY2NvdW50TGluayJUCiJEZWxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESFAoCaWQYAiABKAlCCLpIBXIDsAEBIiUKI0RlbGV0ZURhdGFzb3VyY2VBY2NvdW50TGlua1Jlc3BvbnNlIjkKHUdldERhdGFzb3VyY2VEaXJlY3RvcnlSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQEiiwIKHkdldERhdGFzb3VyY2VEaXJlY3RvcnlSZXNwb25zZRI2CgVsaW5rcxgBIAMoCzInLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZUFjY291bnRMaW5rEjoKCGJpbmRpbmdzGAIgAygLMiguc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlR3JvdXBCaW5kaW5nEjsKB2RvbWFpbnMYAyADKAsyKi5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VWZXJpZmllZERvbWFpbhI4CgV0ZWFtcxgEIAMoCzIpLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZURpcmVjdG9yeVRlYW0irgEKGkJpbmREYXRhc291cmNlR3JvdXBSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESNAoJY29ubmVjdG9yGAIgASgJQiG6SB5yHBACGCAyFl5bYS16XVthLXowLTktXXsxLDMxfSQSJQoRcHJvdmlkZXJfZ3JvdXBfaWQYAyABKAlCCrpIB3IFEAEY/wESGQoHdGVhbV9pZBgEIAEoCUIIukgFcgOwAQEiWAobQmluZERhdGFzb3VyY2VHcm91cFJlc3BvbnNlEjkKB2JpbmRpbmcYASABKAsyKC5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VHcm91cEJpbmRpbmciTgocVW5iaW5kRGF0YXNvdXJjZUdyb3VwUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhQKAmlkGAIgASgJQgi6SAVyA7ABASIfCh1VbmJpbmREYXRhc291cmNlR3JvdXBSZXNwb25zZSJUChxDbGFpbURhdGFzb3VyY2VEb21haW5SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESGgoGZG9tYWluGAIgASgJQgq6SAdyBRADGP0BIlsKHUNsYWltRGF0YXNvdXJjZURvbWFpblJlc3BvbnNlEjoKBmRvbWFpbhgBIAEoCzIqLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVZlcmlmaWVkRG9tYWluIk8KHVZlcmlmeURhdGFzb3VyY2VEb21haW5SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESFAoCaWQYAiABKAlCCLpIBXIDsAEBIlwKHlZlcmlmeURhdGFzb3VyY2VEb21haW5SZXNwb25zZRI6CgZkb21haW4YASABKAsyKi5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VWZXJpZmllZERvbWFpbiJPCh1EZWxldGVEYXRhc291cmNlRG9tYWluUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhQKAmlkGAIgASgJQgi6SAVyA7ABASIgCh5EZWxldGVEYXRhc291cmNlRG9tYWluUmVzcG9uc2UingIKEFNvdXJjZURlbGVnYXRpb24SCgoCaWQYASABKAkSEQoJc291cmNlX2lkGAIgASgJEhQKDHByaW5jaXBhbF9pZBgDIAEoCRIOCgZtb2R1bGUYBCABKAkSDwoHYmluZGluZxgFIAEoCRIuCgpjcmVhdGVkX2F0GAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgpyZXZva2VkX2F0GAcgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBJACgpyZXZvY2F0aW9uGAggASgOMiwuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VEZWxlZ2F0aW9uUmV2b2NhdGlvbhISCgpyZXZva2VkX2J5GAkgASgJIoEBChxMaXN0U291cmNlRGVsZWdhdGlvbnNSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESIAoJc291cmNlX2lkGAIgASgJQgi6SAVyA7ABAUgAiAEBEhcKD2luY2x1ZGVfcmV2b2tlZBgDIAEoCEIMCgpfc291cmNlX2lkIlgKHUxpc3RTb3VyY2VEZWxlZ2F0aW9uc1Jlc3BvbnNlEjcKC2RlbGVnYXRpb25zGAEgAygLMiIuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VEZWxlZ2F0aW9uIk8KHVJldm9rZVNvdXJjZURlbGVnYXRpb25SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESFAoCaWQYAiABKAlCCLpIBXIDsAEBIlgKHlJldm9rZVNvdXJjZURlbGVnYXRpb25SZXNwb25zZRI2CgpkZWxlZ2F0aW9uGAEgASgLMiIuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VEZWxlZ2F0aW9uIjIKD1RyaWdnZXJJZGVudGl0eRIOCgZzb3VyY2UYASABKAkSDwoHYmluZGluZxgCIAEoCSKEAQoXRGVjbGFyZWRUcmlnZ2VyU2NoZWR1bGUSDAoEY3JvbhgBIAEoCRIQCgh0aW1lem9uZRgCIAEoCRISCgptaXNzZWRfcnVuGAMgASgJEg8KB292ZXJsYXAYBCABKAkSEAoIZGVhZGxpbmUYBSABKAMSEgoKaW5wdXRfanNvbhgGIAEoCSLnAgoaVHJpZ2dlckRlbGVnYXRpb25SZWZlcmVuY2USEQoJcmVmZXJlbmNlGAEgASgJEhUKDWRlbGVnYXRpb25faWQYAiABKAkSDgoGbW9kdWxlGAMgASgJEg8KB2JpbmRpbmcYBCABKAkSEAoIYXVkaWVuY2UYBSABKAkSDgoGdGVuYW50GAYgASgJEhoKEm93bmVyX3ByaW5jaXBhbF9pZBgHIAEoCRIOCgZzY29wZXMYCCADKAkSDgoGYWN0aXZlGAkgASgIEi4KCmNyZWF0ZWRfYXQYCiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCnJldm9rZWRfYXQYCyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkAKCnJldm9jYXRpb24YDCABKA4yLC5zYWFzLmFjY291bnRzLnYxLlNvdXJjZURlbGVnYXRpb25SZXZvY2F0aW9uIr4BChNUcmlnZ2VyQ2hpbGRDb250ZXh0EhUKDWRlbGVnYXRpb25faWQYASABKAkSDgoGbW9kdWxlGAIgASgJEg8KB2JpbmRpbmcYAyABKAkSEAoIYXVkaWVuY2UYBCABKAkSDgoGc2NvcGVzGAUgAygJEg4KBmxvb2t1cBgGIAEoCBItCgltaW50ZWRfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEg4KBnJlY29yZBgIIAEoCSLNAgoYU291cmNlVHJpZ2dlckRlY2xhcmF0aW9uEg8KB3JlbGVhc2UYASABKAkSEQoJb3BlcmF0aW9uGAIgASgJEjsKCHNjaGVkdWxlGAMgASgLMikuc2Fhcy5hY2NvdW50cy52MS5EZWNsYXJlZFRyaWdnZXJTY2hlZHVsZRIzCghpZGVudGl0eRgEIAEoCzIhLnNhYXMuYWNjb3VudHMudjEuVHJpZ2dlcklkZW50aXR5Eg4KBmRpZ2VzdBgFIAEoCRI2ChJsYXN0X29jY3VycmVuY2VfYXQYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjYKEm5leHRfb2NjdXJyZW5jZV9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGwoTdW5kZWNsYXJhYmxlX3JlYXNvbhgIIAEoCSJWCh1EZWxlZ2F0ZVNvdXJjZVRyaWdnZXJzUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhsKCXNvdXJjZV9pZBgCIAEoCUIIukgFcgOwAQEiYwoeRGVsZWdhdGVTb3VyY2VUcmlnZ2Vyc1Jlc3BvbnNlEkEKC2RlbGVnYXRpb25zGAEgAygLMiwuc2Fhcy5hY2NvdW50cy52MS5UcmlnZ2VyRGVsZWdhdGlvblJlZmVyZW5jZSJbCiJHZXRTb3VyY2VUcmlnZ2VyRGVjbGFyYXRpb25SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESGwoJc291cmNlX2lkGAIgASgJQgi6SAVyA7ABASLiAQojR2V0U291cmNlVHJpZ2dlckRlY2xhcmF0aW9uUmVzcG9uc2USPwoLZGVjbGFyYXRpb24YASABKAsyKi5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVRyaWdnZXJEZWNsYXJhdGlvbhJBCgtkZWxlZ2F0aW9ucxgCIAMoCzIsLnNhYXMuYWNjb3VudHMudjEuVHJpZ2dlckRlbGVnYXRpb25SZWZlcmVuY2USNwoIY2hpbGRyZW4YAyADKAsyJS5zYWFzLmFjY291bnRzLnYxLlRyaWdnZXJDaGlsZENvbnRleHQibgoWUmVjb25jaWxlU291cmNlUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhsKCXNvdXJjZV9pZBgCIAEoCUIIukgFcgOwAQESHQoJZWZmZWN0X2lkGAMgASgJQgq6SAdyBRABGIABIkwKF1JlY29uY2lsZVNvdXJjZVJlc3BvbnNlEhEKCWVmZmVjdF9pZBgBIAEoCRIOCgZzdGF0dXMYAiABKAkSDgoGam9iX2lkGAMgASgJIj0KHExvb2t1cFJlY29uY2lsZVNvdXJjZVJlcXVlc3QSHQoJZWZmZWN0X2lkGAEgASgJQgq6SAdyBRABGIABIvECCg9Tb3VyY2VPcGVyYXRpb24SDAoEbmFtZRgBIAEoCRITCgtkZXNjcmlwdGlvbhgCIAEoCRIOCgZtZXRob2QYAyABKAkSDAoEcGF0aBgEIAEoCRINCgVxdWVyeRgFIAMoCRItCgxpbnB1dF9zY2hlbWEYBiABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0Ei4KDW91dHB1dF9zY2hlbWEYByABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0EjgKBmVmZmVjdBgIIAEoDjIoLnNhYXMuYWNjb3VudHMudjEuU291cmNlT3BlcmF0aW9uLkVmZmVjdBIYChBtYXhfb3V0cHV0X2J5dGVzGAkgASgNEg4KBmRpZ2VzdBgKIAEoCSJLCgZFZmZlY3QSFgoSRUZGRUNUX1VOU1BFQ0lGSUVEEAASFAoQRUZGRUNUX1JFQURfT05MWRABEhMKD0VGRkVDVF9NVVRBVElPThACIo4BCh5EZWNsYXJlU291cmNlT3BlcmF0aW9uc1JlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIbCglzb3VyY2VfaWQYAiABKAlCCLpIBXIDsAEBEjUKCm9wZXJhdGlvbnMYAyADKAsyIS5zYWFzLmFjY291bnRzLnYxLlNvdXJjZU9wZXJhdGlvbiJYCh9EZWNsYXJlU291cmNlT3BlcmF0aW9uc1Jlc3BvbnNlEjUKCm9wZXJhdGlvbnMYASADKAsyIS5zYWFzLmFjY291bnRzLnYxLlNvdXJjZU9wZXJhdGlvbiJUChtMaXN0U291cmNlT3BlcmF0aW9uc1JlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIbCglzb3VyY2VfaWQYAiABKAlCCLpIBXIDsAEBIlUKHExpc3RTb3VyY2VPcGVyYXRpb25zUmVzcG9uc2USNQoKb3BlcmF0aW9ucxgBIAMoCzIhLnNhYXMuYWNjb3VudHMudjEuU291cmNlT3BlcmF0aW9uIsMBChxJbnZva2VTb3VyY2VPcGVyYXRpb25SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESGwoJc291cmNlX2lkGAIgASgJQgi6SAVyA7ABARIwCglvcGVyYXRpb24YAyABKAlCHbpIGnIYMhZeW2Etel1bYS16MC05X117MCw2M30kEh0KCmlucHV0X2pzb24YBCABKAlCCbpIBnIEKICABBIbCgllZmZlY3RfaWQYBSABKAlCCLpIBXIDKIABIn8KFlNvdXJjZU9wZXJhdGlvblJlY2VpcHQSEQoJZWZmZWN0X2lkGAEgASgJEhQKDGNvbW1pdHRlZF9hdBgCIAEoCRIOCgZzdGF0dXMYAyABKAkSFwoPcHJvdmlkZXJfc3RhdHVzGAQgASgNEhMKC291dHB1dF9qc29uGAUgASgJIm8KHUludm9rZVNvdXJjZU9wZXJhdGlvblJlc3BvbnNlEhMKC291dHB1dF9qc29uGAEgASgJEjkKB3JlY2VpcHQYAiABKAsyKC5zYWFzLmFjY291bnRzLnYxLlNvdXJjZU9wZXJhdGlvblJlY2VpcHQiQwoiTG9va3VwSW52b2tlU291cmNlT3BlcmF0aW9uUmVxdWVzdBIdCgllZmZlY3RfaWQYASABKAlCCrpIB3IFEAEogAEieQojUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1JlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIbCglzb3VyY2VfaWQYAiABKAlCCLpIBXIDsAEBEhsKCWVmZmVjdF9pZBgDIAEoCUIIukgFcgMogAEiWwokUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1Jlc3BvbnNlEhEKCWVmZmVjdF9pZBgBIAEoCRIQCghyZWNlaXB0cxgCIAEoAxIOCgZzdGF0dXMYAyABKAkiSgopTG9va3VwUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1JlcXVlc3QSHQoJZWZmZWN0X2lkGAEgASgJQgq6SAdyBRABKIABKrcBChJEYXRhc291cmNlUHJvdmlkZXISIwofREFUQVNPVVJDRV9QUk9WSURFUl9VTlNQRUNJRklFRBAAEh4KGkRBVEFTT1VSQ0VfUFJPVklERVJfR0lUSFVCEAESGwoXREFUQVNPVVJDRV9QUk9WSURFUl9BUEkQAhIfChtEQVRBU09VUkNFX1BST1ZJREVSX0NSQVdMRVIQAxIeChpEQVRBU09VUkNFX1BST1ZJREVSX1VQTE9BRBAEKpEBChBEYXRhc291cmNlU3RhdHVzEiEKHURBVEFTT1VSQ0VfU1RBVFVTX1VOU1BFQ0lGSUVEEAASHAoYREFUQVNPVVJDRV9TVEFUVVNfQUNUSVZFEAESHAoYREFUQVNPVVJDRV9TVEFUVVNfUEFVU0VEEAISHgoaREFUQVNPVVJDRV9TVEFUVVNfREVHUkFERUQQAyq8AQoWRGF0YXNvdXJjZUxpdmVEZWxpdmVyeRIoCiREQVRBU09VUkNFX0xJVkVfREVMSVZFUllfVU5TUEVDSUZJRUQQABIhCh1EQVRBU09VUkNFX0xJVkVfREVMSVZFUllfTk9ORRABEisKJ0RBVEFTT1VSQ0VfTElWRV9ERUxJVkVSWV9TT1VSQ0VfV0VCSE9PSxACEigKJERBVEFTT1VSQ0VfTElWRV9ERUxJVkVSWV9BUFBfV0VCSE9PSxADKtYBChFBcGlDcmVkZW50aWFsS2luZBIjCh9BUElfQ1JFREVOVElBTF9LSU5EX1VOU1BFQ0lGSUVEEAASHgoaQVBJX0NSRURFTlRJQUxfS0lORF9CRUFSRVIQARIdChlBUElfQ1JFREVOVElBTF9LSU5EX0JBU0lDEAISHgoaQVBJX0NSRURFTlRJQUxfS0lORF9IRUFERVIQAxIdChlBUElfQ1JFREVOVElBTF9LSU5EX1FVRVJZEAQSHgoaQVBJX0NSRURFTlRJQUxfS0lORF9PQVVUSDIQBSqmAgocRGF0YXNvdXJjZUNvbm5lY3RvckludGVyZmFjZRIuCipEQVRBU09VUkNFX0NPTk5FQ1RPUl9JTlRFUkZBQ0VfVU5TUEVDSUZJRUQQABIoCiREQVRBU09VUkNFX0NPTk5FQ1RPUl9JTlRFUkZBQ0VfRklMRVMQARIoCiREQVRBU09VUkNFX0NPTk5FQ1RPUl9JTlRFUkZBQ0VfUEFHRVMQAhIqCiZEQVRBU09VUkNFX0NPTk5FQ1RPUl9JTlRFUkZBQ0VfUkVDT1JEUxADEisKJ0RBVEFTT1VSQ0VfQ09OTkVDVE9SX0lOVEVSRkFDRV9NRVNTQUdFUxAEEikKJURBVEFTT1VSQ0VfQ09OTkVDVE9SX0lOVEVSRkFDRV9FVkVOVFMQBSrsAQoYRGF0YXNvdXJjZUNyZWRlbnRpYWxNb2RlEioKJkRBVEFTT1VSQ0VfQ1JFREVOVElBTF9NT0RFX1VOU1BFQ0lGSUVEEAASIwofREFUQVNPVVJDRV9DUkVERU5USUFMX01PREVfTk9ORRABEiYKIkRBVEFTT1VSQ0VfQ1JFREVOVElBTF9NT0RFX09SR19BUFAQAhIpCiVEQVRBU09VUkNFX0NSRURFTlRJQUxfTU9ERV9VU0VSX09BVVRIEAMSLAooREFUQVNPVVJDRV9DUkVERU5USUFMX01PREVfU1RBVElDX1NFQ1JFVBAEKpcBChZEYXRhc291cmNlUmVhZGVyc01vZGVsEigKJERBVEFTT1VSQ0VfUkVBREVSU19NT0RFTF9VTlNQRUNJRklFRBAAEioKJkRBVEFTT1VSQ0VfUkVBREVSU19NT0RFTF9TT1VSQ0VfU0NPUEVEEAESJwojREFUQVNPVVJDRV9SRUFERVJTX01PREVMX1RSQU5TTEFURUQQAiruAQoPU291cmNlU3luY1BoYXNlEiEKHVNPVVJDRV9TWU5DX1BIQVNFX1VOU1BFQ0lGSUVEEAASHAoYU09VUkNFX1NZTkNfUEhBU0VfUVVFVUVEEAESHgoaU09VUkNFX1NZTkNfUEhBU0VfRkVUQ0hJTkcQAhIeChpTT1VSQ0VfU1lOQ19QSEFTRV9DT01QSUxFRBADEiAKHFNPVVJDRV9TWU5DX1BIQVNFX0hBTkRFRF9PRkYQBBIaChZTT1VSQ0VfU1lOQ19QSEFTRV9ET05FEAUSHAoYU09VUkNFX1NZTkNfUEhBU0VfRkFJTEVEEAYqpgMKF1NvdXJjZVN5bmNGYWlsdXJlUmVhc29uEioKJlNPVVJDRV9TWU5DX0ZBSUxVUkVfUkVBU09OX1VOU1BFQ0lGSUVEEAASKwonU09VUkNFX1NZTkNfRkFJTFVSRV9SRUFTT05fUkFURV9MSU1JVEVEEAESKQolU09VUkNFX1NZTkNfRkFJTFVSRV9SRUFTT05fQ1JFREVOVElBTBACEiwKKFNPVVJDRV9TWU5DX0ZBSUxVUkVfUkVBU09OX0FDQ0VTU19ERU5JRUQQAxIoCiRTT1VSQ0VfU1lOQ19GQUlMVVJFX1JFQVNPTl9OT1RfRk9VTkQQBBIoCiRTT1VSQ0VfU1lOQ19GQUlMVVJFX1JFQVNPTl9UT09fTEFSR0UQBRIvCitTT1VSQ0VfU1lOQ19GQUlMVVJFX1JFQVNPTl9IT1NUX1VOQVZBSUxBQkxFEAYSJAogU09VUkNFX1NZTkNfRkFJTFVSRV9SRUFTT05fT1RIRVIQBxIuCipTT1VSQ0VfU1lOQ19GQUlMVVJFX1JFQVNPTl9ERUxJVkVSWV9GQUlMRUQQCCqcAQoRU291cmNlU3luY1RyaWdnZXISIwofU09VUkNFX1NZTkNfVFJJR0dFUl9VTlNQRUNJRklFRBAAEh4KGlNPVVJDRV9TWU5DX1RSSUdHRVJfTUFOVUFMEAESIQodU09VUkNFX1NZTkNfVFJJR0dFUl9TQ0hFRFVMRUQQAhIfChtTT1VSQ0VfU1lOQ19UUklHR0VSX1dFQkhPT0sQAyqPAQoWRGF0YXNvdXJjZURvbWFpblN0YXR1cxIoCiREQVRBU09VUkNFX0RPTUFJTl9TVEFUVVNfVU5TUEVDSUZJRUQQABIkCiBEQVRBU09VUkNFX0RPTUFJTl9TVEFUVVNfUEVORElORxABEiUKIURBVEFTT1VSQ0VfRE9NQUlOX1NUQVRVU19WRVJJRklFRBACKpUDChpTb3VyY2VEZWxlZ2F0aW9uUmV2b2NhdGlvbhIsCihTT1VSQ0VfREVMRUdBVElPTl9SRVZPQ0FUSU9OX1VOU1BFQ0lGSUVEEAASKAokU09VUkNFX0RFTEVHQVRJT05fUkVWT0NBVElPTl9SRVZPS0VEEAESKQolU09VUkNFX0RFTEVHQVRJT05fUkVWT0NBVElPTl9SRVBMQUNFRBACEi8KK1NPVVJDRV9ERUxFR0FUSU9OX1JFVk9DQVRJT05fU09VUkNFX0RFTEVURUQQAxIvCitTT1VSQ0VfREVMRUdBVElPTl9SRVZPQ0FUSU9OX01FTUJFUl9SRU1PVkVEEAQSMAosU09VUkNFX0RFTEVHQVRJT05fUkVWT0NBVElPTl9QRVJNSVNTSU9OX0xPU1QQBRIuCipTT1VSQ0VfREVMRUdBVElPTl9SRVZPQ0FUSU9OX1VTRVJfSU5BQ1RJVkUQBhIwCixTT1VSQ0VfREVMRUdBVElPTl9SRVZPQ0FUSU9OX0JJTkRJTkdfQ0hBTkdFRBAHMok4ChFEYXRhc291cmNlU2VydmljZRK5AwocUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0cxI1LnNhYXMuYWNjb3VudHMudjEuUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1JlcXVlc3QaNi5zYWFzLmFjY291bnRzLnYxLlBydW5lU291cmNlT3BlcmF0aW9uUmVjZWlwdHNSZXNwb25zZSKpAsLzGGwIAhADGhFkYXRhc291cmNlOmludm9rZSIRZGF0YXNvdXJjZTppbnZva2UqDwoJc291cmNlX2lkEAQYAzABOiMKH3NhYXMuZGF0YXNvdXJjZS5yZWNlaXB0cy5wcnVuZWQQAkADSARQA1gDYAHa8xi0AQoCCDwSAwjYBBgFIgIIAioLVU5BVkFJTEFCTEUqElJFU09VUkNFX0VYSEFVU1RFRCoHQUJPUlRFRDIPc2Fhcy1kYXRhc291cmNlSkYvc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlU2VydmljZS9Mb29rdXBQcnVuZVNvdXJjZU9wZXJhdGlvblJlY2VpcHRzUIAgWIAgYAFyGAoGc291cmNlEgZpbnZva2USBHJlYWQYARLmAQoiTG9va3VwUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0cxI7LnNhYXMuYWNjb3VudHMudjEuTG9va3VwUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1JlcXVlc3QaNi5zYWFzLmFjY291bnRzLnYxLlBydW5lU291cmNlT3BlcmF0aW9uUmVjZWlwdHNSZXNwb25zZSJLwvMYRwgCEAMaD2RhdGFzb3VyY2U6cmVhZCIPZGF0YXNvdXJjZTpyZWFkKg8KCWVmZmVjdF9pZBAEGAMwAToCEAFAAUgDUANYA2ABEvwDChVJbnZva2VTb3VyY2VPcGVyYXRpb24SLi5zYWFzLmFjY291bnRzLnYxLkludm9rZVNvdXJjZU9wZXJhdGlvblJlcXVlc3QaLy5zYWFzLmFjY291bnRzLnYxLkludm9rZVNvdXJjZU9wZXJhdGlvblJlc3BvbnNlIoEDwvMYbggCEAMaEWRhdGFzb3VyY2U6aW52b2tlIhFkYXRhc291cmNlOmludm9rZSoPCglzb3VyY2VfaWQQBBgDMAE6JQohc2Fhcy5kYXRhc291cmNlLm9wZXJhdGlvbi5pbnZva2VkEARAA0gEUARYBGAB2vMYrwEKAgg8EgMI2AQYBSICCAIqC1VOQVZBSUxBQkxFKhJSRVNPVVJDRV9FWEhBVVNURUQqB0FCT1JURUQyD3NhYXMtZGF0YXNvdXJjZUo/L3NhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVNlcnZpY2UvTG9va3VwSW52b2tlU291cmNlT3BlcmF0aW9uUICABFiAgEBgAXIYCgZzb3VyY2USBmludm9rZRIEcmVhZBgBgtPkkwJVOgEqIlAvdjEvb3JnYW5pemF0aW9ucy97b3JnX2lkfS9kYXRhc291cmNlcy97c291cmNlX2lkfS9vcGVyYXRpb25zL3tvcGVyYXRpb259Omludm9rZRKHAgobTG9va3VwSW52b2tlU291cmNlT3BlcmF0aW9uEjQuc2Fhcy5hY2NvdW50cy52MS5Mb29rdXBJbnZva2VTb3VyY2VPcGVyYXRpb25SZXF1ZXN0Gi8uc2Fhcy5hY2NvdW50cy52MS5JbnZva2VTb3VyY2VPcGVyYXRpb25SZXNwb25zZSKAAcLzGEcIAhADGg9kYXRhc291cmNlOnJlYWQiD2RhdGFzb3VyY2U6cmVhZCoPCgllZmZlY3RfaWQQBBgDMAE6AhABQAFIA1ADWARgAYLT5JMCLxItL3YxL2RhdGFzb3VyY2Utb3BlcmF0aW9uLXJlY2VpcHRzL3tlZmZlY3RfaWR9EoUCChRMaXN0U291cmNlT3BlcmF0aW9ucxItLnNhYXMuYWNjb3VudHMudjEuTGlzdFNvdXJjZU9wZXJhdGlvbnNSZXF1ZXN0Gi4uc2Fhcy5hY2NvdW50cy52MS5MaXN0U291cmNlT3BlcmF0aW9uc1Jlc3BvbnNlIo0BwvMYRAgCEAMaD2RhdGFzb3VyY2U6cmVhZCIPZGF0YXNvdXJjZTpyZWFkKgwKBm9yZ19pZBACGAEwAToCEAFAAUgDUANYA2ABgtPkkwI/Ej0vdjEvb3JnYW5pemF0aW9ucy97b3JnX2lkfS9kYXRhc291cmNlcy97c291cmNlX2lkfS9vcGVyYXRpb25zEpMCChdEZWNsYXJlU291cmNlT3BlcmF0aW9ucxIwLnNhYXMuYWNjb3VudHMudjEuRGVjbGFyZVNvdXJjZU9wZXJhdGlvbnNSZXF1ZXN0GjEuc2Fhcy5hY2NvdW50cy52MS5EZWNsYXJlU291cmNlT3BlcmF0aW9uc1Jlc3BvbnNlIpIBwvMYRggCEAQqDAoGb3JnX2lkEAIYATABOiYKInNhYXMuZGF0YXNvdXJjZS5vcGVyYXRpb24uZGVjbGFyZWQQAkABSARQA1gDYAGC0+STAkI6ASoiPS92MS9vcmdhbml6YXRpb25zL3tvcmdfaWR9L2RhdGFzb3VyY2VzL3tzb3VyY2VfaWR9L29wZXJhdGlvbnMSrAEKD0FkZEdpdEh1YlNvdXJjZRIoLnNhYXMuYWNjb3VudHMudjEuQWRkR2l0SHViU291cmNlUmVxdWVzdBopLnNhYXMuYWNjb3VudHMudjEuQWRkR2l0SHViU291cmNlUmVzcG9uc2UiRMLzGEAIAhAEKgwKBm9yZ19pZBACGAEwATogChxzYWFzLmRhdGFzb3VyY2Uuc291cmNlLmFkZGVkEAJAAUgEUARYA2ABEpoBCglBZGRTb3VyY2USIi5zYWFzLmFjY291bnRzLnYxLkFkZFNvdXJjZVJlcXVlc3QaIy5zYWFzLmFjY291bnRzLnYxLkFkZFNvdXJjZVJlc3BvbnNlIkTC8xhACAIQBCoMCgZvcmdfaWQQAhgBMAE6IAocc2Fhcy5kYXRhc291cmNlLnNvdXJjZS5hZGRlZBACQAFIBFAEWANgARKPAQoUR2V0RGF0YXNvdXJjZUNhdGFsb2cSLS5zYWFzLmFjY291bnRzLnYxLkdldERhdGFzb3VyY2VDYXRhbG9nUmVxdWVzdBouLnNhYXMuYWNjb3VudHMudjEuR2V0RGF0YXNvdXJjZUNhdGFsb2dSZXNwb25zZSIYwvMYFAgCEAEwAToCEAFAAUgDUAJYAmABEoIBCgtMaXN0U291cmNlcxIkLnNhYXMuYWNjb3VudHMudjEuTGlzdFNvdXJjZXNSZXF1ZXN0GiUuc2Fhcy5hY2NvdW50cy52MS5MaXN0U291cmNlc1Jlc3BvbnNlIibC8xgiCAIQAyoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARJ8CglHZXRTb3VyY2USIi5zYWFzLmFjY291bnRzLnYxLkdldFNvdXJjZVJlcXVlc3QaIy5zYWFzLmFjY291bnRzLnYxLkdldFNvdXJjZVJlc3BvbnNlIibC8xgiCAIQAyoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARKeAQoKU3luY1NvdXJjZRIjLnNhYXMuYWNjb3VudHMudjEuU3luY1NvdXJjZVJlcXVlc3QaJC5zYWFzLmFjY291bnRzLnYxLlN5bmNTb3VyY2VSZXNwb25zZSJFwvMYQQgCEAQqDAoGb3JnX2lkEAIYATABOiEKHXNhYXMuZGF0YXNvdXJjZS5zb3VyY2Uuc3luY2VkEAJAAUgEUARYAmABEogBCg1HZXRTb3VyY2VTeW5jEiYuc2Fhcy5hY2NvdW50cy52MS5HZXRTb3VyY2VTeW5jUmVxdWVzdBonLnNhYXMuYWNjb3VudHMudjEuR2V0U291cmNlU3luY1Jlc3BvbnNlIibC8xgiCAIQBCoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARKlAQoMRGVsZXRlU291cmNlEiUuc2Fhcy5hY2NvdW50cy52MS5EZWxldGVTb3VyY2VSZXF1ZXN0GiYuc2Fhcy5hY2NvdW50cy52MS5EZWxldGVTb3VyY2VSZXNwb25zZSJGwvMYQggCEAQqDAoGb3JnX2lkEAIYATABOiIKHnNhYXMuZGF0YXNvdXJjZS5zb3VyY2UucmVtb3ZlZBACQAFIBFACWAJgARLEAQoTQmVnaW5HaXRIdWJBcHBTZXR1cBIsLnNhYXMuYWNjb3VudHMudjEuQmVnaW5HaXRIdWJBcHBTZXR1cFJlcXVlc3QaLS5zYWFzLmFjY291bnRzLnYxLkJlZ2luR2l0SHViQXBwU2V0dXBSZXNwb25zZSJQwvMYTAgCEAQqDAoGb3JnX2lkEAIYATABOiwKKHNhYXMuZGF0YXNvdXJjZS5naXRodWJfYXBwLnNldHVwX3N0YXJ0ZWQQAkABSARQAlgEYAESzwEKFkNvbXBsZXRlR2l0SHViQXBwU2V0dXASLy5zYWFzLmFjY291bnRzLnYxLkNvbXBsZXRlR2l0SHViQXBwU2V0dXBSZXF1ZXN0GjAuc2Fhcy5hY2NvdW50cy52MS5Db21wbGV0ZUdpdEh1YkFwcFNldHVwUmVzcG9uc2UiUsLzGE4IAhAEKgwKBm9yZ19pZBACGAEwATouCipzYWFzLmRhdGFzb3VyY2UuZ2l0aHViX2FwcC5zZXR1cF9jb21wbGV0ZWQQAkABSARQBFgDYAESzQEKGE1pZ3JhdGVHaXRIdWJTb3VyY2VUb0FwcBIxLnNhYXMuYWNjb3VudHMudjEuTWlncmF0ZUdpdEh1YlNvdXJjZVRvQXBwUmVxdWVzdBoyLnNhYXMuYWNjb3VudHMudjEuTWlncmF0ZUdpdEh1YlNvdXJjZVRvQXBwUmVzcG9uc2UiSsLzGEYIAhAEKgwKBm9yZ19pZBACGAEwATomCiJzYWFzLmRhdGFzb3VyY2UuY3JlZGVudGlhbC51cGRhdGVkEAJAAUgEUAJYA2ABEtUBChpCZWdpbkRhdGFzb3VyY2VBY2NvdW50TGluaxIzLnNhYXMuYWNjb3VudHMudjEuQmVnaW5EYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0GjQuc2Fhcy5hY2NvdW50cy52MS5CZWdpbkRhdGFzb3VyY2VBY2NvdW50TGlua1Jlc3BvbnNlIkzC8xhICAIQAyoMCgZvcmdfaWQQAhgBMAE6KAokc2Fhcy5kYXRhc291cmNlLmFjY291bnRfbGlua19zdGFydGVkEAJAAUgEUAJYBGABEtgBCh1Db21wbGV0ZURhdGFzb3VyY2VBY2NvdW50TGluaxI2LnNhYXMuYWNjb3VudHMudjEuQ29tcGxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0Gjcuc2Fhcy5hY2NvdW50cy52MS5Db21wbGV0ZURhdGFzb3VyY2VBY2NvdW50TGlua1Jlc3BvbnNlIkbC8xhCCAIQAyoMCgZvcmdfaWQQAhgBMAE6Igoec2Fhcy5kYXRhc291cmNlLmFjY291bnRfbGlua2VkEAJAAUgEUARYA2ABErUBChxMaXN0TXlEYXRhc291cmNlQWNjb3VudExpbmtzEjUuc2Fhcy5hY2NvdW50cy52MS5MaXN0TXlEYXRhc291cmNlQWNjb3VudExpbmtzUmVxdWVzdBo2LnNhYXMuYWNjb3VudHMudjEuTGlzdE15RGF0YXNvdXJjZUFjY291bnRMaW5rc1Jlc3BvbnNlIibC8xgiCAIQAyoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARLUAQobRGVsZXRlRGF0YXNvdXJjZUFjY291bnRMaW5rEjQuc2Fhcy5hY2NvdW50cy52MS5EZWxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0GjUuc2Fhcy5hY2NvdW50cy52MS5EZWxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXNwb25zZSJIwvMYRAgCEAMqDAoGb3JnX2lkEAIYATABOiQKIHNhYXMuZGF0YXNvdXJjZS5hY2NvdW50X3VubGlua2VkEAJAAUgEUAJYA2ABEqMBChZHZXREYXRhc291cmNlRGlyZWN0b3J5Ei8uc2Fhcy5hY2NvdW50cy52MS5HZXREYXRhc291cmNlRGlyZWN0b3J5UmVxdWVzdBowLnNhYXMuYWNjb3VudHMudjEuR2V0RGF0YXNvdXJjZURpcmVjdG9yeVJlc3BvbnNlIibC8xgiCAIQBCoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARK3AQoTQmluZERhdGFzb3VyY2VHcm91cBIsLnNhYXMuYWNjb3VudHMudjEuQmluZERhdGFzb3VyY2VHcm91cFJlcXVlc3QaLS5zYWFzLmFjY291bnRzLnYxLkJpbmREYXRhc291cmNlR3JvdXBSZXNwb25zZSJDwvMYPwgCEAQqDAoGb3JnX2lkEAIYATABOh8KG3NhYXMuZGF0YXNvdXJjZS5ncm91cF9ib3VuZBACQAFIBFACWANgARK/AQoVVW5iaW5kRGF0YXNvdXJjZUdyb3VwEi4uc2Fhcy5hY2NvdW50cy52MS5VbmJpbmREYXRhc291cmNlR3JvdXBSZXF1ZXN0Gi8uc2Fhcy5hY2NvdW50cy52MS5VbmJpbmREYXRhc291cmNlR3JvdXBSZXNwb25zZSJFwvMYQQgCEAQqDAoGb3JnX2lkEAIYATABOiEKHXNhYXMuZGF0YXNvdXJjZS5ncm91cF91bmJvdW5kEAJAAUgEUAJYA2ABEsABChVDbGFpbURhdGFzb3VyY2VEb21haW4SLi5zYWFzLmFjY291bnRzLnYxLkNsYWltRGF0YXNvdXJjZURvbWFpblJlcXVlc3QaLy5zYWFzLmFjY291bnRzLnYxLkNsYWltRGF0YXNvdXJjZURvbWFpblJlc3BvbnNlIkbC8xhCCAIQBCoMCgZvcmdfaWQQAhgBMAE6Igoec2Fhcy5kYXRhc291cmNlLmRvbWFpbl9jbGFpbWVkEAJAAUgEUAJYA2ABEsQBChZWZXJpZnlEYXRhc291cmNlRG9tYWluEi8uc2Fhcy5hY2NvdW50cy52MS5WZXJpZnlEYXRhc291cmNlRG9tYWluUmVxdWVzdBowLnNhYXMuYWNjb3VudHMudjEuVmVyaWZ5RGF0YXNvdXJjZURvbWFpblJlc3BvbnNlIkfC8xhDCAIQBCoMCgZvcmdfaWQQAhgBMAE6Iwofc2Fhcy5kYXRhc291cmNlLmRvbWFpbl92ZXJpZmllZBACQAFIBFACWANgARLDAQoWRGVsZXRlRGF0YXNvdXJjZURvbWFpbhIvLnNhYXMuYWNjb3VudHMudjEuRGVsZXRlRGF0YXNvdXJjZURvbWFpblJlcXVlc3QaMC5zYWFzLmFjY291bnRzLnYxLkRlbGV0ZURhdGFzb3VyY2VEb21haW5SZXNwb25zZSJGwvMYQggCEAQqDAoGb3JnX2lkEAIYATABOiIKHnNhYXMuZGF0YXNvdXJjZS5kb21haW5fcmVtb3ZlZBACQAFIBFACWANgARKgAQoVTGlzdFNvdXJjZURlbGVnYXRpb25zEi4uc2Fhcy5hY2NvdW50cy52MS5MaXN0U291cmNlRGVsZWdhdGlvbnNSZXF1ZXN0Gi8uc2Fhcy5hY2NvdW50cy52MS5MaXN0U291cmNlRGVsZWdhdGlvbnNSZXNwb25zZSImwvMYIggCEAQqDAoGb3JnX2lkEAIYATABOgIQAUABSANQAlgDYAESxwEKFlJldm9rZVNvdXJjZURlbGVnYXRpb24SLy5zYWFzLmFjY291bnRzLnYxLlJldm9rZVNvdXJjZURlbGVnYXRpb25SZXF1ZXN0GjAuc2Fhcy5hY2NvdW50cy52MS5SZXZva2VTb3VyY2VEZWxlZ2F0aW9uUmVzcG9uc2UiSsLzGEYIAhAEKgwKBm9yZ19pZBACGAEwATomCiJzYWFzLmRhdGFzb3VyY2UuZGVsZWdhdGlvbi5yZXZva2VkEAJAAUgEUAJYA2ABEusBChZEZWxlZ2F0ZVNvdXJjZVRyaWdnZXJzEi8uc2Fhcy5hY2NvdW50cy52MS5EZWxlZ2F0ZVNvdXJjZVRyaWdnZXJzUmVxdWVzdBowLnNhYXMuYWNjb3VudHMudjEuRGVsZWdhdGVTb3VyY2VUcmlnZ2Vyc1Jlc3BvbnNlIm7C8xhqCAIQBCoMCgZvcmdfaWQQAhgBMAE6Sgoic2Fhcy5kYXRhc291cmNlLmRlbGVnYXRpb24uY3JlYXRlZAoic2Fhcy5kYXRhc291cmNlLmRlbGVnYXRpb24ucmV2b2tlZBACQAFIBFACWANgARKyAQobR2V0U291cmNlVHJpZ2dlckRlY2xhcmF0aW9uEjQuc2Fhcy5hY2NvdW50cy52MS5HZXRTb3VyY2VUcmlnZ2VyRGVjbGFyYXRpb25SZXF1ZXN0GjUuc2Fhcy5hY2NvdW50cy52MS5HZXRTb3VyY2VUcmlnZ2VyRGVjbGFyYXRpb25SZXNwb25zZSImwvMYIggCEAQqDAoGb3JnX2lkEAIYATABOgIQAUABSANQAlgDYAESgwMKD1JlY29uY2lsZVNvdXJjZRIoLnNhYXMuYWNjb3VudHMudjEuUmVjb25jaWxlU291cmNlUmVxdWVzdBopLnNhYXMuYWNjb3VudHMudjEuUmVjb25jaWxlU291cmNlUmVzcG9uc2UimgLC8xhqCAIQAxoRZGF0YXNvdXJjZTppbnZva2UiEWRhdGFzb3VyY2U6aW52b2tlKg8KCXNvdXJjZV9pZBAEGAMwATohCh1zYWFzLmRhdGFzb3VyY2Uuc291cmNlLnN5bmNlZBACQANIBFACWAJgAdrzGKcBCgIIPBIDCNgEGAUiAggCKgtVTkFWQUlMQUJMRSoSUkVTT1VSQ0VfRVhIQVVTVEVEKgdBQk9SVEVEMg9zYWFzLWRhdGFzb3VyY2VKOS9zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VTZXJ2aWNlL0xvb2t1cFJlY29uY2lsZVNvdXJjZVCAIFiAIGABchgKBnNvdXJjZRIGaW52b2tlEgRyZWFkGAESvwEKFUxvb2t1cFJlY29uY2lsZVNvdXJjZRIuLnNhYXMuYWNjb3VudHMudjEuTG9va3VwUmVjb25jaWxlU291cmNlUmVxdWVzdBopLnNhYXMuYWNjb3VudHMudjEuUmVjb25jaWxlU291cmNlUmVzcG9uc2UiS8LzGEcIAhADGg9kYXRhc291cmNlOnJlYWQiD2RhdGFzb3VyY2U6cmVhZCoPCgllZmZlY3RfaWQQBBgDMAE6AhABQAFIA1ACWAJgAWIGcHJvdG8z", [file_buf_validate_validate, file_codefly_runnable_v0_options, file_google_api_annotations, file_google_protobuf_duration, file_google_protobuf_struct, file_google_protobuf_timestamp, file_saas_jobs_v1_jobs, file_saas_policy_v1_options]); + fileDesc("CiFzYWFzL2FjY291bnRzL3YxL2RhdGFzb3VyY2UucHJvdG8SEHNhYXMuYWNjb3VudHMudjEiXgoWR2l0SHViRGF0YXNvdXJjZUNvbmZpZxIMCgRyZXBvGAEgASgJEg0KBXBhdGhzGAIgAygJEg4KBmJyYW5jaBgDIAEoCRIXCg9maWxlX2V4dGVuc2lvbnMYBCADKAki9AEKD0FwaU9BdXRoMkNvbmZpZxI2CgVncmFudBgEIAEoDjInLnNhYXMuYWNjb3VudHMudjEuQXBpT0F1dGgyQ29uZmlnLkdyYW50EhEKCXRva2VuX3VybBgBIAEoCRIRCgljbGllbnRfaWQYAiABKAkSDgoGc2NvcGVzGAMgAygJInMKBUdyYW50EhUKEUdSQU5UX1VOU1BFQ0lGSUVEEAASFwoTR1JBTlRfUkVGUkVTSF9UT0tFThABEhwKGEdSQU5UX0NMSUVOVF9DUkVERU5USUFMUxACEhwKGEdSQU5UX0FVVEhPUklaQVRJT05fQ09ERRADIuoBChNBcGlEYXRhc291cmNlQ29uZmlnEhAKCGJhc2VfdXJsGAEgASgJEhUKDXJlc291cmNlX3BhdGgYAiABKAkSPAoPY3JlZGVudGlhbF9raW5kGAMgASgOMiMuc2Fhcy5hY2NvdW50cy52MS5BcGlDcmVkZW50aWFsS2luZBIZChFjcmVkZW50aWFsX2hlYWRlchgEIAEoCRIeChZjcmVkZW50aWFsX3F1ZXJ5X3BhcmFtGAUgASgJEjEKBm9hdXRoMhgGIAEoCzIhLnNhYXMuYWNjb3VudHMudjEuQXBpT0F1dGgyQ29uZmlnIkEKF0NyYXdsZXJEYXRhc291cmNlQ29uZmlnEhMKC3NpdGVtYXBfdXJsGAEgASgJEhEKCW1heF9wYWdlcxgCIAEoDSKGAQoWVXBsb2FkRGF0YXNvdXJjZUNvbmZpZxIQCghlbmRwb2ludBgBIAEoCRIOCgZyZWdpb24YAiABKAkSDgoGYnVja2V0GAMgASgJEg4KBnByZWZpeBgEIAEoCRIVCg1hY2Nlc3Nfa2V5X2lkGAUgASgJEhMKC21heF9vYmplY3RzGAYgASgNIoMHCgpEYXRhc291cmNlEgoKAmlkGAEgASgJEg4KBm9yZ19pZBgCIAEoCRI2Cghwcm92aWRlchgDIAEoDjIkLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVByb3ZpZGVyEjgKBmdpdGh1YhgFIAEoCzIoLnNhYXMuYWNjb3VudHMudjEuR2l0SHViRGF0YXNvdXJjZUNvbmZpZxIyCgZzdGF0dXMYBiABKA4yIi5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VTdGF0dXMSGgoSd2ViaG9va19jb25maWd1cmVkGAcgASgIEi4KCmNyZWF0ZWRfYXQYCCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCnVwZGF0ZWRfYXQYCSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjIKDmxhc3Rfc3luY2VkX2F0GAogASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIyCgNhcGkYCyABKAsyJS5zYWFzLmFjY291bnRzLnYxLkFwaURhdGFzb3VyY2VDb25maWcSOgoHY3Jhd2xlchgMIAEoCzIpLnNhYXMuYWNjb3VudHMudjEuQ3Jhd2xlckRhdGFzb3VyY2VDb25maWcSOAoGdXBsb2FkGA0gASgLMiguc2Fhcy5hY2NvdW50cy52MS5VcGxvYWREYXRhc291cmNlQ29uZmlnEhgKEGJvdW5kYXJ5X25vZGVfaWQYDiABKAkSNAoQbGFzdF9pbmdlc3RlZF9hdBgPIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASHAoUbGFzdF9pbmdlc3RlZF9jb21taXQYECABKAkSFQoNc3RhdHVzX3JlYXNvbhgRIAEoCRIWCg5ib3VuZGFyeV9sYWJlbBgSIAEoCRISCgpjb25mb3JtYW50GBMgASgIEhcKD2NvbmZvcm1hbmNlX2dhcBgUIAEoCRI/Cg1saXZlX2RlbGl2ZXJ5GBUgASgOMiguc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlTGl2ZURlbGl2ZXJ5EjUKEnJlY29uY2lsZV9pbnRlcnZhbBgWIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkoECAQQBVIRdGFyZ2V0X2NvbGxlY3Rpb24isgMKFkFkZEdpdEh1YlNvdXJjZVJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARI7CgRyZXBvGAIgASgJQi26SCpyKBADGP8BMiFeW0EtWmEtejAtOV8uLV0rL1tBLVphLXowLTlfLi1dKyQSIAoFcGF0aHMYAyADKAlCEbpIDpIBCxBAIgdyBRABGIAEEhgKBmJyYW5jaBgEIAEoCUIIukgFcgMY/wESJAoQYm91bmRhcnlfbm9kZV9pZBgIIAEoCUIIukgFcgOwAQFIABImChBjb2xsZWN0aW9uX2xhYmVsGAkgASgJQgq6SAdyBRABGP8BSAASHgoMYWNjZXNzX3Rva2VuGAYgASgJQgi6SAVyAxiACBIgCg53ZWJob29rX3NlY3JldBgHIAEoCUIIukgFcgMYgAgSSQoPZmlsZV9leHRlbnNpb25zGAogAygJQjC6SC2SASoQICImciQQAhghMh5eXC5bQS1aYS16MC05XVtBLVphLXowLTkuXy1dKiRCEQoIYm91bmRhcnkSBbpIAggBSgQIBRAGUhF0YXJnZXRfY29sbGVjdGlvbiJLChdBZGRHaXRIdWJTb3VyY2VSZXNwb25zZRIwCgpkYXRhc291cmNlGAEgASgLMhwuc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlIsgEChBBZGRTb3VyY2VSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESQgoIcHJvdmlkZXIYAiABKA4yJC5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VQcm92aWRlckIKukgHggEEEAEgABI6CgZnaXRodWIYBCABKAsyKC5zYWFzLmFjY291bnRzLnYxLkdpdEh1YkRhdGFzb3VyY2VDb25maWdIABI0CgNhcGkYBSABKAsyJS5zYWFzLmFjY291bnRzLnYxLkFwaURhdGFzb3VyY2VDb25maWdIABI8CgdjcmF3bGVyGAggASgLMikuc2Fhcy5hY2NvdW50cy52MS5DcmF3bGVyRGF0YXNvdXJjZUNvbmZpZ0gAEjoKBnVwbG9hZBgJIAEoCzIoLnNhYXMuYWNjb3VudHMudjEuVXBsb2FkRGF0YXNvdXJjZUNvbmZpZ0gAEiQKEGJvdW5kYXJ5X25vZGVfaWQYDCABKAlCCLpIBXIDsAEBSAESJgoQY29sbGVjdGlvbl9sYWJlbBgNIAEoCUIKukgHcgUQARj/AUgBEhwKCmNyZWRlbnRpYWwYBiABKAlCCLpIBXIDGIAgEiAKDndlYmhvb2tfc2VjcmV0GAcgASgJQgi6SAVyAxiACBImChRvYXV0aDJfY2xpZW50X3NlY3JldBgKIAEoCUIIukgFcgMYgAhCCAoGY29uZmlnQhEKCGJvdW5kYXJ5EgW6SAIIAUoECAMQBFIRdGFyZ2V0X2NvbGxlY3Rpb24iRQoRQWRkU291cmNlUmVzcG9uc2USMAoKZGF0YXNvdXJjZRgBIAEoCzIcLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZSJaChVEYXRhc291cmNlQ29uZmlnRmllbGQSCwoDa2V5GAEgASgJEhQKDGRpc3BsYXlfbmFtZRgCIAEoCRIMCgRoZWxwGAMgASgJEhAKCHJlcXVpcmVkGAQgASgIIsQBChlEYXRhc291cmNlQ29ubmVjdG9yQnVkZ2V0EhoKEm1heF9pdGVtc19wZXJfY2FsbBgBIAEoDRIaChJtYXhfYnl0ZXNfcGVyX2NhbGwYAiABKAMSFgoObWF4X2l0ZW1fYnl0ZXMYAyABKAMSHQoVb3BlcmF0aW9uc19wZXJfd2luZG93GAQgASgNEhYKDndpbmRvd19zZWNvbmRzGAUgASgDEiAKGGJhY2tncm91bmRfc2hhcmVfcGVyY2VudBgGIAEoDSKqBgocRGF0YXNvdXJjZVByb3ZpZGVyRGVzY3JpcHRvchI2Cghwcm92aWRlchgBIAEoDjIkLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVByb3ZpZGVyEhQKDGRpc3BsYXlfbmFtZRgCIAEoCRITCgtkZXNjcmlwdGlvbhgDIAEoCRI+Cg1jb25maWdfZmllbGRzGAQgAygLMicuc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlQ29uZmlnRmllbGQSGAoQc3VwcG9ydHNfd2ViaG9vaxgFIAEoCBJHChpzdXBwb3J0ZWRfY3JlZGVudGlhbF9raW5kcxgGIAMoDjIjLnNhYXMuYWNjb3VudHMudjEuQXBpQ3JlZGVudGlhbEtpbmQSEQoJY29ubmVjdG9yGAcgASgJEkEKCWludGVyZmFjZRgIIAEoDjIuLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZUNvbm5lY3RvckludGVyZmFjZRJEChBjcmVkZW50aWFsX21vZGVzGAkgAygOMiouc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlQ3JlZGVudGlhbE1vZGUSPwoNcmVhZGVyc19tb2RlbBgKIAEoDjIoLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVJlYWRlcnNNb2RlbBI7CgZidWRnZXQYCyABKAsyKy5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VDb25uZWN0b3JCdWRnZXQSEgoKY29uZm9ybWFudBgMIAEoCBIXCg9jb25mb3JtYW5jZV9nYXAYDSABKAkSGwoTYWNjZXB0c19uZXdfc291cmNlcxgOIAEoCBIgChhsaXZlX2RlbGl2ZXJ5X2NvbmZpZ3VyZWQYDyABKAgSGgoSYWNjZXB0c19vcGVyYXRpb25zGBAgASgIEhYKDm9wZXJhdGlvbnNfZ2FwGBEgASgJEhsKE29hdXRoX2F1dGhvcml6ZV91cmwYEiABKAkSFwoPb2F1dGhfdG9rZW5fdXJsGBMgASgJEhQKDG9hdXRoX3Njb3BlcxgUIAMoCSIdChtHZXREYXRhc291cmNlQ2F0YWxvZ1JlcXVlc3QiYQocR2V0RGF0YXNvdXJjZUNhdGFsb2dSZXNwb25zZRJBCglwcm92aWRlcnMYASADKAsyLi5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VQcm92aWRlckRlc2NyaXB0b3IiLgoSTGlzdFNvdXJjZXNSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQEiSAoTTGlzdFNvdXJjZXNSZXNwb25zZRIxCgtkYXRhc291cmNlcxgBIAMoCzIcLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZSJCChBHZXRTb3VyY2VSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESFAoCaWQYAiABKAlCCLpIBXIDsAEBIkUKEUdldFNvdXJjZVJlc3BvbnNlEjAKCmRhdGFzb3VyY2UYASABKAsyHC5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2UidgoRU3luY1NvdXJjZVJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIUCgJpZBgCIAEoCUIIukgFcgOwAQESHgoMYWNjZXNzX3Rva2VuGAMgASgJQgi6SAVyAxiAIBIRCglyZWNvbm5lY3QYBCABKAgiJAoSU3luY1NvdXJjZVJlc3BvbnNlEg4KBmpvYl9pZBgBIAEoCSJqChRHZXRTb3VyY2VTeW5jUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhsKCXNvdXJjZV9pZBgCIAEoCUIIukgFcgOwAQESGwoGam9iX2lkGAMgASgJQgu6SAjYAQFyA7ABASKVAQoSU291cmNlU3luY0RlbGl2ZXJ5EhgKBmpvYl9pZBgBIAEoCUIIukgFcgOwAQESLQoFc3RhdGUYAiABKA4yFi5zYWFzLmpvYnMudjEuSm9iU3RhdGVCBrpIA8gBARI2CglleGVjdXRpb24YAyABKAsyIy5zYWFzLmpvYnMudjEuSm9iRXhlY3V0aW9uUmVmZXJlbmNlIosBChFTb3VyY2VTeW5jQ2hhbmdlcxINCgVmaWxlcxgBIAEoDRINCgVhZGRlZBgCIAEoDRIQCghtb2RpZmllZBgDIAEoDRIPCgdkZWxldGVkGAQgASgNEhMKC3NwbGl0X2tub3duGAUgASgIEhAKCHNuYXBzaG90GAYgASgIEg4KBmNvbW1pdBgHIAEoCSKtAQoRU291cmNlU3luY0ZhaWx1cmUSOQoGcmVhc29uGAEgASgOMikuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VTeW5jRmFpbHVyZVJlYXNvbhIMCgRjb2RlGAIgASgJEg8KB21lc3NhZ2UYAyABKAkSEAoIcmV0cnlpbmcYBCABKAgSLAoIcmV0cnlfYXQYBSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIoQEChJTb3VyY2VTeW5jUHJvZ3Jlc3MSMAoFcGhhc2UYASABKA4yIS5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVN5bmNQaGFzZRI0Cgd0cmlnZ2VyGAIgASgOMiMuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VTeW5jVHJpZ2dlchItCglxdWV1ZWRfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi8KC2ZldGNoaW5nX2F0GAQgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIvCgtjb21waWxlZF9hdBgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASMQoNaGFuZGVkX29mZl9hdBgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLwoLZmluaXNoZWRfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjQKB2NoYW5nZXMYCCABKAsyIy5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVN5bmNDaGFuZ2VzEjQKB2ZhaWx1cmUYCSABKAsyIy5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVN5bmNGYWlsdXJlEg8KB2F0dGVtcHQYCiABKA0SFAoMbWF4X2F0dGVtcHRzGAsgASgNItIBChVHZXRTb3VyY2VTeW5jUmVzcG9uc2USGAoGam9iX2lkGAEgASgJQgi6SAVyA7ABARItCgVzdGF0ZRgCIAEoDjIWLnNhYXMuam9icy52MS5Kb2JTdGF0ZUIGukgDyAEBEjgKCmRlbGl2ZXJpZXMYAyADKAsyJC5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVN5bmNEZWxpdmVyeRI2Cghwcm9ncmVzcxgEIAEoCzIkLnNhYXMuYWNjb3VudHMudjEuU291cmNlU3luY1Byb2dyZXNzIkUKE0RlbGV0ZVNvdXJjZVJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIUCgJpZBgCIAEoCUIIukgFcgOwAQEiFgoURGVsZXRlU291cmNlUmVzcG9uc2UiVgoTR2l0SHViQXBwUmVwb3NpdG9yeRIMCgRyZXBvGAEgASgJEhYKDmRlZmF1bHRfYnJhbmNoGAIgASgJEhkKEWFscmVhZHlfY29ubmVjdGVkGAMgASgIIjYKGkJlZ2luR2l0SHViQXBwU2V0dXBSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQEicQobQmVnaW5HaXRIdWJBcHBTZXR1cFJlc3BvbnNlEhMKC2luc3RhbGxfdXJsGAEgASgJEg0KBXN0YXRlGAIgASgJEi4KCmV4cGlyZXNfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIpwBCh1Db21wbGV0ZUdpdEh1YkFwcFNldHVwUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhkKBXN0YXRlGAIgASgJQgq6SAdyBRABGP8BEiwKD2luc3RhbGxhdGlvbl9pZBgDIAEoCUITukgQcg4QARggMgheWzAtOV0rJBIYCgRjb2RlGAQgASgJQgq6SAdyBRABGP8BInYKHkNvbXBsZXRlR2l0SHViQXBwU2V0dXBSZXNwb25zZRIXCg9pbnN0YWxsYXRpb25faWQYASABKAkSOwoMcmVwb3NpdG9yaWVzGAIgAygLMiUuc2Fhcy5hY2NvdW50cy52MS5HaXRIdWJBcHBSZXBvc2l0b3J5IlEKH01pZ3JhdGVHaXRIdWJTb3VyY2VUb0FwcFJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIUCgJpZBgCIAEoCUIIukgFcgOwAQEiVAogTWlncmF0ZUdpdEh1YlNvdXJjZVRvQXBwUmVzcG9uc2USMAoKZGF0YXNvdXJjZRgBIAEoCzIcLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZSLEAQoVRGF0YXNvdXJjZUFjY291bnRMaW5rEgoKAmlkGAEgASgJEg4KBm9yZ19pZBgCIAEoCRIPCgd1c2VyX2lkGAMgASgJEhEKCWNvbm5lY3RvchgEIAEoCRIbChNwcm92aWRlcl9hY2NvdW50X2lkGAUgASgJEh4KFnByb3ZpZGVyX2FjY291bnRfbG9naW4YBiABKAkSLgoKY3JlYXRlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAitwEKFkRhdGFzb3VyY2VHcm91cEJpbmRpbmcSCgoCaWQYASABKAkSDgoGb3JnX2lkGAIgASgJEhEKCWNvbm5lY3RvchgDIAEoCRIZChFwcm92aWRlcl9ncm91cF9pZBgEIAEoCRIPCgd0ZWFtX2lkGAUgASgJEhIKCmNyZWF0ZWRfYnkYBiABKAkSLgoKY3JlYXRlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAilAIKGERhdGFzb3VyY2VWZXJpZmllZERvbWFpbhIKCgJpZBgBIAEoCRIOCgZvcmdfaWQYAiABKAkSDgoGZG9tYWluGAMgASgJEjgKBnN0YXR1cxgEIAEoDjIoLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZURvbWFpblN0YXR1cxIXCg90eHRfcmVjb3JkX25hbWUYBSABKAkSGAoQdHh0X3JlY29yZF92YWx1ZRgGIAEoCRIvCgt2ZXJpZmllZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLgoKY3JlYXRlZF9hdBgIIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiMwoXRGF0YXNvdXJjZURpcmVjdG9yeVRlYW0SCgoCaWQYASABKAkSDAoEbmFtZRgCIAEoCSKmAQohQmVnaW5EYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESNAoJY29ubmVjdG9yGAIgASgJQiG6SB5yHBACGCAyFl5bYS16XVthLXowLTktXXsxLDMxfSQSHgoMcmVkaXJlY3RfdXJpGAMgASgJQgi6SAVyAxiAEBIRCglzb3VyY2VfaWQYBCABKAkiegoiQmVnaW5EYXRhc291cmNlQWNjb3VudExpbmtSZXNwb25zZRIVCg1hdXRob3JpemVfdXJsGAEgASgJEg0KBXN0YXRlGAIgASgJEi4KCmV4cGlyZXNfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wInUKJENvbXBsZXRlRGF0YXNvdXJjZUFjY291bnRMaW5rUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhkKBXN0YXRlGAIgASgJQgq6SAdyBRABGIBAEhgKBGNvZGUYAyABKAlCCrpIB3IFEAEY/wEiXgolQ29tcGxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXNwb25zZRI1CgRsaW5rGAEgASgLMicuc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlQWNjb3VudExpbmsiPwojTGlzdE15RGF0YXNvdXJjZUFjY291bnRMaW5rc1JlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABASJeCiRMaXN0TXlEYXRhc291cmNlQWNjb3VudExpbmtzUmVzcG9uc2USNgoFbGlua3MYASADKAsyJy5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VBY2NvdW50TGluayJUCiJEZWxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESFAoCaWQYAiABKAlCCLpIBXIDsAEBIiUKI0RlbGV0ZURhdGFzb3VyY2VBY2NvdW50TGlua1Jlc3BvbnNlIjkKHUdldERhdGFzb3VyY2VEaXJlY3RvcnlSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQEiiwIKHkdldERhdGFzb3VyY2VEaXJlY3RvcnlSZXNwb25zZRI2CgVsaW5rcxgBIAMoCzInLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZUFjY291bnRMaW5rEjoKCGJpbmRpbmdzGAIgAygLMiguc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlR3JvdXBCaW5kaW5nEjsKB2RvbWFpbnMYAyADKAsyKi5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VWZXJpZmllZERvbWFpbhI4CgV0ZWFtcxgEIAMoCzIpLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZURpcmVjdG9yeVRlYW0irgEKGkJpbmREYXRhc291cmNlR3JvdXBSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESNAoJY29ubmVjdG9yGAIgASgJQiG6SB5yHBACGCAyFl5bYS16XVthLXowLTktXXsxLDMxfSQSJQoRcHJvdmlkZXJfZ3JvdXBfaWQYAyABKAlCCrpIB3IFEAEY/wESGQoHdGVhbV9pZBgEIAEoCUIIukgFcgOwAQEiWAobQmluZERhdGFzb3VyY2VHcm91cFJlc3BvbnNlEjkKB2JpbmRpbmcYASABKAsyKC5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VHcm91cEJpbmRpbmciTgocVW5iaW5kRGF0YXNvdXJjZUdyb3VwUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhQKAmlkGAIgASgJQgi6SAVyA7ABASIfCh1VbmJpbmREYXRhc291cmNlR3JvdXBSZXNwb25zZSJUChxDbGFpbURhdGFzb3VyY2VEb21haW5SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESGgoGZG9tYWluGAIgASgJQgq6SAdyBRADGP0BIlsKHUNsYWltRGF0YXNvdXJjZURvbWFpblJlc3BvbnNlEjoKBmRvbWFpbhgBIAEoCzIqLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVZlcmlmaWVkRG9tYWluIk8KHVZlcmlmeURhdGFzb3VyY2VEb21haW5SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESFAoCaWQYAiABKAlCCLpIBXIDsAEBIlwKHlZlcmlmeURhdGFzb3VyY2VEb21haW5SZXNwb25zZRI6CgZkb21haW4YASABKAsyKi5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VWZXJpZmllZERvbWFpbiJPCh1EZWxldGVEYXRhc291cmNlRG9tYWluUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhQKAmlkGAIgASgJQgi6SAVyA7ABASIgCh5EZWxldGVEYXRhc291cmNlRG9tYWluUmVzcG9uc2UingIKEFNvdXJjZURlbGVnYXRpb24SCgoCaWQYASABKAkSEQoJc291cmNlX2lkGAIgASgJEhQKDHByaW5jaXBhbF9pZBgDIAEoCRIOCgZtb2R1bGUYBCABKAkSDwoHYmluZGluZxgFIAEoCRIuCgpjcmVhdGVkX2F0GAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgpyZXZva2VkX2F0GAcgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBJACgpyZXZvY2F0aW9uGAggASgOMiwuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VEZWxlZ2F0aW9uUmV2b2NhdGlvbhISCgpyZXZva2VkX2J5GAkgASgJIoEBChxMaXN0U291cmNlRGVsZWdhdGlvbnNSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESIAoJc291cmNlX2lkGAIgASgJQgi6SAVyA7ABAUgAiAEBEhcKD2luY2x1ZGVfcmV2b2tlZBgDIAEoCEIMCgpfc291cmNlX2lkIlgKHUxpc3RTb3VyY2VEZWxlZ2F0aW9uc1Jlc3BvbnNlEjcKC2RlbGVnYXRpb25zGAEgAygLMiIuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VEZWxlZ2F0aW9uIk8KHVJldm9rZVNvdXJjZURlbGVnYXRpb25SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESFAoCaWQYAiABKAlCCLpIBXIDsAEBIlgKHlJldm9rZVNvdXJjZURlbGVnYXRpb25SZXNwb25zZRI2CgpkZWxlZ2F0aW9uGAEgASgLMiIuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VEZWxlZ2F0aW9uIjIKD1RyaWdnZXJJZGVudGl0eRIOCgZzb3VyY2UYASABKAkSDwoHYmluZGluZxgCIAEoCSKEAQoXRGVjbGFyZWRUcmlnZ2VyU2NoZWR1bGUSDAoEY3JvbhgBIAEoCRIQCgh0aW1lem9uZRgCIAEoCRISCgptaXNzZWRfcnVuGAMgASgJEg8KB292ZXJsYXAYBCABKAkSEAoIZGVhZGxpbmUYBSABKAMSEgoKaW5wdXRfanNvbhgGIAEoCSLnAgoaVHJpZ2dlckRlbGVnYXRpb25SZWZlcmVuY2USEQoJcmVmZXJlbmNlGAEgASgJEhUKDWRlbGVnYXRpb25faWQYAiABKAkSDgoGbW9kdWxlGAMgASgJEg8KB2JpbmRpbmcYBCABKAkSEAoIYXVkaWVuY2UYBSABKAkSDgoGdGVuYW50GAYgASgJEhoKEm93bmVyX3ByaW5jaXBhbF9pZBgHIAEoCRIOCgZzY29wZXMYCCADKAkSDgoGYWN0aXZlGAkgASgIEi4KCmNyZWF0ZWRfYXQYCiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCnJldm9rZWRfYXQYCyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkAKCnJldm9jYXRpb24YDCABKA4yLC5zYWFzLmFjY291bnRzLnYxLlNvdXJjZURlbGVnYXRpb25SZXZvY2F0aW9uIr4BChNUcmlnZ2VyQ2hpbGRDb250ZXh0EhUKDWRlbGVnYXRpb25faWQYASABKAkSDgoGbW9kdWxlGAIgASgJEg8KB2JpbmRpbmcYAyABKAkSEAoIYXVkaWVuY2UYBCABKAkSDgoGc2NvcGVzGAUgAygJEg4KBmxvb2t1cBgGIAEoCBItCgltaW50ZWRfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEg4KBnJlY29yZBgIIAEoCSK5AwoYU291cmNlVHJpZ2dlckRlY2xhcmF0aW9uEg8KB3JlbGVhc2UYASABKAkSEQoJb3BlcmF0aW9uGAIgASgJEjsKCHNjaGVkdWxlGAMgASgLMikuc2Fhcy5hY2NvdW50cy52MS5EZWNsYXJlZFRyaWdnZXJTY2hlZHVsZRIzCghpZGVudGl0eRgEIAEoCzIhLnNhYXMuYWNjb3VudHMudjEuVHJpZ2dlcklkZW50aXR5Eg4KBmRpZ2VzdBgFIAEoCRI2ChJsYXN0X29jY3VycmVuY2VfYXQYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjYKEm5leHRfb2NjdXJyZW5jZV9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGwoTdW5kZWNsYXJhYmxlX3JlYXNvbhgIIAEoCRIaChJob3N0X3N3ZWVwX2VuYWJsZWQYCSABKAgSNQoRaG9zdF9zd2VlcF9kdWVfYXQYCiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhcKD2lkZW50aXR5X2hvbGRlchgLIAEoCSJWCh1EZWxlZ2F0ZVNvdXJjZVRyaWdnZXJzUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhsKCXNvdXJjZV9pZBgCIAEoCUIIukgFcgOwAQEiYwoeRGVsZWdhdGVTb3VyY2VUcmlnZ2Vyc1Jlc3BvbnNlEkEKC2RlbGVnYXRpb25zGAEgAygLMiwuc2Fhcy5hY2NvdW50cy52MS5UcmlnZ2VyRGVsZWdhdGlvblJlZmVyZW5jZSJbCiJHZXRTb3VyY2VUcmlnZ2VyRGVjbGFyYXRpb25SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESGwoJc291cmNlX2lkGAIgASgJQgi6SAVyA7ABASLiAQojR2V0U291cmNlVHJpZ2dlckRlY2xhcmF0aW9uUmVzcG9uc2USPwoLZGVjbGFyYXRpb24YASABKAsyKi5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVRyaWdnZXJEZWNsYXJhdGlvbhJBCgtkZWxlZ2F0aW9ucxgCIAMoCzIsLnNhYXMuYWNjb3VudHMudjEuVHJpZ2dlckRlbGVnYXRpb25SZWZlcmVuY2USNwoIY2hpbGRyZW4YAyADKAsyJS5zYWFzLmFjY291bnRzLnYxLlRyaWdnZXJDaGlsZENvbnRleHQibgoWUmVjb25jaWxlU291cmNlUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhsKCXNvdXJjZV9pZBgCIAEoCUIIukgFcgOwAQESHQoJZWZmZWN0X2lkGAMgASgJQgq6SAdyBRABGIABIkwKF1JlY29uY2lsZVNvdXJjZVJlc3BvbnNlEhEKCWVmZmVjdF9pZBgBIAEoCRIOCgZzdGF0dXMYAiABKAkSDgoGam9iX2lkGAMgASgJIj0KHExvb2t1cFJlY29uY2lsZVNvdXJjZVJlcXVlc3QSHQoJZWZmZWN0X2lkGAEgASgJQgq6SAdyBRABGIABIvECCg9Tb3VyY2VPcGVyYXRpb24SDAoEbmFtZRgBIAEoCRITCgtkZXNjcmlwdGlvbhgCIAEoCRIOCgZtZXRob2QYAyABKAkSDAoEcGF0aBgEIAEoCRINCgVxdWVyeRgFIAMoCRItCgxpbnB1dF9zY2hlbWEYBiABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0Ei4KDW91dHB1dF9zY2hlbWEYByABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0EjgKBmVmZmVjdBgIIAEoDjIoLnNhYXMuYWNjb3VudHMudjEuU291cmNlT3BlcmF0aW9uLkVmZmVjdBIYChBtYXhfb3V0cHV0X2J5dGVzGAkgASgNEg4KBmRpZ2VzdBgKIAEoCSJLCgZFZmZlY3QSFgoSRUZGRUNUX1VOU1BFQ0lGSUVEEAASFAoQRUZGRUNUX1JFQURfT05MWRABEhMKD0VGRkVDVF9NVVRBVElPThACIo4BCh5EZWNsYXJlU291cmNlT3BlcmF0aW9uc1JlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIbCglzb3VyY2VfaWQYAiABKAlCCLpIBXIDsAEBEjUKCm9wZXJhdGlvbnMYAyADKAsyIS5zYWFzLmFjY291bnRzLnYxLlNvdXJjZU9wZXJhdGlvbiJYCh9EZWNsYXJlU291cmNlT3BlcmF0aW9uc1Jlc3BvbnNlEjUKCm9wZXJhdGlvbnMYASADKAsyIS5zYWFzLmFjY291bnRzLnYxLlNvdXJjZU9wZXJhdGlvbiJUChtMaXN0U291cmNlT3BlcmF0aW9uc1JlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIbCglzb3VyY2VfaWQYAiABKAlCCLpIBXIDsAEBIlUKHExpc3RTb3VyY2VPcGVyYXRpb25zUmVzcG9uc2USNQoKb3BlcmF0aW9ucxgBIAMoCzIhLnNhYXMuYWNjb3VudHMudjEuU291cmNlT3BlcmF0aW9uIsMBChxJbnZva2VTb3VyY2VPcGVyYXRpb25SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESGwoJc291cmNlX2lkGAIgASgJQgi6SAVyA7ABARIwCglvcGVyYXRpb24YAyABKAlCHbpIGnIYMhZeW2Etel1bYS16MC05X117MCw2M30kEh0KCmlucHV0X2pzb24YBCABKAlCCbpIBnIEKICABBIbCgllZmZlY3RfaWQYBSABKAlCCLpIBXIDKIABIn8KFlNvdXJjZU9wZXJhdGlvblJlY2VpcHQSEQoJZWZmZWN0X2lkGAEgASgJEhQKDGNvbW1pdHRlZF9hdBgCIAEoCRIOCgZzdGF0dXMYAyABKAkSFwoPcHJvdmlkZXJfc3RhdHVzGAQgASgNEhMKC291dHB1dF9qc29uGAUgASgJIm8KHUludm9rZVNvdXJjZU9wZXJhdGlvblJlc3BvbnNlEhMKC291dHB1dF9qc29uGAEgASgJEjkKB3JlY2VpcHQYAiABKAsyKC5zYWFzLmFjY291bnRzLnYxLlNvdXJjZU9wZXJhdGlvblJlY2VpcHQiQwoiTG9va3VwSW52b2tlU291cmNlT3BlcmF0aW9uUmVxdWVzdBIdCgllZmZlY3RfaWQYASABKAlCCrpIB3IFEAEogAEieQojUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1JlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIbCglzb3VyY2VfaWQYAiABKAlCCLpIBXIDsAEBEhsKCWVmZmVjdF9pZBgDIAEoCUIIukgFcgMogAEiWwokUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1Jlc3BvbnNlEhEKCWVmZmVjdF9pZBgBIAEoCRIQCghyZWNlaXB0cxgCIAEoAxIOCgZzdGF0dXMYAyABKAkiSgopTG9va3VwUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1JlcXVlc3QSHQoJZWZmZWN0X2lkGAEgASgJQgq6SAdyBRABKIABKrcBChJEYXRhc291cmNlUHJvdmlkZXISIwofREFUQVNPVVJDRV9QUk9WSURFUl9VTlNQRUNJRklFRBAAEh4KGkRBVEFTT1VSQ0VfUFJPVklERVJfR0lUSFVCEAESGwoXREFUQVNPVVJDRV9QUk9WSURFUl9BUEkQAhIfChtEQVRBU09VUkNFX1BST1ZJREVSX0NSQVdMRVIQAxIeChpEQVRBU09VUkNFX1BST1ZJREVSX1VQTE9BRBAEKpEBChBEYXRhc291cmNlU3RhdHVzEiEKHURBVEFTT1VSQ0VfU1RBVFVTX1VOU1BFQ0lGSUVEEAASHAoYREFUQVNPVVJDRV9TVEFUVVNfQUNUSVZFEAESHAoYREFUQVNPVVJDRV9TVEFUVVNfUEFVU0VEEAISHgoaREFUQVNPVVJDRV9TVEFUVVNfREVHUkFERUQQAyq8AQoWRGF0YXNvdXJjZUxpdmVEZWxpdmVyeRIoCiREQVRBU09VUkNFX0xJVkVfREVMSVZFUllfVU5TUEVDSUZJRUQQABIhCh1EQVRBU09VUkNFX0xJVkVfREVMSVZFUllfTk9ORRABEisKJ0RBVEFTT1VSQ0VfTElWRV9ERUxJVkVSWV9TT1VSQ0VfV0VCSE9PSxACEigKJERBVEFTT1VSQ0VfTElWRV9ERUxJVkVSWV9BUFBfV0VCSE9PSxADKtYBChFBcGlDcmVkZW50aWFsS2luZBIjCh9BUElfQ1JFREVOVElBTF9LSU5EX1VOU1BFQ0lGSUVEEAASHgoaQVBJX0NSRURFTlRJQUxfS0lORF9CRUFSRVIQARIdChlBUElfQ1JFREVOVElBTF9LSU5EX0JBU0lDEAISHgoaQVBJX0NSRURFTlRJQUxfS0lORF9IRUFERVIQAxIdChlBUElfQ1JFREVOVElBTF9LSU5EX1FVRVJZEAQSHgoaQVBJX0NSRURFTlRJQUxfS0lORF9PQVVUSDIQBSqmAgocRGF0YXNvdXJjZUNvbm5lY3RvckludGVyZmFjZRIuCipEQVRBU09VUkNFX0NPTk5FQ1RPUl9JTlRFUkZBQ0VfVU5TUEVDSUZJRUQQABIoCiREQVRBU09VUkNFX0NPTk5FQ1RPUl9JTlRFUkZBQ0VfRklMRVMQARIoCiREQVRBU09VUkNFX0NPTk5FQ1RPUl9JTlRFUkZBQ0VfUEFHRVMQAhIqCiZEQVRBU09VUkNFX0NPTk5FQ1RPUl9JTlRFUkZBQ0VfUkVDT1JEUxADEisKJ0RBVEFTT1VSQ0VfQ09OTkVDVE9SX0lOVEVSRkFDRV9NRVNTQUdFUxAEEikKJURBVEFTT1VSQ0VfQ09OTkVDVE9SX0lOVEVSRkFDRV9FVkVOVFMQBSrsAQoYRGF0YXNvdXJjZUNyZWRlbnRpYWxNb2RlEioKJkRBVEFTT1VSQ0VfQ1JFREVOVElBTF9NT0RFX1VOU1BFQ0lGSUVEEAASIwofREFUQVNPVVJDRV9DUkVERU5USUFMX01PREVfTk9ORRABEiYKIkRBVEFTT1VSQ0VfQ1JFREVOVElBTF9NT0RFX09SR19BUFAQAhIpCiVEQVRBU09VUkNFX0NSRURFTlRJQUxfTU9ERV9VU0VSX09BVVRIEAMSLAooREFUQVNPVVJDRV9DUkVERU5USUFMX01PREVfU1RBVElDX1NFQ1JFVBAEKpcBChZEYXRhc291cmNlUmVhZGVyc01vZGVsEigKJERBVEFTT1VSQ0VfUkVBREVSU19NT0RFTF9VTlNQRUNJRklFRBAAEioKJkRBVEFTT1VSQ0VfUkVBREVSU19NT0RFTF9TT1VSQ0VfU0NPUEVEEAESJwojREFUQVNPVVJDRV9SRUFERVJTX01PREVMX1RSQU5TTEFURUQQAiruAQoPU291cmNlU3luY1BoYXNlEiEKHVNPVVJDRV9TWU5DX1BIQVNFX1VOU1BFQ0lGSUVEEAASHAoYU09VUkNFX1NZTkNfUEhBU0VfUVVFVUVEEAESHgoaU09VUkNFX1NZTkNfUEhBU0VfRkVUQ0hJTkcQAhIeChpTT1VSQ0VfU1lOQ19QSEFTRV9DT01QSUxFRBADEiAKHFNPVVJDRV9TWU5DX1BIQVNFX0hBTkRFRF9PRkYQBBIaChZTT1VSQ0VfU1lOQ19QSEFTRV9ET05FEAUSHAoYU09VUkNFX1NZTkNfUEhBU0VfRkFJTEVEEAYqpgMKF1NvdXJjZVN5bmNGYWlsdXJlUmVhc29uEioKJlNPVVJDRV9TWU5DX0ZBSUxVUkVfUkVBU09OX1VOU1BFQ0lGSUVEEAASKwonU09VUkNFX1NZTkNfRkFJTFVSRV9SRUFTT05fUkFURV9MSU1JVEVEEAESKQolU09VUkNFX1NZTkNfRkFJTFVSRV9SRUFTT05fQ1JFREVOVElBTBACEiwKKFNPVVJDRV9TWU5DX0ZBSUxVUkVfUkVBU09OX0FDQ0VTU19ERU5JRUQQAxIoCiRTT1VSQ0VfU1lOQ19GQUlMVVJFX1JFQVNPTl9OT1RfRk9VTkQQBBIoCiRTT1VSQ0VfU1lOQ19GQUlMVVJFX1JFQVNPTl9UT09fTEFSR0UQBRIvCitTT1VSQ0VfU1lOQ19GQUlMVVJFX1JFQVNPTl9IT1NUX1VOQVZBSUxBQkxFEAYSJAogU09VUkNFX1NZTkNfRkFJTFVSRV9SRUFTT05fT1RIRVIQBxIuCipTT1VSQ0VfU1lOQ19GQUlMVVJFX1JFQVNPTl9ERUxJVkVSWV9GQUlMRUQQCCqcAQoRU291cmNlU3luY1RyaWdnZXISIwofU09VUkNFX1NZTkNfVFJJR0dFUl9VTlNQRUNJRklFRBAAEh4KGlNPVVJDRV9TWU5DX1RSSUdHRVJfTUFOVUFMEAESIQodU09VUkNFX1NZTkNfVFJJR0dFUl9TQ0hFRFVMRUQQAhIfChtTT1VSQ0VfU1lOQ19UUklHR0VSX1dFQkhPT0sQAyqPAQoWRGF0YXNvdXJjZURvbWFpblN0YXR1cxIoCiREQVRBU09VUkNFX0RPTUFJTl9TVEFUVVNfVU5TUEVDSUZJRUQQABIkCiBEQVRBU09VUkNFX0RPTUFJTl9TVEFUVVNfUEVORElORxABEiUKIURBVEFTT1VSQ0VfRE9NQUlOX1NUQVRVU19WRVJJRklFRBACKpUDChpTb3VyY2VEZWxlZ2F0aW9uUmV2b2NhdGlvbhIsCihTT1VSQ0VfREVMRUdBVElPTl9SRVZPQ0FUSU9OX1VOU1BFQ0lGSUVEEAASKAokU09VUkNFX0RFTEVHQVRJT05fUkVWT0NBVElPTl9SRVZPS0VEEAESKQolU09VUkNFX0RFTEVHQVRJT05fUkVWT0NBVElPTl9SRVBMQUNFRBACEi8KK1NPVVJDRV9ERUxFR0FUSU9OX1JFVk9DQVRJT05fU09VUkNFX0RFTEVURUQQAxIvCitTT1VSQ0VfREVMRUdBVElPTl9SRVZPQ0FUSU9OX01FTUJFUl9SRU1PVkVEEAQSMAosU09VUkNFX0RFTEVHQVRJT05fUkVWT0NBVElPTl9QRVJNSVNTSU9OX0xPU1QQBRIuCipTT1VSQ0VfREVMRUdBVElPTl9SRVZPQ0FUSU9OX1VTRVJfSU5BQ1RJVkUQBhIwCixTT1VSQ0VfREVMRUdBVElPTl9SRVZPQ0FUSU9OX0JJTkRJTkdfQ0hBTkdFRBAHMok4ChFEYXRhc291cmNlU2VydmljZRK5AwocUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0cxI1LnNhYXMuYWNjb3VudHMudjEuUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1JlcXVlc3QaNi5zYWFzLmFjY291bnRzLnYxLlBydW5lU291cmNlT3BlcmF0aW9uUmVjZWlwdHNSZXNwb25zZSKpAsLzGGwIAhADGhFkYXRhc291cmNlOmludm9rZSIRZGF0YXNvdXJjZTppbnZva2UqDwoJc291cmNlX2lkEAQYAzABOiMKH3NhYXMuZGF0YXNvdXJjZS5yZWNlaXB0cy5wcnVuZWQQAkADSARQA1gDYAHa8xi0AQoCCDwSAwjYBBgFIgIIAioLVU5BVkFJTEFCTEUqElJFU09VUkNFX0VYSEFVU1RFRCoHQUJPUlRFRDIPc2Fhcy1kYXRhc291cmNlSkYvc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlU2VydmljZS9Mb29rdXBQcnVuZVNvdXJjZU9wZXJhdGlvblJlY2VpcHRzUIAgWIAgYAFyGAoGc291cmNlEgZpbnZva2USBHJlYWQYARLmAQoiTG9va3VwUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0cxI7LnNhYXMuYWNjb3VudHMudjEuTG9va3VwUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1JlcXVlc3QaNi5zYWFzLmFjY291bnRzLnYxLlBydW5lU291cmNlT3BlcmF0aW9uUmVjZWlwdHNSZXNwb25zZSJLwvMYRwgCEAMaD2RhdGFzb3VyY2U6cmVhZCIPZGF0YXNvdXJjZTpyZWFkKg8KCWVmZmVjdF9pZBAEGAMwAToCEAFAAUgDUANYA2ABEvwDChVJbnZva2VTb3VyY2VPcGVyYXRpb24SLi5zYWFzLmFjY291bnRzLnYxLkludm9rZVNvdXJjZU9wZXJhdGlvblJlcXVlc3QaLy5zYWFzLmFjY291bnRzLnYxLkludm9rZVNvdXJjZU9wZXJhdGlvblJlc3BvbnNlIoEDwvMYbggCEAMaEWRhdGFzb3VyY2U6aW52b2tlIhFkYXRhc291cmNlOmludm9rZSoPCglzb3VyY2VfaWQQBBgDMAE6JQohc2Fhcy5kYXRhc291cmNlLm9wZXJhdGlvbi5pbnZva2VkEARAA0gEUARYBGAB2vMYrwEKAgg8EgMI2AQYBSICCAIqC1VOQVZBSUxBQkxFKhJSRVNPVVJDRV9FWEhBVVNURUQqB0FCT1JURUQyD3NhYXMtZGF0YXNvdXJjZUo/L3NhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVNlcnZpY2UvTG9va3VwSW52b2tlU291cmNlT3BlcmF0aW9uUICABFiAgEBgAXIYCgZzb3VyY2USBmludm9rZRIEcmVhZBgBgtPkkwJVOgEqIlAvdjEvb3JnYW5pemF0aW9ucy97b3JnX2lkfS9kYXRhc291cmNlcy97c291cmNlX2lkfS9vcGVyYXRpb25zL3tvcGVyYXRpb259Omludm9rZRKHAgobTG9va3VwSW52b2tlU291cmNlT3BlcmF0aW9uEjQuc2Fhcy5hY2NvdW50cy52MS5Mb29rdXBJbnZva2VTb3VyY2VPcGVyYXRpb25SZXF1ZXN0Gi8uc2Fhcy5hY2NvdW50cy52MS5JbnZva2VTb3VyY2VPcGVyYXRpb25SZXNwb25zZSKAAcLzGEcIAhADGg9kYXRhc291cmNlOnJlYWQiD2RhdGFzb3VyY2U6cmVhZCoPCgllZmZlY3RfaWQQBBgDMAE6AhABQAFIA1ADWARgAYLT5JMCLxItL3YxL2RhdGFzb3VyY2Utb3BlcmF0aW9uLXJlY2VpcHRzL3tlZmZlY3RfaWR9EoUCChRMaXN0U291cmNlT3BlcmF0aW9ucxItLnNhYXMuYWNjb3VudHMudjEuTGlzdFNvdXJjZU9wZXJhdGlvbnNSZXF1ZXN0Gi4uc2Fhcy5hY2NvdW50cy52MS5MaXN0U291cmNlT3BlcmF0aW9uc1Jlc3BvbnNlIo0BwvMYRAgCEAMaD2RhdGFzb3VyY2U6cmVhZCIPZGF0YXNvdXJjZTpyZWFkKgwKBm9yZ19pZBACGAEwAToCEAFAAUgDUANYA2ABgtPkkwI/Ej0vdjEvb3JnYW5pemF0aW9ucy97b3JnX2lkfS9kYXRhc291cmNlcy97c291cmNlX2lkfS9vcGVyYXRpb25zEpMCChdEZWNsYXJlU291cmNlT3BlcmF0aW9ucxIwLnNhYXMuYWNjb3VudHMudjEuRGVjbGFyZVNvdXJjZU9wZXJhdGlvbnNSZXF1ZXN0GjEuc2Fhcy5hY2NvdW50cy52MS5EZWNsYXJlU291cmNlT3BlcmF0aW9uc1Jlc3BvbnNlIpIBwvMYRggCEAQqDAoGb3JnX2lkEAIYATABOiYKInNhYXMuZGF0YXNvdXJjZS5vcGVyYXRpb24uZGVjbGFyZWQQAkABSARQA1gDYAGC0+STAkI6ASoiPS92MS9vcmdhbml6YXRpb25zL3tvcmdfaWR9L2RhdGFzb3VyY2VzL3tzb3VyY2VfaWR9L29wZXJhdGlvbnMSrAEKD0FkZEdpdEh1YlNvdXJjZRIoLnNhYXMuYWNjb3VudHMudjEuQWRkR2l0SHViU291cmNlUmVxdWVzdBopLnNhYXMuYWNjb3VudHMudjEuQWRkR2l0SHViU291cmNlUmVzcG9uc2UiRMLzGEAIAhAEKgwKBm9yZ19pZBACGAEwATogChxzYWFzLmRhdGFzb3VyY2Uuc291cmNlLmFkZGVkEAJAAUgEUARYA2ABEpoBCglBZGRTb3VyY2USIi5zYWFzLmFjY291bnRzLnYxLkFkZFNvdXJjZVJlcXVlc3QaIy5zYWFzLmFjY291bnRzLnYxLkFkZFNvdXJjZVJlc3BvbnNlIkTC8xhACAIQBCoMCgZvcmdfaWQQAhgBMAE6IAocc2Fhcy5kYXRhc291cmNlLnNvdXJjZS5hZGRlZBACQAFIBFAEWANgARKPAQoUR2V0RGF0YXNvdXJjZUNhdGFsb2cSLS5zYWFzLmFjY291bnRzLnYxLkdldERhdGFzb3VyY2VDYXRhbG9nUmVxdWVzdBouLnNhYXMuYWNjb3VudHMudjEuR2V0RGF0YXNvdXJjZUNhdGFsb2dSZXNwb25zZSIYwvMYFAgCEAEwAToCEAFAAUgDUAJYAmABEoIBCgtMaXN0U291cmNlcxIkLnNhYXMuYWNjb3VudHMudjEuTGlzdFNvdXJjZXNSZXF1ZXN0GiUuc2Fhcy5hY2NvdW50cy52MS5MaXN0U291cmNlc1Jlc3BvbnNlIibC8xgiCAIQAyoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARJ8CglHZXRTb3VyY2USIi5zYWFzLmFjY291bnRzLnYxLkdldFNvdXJjZVJlcXVlc3QaIy5zYWFzLmFjY291bnRzLnYxLkdldFNvdXJjZVJlc3BvbnNlIibC8xgiCAIQAyoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARKeAQoKU3luY1NvdXJjZRIjLnNhYXMuYWNjb3VudHMudjEuU3luY1NvdXJjZVJlcXVlc3QaJC5zYWFzLmFjY291bnRzLnYxLlN5bmNTb3VyY2VSZXNwb25zZSJFwvMYQQgCEAQqDAoGb3JnX2lkEAIYATABOiEKHXNhYXMuZGF0YXNvdXJjZS5zb3VyY2Uuc3luY2VkEAJAAUgEUARYAmABEogBCg1HZXRTb3VyY2VTeW5jEiYuc2Fhcy5hY2NvdW50cy52MS5HZXRTb3VyY2VTeW5jUmVxdWVzdBonLnNhYXMuYWNjb3VudHMudjEuR2V0U291cmNlU3luY1Jlc3BvbnNlIibC8xgiCAIQBCoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARKlAQoMRGVsZXRlU291cmNlEiUuc2Fhcy5hY2NvdW50cy52MS5EZWxldGVTb3VyY2VSZXF1ZXN0GiYuc2Fhcy5hY2NvdW50cy52MS5EZWxldGVTb3VyY2VSZXNwb25zZSJGwvMYQggCEAQqDAoGb3JnX2lkEAIYATABOiIKHnNhYXMuZGF0YXNvdXJjZS5zb3VyY2UucmVtb3ZlZBACQAFIBFACWAJgARLEAQoTQmVnaW5HaXRIdWJBcHBTZXR1cBIsLnNhYXMuYWNjb3VudHMudjEuQmVnaW5HaXRIdWJBcHBTZXR1cFJlcXVlc3QaLS5zYWFzLmFjY291bnRzLnYxLkJlZ2luR2l0SHViQXBwU2V0dXBSZXNwb25zZSJQwvMYTAgCEAQqDAoGb3JnX2lkEAIYATABOiwKKHNhYXMuZGF0YXNvdXJjZS5naXRodWJfYXBwLnNldHVwX3N0YXJ0ZWQQAkABSARQAlgEYAESzwEKFkNvbXBsZXRlR2l0SHViQXBwU2V0dXASLy5zYWFzLmFjY291bnRzLnYxLkNvbXBsZXRlR2l0SHViQXBwU2V0dXBSZXF1ZXN0GjAuc2Fhcy5hY2NvdW50cy52MS5Db21wbGV0ZUdpdEh1YkFwcFNldHVwUmVzcG9uc2UiUsLzGE4IAhAEKgwKBm9yZ19pZBACGAEwATouCipzYWFzLmRhdGFzb3VyY2UuZ2l0aHViX2FwcC5zZXR1cF9jb21wbGV0ZWQQAkABSARQBFgDYAESzQEKGE1pZ3JhdGVHaXRIdWJTb3VyY2VUb0FwcBIxLnNhYXMuYWNjb3VudHMudjEuTWlncmF0ZUdpdEh1YlNvdXJjZVRvQXBwUmVxdWVzdBoyLnNhYXMuYWNjb3VudHMudjEuTWlncmF0ZUdpdEh1YlNvdXJjZVRvQXBwUmVzcG9uc2UiSsLzGEYIAhAEKgwKBm9yZ19pZBACGAEwATomCiJzYWFzLmRhdGFzb3VyY2UuY3JlZGVudGlhbC51cGRhdGVkEAJAAUgEUAJYA2ABEtUBChpCZWdpbkRhdGFzb3VyY2VBY2NvdW50TGluaxIzLnNhYXMuYWNjb3VudHMudjEuQmVnaW5EYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0GjQuc2Fhcy5hY2NvdW50cy52MS5CZWdpbkRhdGFzb3VyY2VBY2NvdW50TGlua1Jlc3BvbnNlIkzC8xhICAIQAyoMCgZvcmdfaWQQAhgBMAE6KAokc2Fhcy5kYXRhc291cmNlLmFjY291bnRfbGlua19zdGFydGVkEAJAAUgEUAJYBGABEtgBCh1Db21wbGV0ZURhdGFzb3VyY2VBY2NvdW50TGluaxI2LnNhYXMuYWNjb3VudHMudjEuQ29tcGxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0Gjcuc2Fhcy5hY2NvdW50cy52MS5Db21wbGV0ZURhdGFzb3VyY2VBY2NvdW50TGlua1Jlc3BvbnNlIkbC8xhCCAIQAyoMCgZvcmdfaWQQAhgBMAE6Igoec2Fhcy5kYXRhc291cmNlLmFjY291bnRfbGlua2VkEAJAAUgEUARYA2ABErUBChxMaXN0TXlEYXRhc291cmNlQWNjb3VudExpbmtzEjUuc2Fhcy5hY2NvdW50cy52MS5MaXN0TXlEYXRhc291cmNlQWNjb3VudExpbmtzUmVxdWVzdBo2LnNhYXMuYWNjb3VudHMudjEuTGlzdE15RGF0YXNvdXJjZUFjY291bnRMaW5rc1Jlc3BvbnNlIibC8xgiCAIQAyoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARLUAQobRGVsZXRlRGF0YXNvdXJjZUFjY291bnRMaW5rEjQuc2Fhcy5hY2NvdW50cy52MS5EZWxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0GjUuc2Fhcy5hY2NvdW50cy52MS5EZWxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXNwb25zZSJIwvMYRAgCEAMqDAoGb3JnX2lkEAIYATABOiQKIHNhYXMuZGF0YXNvdXJjZS5hY2NvdW50X3VubGlua2VkEAJAAUgEUAJYA2ABEqMBChZHZXREYXRhc291cmNlRGlyZWN0b3J5Ei8uc2Fhcy5hY2NvdW50cy52MS5HZXREYXRhc291cmNlRGlyZWN0b3J5UmVxdWVzdBowLnNhYXMuYWNjb3VudHMudjEuR2V0RGF0YXNvdXJjZURpcmVjdG9yeVJlc3BvbnNlIibC8xgiCAIQBCoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARK3AQoTQmluZERhdGFzb3VyY2VHcm91cBIsLnNhYXMuYWNjb3VudHMudjEuQmluZERhdGFzb3VyY2VHcm91cFJlcXVlc3QaLS5zYWFzLmFjY291bnRzLnYxLkJpbmREYXRhc291cmNlR3JvdXBSZXNwb25zZSJDwvMYPwgCEAQqDAoGb3JnX2lkEAIYATABOh8KG3NhYXMuZGF0YXNvdXJjZS5ncm91cF9ib3VuZBACQAFIBFACWANgARK/AQoVVW5iaW5kRGF0YXNvdXJjZUdyb3VwEi4uc2Fhcy5hY2NvdW50cy52MS5VbmJpbmREYXRhc291cmNlR3JvdXBSZXF1ZXN0Gi8uc2Fhcy5hY2NvdW50cy52MS5VbmJpbmREYXRhc291cmNlR3JvdXBSZXNwb25zZSJFwvMYQQgCEAQqDAoGb3JnX2lkEAIYATABOiEKHXNhYXMuZGF0YXNvdXJjZS5ncm91cF91bmJvdW5kEAJAAUgEUAJYA2ABEsABChVDbGFpbURhdGFzb3VyY2VEb21haW4SLi5zYWFzLmFjY291bnRzLnYxLkNsYWltRGF0YXNvdXJjZURvbWFpblJlcXVlc3QaLy5zYWFzLmFjY291bnRzLnYxLkNsYWltRGF0YXNvdXJjZURvbWFpblJlc3BvbnNlIkbC8xhCCAIQBCoMCgZvcmdfaWQQAhgBMAE6Igoec2Fhcy5kYXRhc291cmNlLmRvbWFpbl9jbGFpbWVkEAJAAUgEUAJYA2ABEsQBChZWZXJpZnlEYXRhc291cmNlRG9tYWluEi8uc2Fhcy5hY2NvdW50cy52MS5WZXJpZnlEYXRhc291cmNlRG9tYWluUmVxdWVzdBowLnNhYXMuYWNjb3VudHMudjEuVmVyaWZ5RGF0YXNvdXJjZURvbWFpblJlc3BvbnNlIkfC8xhDCAIQBCoMCgZvcmdfaWQQAhgBMAE6Iwofc2Fhcy5kYXRhc291cmNlLmRvbWFpbl92ZXJpZmllZBACQAFIBFACWANgARLDAQoWRGVsZXRlRGF0YXNvdXJjZURvbWFpbhIvLnNhYXMuYWNjb3VudHMudjEuRGVsZXRlRGF0YXNvdXJjZURvbWFpblJlcXVlc3QaMC5zYWFzLmFjY291bnRzLnYxLkRlbGV0ZURhdGFzb3VyY2VEb21haW5SZXNwb25zZSJGwvMYQggCEAQqDAoGb3JnX2lkEAIYATABOiIKHnNhYXMuZGF0YXNvdXJjZS5kb21haW5fcmVtb3ZlZBACQAFIBFACWANgARKgAQoVTGlzdFNvdXJjZURlbGVnYXRpb25zEi4uc2Fhcy5hY2NvdW50cy52MS5MaXN0U291cmNlRGVsZWdhdGlvbnNSZXF1ZXN0Gi8uc2Fhcy5hY2NvdW50cy52MS5MaXN0U291cmNlRGVsZWdhdGlvbnNSZXNwb25zZSImwvMYIggCEAQqDAoGb3JnX2lkEAIYATABOgIQAUABSANQAlgDYAESxwEKFlJldm9rZVNvdXJjZURlbGVnYXRpb24SLy5zYWFzLmFjY291bnRzLnYxLlJldm9rZVNvdXJjZURlbGVnYXRpb25SZXF1ZXN0GjAuc2Fhcy5hY2NvdW50cy52MS5SZXZva2VTb3VyY2VEZWxlZ2F0aW9uUmVzcG9uc2UiSsLzGEYIAhAEKgwKBm9yZ19pZBACGAEwATomCiJzYWFzLmRhdGFzb3VyY2UuZGVsZWdhdGlvbi5yZXZva2VkEAJAAUgEUAJYA2ABEusBChZEZWxlZ2F0ZVNvdXJjZVRyaWdnZXJzEi8uc2Fhcy5hY2NvdW50cy52MS5EZWxlZ2F0ZVNvdXJjZVRyaWdnZXJzUmVxdWVzdBowLnNhYXMuYWNjb3VudHMudjEuRGVsZWdhdGVTb3VyY2VUcmlnZ2Vyc1Jlc3BvbnNlIm7C8xhqCAIQBCoMCgZvcmdfaWQQAhgBMAE6Sgoic2Fhcy5kYXRhc291cmNlLmRlbGVnYXRpb24uY3JlYXRlZAoic2Fhcy5kYXRhc291cmNlLmRlbGVnYXRpb24ucmV2b2tlZBACQAFIBFACWANgARKyAQobR2V0U291cmNlVHJpZ2dlckRlY2xhcmF0aW9uEjQuc2Fhcy5hY2NvdW50cy52MS5HZXRTb3VyY2VUcmlnZ2VyRGVjbGFyYXRpb25SZXF1ZXN0GjUuc2Fhcy5hY2NvdW50cy52MS5HZXRTb3VyY2VUcmlnZ2VyRGVjbGFyYXRpb25SZXNwb25zZSImwvMYIggCEAQqDAoGb3JnX2lkEAIYATABOgIQAUABSANQAlgDYAESgwMKD1JlY29uY2lsZVNvdXJjZRIoLnNhYXMuYWNjb3VudHMudjEuUmVjb25jaWxlU291cmNlUmVxdWVzdBopLnNhYXMuYWNjb3VudHMudjEuUmVjb25jaWxlU291cmNlUmVzcG9uc2UimgLC8xhqCAIQAxoRZGF0YXNvdXJjZTppbnZva2UiEWRhdGFzb3VyY2U6aW52b2tlKg8KCXNvdXJjZV9pZBAEGAMwATohCh1zYWFzLmRhdGFzb3VyY2Uuc291cmNlLnN5bmNlZBACQANIBFACWAJgAdrzGKcBCgIIPBIDCNgEGAUiAggCKgtVTkFWQUlMQUJMRSoSUkVTT1VSQ0VfRVhIQVVTVEVEKgdBQk9SVEVEMg9zYWFzLWRhdGFzb3VyY2VKOS9zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VTZXJ2aWNlL0xvb2t1cFJlY29uY2lsZVNvdXJjZVCAIFiAIGABchgKBnNvdXJjZRIGaW52b2tlEgRyZWFkGAESvwEKFUxvb2t1cFJlY29uY2lsZVNvdXJjZRIuLnNhYXMuYWNjb3VudHMudjEuTG9va3VwUmVjb25jaWxlU291cmNlUmVxdWVzdBopLnNhYXMuYWNjb3VudHMudjEuUmVjb25jaWxlU291cmNlUmVzcG9uc2UiS8LzGEcIAhADGg9kYXRhc291cmNlOnJlYWQiD2RhdGFzb3VyY2U6cmVhZCoPCgllZmZlY3RfaWQQBBgDMAE6AhABQAFIA1ACWAJgAWIGcHJvdG8z", [file_buf_validate_validate, file_codefly_runnable_v0_options, file_google_api_annotations, file_google_protobuf_duration, file_google_protobuf_struct, file_google_protobuf_timestamp, file_saas_jobs_v1_jobs, file_saas_policy_v1_options]); /** * GitHubDatasourceConfig is the public, non-secret configuration of a GitHub @@ -2416,6 +2416,24 @@ export const RevokeSourceDelegationResponseSchema: GenMessage = /*@__PURE__*/ messageDesc(file_saas_accounts_v1_platform_admin, 51); +/** + * @generated from message saas.accounts.v1.ResolveModuleTenantIdentityRequest + */ +export type ResolveModuleTenantIdentityRequest = Message<"saas.accounts.v1.ResolveModuleTenantIdentityRequest"> & { + /** + * prefix is the module principal's registration prefix and binding the key + * of its operation_audiences entry. + * + * @generated from field: string prefix = 1; + */ + prefix: string; + + /** + * @generated from field: string binding = 2; + */ + binding: string; + + /** + * organization_id is the tenant the capability would act for. + * + * @generated from field: string organization_id = 3; + */ + organizationId: string; +}; + +/** + * Describes the message saas.accounts.v1.ResolveModuleTenantIdentityRequest. + * Use `create(ResolveModuleTenantIdentityRequestSchema)` to create a new message. + */ +export const ResolveModuleTenantIdentityRequestSchema: GenMessage = /*@__PURE__*/ + messageDesc(file_saas_accounts_v1_platform_admin, 52); + +/** + * ModuleTenantIdentity is what one per-tenant mint would assert. Every field is + * the host's: nothing here is requestable. + * + * @generated from message saas.accounts.v1.ModuleTenantIdentity + */ +export type ModuleTenantIdentity = Message<"saas.accounts.v1.ModuleTenantIdentity"> & { + /** + * principal_id is the module's own service principal, which owns the + * capability and acts directly — there is no person and no actor hop. + * + * @generated from field: string principal_id = 1; + */ + principalId: string; + + /** + * tenant is the organization it would act for, and audience the service the + * binding declares it may call. A binding whose audience is the module's own + * prefix is one the module admits itself, which is how unattended work is + * admitted by the module that executes it. + * + * @generated from field: string tenant = 2; + */ + tenant: string; + + /** + * @generated from field: string audience = 3; + */ + audience: string; + + /** + * scopes is exactly what the capability would carry, as + * `kind:action[:resource]`: the binding's headless_scopes narrowed by THIS + * organization's installation scope. Never its invoke_scopes, which describe + * authority exercised on a person's behalf. + * + * @generated from field: repeated string scopes = 4; + */ + scopes: string[]; + + /** + * lifetime_seconds is the fixed lifetime every such capability carries. + * + * @generated from field: int64 lifetime_seconds = 5; + */ + lifetimeSeconds: bigint; + + /** + * revision is the authorization revision it would be sealed with: a digest + * of the module's whole effective entry, so any change to the entry stops + * confirming every capability minted under the old one. + * + * @generated from field: uint64 revision = 6; + */ + revision: bigint; + + /** + * shared says the principal is unpinned and declares cross_tenant, so it may + * act for more than one organization. A pinned principal reads false and can + * only ever name the tenant its envelope declares. + * + * @generated from field: bool shared = 7; + */ + shared: boolean; +}; + +/** + * Describes the message saas.accounts.v1.ModuleTenantIdentity. + * Use `create(ModuleTenantIdentitySchema)` to create a new message. + */ +export const ModuleTenantIdentitySchema: GenMessage = /*@__PURE__*/ + messageDesc(file_saas_accounts_v1_platform_admin, 53); + +/** + * ModuleTenantIdentityMint is one capability actually issued, as the audit + * trail recorded it. There is no other record: a capability lives a minute and + * nothing caches one. + * + * @generated from message saas.accounts.v1.ModuleTenantIdentityMint + */ +export type ModuleTenantIdentityMint = Message<"saas.accounts.v1.ModuleTenantIdentityMint"> & { + /** + * @generated from field: string record = 1; + */ + record: string; + + /** + * @generated from field: string tenant = 2; + */ + tenant: string; + + /** + * @generated from field: string binding = 3; + */ + binding: string; + + /** + * @generated from field: string audience = 4; + */ + audience: string; + + /** + * @generated from field: repeated string scopes = 5; + */ + scopes: string[]; + + /** + * @generated from field: google.protobuf.Timestamp minted_at = 6; + */ + mintedAt?: Timestamp; +}; + +/** + * Describes the message saas.accounts.v1.ModuleTenantIdentityMint. + * Use `create(ModuleTenantIdentityMintSchema)` to create a new message. + */ +export const ModuleTenantIdentityMintSchema: GenMessage = /*@__PURE__*/ + messageDesc(file_saas_accounts_v1_platform_admin, 54); + +/** + * @generated from message saas.accounts.v1.ResolveModuleTenantIdentityResponse + */ +export type ResolveModuleTenantIdentityResponse = Message<"saas.accounts.v1.ResolveModuleTenantIdentityResponse"> & { + /** + * identity is set when a mint for this organization would be issued; refusal + * says why it would not. Exactly one is present, and a refusal is a decision + * about declared authority rather than an outage. + * + * @generated from field: saas.accounts.v1.ModuleTenantIdentity identity = 1; + */ + identity?: ModuleTenantIdentity; + + /** + * @generated from field: string refusal = 2; + */ + refusal: string; + + /** + * recent is the trail of capabilities this module was actually issued for + * this organization, newest first. + * + * @generated from field: repeated saas.accounts.v1.ModuleTenantIdentityMint recent = 3; + */ + recent: ModuleTenantIdentityMint[]; +}; + +/** + * Describes the message saas.accounts.v1.ResolveModuleTenantIdentityResponse. + * Use `create(ResolveModuleTenantIdentityResponseSchema)` to create a new message. + */ +export const ResolveModuleTenantIdentityResponseSchema: GenMessage = /*@__PURE__*/ + messageDesc(file_saas_accounts_v1_platform_admin, 55); + /** * CatalogueEntryKind distinguishes a composed module from a solution. * @@ -2018,5 +2203,17 @@ export const PlatformAdminService: GenService<{ input: typeof PutModuleEnvelopeRequestSchema; output: typeof PutModuleEnvelopeResponseSchema; }, + /** + * ResolveModuleTenantIdentity answers what a per-tenant module operation + * context would assert for one module, one of its bindings and one + * organization — or why it would be refused. It issues no capability. + * + * @generated from rpc saas.accounts.v1.PlatformAdminService.ResolveModuleTenantIdentity + */ + resolveModuleTenantIdentity: { + methodKind: "unary"; + input: typeof ResolveModuleTenantIdentityRequestSchema; + output: typeof ResolveModuleTenantIdentityResponseSchema; + }, }> = /*@__PURE__*/ serviceDesc(file_saas_accounts_v1_platform_admin, 0); diff --git a/module/services/frontend/code/packages/saas-ui/package.json b/module/services/frontend/code/packages/saas-ui/package.json index 0c5c5aa64..2d1119314 100644 --- a/module/services/frontend/code/packages/saas-ui/package.json +++ b/module/services/frontend/code/packages/saas-ui/package.json @@ -1,6 +1,6 @@ { "name": "@codefly-dev/saas-ui", - "version": "0.12.11", + "version": "0.12.12", "description": "Reusable SaaS-domain frontend components (datasources, …) the portal and solutions both import, built on @codefly-dev/ui primitives and driven by an injected typed client.", "repository": { "type": "git", diff --git a/module/services/frontend/code/server/plugin-bff.ts b/module/services/frontend/code/server/plugin-bff.ts index 5f9f73eff..233605dd9 100644 --- a/module/services/frontend/code/server/plugin-bff.ts +++ b/module/services/frontend/code/server/plugin-bff.ts @@ -2,12 +2,10 @@ import { toJsonString } from "@bufbuild/protobuf"; import { type ConnectProcedure, connectProcedureTargetPath, - FRONTEND_SERVICE_ROOT_PREFIX, - type FrontendServiceAllowlistEntry, type FrontendServiceProtocol, frontendServiceTargetPath, - isConnectServiceName, isFrontendServicePath, + isServiceableFrontendService, resolveConnectProcedure, } from "@codefly-dev/saas-plugin-contract"; import { @@ -140,25 +138,6 @@ function safePath(request: Request, segments: readonly string[]): boolean { return isFrontendServicePath(segments); } -/** - * Whether this host will proxy the resolved alias at all, independent of the - * path asked for. Both rules are the composition's, re-asserted here because - * the BFF reads the GENERATED allowlist rather than the composition that - * validated it: a build-time rule no runtime re-checks is one a stale or - * hand-edited projection walks straight past. - */ -function proxyableEntry(entry: FrontendServiceAllowlistEntry): boolean { - if (entry.protocol === "connect") { - // Connect without a declared service list reaches nothing: the path - // names the service, so an absent list is an unbounded alias. - const services = entry.connectServices ?? []; - return services.length > 0 && services.every(isConnectServiceName); - } - // The origin root is Connect-only. A REST alias declaring it would be a - // prefix-less proxy of its whole upstream. - return entry.routePrefix !== FRONTEND_SERVICE_ROOT_PREFIX; -} - function sameOrigin(request: Request): boolean { const origin = request.headers.get("origin"); if (origin) { @@ -304,16 +283,37 @@ function isCapabilityProbe(path: readonly string[]): boolean { ); } +/** + * Where the fixed capability handshake is probed on this alias's upstream. + * + * On a Connect alias it lands under the requirement's own mount prefix, like + * every other procedure of that alias (issue #1121). It used to be sent to the + * origin root unconditionally, which is right only for a requirement that + * declared the root: a backend mounting Connect under `/v1/connect` answered + * the probe with its own 404, so the alias was reported incompatible and the + * mounted form this host advertises could never complete a handshake. + * + * On a REST alias the product may own the path, so the requirement's optional + * `probePath` wins over the well-known one; neither is relative to the route + * prefix, because a probe path is declared absolute and validated as such. + */ function capabilityTargetURL( baseURL: string, protocol: FrontendServiceProtocol, + routePrefix: string, probePath?: string, ): URL { const target = new URL(baseURL); - target.pathname = - protocol === "connect" - ? FRONTEND_PLUGIN_CAPABILITIES_CONNECT_PROCEDURE - : (probePath ?? FRONTEND_PLUGIN_CAPABILITIES_REST_PATH); + if (protocol !== "connect") { + target.pathname = probePath ?? FRONTEND_PLUGIN_CAPABILITIES_REST_PATH; + return target; + } + const [service, method] = + FRONTEND_PLUGIN_CAPABILITIES_CONNECT_PROCEDURE.slice(1).split("/"); + target.pathname = connectProcedureTargetPath(routePrefix, { + service, + method, + }); return target; } @@ -345,7 +345,14 @@ export async function handlePluginBffRequest( // A resolved entry the composition's own rules would have refused is a // projection this host cannot serve, not a bad request: nothing the caller // could have asked differently would make the alias proxyable. - if (!proxyableEntry(resolution.value.entry)) { + // + // `resolvePluginService` already refuses an unserviceable entry at load, so + // in this service the check below is unreachable through that resolver. + // It stays because `resolve` is a dependency: a test, or a host wiring its + // own resolver, reaches this handler with whatever entry it hands over, and + // the rule that decides what may be proxied belongs to the thing that + // proxies. One predicate, read in both places, so they cannot disagree. + if (!isServiceableFrontendService(resolution.value.entry)) { return problem("backend_unavailable", 503, requestID); } @@ -426,6 +433,7 @@ export async function handlePluginBffRequest( upstreamTarget = capabilityTargetURL( resolution.value.baseURL, resolution.value.entry.protocol, + resolution.value.entry.routePrefix, resolution.value.entry.compatibility.probePath, ); upstreamHeaders.set("accept", "application/json"); diff --git a/module/services/frontend/code/server/plugin-service-bindings.ts b/module/services/frontend/code/server/plugin-service-bindings.ts index cefa4198e..d470e3963 100644 --- a/module/services/frontend/code/server/plugin-service-bindings.ts +++ b/module/services/frontend/code/server/plugin-service-bindings.ts @@ -1,6 +1,7 @@ -import type { - FrontendServiceAllowlist, - FrontendServiceAllowlistEntry, +import { + type FrontendServiceAllowlist, + type FrontendServiceAllowlistEntry, + isServiceableFrontendService, } from "@codefly-dev/saas-plugin-contract"; import { getEndpoints, type ServiceEndpoint } from "codefly"; @@ -69,10 +70,24 @@ export function resolvePluginServiceFrom( plugin: string, alias: string, ): PluginServiceResolution { - const entry = allowlist.entries.find( - (candidate) => candidate.plugin === plugin && candidate.alias === alias, - ); + const entry = Array.isArray(allowlist?.entries) + ? allowlist.entries.find( + (candidate) => candidate.plugin === plugin && candidate.alias === alias, + ) + : undefined; if (!entry) return { ok: false, reason: "not_installed" }; + // The composition's own rules, re-checked against the GENERATED projection + // this server actually reads (issue #1121). The allowlist is a build + // artifact, so a build-time rule nothing re-checks is one a stale or + // hand-edited file walks straight past: a `rest` entry whose prefix is `""` + // is not the root the old check compared against, yet it lands every + // relative path on the upstream origin — `admin/secret` reaches + // `https://upstream/admin/secret` and is answered under the viewer's own + // bearer. An entry that cannot be served is `unavailable`, never + // `not_installed`: the alias IS installed, and this host cannot serve it. + if (!isServiceableFrontendService(entry)) { + return { ok: false, reason: "unavailable" }; + } const matches = endpoints.filter( (endpoint) => diff --git a/module/services/frontend/code/src/app/admin/platform/module-identity/page.tsx b/module/services/frontend/code/src/app/admin/platform/module-identity/page.tsx new file mode 100644 index 000000000..7628cee5f --- /dev/null +++ b/module/services/frontend/code/src/app/admin/platform/module-identity/page.tsx @@ -0,0 +1,34 @@ +import { RoleGate } from "@/components/auth/role-gate"; +import { ModuleTenantIdentityPlayground } from "@/features/module-tenant-identity"; + +function AccessDenied() { + return ( +
+

+ Super administrator required +

+

+ Resolving what a module's capability would carry reads any + organization's installation scope and is restricted to platform + super administrators. +

+
+ ); +} + +/** + * The playground for a module identity minted for one tenant. + * + * Under `/admin/platform/`, which is where it belongs and where the route + * catalog derives `super_admin` from — the same boundary `ResolveModuleTenantIdentity` + * declares. It reads any organization's installation scope, which is + * cross-tenant authority however read-only it is, so this page's gate and the + * RPC's `platform_role` are one answer rather than two. + */ +export default function Page() { + return ( + }> + + + ); +} diff --git a/module/services/frontend/code/src/app/admin/platform/page.tsx b/module/services/frontend/code/src/app/admin/platform/page.tsx index b6d90e783..2cfbaba2f 100644 --- a/module/services/frontend/code/src/app/admin/platform/page.tsx +++ b/module/services/frontend/code/src/app/admin/platform/page.tsx @@ -68,10 +68,23 @@ const sections = [ icon: Workflow, }, { + // Under /admin/, not /admin/platform/: every RPC behind it is org-scoped + // and ORG_ADMIN, so an organization administrator reaches it from their + // own sidebar (issue #1121). It is listed here too because a platform + // operator looking at the composition's unattended work starts on this + // page, and a tile naming the page they want is cheaper than knowing + // the route. title: "Unattended Work", description: "Bind the identity work no person started runs under, and read the trigger each source declares.", - href: "/admin/platform/unattended-work", + href: "/admin/unattended-work", + icon: KeyRound, + }, + { + title: "Module Identity", + description: + "Resolve what a module's capability for one tenant would carry, and why it would be refused.", + href: "/admin/platform/module-identity", icon: KeyRound, }, { diff --git a/module/services/frontend/code/src/app/admin/platform/unattended-work/page.tsx b/module/services/frontend/code/src/app/admin/unattended-work/page.tsx similarity index 65% rename from module/services/frontend/code/src/app/admin/platform/unattended-work/page.tsx rename to module/services/frontend/code/src/app/admin/unattended-work/page.tsx index ae6306775..ca80ecfaa 100644 --- a/module/services/frontend/code/src/app/admin/platform/unattended-work/page.tsx +++ b/module/services/frontend/code/src/app/admin/unattended-work/page.tsx @@ -26,6 +26,16 @@ function AccessDenied() { * asked for a platform super administrator and said it reached every tenant's * delegations, which was wrong in both directions: it hid an org admin's own * organization from them, and it described a reach no RPC behind it has. + * + * IT LIVES UNDER `/admin/`, NOT `/admin/platform/`, and that is the fix rather + * than a tidy-up (issue #1121, N5). The route catalog derives a page's access + * boundary from its path — everything under `admin/platform` is `super_admin` + * — so while this page sat there, the catalog said `super_admin` and the gate + * below said `admin`: two access declarations for one page, disagreeing, with + * nothing to reconcile them. Moving it makes the derivation agree by + * construction instead of by a special case in the generator, and it gives + * organization administrators a navigation entry they can actually reach + * (`admin-unattended-work` in frontend.bindings.codefly.yaml). */ export default function Page() { return ( diff --git a/module/services/frontend/code/src/app/api/plugins/[plugin]/[alias]/[...path]/__tests__/route.raw-path.test.ts b/module/services/frontend/code/src/app/api/plugins/[plugin]/[alias]/[...path]/__tests__/route.raw-path.test.ts index 654c4d656..ec2468e98 100644 --- a/module/services/frontend/code/src/app/api/plugins/[plugin]/[alias]/[...path]/__tests__/route.raw-path.test.ts +++ b/module/services/frontend/code/src/app/api/plugins/[plugin]/[alias]/[...path]/__tests__/route.raw-path.test.ts @@ -12,6 +12,17 @@ import { describe, expect, it } from "vitest"; // the binding never declared, while the contract says the colon is literal // precisely because encoding it names a different resource. The raw path is the // only place that distinction still exists, so it is screened there. +// +// WHAT THIS FILE PROVES, AND WHAT IT ASSUMES (issue #1121, m3). The decoding is +// the FRAMEWORK's, and these tests hand the route its already-decoded params +// (`context(...)`) because that is the only way to call a route handler +// directly — so the decoding is the premise here, not the finding. What is +// proved is the half this repository owns: given a decoded param, the screen +// reads the RAW url and refuses, which is what a sibling test with a literal +// colon shows is a path refusal rather than an unrelated 400. The premise +// itself is the framework's documented behaviour for a catch-all segment, and +// nothing in this repository can hold it — a Next.js release that stopped +// decoding would make these refusals unreachable rather than wrong. import { GET, POST } from "@/app/api/plugins/[plugin]/[alias]/[...path]/route"; const TOKEN = `Bearer ${"a".repeat(32)}`; diff --git a/module/services/frontend/code/src/features/module-tenant-identity/index.ts b/module/services/frontend/code/src/features/module-tenant-identity/index.ts new file mode 100644 index 000000000..875755e8c --- /dev/null +++ b/module/services/frontend/code/src/features/module-tenant-identity/index.ts @@ -0,0 +1,2 @@ +export { useModuleTenantIdentity } from "./service/queries"; +export { ModuleTenantIdentityPlayground } from "./ui/module-tenant-identity-playground"; diff --git a/module/services/frontend/code/src/features/module-tenant-identity/service/queries.ts b/module/services/frontend/code/src/features/module-tenant-identity/service/queries.ts new file mode 100644 index 000000000..2416b3b47 --- /dev/null +++ b/module/services/frontend/code/src/features/module-tenant-identity/service/queries.ts @@ -0,0 +1,70 @@ +import { useQuery, useQueryClient } from "@tanstack/react-query"; +import { usePlatformAdminService } from "@/lib/hooks/use-api-client"; +import { mayKeepRetainedRows, readOutcome } from "@/shared/lib/read-outcome"; + +/** + * The read behind the per-tenant module identity playground. + * + * It resolves what one module's capability WOULD assert for one organization, + * and issues nothing: the mint needs the module pod's projected ServiceAccount + * token held against the build its authority document approves, which a browser + * has none of — and a path that answered an operator with a module's capability + * would be a second spelling of that module's identity. + * + * `enabled` is every field, because the answer is about the triple. A read with + * two of the three would be asking a different question and the page would show + * its answer as if it were this one's. + */ +export function useModuleTenantIdentity( + prefix: string, + binding: string, + organizationId: string, +) { + const service = usePlatformAdminService(); + const client = useQueryClient(); + return useQuery({ + queryKey: ["module-tenant-identity", prefix, binding, organizationId], + enabled: !!prefix && !!binding && !!organizationId, + queryFn: async () => { + // Which generation of the answer this fetch is reading, so a + // superseded refusal cannot delete a newer one (issue #1121; the + // same guard the declaration read carries, for the same race, on + // the same field — a generation counter rather than a millisecond + // timestamp, which two successes can share). + const key = [ + "module-tenant-identity", + prefix, + binding, + organizationId, + ] as const; + const readingGeneration = + client.getQueryCache().find({ queryKey: key, exact: true })?.state + .dataUpdateCount ?? 0; + try { + return await service.resolveModuleTenantIdentity({ + prefix, + binding, + organizationId, + }); + } catch (error) { + // The refused triple, and only it. `findAll({ queryKey })` is a + // PREFIX match, so this cleared every cached triple — including + // answers about other bindings and other organizations that + // nothing had refused. This page asks one triple at a time, so + // the harm was a needless refetch rather than a false claim, but + // the rule is the same one the declaration query now follows + // (issue #1121): a refusal is evidence about the key it + // answered, and about no other. + if (!mayKeepRetainedRows(readOutcome(true, error))) { + const entry = client + .getQueryCache() + .find({ queryKey: key, exact: true }); + if (entry && entry.state.dataUpdateCount <= readingGeneration) { + entry.setState({ data: undefined, dataUpdatedAt: 0 }); + } + } + throw error; + } + }, + }); +} diff --git a/module/services/frontend/code/src/features/module-tenant-identity/ui/module-tenant-identity-playground.container.test.tsx b/module/services/frontend/code/src/features/module-tenant-identity/ui/module-tenant-identity-playground.container.test.tsx new file mode 100644 index 000000000..2dfc46ff8 --- /dev/null +++ b/module/services/frontend/code/src/features/module-tenant-identity/ui/module-tenant-identity-playground.container.test.tsx @@ -0,0 +1,597 @@ +import { onlineManager, QueryClient } from "@tanstack/react-query"; +import { + act, + cleanup, + fireEvent, + screen, + waitFor, + within, +} from "@testing-library/react"; +import { HttpResponse, http, type JsonBodyType } from "msw"; +import { afterEach, describe, expect, it, vi } from "vitest"; +import { renderInApp, rpc } from "@/test/container"; +import { server } from "@/test/setup"; +import { ModuleTenantIdentityPlayground } from "./module-tenant-identity-playground"; + +// THE PAGE RESOLVES A MINT AND NEVER PERFORMS ONE. +// +// That is the claim worth testing, and it is a claim about what the page asks +// for rather than about what renders: a surface that answered an operator with +// a module's capability would be a second spelling of that module's identity. +// So the test records the requests the page makes, asserts they are the +// resolution and nothing else, and then asserts the two answers an operator +// has to tell apart — what would be carried, and why nothing would be. + +afterEach(cleanup); + +const ORG = "11111111-1111-4111-8111-111111111111"; + +const minted = { + identity: { + principalId: "module:example", + tenant: ORG, + audience: "example.api", + scopes: ["records:read:one", "records:write:one"], + lifetimeSeconds: "60", + revision: "8123456789", + shared: true, + }, + refusal: "", + recent: [ + { + record: "audit-1", + tenant: ORG, + binding: "operate", + audience: "example.api", + scopes: ["records:read:one"], + mintedAt: "2026-10-13T09:00:00Z", + }, + ], +}; + +const refused = { + refusal: "the organization has no live installation of this module", + recent: [], +}; + +/** Serve the resolution, and record every request the page makes. */ +function serve(answer: JsonBodyType): { calls: unknown[] } { + const calls: unknown[] = []; + server.use( + http.post( + rpc("PlatformAdminService", "ResolveModuleTenantIdentity"), + async ({ request }) => { + calls.push(await request.json()); + return HttpResponse.json(answer); + }, + ), + ); + return { calls }; +} + +function fill() { + fireEvent.change(screen.getByLabelText("Module prefix"), { + target: { value: "example" }, + }); + fireEvent.change(screen.getByLabelText("Operation binding"), { + target: { value: "operate" }, + }); + fireEvent.change(screen.getByLabelText("Organization"), { + target: { value: ORG }, + }); +} + +describe("ModuleTenantIdentityPlayground", () => { + it("asks nothing until the triple is named", async () => { + const recorded = serve(minted); + renderInApp(); + + // The answer is about the three together, so two of them is a different + // question — and showing its answer as this one's would be wrong. + fireEvent.change(screen.getByLabelText("Module prefix"), { + target: { value: "example" }, + }); + fireEvent.change(screen.getByLabelText("Operation binding"), { + target: { value: "operate" }, + }); + expect( + await screen.findByText(/Name a module, a binding and an organization/), + ).toBeTruthy(); + expect(recorded.calls).toHaveLength(0); + }); + + it("shows what one tenant's capability would carry, and asks for no mint", async () => { + const recorded = serve(minted); + renderInApp(); + fill(); + + expect( + await screen.findByText(/A capability would be issued/), + ).toBeTruthy(); + // Acting FOR the organization named: the tenant is the capability's, and + // it is what a consumer admitting a publication reads it from. + // Scoped to the resolution's own card: the audience also appears in the + // trail below it, and `getByText` over the page would be ambiguous for + // the wrong reason. + const resolved = document.querySelector( + '[data-slot="module-tenant-identity"]', + ) as HTMLElement; + expect(within(resolved).getByText(ORG)).toBeTruthy(); + expect(within(resolved).getByText("example.api")).toBeTruthy(); + expect(within(resolved).getByText("60 seconds")).toBeTruthy(); + // The scopes are the binding's headless list as this organization's + // installation narrowed it — never its invoke scopes. + expect( + within(resolved).getByText("records:read:one, records:write:one"), + ).toBeTruthy(); + expect( + screen.getByText(/may act for any organization that installs it/), + ).toBeTruthy(); + + // The trail of capabilities actually issued, which is the only record of + // one: nothing caches a capability. + expect( + document.querySelectorAll('[data-slot="module-tenant-mint"]'), + ).toHaveLength(1); + + // And the whole point: one request, the resolution, carrying the triple + // — and no mint anywhere. + expect(recorded.calls).toEqual([ + { prefix: "example", binding: "operate", organizationId: ORG }, + ]); + }); + + it("shows the refusal in the host's own words", async () => { + // A refusal is a decision about declared authority, and each one is a + // different thing for an operator to do about it — so the page prints + // what the host said rather than mapping every refusal onto one word. + serve(refused); + renderInApp(); + fill(); + + expect( + await screen.findByText(/No capability would be issued/), + ).toBeTruthy(); + expect( + screen.getByText(/has no live installation of this module/), + ).toBeTruthy(); + expect( + screen.getByText(/is a decision about declared authority, not an outage/), + ).toBeTruthy(); + // A refused resolution shows no capability's facts at all. + expect( + document.querySelector('[data-slot="module-tenant-identity"]'), + ).toBeNull(); + }); +}); + +describe("independent review: authority read outcomes", () => { + it("does not claim no issued capabilities before a read", () => { + renderInApp(); + expect(screen.queryByText(/No capability has been issued/)).toBeNull(); + }); + it("removes issued capability rows after a forbidden refetch", async () => { + serve(minted); + renderInApp(); + fill(); + await screen.findByText("audit-1"); + server.use( + http.post( + rpc("PlatformAdminService", "ResolveModuleTenantIdentity"), + () => + HttpResponse.json( + { + code: "permission_denied", + message: "requires platform super_admin role", + }, + { status: 403 }, + ), + ), + ); + fireEvent.click(screen.getByRole("button", { name: "Resolve again" })); + await screen.findAllByText(/not allowed|permission|cannot view|access/i); + expect(screen.queryByText("audit-1")).toBeNull(); + }); + it("does not restore a forbidden snapshot after a later unavailable read", async () => { + serve(minted); + renderInApp(); + fill(); + await screen.findByText("audit-1"); + server.use( + http.post( + rpc("PlatformAdminService", "ResolveModuleTenantIdentity"), + () => + HttpResponse.json( + { code: "permission_denied", message: "refused" }, + { status: 403 }, + ), + ), + ); + fireEvent.click(screen.getByRole("button", { name: "Resolve again" })); + await screen.findAllByText(/don't have permission/); + server.use( + http.post( + rpc("PlatformAdminService", "ResolveModuleTenantIdentity"), + () => + HttpResponse.json( + { code: "unavailable", message: "unavailable" }, + { status: 503 }, + ), + ), + ); + fireEvent.click(screen.getByRole("button", { name: "Resolve again" })); + await screen.findAllByText(/Couldn't load/); + expect(screen.queryByText("audit-1")).toBeNull(); + }); + it("retains a successful answer with a notice on transient failure", async () => { + serve(minted); + renderInApp(); + fill(); + await screen.findByText("audit-1"); + server.use( + http.post( + rpc("PlatformAdminService", "ResolveModuleTenantIdentity"), + () => + HttpResponse.json( + { code: "unavailable", message: "unavailable" }, + { status: 503 }, + ), + ), + ); + fireEvent.click(screen.getByRole("button", { name: "Resolve again" })); + await screen.findByText(/may be out of date/); + expect(screen.getByText("audit-1")).toBeTruthy(); + }); +}); + +// AND THE REFUSAL IS ABOUT ONE TRIPLE (issue #1121, the same scope finding the +// declaration query carried). `findAll({ queryKey })` matches by prefix, so a +// refusal here deleted every cached triple — other bindings, other +// organizations — none of which had been refused. This page asks one triple at +// a time, so the harm was a needless refetch rather than a false claim; the rule +// is the same either way, and this pins it. +describe("a refusal's blast radius is the triple it answered", () => { + it("keeps another organization's cached answer", async () => { + serve(minted); + const { client } = renderInApp(); + fill(); + await screen.findByText("audit-1"); + + const other = [ + "module-tenant-identity", + "saas", + "module:audit", + "22222222-2222-4222-8222-222222222222", + ] as const; + client.setQueryData(other, minted); + + server.use( + http.post( + rpc("PlatformAdminService", "ResolveModuleTenantIdentity"), + () => + HttpResponse.json( + { code: "permission_denied", message: "refused" }, + { status: 403 }, + ), + ), + ); + fireEvent.click(screen.getByRole("button", { name: "Resolve again" })); + await screen.findAllByText(/not allowed|permission|cannot view|access/i); + + expect(screen.queryByText("audit-1")).toBeNull(); + expect(client.getQueryData(other)).toBeTruthy(); + }); +}); + +// AND THE SAME SUPERSESSION RACE, in the other query family (issue #1121). +// +// Two fetches overlap on one triple. The older is superseded, answers last and +// answers 403, and its catch deleted the answer the NEWER fetch had written — +// leaving status `success`, fetchStatus `idle`, `data` undefined and `error` +// null, which no component can read correctly. The guard is the same: delete +// only when no newer success replaced what this fetch was reading. +describe("a superseded refusal in the identity read", () => { + const KEY = ["module-tenant-identity", "example", "operate", ORG] as const; + + it("does not erase the newer answer it was superseded by", async () => { + let call = 0; + let release403: (() => void) | undefined; + const held = new Promise((resolve) => { + release403 = resolve; + }); + server.use( + http.post( + rpc("PlatformAdminService", "ResolveModuleTenantIdentity"), + async () => { + call++; + if (call === 1) return HttpResponse.json(minted); + if (call === 2) { + await held; + return HttpResponse.json( + { code: "permission_denied", message: "refused" }, + { status: 403 }, + ); + } + return HttpResponse.json(minted); + }, + ), + ); + const { client } = renderInApp(); + fill(); + await screen.findByText("audit-1"); + + const stale = client + .refetchQueries({ queryKey: KEY, exact: true }) + .catch(() => undefined); + await act(async () => { + await client.refetchQueries({ queryKey: KEY, exact: true }); + }); + + release403?.(); + await act(async () => { + await stale; + }); + + expect(client.getQueryState([...KEY])?.status).toBe("success"); + expect(client.getQueryData([...KEY])).toBeTruthy(); + expect(screen.getByText("audit-1")).toBeTruthy(); + }); + + // The deletion still happens when nothing newer replaced it, unmounted. + it("still deletes a refusal that nothing newer replaced, with the view unmounted", async () => { + serve(minted); + const { client } = renderInApp(); + fill(); + await screen.findByText("audit-1"); + expect(client.getQueryData([...KEY])).toBeTruthy(); + + cleanup(); + server.use( + http.post( + rpc("PlatformAdminService", "ResolveModuleTenantIdentity"), + () => + HttpResponse.json( + { code: "permission_denied", message: "refused" }, + { status: 403 }, + ), + ), + ); + await act(async () => { + await client + .refetchQueries({ queryKey: KEY, exact: true, type: "all" }) + .catch(() => undefined); + }); + + expect(client.getQueryData([...KEY])).toBeUndefined(); + }); +}); + +// AND THE SAME FIELD CHOICE HERE (issue #1121, r23): the guard counts +// generations, not milliseconds. `dataUpdatedAt` is a millisecond timestamp, so +// two successes in one millisecond tie — the spacing an overlapping refetch +// actually has — and the superseded refusal would delete the newer answer after +// all. Only Date is faked, so promises and MSW keep working while every +// `Date.now()` returns one instant. +describe("a superseded refusal when both identity answers share a millisecond", () => { + const KEY = ["module-tenant-identity", "example", "operate", ORG] as const; + + afterEach(() => vi.useRealTimers()); + + it("does not erase a newer success that landed in the same millisecond", async () => { + vi.useFakeTimers({ toFake: ["Date"] }); + vi.setSystemTime(new Date("2026-10-13T12:00:00.000Z")); + + let call = 0; + let release403: (() => void) | undefined; + const held = new Promise((resolve) => { + release403 = resolve; + }); + server.use( + http.post( + rpc("PlatformAdminService", "ResolveModuleTenantIdentity"), + async () => { + call++; + if (call === 1) return HttpResponse.json(minted); + if (call === 2) { + await held; + return HttpResponse.json( + { code: "permission_denied", message: "refused" }, + { status: 403 }, + ); + } + return HttpResponse.json(minted); + }, + ), + ); + const { client } = renderInApp(); + fill(); + await screen.findByText("audit-1"); + + const stale = client + .refetchQueries({ queryKey: KEY, exact: true }) + .catch(() => undefined); + await act(async () => { + await client.refetchQueries({ queryKey: KEY, exact: true }); + }); + + // The premise, asserted: one timestamp, two generations. + const after = client.getQueryState([...KEY]); + expect(after?.dataUpdatedAt).toBe( + new Date("2026-10-13T12:00:00.000Z").getTime(), + ); + expect(after?.dataUpdateCount).toBeGreaterThan(1); + + release403?.(); + await act(async () => { + await stale; + }); + + expect(client.getQueryData([...KEY])).toBeTruthy(); + expect(client.getQueryState([...KEY])?.status).toBe("success"); + }); +}); + +// THE SAME TWO LIFECYCLE PATHS HERE (issue #1121, r23's request-order note): +// an observer that unmounts WHILE the refusal is in flight — TanStack's +// `removeObserver` route, which may cancel and revert the fetch's state, and is +// not the same path as refetching an already-inactive query — and RETRY, which +// the real client has (`src/lib/providers.tsx`: `retry: 1`) and this harness +// does not (`src/test/container.tsx`: `retry: false`), so every refusal test +// here had been exercising a single attempt. +describe("the identity deletion under the lifecycle paths the harness hides", () => { + const KEY = ["module-tenant-identity", "example", "operate", ORG] as const; + + it("still deletes when the observer unmounts before the refusal arrives", async () => { + let denied = false; + let release403: (() => void) | undefined; + const held = new Promise((resolve) => { + release403 = resolve; + }); + server.use( + http.post( + rpc("PlatformAdminService", "ResolveModuleTenantIdentity"), + async () => { + if (!denied) return HttpResponse.json(minted); + await held; + return HttpResponse.json( + { code: "permission_denied", message: "refused" }, + { status: 403 }, + ); + }, + ), + ); + const { client, unmount } = renderInApp(); + fill(); + await screen.findByText("audit-1"); + + denied = true; + const refused = client + .refetchQueries({ queryKey: KEY, exact: true }) + .catch(() => undefined); + unmount(); + release403?.(); + await act(async () => { + await refused; + }); + + expect(client.getQueryData([...KEY])).toBeUndefined(); + }); + + it("deletes a refused read that the client retried", async () => { + let attempts = 0; + server.use( + http.post( + rpc("PlatformAdminService", "ResolveModuleTenantIdentity"), + () => { + attempts++; + return attempts === 1 + ? HttpResponse.json(minted) + : HttpResponse.json( + { code: "permission_denied", message: "refused" }, + { status: 403 }, + ); + }, + ), + ); + const client = new QueryClient({ + defaultOptions: { queries: { retry: 1, retryDelay: 0 } }, + }); + renderInApp(, client); + fill(); + await screen.findByText("audit-1"); + + await act(async () => { + await client + .refetchQueries({ queryKey: KEY, exact: true }) + .catch(() => undefined); + }); + + expect(attempts).toBeGreaterThan(2); + expect(client.getQueryData([...KEY])).toBeUndefined(); + }); + + it("keeps the answer a retry recovered after a transient failure", async () => { + let attempts = 0; + server.use( + http.post( + rpc("PlatformAdminService", "ResolveModuleTenantIdentity"), + () => { + attempts++; + return attempts === 1 + ? HttpResponse.json({ message: "boom" }, { status: 500 }) + : HttpResponse.json(minted); + }, + ), + ); + const client = new QueryClient({ + defaultOptions: { queries: { retry: 1, retryDelay: 0 } }, + }); + renderInApp(, client); + fill(); + + await screen.findByText("audit-1"); + expect(attempts).toBe(2); + expect(client.getQueryData([...KEY])).toBeTruthy(); + }); +}); + +// A PAUSED READ IS NOT AN INCOMPLETE SELECTION (issue #1121, the read-lifecycle +// review). Offline with all three fields entered, the query parks at status +// `pending` / fetchStatus `paused` and `isFetching` is FALSE — so the page fell +// through to "Complete the selection above to read issued capabilities" while +// the selection was complete. Its own comment already stated the rule the code +// did not follow: a disabled query sits at isPending with an IDLE fetch status, +// which is the genuine no-input case and keeps that copy. +describe("the identity read while paused by the browser being offline", () => { + afterEach(() => onlineManager.setOnline(true)); + + it("does not ask for a selection that is already complete, and recovers", async () => { + serve(minted); + onlineManager.setOnline(false); + const { client } = renderInApp(); + fill(); + + await waitFor(() => { + const state = client.getQueryState([ + "module-tenant-identity", + "example", + "operate", + ORG, + ]); + expect(state?.fetchStatus).toBe("paused"); + expect(state?.status).toBe("pending"); + }); + + expect( + screen.queryByText( + "Complete the selection above to read issued capabilities.", + ), + ).toBeNull(); + + onlineManager.setOnline(true); + await screen.findByText("audit-1"); + }); + + // The genuine no-input case must keep its own copy: a query disabled by an + // empty field sits at isPending with an IDLE fetch status. + it("still asks for the selection when a field is empty", async () => { + serve(minted); + const { client } = renderInApp(); + fireEvent.change(screen.getByLabelText("Module prefix"), { + target: { value: "example" }, + }); + + const state = client.getQueryState([ + "module-tenant-identity", + "example", + "", + "", + ]); + expect(state?.fetchStatus ?? "idle").toBe("idle"); + expect( + screen.getByText( + "Complete the selection above to read issued capabilities.", + ), + ).toBeTruthy(); + }); +}); diff --git a/module/services/frontend/code/src/features/module-tenant-identity/ui/module-tenant-identity-playground.tsx b/module/services/frontend/code/src/features/module-tenant-identity/ui/module-tenant-identity-playground.tsx new file mode 100644 index 000000000..c7255df0c --- /dev/null +++ b/module/services/frontend/code/src/features/module-tenant-identity/ui/module-tenant-identity-playground.tsx @@ -0,0 +1,359 @@ +"use client"; + +import { timestampDate } from "@bufbuild/protobuf/wkt"; +import { KeyRound } from "lucide-react"; +import { useState } from "react"; +import { EmptyState } from "@/components/empty-state"; +import { + readHasNotAnswered, + readOutcome, + readOutcomeMessage, + staleReadNotice, +} from "@/shared/lib/read-outcome"; +import { + Badge, + Button, + Card, + CardContent, + CardDescription, + CardHeader, + CardTitle, + DelayedLoading, + Input, + Label, + Table, + TableBody, + TableCell, + TableHead, + TableHeader, + TableRow, + useLoadingPhase, +} from "@/shared/ui"; +import { useModuleTenantIdentity } from "../service/queries"; + +/** + * The playground for a module identity minted for ONE tenant. + * + * A composed module acting with no person present mints a Work Context for one + * of its installed operation bindings and names the organization it is acting + * FOR. That capability is how a module presents itself as acting for a tenant + * rather than as itself, and it is what a consumer admitting a publication for + * a tenant needs from a publisher with nobody signed in: the tenant comes from + * the verified capability, where this host has already checked that the + * principal may speak for it, never from a request field. + * + * Three things bound it, and the page shows each of them answered: + * + * - the ENVELOPE decides which organizations may be named. A principal pinned + * to a tenant may name that tenant and no other; an unpinned principal + * declaring `cross_tenant` may name one organization per mint. Naming an + * organization is not authority over it. + * - that organization's own live INSTALLATION must consent to this module. + * - the binding must declare `headless_scopes`, and what the capability + * carries is that list narrowed by THIS organization's installation scope. + * An organization that consented to less gets less, and one that consented + * to nothing is refused — which is what makes the bound per tenant rather + * than per deployment. + * + * IT MINTS NOTHING, deliberately. The mint authenticates with the module pod's + * projected ServiceAccount token, held against the build its authority document + * approves; a browser holds no such token, and a surface that handed an operator + * a module's capability would be a second spelling of that module's identity. So + * this resolves the decision from the same declared facts the mint decides on + * and stops one step before the signature. What it then shows beside the + * resolution is the trail of capabilities actually issued, which is the only + * record of one: a capability lives about a minute and nothing caches it. + */ +export function ModuleTenantIdentityPlayground() { + const [prefix, setPrefix] = useState(""); + const [binding, setBinding] = useState(""); + const [organizationId, setOrganizationId] = useState(""); + const read = useModuleTenantIdentity(prefix, binding, organizationId); + // `empty` is this classifier's word for "the read completed" — there is no + // list here, so the only thing it is asked is whether the answer arrived. + const outcome = readOutcome(read.isError, read.error); + const answer = read.data; + // A disabled query is not a loading one, a paused one is not finished, and + // a refused refetch's paused retry is neither — asked once, in the read + // seam, rather than re-derived from whichever flag looked closest (issue + // #1121). A read that was never issued is idle, which is what keeps + // "complete the selection above" attached to an incomplete selection. + const unanswered = readHasNotAnswered(read); + const phase = useLoadingPhase(unanswered); + const waiting = unanswered || phase.indicator || phase.quiet; + const stale = answer + ? staleReadNotice( + outcome, + "this module’s authority and issued capabilities", + ) + : null; + + return ( +
+
+

+ Module identity for one tenant +

+

+ A composed module with no person present mints a capability for one of + its installed operation bindings and names the organization it acts + for. Resolve what that capability would carry — and why it would be + refused. +

+
+ + + + What would be minted + + Name a module's registration prefix, one of its operation + bindings, and the organization it would act for. This page reads the + decision and issues no capability: a mint authenticates with the + module pod's projected ServiceAccount token, which a browser + does not have and must not be given a way around. + + + +
+
+ + setPrefix(event.target.value.trim())} + /> +
+
+ + setBinding(event.target.value.trim())} + /> +
+
+ + + setOrganizationId(event.target.value.trim()) + } + /> +
+ +
+ + + {stale && ( +

+ {stale} +

+ )} + {waiting ? null : outcome !== "empty" && !answer ? ( +

+ {readOutcomeMessage( + outcome, + "this module's declared authority", + "", + )} +

+ ) : !answer ? ( + + ) : answer.identity ? ( + + ) : ( + + )} + + + + + + Capabilities issued + + Every mint is recorded, and the record is the only trace: a + capability lives about a minute and nothing caches one. A reference + that no longer resolves shows up as the next mint having no row here + at all. + + + + + {waiting ? null : !answer ? ( +

+ {readOutcomeMessage( + outcome, + "issued capabilities", + "Complete the selection above to read issued capabilities.", + )} +

+ ) : answer.recent.length === 0 ? ( +

+ No capability has been issued to this module for this + organization. +

+ ) : ( + + + + Minted + Binding + Audience + Scopes + Record + + + + {answer.recent.map((mint) => ( + + + {mint.mintedAt + ? timestampDate(mint.mintedAt).toLocaleString() + : "—"} + + + {mint.binding} + + + {mint.audience} + + + {mint.scopes.join(", ") || "—"} + + + {mint.record} + + + ))} + +
+ )} + + +
+ ); +} + +/** What one per-tenant capability would assert, field by field. */ +function Minted({ + identity, +}: { + identity: { + principalId: string; + tenant: string; + audience: string; + scopes: readonly string[]; + lifetimeSeconds: bigint; + revision: bigint; + shared: boolean; + }; +}) { + return ( +
+ A capability would be issued +
+ + + + + + +
+
+

+ Scopes, as this organization's installation narrowed them +

+

+ {identity.scopes.join(", ") || "—"} +

+
+

+ The owner is the module's own service principal and it acts + directly: no person, and no actor hop. The scopes are the binding's{" "} + headless_scopes narrowed by this organization's + installation scope, never the invoke_scopes it holds for + work a person asked for. +

+
+ ); +} + +/** + * Why nothing would be minted. The refusal is the host's own words rather than + * a code, because each one is a different thing for an operator to do: declare + * the principal, widen the envelope's tenancy, install the module in that + * organization, or consent to the binding's headless scopes there. + */ +function Refused({ refusal }: { refusal: string }) { + return ( +
+ No capability would be issued +

{refusal}

+

+ A refusal here is a decision about declared authority, not an outage: it + is what the mint itself would answer, and retrying changes nothing until + the declaration does. +

+
+ ); +} + +/** One labelled fact. */ +function Fact({ + label, + value, + mono, +}: { + label: string; + value: string; + mono?: boolean; +}) { + return ( +
+
{label}
+
+ {value} +
+
+ ); +} diff --git a/module/services/frontend/code/src/features/plugin-transport/model/demo-plugin.test.ts b/module/services/frontend/code/src/features/plugin-transport/model/demo-plugin.test.ts index 2725ca7f7..1363d0e12 100644 --- a/module/services/frontend/code/src/features/plugin-transport/model/demo-plugin.test.ts +++ b/module/services/frontend/code/src/features/plugin-transport/model/demo-plugin.test.ts @@ -46,19 +46,29 @@ describe("the transport playground's demo plugin", () => { expect(outside && transportCarries(outside)).toBe(false); }); - it("confirms every mutating route it would actually send", () => { - // The page's plugin name is editable, so a press on a carried non-read is - // a real write to whatever backend the operator named. Each one is armed - // first; a route the transport will not carry needs no confirmation - // because nothing leaves the browser. + it("confirms every non-GET route, carried or not", () => { + // The page's plugin name is editable, so a press on a non-read is a real + // write to whatever backend the operator named — and `carried` answers + // for the DEMO declaration, not for that plugin's installed requirement + // (issue #1121, N3). A row the demo reads as refused is carried the + // moment the named plugin declares that alias differently, and it left + // the browser unconfirmed. So the arming gate reads the method alone. for (const route of TRANSPORT_DEMO_ROUTES) { - expect(transportMutates(route), route.path).toBe( - route.method !== "GET" && route.carried, - ); + expect(transportMutates(route), route.path).toBe(route.method !== "GET"); } + // Non-vacuous in both directions: the table carries reads and writes, + // and at least one write the demo itself reads as refused. expect( TRANSPORT_DEMO_ROUTES.filter(transportMutates).length, ).toBeGreaterThan(0); + expect( + TRANSPORT_DEMO_ROUTES.filter((route) => !transportMutates(route)).length, + ).toBeGreaterThan(0); + expect( + TRANSPORT_DEMO_ROUTES.filter( + (route) => !route.carried && transportMutates(route), + ).length, + ).toBeGreaterThan(0); }); it("names every route against a declared alias", () => { diff --git a/module/services/frontend/code/src/features/plugin-transport/model/demo-plugin.ts b/module/services/frontend/code/src/features/plugin-transport/model/demo-plugin.ts index 571895c61..ad7d84816 100644 --- a/module/services/frontend/code/src/features/plugin-transport/model/demo-plugin.ts +++ b/module/services/frontend/code/src/features/plugin-transport/model/demo-plugin.ts @@ -172,6 +172,13 @@ export const TRANSPORT_DEMO_ROUTES: readonly TransportDemoRoute[] = [ * Whether the transport carries one demo route, derived from the contract's own * predicates rather than from the row's `carried` flag — so the table and the * transport cannot disagree about a shape while both look right. + * + * It answers for THE DEMO DECLARATION, which is what the table is about, and + * that is not the same question as what the plugin the operator named carries: + * the runtime applies the INSTALLED requirement's rule. Nothing safety-bearing + * may read this (issue #1121, N3) — `transportMutates` arms every non-GET row + * precisely because this predicate cannot answer for a plugin it has never + * seen. */ export function transportCarries(route: TransportDemoRoute): boolean { const segments = route.path.split("/"); @@ -192,9 +199,19 @@ export function transportCarries(route: TransportDemoRoute): boolean { * It matters because the page's plugin name is the operator's to edit. Pointed * at a plugin their composition really installed, a press on one of these rows * is a real write to that backend under the operator's own credential, so the - * page asks first. A route the transport will not carry needs no confirmation: - * nothing leaves the browser. + * page asks first. + * + * EVERY NON-GET ROW IS CONFIRMED, including the ones the table shows as + * refused (issue #1121, N3). It used to skip confirmation for a row + * `transportCarries` reads as refused, and that predicate answers from the DEMO + * DECLARATION — while the request is sent against the plugin the operator + * named, whose requirement for the same alias may be a different protocol with + * a different declared service list. So `procedures/records`, which the demo + * reads as a REST path on a Connect alias, is carried the moment the named + * plugin declares that alias `rest` — and it left the browser as a POST on the + * first press. A refusal the browser will make costs one extra press; a write + * nobody confirmed cannot be taken back. */ export function transportMutates(route: TransportDemoRoute): boolean { - return route.method !== "GET" && transportCarries(route); + return route.method !== "GET"; } diff --git a/module/services/frontend/code/src/features/plugin-transport/ui/plugin-transport-playground.container.test.tsx b/module/services/frontend/code/src/features/plugin-transport/ui/plugin-transport-playground.container.test.tsx index e1a4beb75..d0ec16588 100644 --- a/module/services/frontend/code/src/features/plugin-transport/ui/plugin-transport-playground.container.test.tsx +++ b/module/services/frontend/code/src/features/plugin-transport/ui/plugin-transport-playground.container.test.tsx @@ -235,6 +235,29 @@ describe("the plugin transport playground", () => { expect(row.textContent).not.toContain("Press again to send"); }); + it("arms a non-GET row the table shows as refused", async () => { + // `carried` answers for the DEMO declaration, and the request goes to + // the plugin the operator named — whose requirement for the same alias + // may be a different protocol with a different service list (issue + // #1121, N3). So the arming gate reads the method, not the badge: this + // row is a POST the demo reads as refused, and one press must not send + // it. + const { upstream } = render(); + const row = rowFor("POST procedures/records"); + expect(row.textContent).toContain("refused"); + + press(row); + expect(row.textContent).toContain("Press again to send"); + expect(upstream).not.toHaveBeenCalled(); + // Nothing was attempted at all, so the row carries no answer yet. + expect(row.textContent).not.toContain("invalid_path"); + + press(row); + await waitFor(() => { + expect(row.textContent).toContain("invalid_path"); + }); + }); + it("sends a read on the first press", async () => { // GET is safe and idempotent, so there is nothing to confirm; making the // operator press twice for every row would turn the confirmation into diff --git a/module/services/frontend/code/src/features/plugin-transport/ui/plugin-transport-playground.tsx b/module/services/frontend/code/src/features/plugin-transport/ui/plugin-transport-playground.tsx index ee66e87ab..86bc840a2 100644 --- a/module/services/frontend/code/src/features/plugin-transport/ui/plugin-transport-playground.tsx +++ b/module/services/frontend/code/src/features/plugin-transport/ui/plugin-transport-playground.tsx @@ -83,6 +83,12 @@ type Answer = * because the custom-verb rows are writes. Anything but a read is therefore * armed by the first press, naming the plugin and alias it will write to, and * sent only by the second; editing the plugin name retracts it. + * + * EVERY non-read is armed, including the rows the Carried column shows as + * refused. That column answers for the demo declaration above, and the request + * goes to the plugin the operator named: an alias the demo declares `connect` + * may be `rest` there, so a row this page reads as refused is one that backend + * carries — and it used to leave the browser on the first press. */ export function PluginTransportPlayground() { const runtime = usePluginRuntime(); @@ -210,8 +216,10 @@ export function PluginTransportPlayground() { literal. A colon anywhere else, a traversal, a non-procedure path on a Connect alias, or a procedure of a service the requirement never declared is refused in the browser. Anything but a read asks for - confirmation first: the plugin above is editable, so a press could - write to a backend your composition really installed. + confirmation first — including a row below shown as refused, because + “carried” is read from the demo declaration while the + request goes to the plugin named above, whose own requirement for + that alias may carry it. @@ -240,7 +248,9 @@ export function PluginTransportPlayground() { - {transportCarries(route) ? "carried" : "refused"} + {transportCarries(route) + ? "carried" + : "refused by the demo"} diff --git a/module/services/frontend/code/src/features/unattended-work/service/queries.ts b/module/services/frontend/code/src/features/unattended-work/service/queries.ts index e42ebac7a..191c344ef 100644 --- a/module/services/frontend/code/src/features/unattended-work/service/queries.ts +++ b/module/services/frontend/code/src/features/unattended-work/service/queries.ts @@ -1,5 +1,6 @@ -import { useQuery } from "@tanstack/react-query"; +import { useQuery, useQueryClient } from "@tanstack/react-query"; import { useDatasourceService } from "@/lib/hooks/use-api-client"; +import { mayKeepRetainedRows, readOutcome } from "@/shared/lib/read-outcome"; /** * The reads behind the unattended-work playground. @@ -32,9 +33,74 @@ export function useTriggerSources(orgId: string) { */ export function useSourceTriggerDeclaration(orgId: string, sourceId: string) { const service = useDatasourceService(); + const client = useQueryClient(); return useQuery({ queryKey: unattendedWorkKeys.declaration(orgId, sourceId), enabled: !!orgId && !!sourceId, - queryFn: () => service.getSourceTriggerDeclaration({ orgId, sourceId }), + queryFn: async () => { + // WHICH GENERATION OF THE ANSWER THIS FETCH IS READING. A refusal + // may only delete the answer it was refused about; if a newer fetch + // has written one since, this fetch's refusal is stale news (issue + // #1121). + // + // The field is `dataUpdateCount`, the lifecycle's own counter, and + // NOT `dataUpdatedAt`: that is a millisecond timestamp, so two + // successes in the same millisecond tie and the guard reads a newer + // answer as the one it was reading — at exactly the sub-millisecond + // spacing an overlapping refetch has. A generation cannot tie. + const readingGeneration = + client.getQueryCache().find({ + queryKey: unattendedWorkKeys.declaration(orgId, sourceId), + exact: true, + })?.state.dataUpdateCount ?? 0; + try { + return await service.getSourceTriggerDeclaration({ orgId, sourceId }); + } catch (error) { + // A REFUSAL DELETES WHAT IT WAS READING, and it does it here + // rather than at render (issue #1121). TanStack keeps the last + // successful answer when a refetch rejects, so a viewer whose + // authority was withdrawn went on seeing the declaration — and + // the sweep row beside it — from cache. Authority is a property + // of the read, so what the read may leave behind is too. + // + // Only a refusal clears. A transient failure keeps the prior + // answer under a stale notice, because blanking a good answer + // because one request did not come back is worse than the + // staleness (shared/lib/read-outcome.ts). + // + // AND IT CLEARS EXACTLY ONE KEY — the one that was refused. + // `findAll({ queryKey })` matches by PREFIX, so clearing + // `["source-trigger-declaration"]` reached every organization + // and every source: one source's 403 blanked a sibling source + // whose own read had succeeded. That sibling's query stays in + // `success` with no error, so its row has no refusal to report + // and says "This source declares no trigger" — a false + // statement about a source the viewer may see. A refusal is + // evidence about the key it answered, and about no other. + // + // AND ONLY WHILE IT IS STILL THIS FETCH'S ANSWER TO DELETE. Two + // fetches overlap; the older is superseded, answers last and + // answers 403, and deleting here erased the newer fetch's + // success — leaving status `success`, fetchStatus `idle`, data + // undefined and error null, a state no component reads + // correctly: the row has no refusal to report and no + // declaration to show, so it says a source declares no trigger + // when its latest read succeeded. A superseded refusal is stale + // news about authority, not current evidence. The deletion + // still happens when nothing newer replaced the answer — + // including with no component mounted, which is the case this + // guard must not swallow. + if (!mayKeepRetainedRows(readOutcome(true, error))) { + const entry = client.getQueryCache().find({ + queryKey: unattendedWorkKeys.declaration(orgId, sourceId), + exact: true, + }); + if (entry && entry.state.dataUpdateCount <= readingGeneration) { + entry.setState({ data: undefined, dataUpdatedAt: 0 }); + } + } + throw error; + } + }, }); } diff --git a/module/services/frontend/code/src/features/unattended-work/ui/source-trigger-schedules.container.test.tsx b/module/services/frontend/code/src/features/unattended-work/ui/source-trigger-schedules.container.test.tsx index 0c6fd5917..349dccf5e 100644 --- a/module/services/frontend/code/src/features/unattended-work/ui/source-trigger-schedules.container.test.tsx +++ b/module/services/frontend/code/src/features/unattended-work/ui/source-trigger-schedules.container.test.tsx @@ -1,4 +1,5 @@ import { notifySourceReconcileAdmitted } from "@codefly-dev/saas-ui"; +import { onlineManager, QueryClient } from "@tanstack/react-query"; import { act, cleanup, screen, waitFor, within } from "@testing-library/react"; import { HttpResponse, http, type JsonBodyType } from "msw"; import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; @@ -43,6 +44,12 @@ const declared = { digest: "4f1c", lastOccurrenceAt: "2026-10-12T09:00:00Z", nextOccurrenceAt: "2026-10-12T09:30:00Z", + // The host still fires the schedule itself, and NOT on the declared cron's + // instant: the sweep reads the source's stored instant, which every pass + // moves to `now + interval`. The two share a period and not a phase, which + // is why the fixture's two instants differ by more than a label. + hostSweepEnabled: true, + hostSweepDueAt: "2026-10-12T09:07:00Z", }; beforeEach(() => vi.clearAllMocks()); @@ -69,7 +76,7 @@ async function admissions(): Promise { expect(found).not.toBeNull(); return found as HTMLElement; }); - await within(table).findByText(/Scheduled · next occurrence/); + await within(table).findByText(/Declared · next occurrence/); return table; } @@ -199,3 +206,1285 @@ describe("SourceTriggerSchedules", () => { ).toHaveLength(0); }); }); + +// THE DECLARED OCCURRENCE AND THE PASS THAT WILL HAPPEN ARE TWO FACTS +// (issue #1121, N6). +// +// The panel used to show the cron's instant alone and claim the stopgap agreed +// with it. It does not: the cron comes due on the half hour while the sweep +// fires on the stored instant, so a reader was shown 09:30 for a pass that +// happens at 09:07. Both rows are here, and the host's row says what it is. +describe("the host's own sweep", () => { + it("shows the instant it will sweep on, beside the declared occurrence", async () => { + serve({ declaration: declared, delegations: [], children: [] }); + renderInApp(); + const table = await admissions(); + + const declaredRow = within(table).getByText(/Declared · next occurrence/); + const sweepRow = within(table).getByText( + /This host’s stopgap sweep · next pass/, + ); + expect(declaredRow).toBeTruthy(); + expect(sweepRow).toBeTruthy(); + // The two instants are different, which is the whole finding. Compared + // as rendered rather than as ISO strings, because the cells are local + // time. + const declaredAt = new Date("2026-10-12T09:30:00Z").toLocaleString(); + const sweepAt = new Date("2026-10-12T09:07:00Z").toLocaleString(); + expect(declaredAt).not.toBe(sweepAt); + expect( + table.querySelector('[data-slot="next-occurrence"]')?.textContent, + ).toBe(declaredAt); + expect( + table.querySelector('[data-slot="host-sweep-due"]')?.textContent, + ).toBe(sweepAt); + // The sweep admits no operation, so it has no effect identity to show — + // said rather than left as a dash that would read as "it has none". + expect( + within(table).getByText(/None — the sweep admits no operation/), + ).toBeTruthy(); + }); + + it("says the host takes no pass when an operator turned the sweep off", async () => { + // The switch exists so the declaration's consumer and the stopgap can + // never both run. With it off there is no host pass at all, and showing + // an instant would be describing one. + serve({ + declaration: { + ...declared, + hostSweepEnabled: false, + hostSweepDueAt: undefined, + }, + delegations: [], + children: [], + }); + renderInApp(); + const table = await admissions(); + + expect( + within(table).getByText(/This host’s stopgap sweep · off/), + ).toBeTruthy(); + // NOT "an executing module fires the declaration", which asserted that + // something else does fire it — a readiness claim this host cannot make + // (issue #1121, F1). The switch says only that this host stopped. + expect(within(table).getByText(/This host does not fire it/)).toBeTruthy(); + expect( + within(table).queryByText(/An executing module fires the declaration/), + ).toBeNull(); + expect( + table.querySelector('[data-slot="host-sweep-due"]')?.textContent, + ).toBe("—"); + // The declaration itself is unchanged by the switch: it is what the + // source declares, not what this host does about it. + expect( + table.querySelector('[data-slot="next-occurrence"]')?.textContent, + ).toBe(new Date("2026-10-12T09:30:00Z").toLocaleString()); + }); +}); + +// TWO CLAIMS THE PANEL MADE THAT THIS HOST CANNOT BACK (issue #1121, the +// final-amendment review). +// +// Both are about the host-sweep row, and both are render-side: the backend +// already carries every fact either one needs. +describe("what the panel says about this host's own sweep", () => { + // The sweep does not care whether the source DECLARES a trigger. Its due + // query selects active sources whose stored instant has elapsed, and + // `DeclareSourceTrigger` computes `hostSweepDueAt` before the cron check + // precisely so this case is reportable — `TestAnUndeclarableSourceStillReportsTheHostSweep` + // pins that in pkg/adapters. So a source whose interval no five-field cron + // can express is swept every interval while the panel showed "declares no + // trigger" and nothing else: the operator was told the host does nothing + // for a source it reconciles on a timer. + it("reports the sweep for a source that declares no trigger", async () => { + serve({ + declaration: { + release: "saas_datasource_reconcile", + operation: "/saas.accounts.v1.DatasourceService/ReconcileSource", + undeclarableReason: + "the reconcile interval is not one a five-field cron expression can express", + hostSweepEnabled: true, + hostSweepDueAt: "2026-10-12T09:07:00Z", + }, + delegations: [], + children: [], + }); + renderInApp(); + await screen.findByText(/not one a five-field cron expression can express/); + const table = await waitFor(() => { + const found = document.querySelector( + '[data-slot="admissions"]', + ); + expect(found).not.toBeNull(); + return found as HTMLElement; + }); + + await waitFor(() => + expect(table.querySelector('[data-slot="host-sweep"]')).not.toBeNull(), + ); + expect( + table.querySelector('[data-slot="host-sweep-due"]')?.textContent, + ).toBe(new Date("2026-10-12T09:07:00Z").toLocaleString()); + // And the DECLARATION's own rows stay withheld, which was the half the + // old conditional had right: without a schedule there is no declared + // occurrence to show. + expect( + table.querySelectorAll('[data-slot="scheduled-occurrence"]'), + ).toHaveLength(0); + }); + + // With the sweep off, "an executing module fires the declaration" asserts + // that something else does fire it. Nothing this host holds verifies that + // (issue #1121, F1): the switch says only that THIS host stopped, so a + // deployment that turned it off before a runtime consumed the declaration + // read as covered while nothing fired at all. + it("does not claim an executing module fires it when the sweep is off", async () => { + serve({ + declaration: { + ...declared, + identityHolder: "module-a", + hostSweepEnabled: false, + hostSweepDueAt: undefined, + }, + delegations: [], + children: [], + }); + renderInApp(); + const table = await admissions(); + + const sweep = table.querySelector('[data-slot="host-sweep"]'); + expect(sweep).not.toBeNull(); + expect((sweep as HTMLElement).textContent).not.toMatch( + /An executing module fires the declaration/, + ); + expect((sweep as HTMLElement).textContent).toMatch(/unverified/); + // The holder is reported in the declared-identity row, so the two facts + // are not conflated into one claim. + expect(screen.getByText(/held by module-a/)).toBeTruthy(); + }); + + // A declaration that has not arrived — a read still in flight, or one that + // failed — must not render a sweep row at all: "off" would be an answer + // about this host that nothing established. + it("says nothing about the sweep before the declaration lands", async () => { + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => + HttpResponse.json({}, { status: 500 }), + ), + ); + renderInApp(); + await screen.findByText("acme/handbook"); + + await waitFor(() => + expect(document.querySelector('[data-slot="admissions"]')).not.toBeNull(), + ); + expect(document.querySelector('[data-slot="host-sweep"]')).toBeNull(); + expect( + document.querySelector('[data-slot="scheduled-occurrence"]'), + ).toBeNull(); + }); +}); + +// WHAT ONE SOURCE'S ROW SAYS WHEN THE DECLARATION READ DID NOT SUCCEED +// (issue #1121, the final UI review). +// +// The list read is classified; the PER-SOURCE declaration read was not, and a +// row that reads only `data` answers three different situations the same way. +// All three probes drive the real hooks through the container harness. +describe("a per-source declaration read that is refused, pending or stale", () => { + // Cold refusal: the host answered nothing, and the row said "None — + // occurrences would be refused", which is a definite statement about this + // source's identity. `declaredIdentity(undefined)` treated unknown as + // absent, so a viewer whose read was denied was told the trigger has no + // identity rather than that they cannot see it. + it("does not report an absent identity when the read was refused", async () => { + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => + HttpResponse.json( + { code: "permission_denied", message: "denied" }, + { status: 403 }, + ), + ), + ); + renderInApp(); + await screen.findByText("acme/handbook"); + + await waitFor(() => + expect( + document.querySelector('[data-slot="source-trigger"]'), + ).not.toBeNull(), + ); + await waitFor(() => + expect(screen.getByText(/don.t have permission/i)).toBeTruthy(), + ); + expect( + screen.queryByText("None — occurrences would be refused"), + ).toBeNull(); + // And nothing about this host's own sweep, which the read never answered. + expect(document.querySelector('[data-slot="host-sweep"]')).toBeNull(); + }); + + // A refusal AFTER a success must not leave the previous answer on screen: + // TanStack keeps the last good data when a refetch rejects, so the row went + // on showing a cached declaration — including the sweep row this amendment + // added — to a viewer who is no longer allowed to see it. The clearing + // belongs in the query function, where the refusal is classified. + it("drops a cached declaration when a later read is refused", async () => { + let denied = false; + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => + denied + ? HttpResponse.json( + { code: "permission_denied", message: "denied" }, + { status: 403 }, + ) + : HttpResponse.json({ + declaration: { + release: "saas_datasource_reconcile", + operation: + "/saas.accounts.v1.DatasourceService/ReconcileSource", + undeclarableReason: "the source has no reconcile schedule", + hostSweepEnabled: true, + hostSweepDueAt: "2026-10-12T09:07:00Z", + }, + delegations: [], + children: [], + }), + ), + ); + const { client } = renderInApp(); + await screen.findByText("the source has no reconcile schedule"); + await waitFor(() => + expect(document.querySelector('[data-slot="host-sweep"]')).not.toBeNull(), + ); + + denied = true; + await act(async () => { + await client.refetchQueries({ queryKey: ["source-trigger-declaration"] }); + }); + + await waitFor(() => + expect(screen.getByText(/don.t have permission/i)).toBeTruthy(), + ); + expect( + screen.queryByText("the source has no reconcile schedule"), + ).toBeNull(); + expect(document.querySelector('[data-slot="host-sweep"]')).toBeNull(); + }); + + // The sweep is ON and this source has no due instant — a parked source, + // whose stored instant the park path cleared. "next pass —" reads as a pass + // whose time is unknown; the supplied facts say there is no pass due. + it("says the sweep has nothing due rather than a next pass with no time", async () => { + serve({ + declaration: { + release: "saas_datasource_reconcile", + operation: "/saas.accounts.v1.DatasourceService/ReconcileSource", + undeclarableReason: + "the source is parked and is not on its reconcile schedule", + hostSweepEnabled: true, + }, + delegations: [], + children: [], + }); + renderInApp(); + await screen.findByText(/parked and is not on its reconcile schedule/); + const sweep = await waitFor(() => { + const found = document.querySelector( + '[data-slot="host-sweep"]', + ); + expect(found).not.toBeNull(); + return found as HTMLElement; + }); + + expect(sweep.textContent).not.toMatch(/next pass/); + expect(sweep.textContent).toMatch(/nothing due/i); + expect( + sweep.querySelector('[data-slot="host-sweep-due"]')?.textContent, + ).toBe("—"); + }); +}); + +// THE REST OF THE CLOSURE CONDITIONS for the per-source declaration read +// (issue #1121, r22 F1): pending, a non-refusal failure, 403 then a transient +// failure, 403 then a remount, recovery on success, and manual admissions +// surviving all of it. +// +// A declaration served only after the test releases it, so "pending" is a real +// state rather than a race. +function heldDeclaration() { + let release: (() => void) | undefined; + const gate = new Promise((resolve) => { + release = resolve; + }); + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post( + rpc("DatasourceService", "GetSourceTriggerDeclaration"), + async () => { + await gate; + return HttpResponse.json({ + declaration: declared, + delegations: [], + children: [], + }); + }, + ), + ); + return () => release?.(); +} + +describe("the declaration read's remaining states", () => { + it("claims nothing while the read is still in flight", async () => { + const release = heldDeclaration(); + renderInApp(); + await screen.findByText("acme/handbook"); + + // The row exists; its declaration does not yet. Neither an absent + // identity nor a sweep state may be asserted about a read in flight. + await waitFor(() => + expect( + document.querySelector('[data-slot="source-trigger"]'), + ).not.toBeNull(), + ); + expect( + screen.queryByText("None — occurrences would be refused"), + ).toBeNull(); + expect(document.querySelector('[data-slot="host-sweep"]')).toBeNull(); + + release(); + await screen.findByText("*/30 * * * *"); + }); + + // A failure that is NOT a refusal reads differently, because the two mean + // different things: unknown versus not allowed. + it("separates a failed read from a refused one", async () => { + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => + HttpResponse.json({ message: "boom" }, { status: 500 }), + ), + ); + renderInApp(); + await screen.findByText("acme/handbook"); + + await waitFor(() => + expect(screen.getByText(/Couldn.t load/i)).toBeTruthy(), + ); + expect(screen.queryByText(/don.t have permission/i)).toBeNull(); + expect( + screen.queryByText("None — occurrences would be refused"), + ).toBeNull(); + }); + + // A refusal, then a transient failure. The snapshot the refusal deleted must + // not come back: a transient failure retains what the cache HAS, and after a + // refusal it has nothing. + it("does not resurrect a refused snapshot through a later transient failure", async () => { + let phase: "ok" | "denied" | "down" = "ok"; + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => { + if (phase === "ok") { + return HttpResponse.json({ + declaration: declared, + delegations: [], + children: [], + }); + } + return phase === "denied" + ? HttpResponse.json({ code: "permission_denied" }, { status: 403 }) + : HttpResponse.json({ message: "boom" }, { status: 500 }); + }), + ); + const { client } = renderInApp(); + await screen.findByText("*/30 * * * *"); + + phase = "denied"; + await act(async () => { + await client.refetchQueries({ queryKey: ["source-trigger-declaration"] }); + }); + await waitFor(() => + expect(screen.getByText(/don.t have permission/i)).toBeTruthy(), + ); + + phase = "down"; + await act(async () => { + await client.refetchQueries({ queryKey: ["source-trigger-declaration"] }); + }); + expect(screen.queryByText("*/30 * * * *")).toBeNull(); + expect(document.querySelector('[data-slot="host-sweep"]')).toBeNull(); + }); + + // And not through a remount either: the snapshot is gone from the cache, so + // a component mounting into that same cache has nothing to show. + it("does not resurrect a refused snapshot through a remount", async () => { + let denied = false; + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => + denied + ? HttpResponse.json({ code: "permission_denied" }, { status: 403 }) + : HttpResponse.json({ + declaration: declared, + delegations: [], + children: [], + }), + ), + ); + const first = renderInApp(); + await screen.findByText("*/30 * * * *"); + + denied = true; + await act(async () => { + await first.client.refetchQueries({ + queryKey: ["source-trigger-declaration"], + }); + }); + await waitFor(() => + expect(screen.getByText(/don.t have permission/i)).toBeTruthy(), + ); + + cleanup(); + renderInApp(, first.client); + await screen.findByText("acme/handbook"); + expect(screen.queryByText("*/30 * * * *")).toBeNull(); + expect(document.querySelector('[data-slot="host-sweep"]')).toBeNull(); + }); + + // Recovery is exactly one thing: a read that succeeds. + it("recovers when a later read succeeds", async () => { + let denied = true; + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => + denied + ? HttpResponse.json({ code: "permission_denied" }, { status: 403 }) + : HttpResponse.json({ + declaration: declared, + delegations: [], + children: [], + }), + ), + ); + const { client } = renderInApp(); + await waitFor(() => + expect(screen.getByText(/don.t have permission/i)).toBeTruthy(), + ); + + denied = false; + await act(async () => { + await client.refetchQueries({ queryKey: ["source-trigger-declaration"] }); + }); + await screen.findByText("*/30 * * * *"); + await waitFor(() => + expect(document.querySelector('[data-slot="host-sweep"]')).not.toBeNull(), + ); + expect(screen.queryByText(/don.t have permission/i)).toBeNull(); + }); + + // A transient failure keeps the last good answer AND says it may be out of + // date. Blanking a good answer because one request did not come back is + // worse than the staleness. + it("keeps a transiently failed answer and labels it stale", async () => { + let down = false; + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => + down + ? HttpResponse.json({ message: "boom" }, { status: 500 }) + : HttpResponse.json({ + declaration: declared, + delegations: [], + children: [], + }), + ), + ); + const { client } = renderInApp(); + await screen.findByText("*/30 * * * *"); + + down = true; + await act(async () => { + await client.refetchQueries({ queryKey: ["source-trigger-declaration"] }); + }); + + expect(screen.getByText("*/30 * * * *")).toBeTruthy(); + await waitFor(() => + expect(screen.getByText(/may be out of date/i)).toBeTruthy(), + ); + }); + + // Through every one of those, the passes THIS BROWSER admitted stay: they + // come from the kit's notification, not from the declaration read, and a + // person's pass goes through no schedule at all. + it("keeps manual admissions through a refusal", async () => { + let denied = false; + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => + denied + ? HttpResponse.json({ code: "permission_denied" }, { status: 403 }) + : HttpResponse.json({ + declaration: declared, + delegations: [], + children: [], + }), + ), + ); + const { client } = renderInApp(); + await screen.findByText("*/30 * * * *"); + act(() => + notifySourceReconcileAdmitted({ + sourceId: SOURCE, + effectId: "effect-dddd", + jobId: "job-9", + status: "committed", + repeat: false, + at: "2026-10-12T09:20:00Z", + }), + ); + await screen.findByText("effect-dddd"); + + denied = true; + await act(async () => { + await client.refetchQueries({ queryKey: ["source-trigger-declaration"] }); + }); + await waitFor(() => + expect(screen.getByText(/don.t have permission/i)).toBeTruthy(), + ); + + expect(screen.getByText("effect-dddd")).toBeTruthy(); + expect(document.querySelectorAll('[data-slot="manual-pass"]')).toHaveLength( + 1, + ); + }); +}); + +// A REFUSAL DELETES ONE DECLARATION, NOT EVERY DECLARATION (issue #1121, the +// parent's scope finding on b3d01c3d3). +// +// `getQueryCache().findAll({ queryKey })` matches by PREFIX in TanStack Query, +// so clearing `["source-trigger-declaration"]` reached every org and every +// source. One source refusing its read then blanked a sibling source whose own +// read had SUCCEEDED — and the damage is invisible at the component, because +// that sibling's query status is still `success` with no error: the row has no +// refusal to report and falls through to "This source declares no trigger", +// which is a false statement about a source the viewer is allowed to see. +// +// The blast radius of a refusal is the key that was refused. These two probes +// pin that at both scopes a key carries: another source in the same +// organization, and the same source in another organization. +const SOURCE_B = "aaaaaaaa-0000-4000-8000-000000000002"; + +const twoSources = { + datasources: [ + sources.datasources[0], + { + id: SOURCE_B, + orgId: "org-1", + provider: "DATASOURCE_PROVIDER_GITHUB", + github: { repo: "acme/runbooks", branch: "main" }, + status: "DATASOURCE_STATUS_ACTIVE", + }, + ], +}; + +const declaredB = { + ...declared, + schedule: { ...declared.schedule, cron: "15 * * * *" }, + identity: { source: SOURCE_B }, + digest: "9e22", +}; + +describe("one refused declaration does not blank another", () => { + it("leaves an authorized source's declaration intact when a sibling source is refused", async () => { + let denyA = false; + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(twoSources), + ), + http.post( + rpc("DatasourceService", "GetSourceTriggerDeclaration"), + async ({ request }) => { + const body = (await request.json()) as { sourceId?: string }; + if (body.sourceId === SOURCE_B) { + return HttpResponse.json({ + declaration: declaredB, + delegations: [], + children: [], + }); + } + return denyA + ? HttpResponse.json({ code: "permission_denied" }, { status: 403 }) + : HttpResponse.json({ + declaration: declared, + delegations: [], + children: [], + }); + }, + ), + ); + const { client } = renderInApp(); + await screen.findByText("*/30 * * * *"); + await screen.findByText("15 * * * *"); + + denyA = true; + // ONLY A IS REFETCHED, which is the whole point: B's query is not + // re-run, so if A's refusal deleted B's snapshot nothing restores it. + // Refetching both would hide the defect, because B's own successful + // re-read would repopulate what A had just wiped. + await act(async () => { + await client.refetchQueries({ + queryKey: ["source-trigger-declaration", "org-1", SOURCE], + exact: true, + }); + }); + + // A is gone and says why. + await waitFor(() => + expect(screen.getByText(/don.t have permission/i)).toBeTruthy(), + ); + expect(screen.queryByText("*/30 * * * *")).toBeNull(); + // B is UNTOUCHED: its read succeeded, so its declaration, its sweep row + // and its cached answer all stand. The last assertion is the one that + // fails on the prefix clear — the component would otherwise claim B + // declares no trigger while its query sits in `success`. + expect(screen.getByText("15 * * * *")).toBeTruthy(); + expect( + client.getQueryData(["source-trigger-declaration", "org-1", SOURCE_B]), + ).toBeTruthy(); + expect(screen.queryByText("This source declares no trigger.")).toBeNull(); + }); + + it("leaves another organization's declaration of the same source intact", async () => { + const other = ["source-trigger-declaration", "org-2", SOURCE] as const; + let denied = false; + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => + denied + ? HttpResponse.json({ code: "permission_denied" }, { status: 403 }) + : HttpResponse.json({ + declaration: declared, + delegations: [], + children: [], + }), + ), + ); + const { client } = renderInApp(); + await screen.findByText("*/30 * * * *"); + + // A second organization's answer for the same source id, which no part + // of this refusal is about. + client.setQueryData(other, { + declaration: declaredB, + delegations: [], + children: [], + }); + + denied = true; + await act(async () => { + await client.refetchQueries({ + queryKey: ["source-trigger-declaration", "org-1", SOURCE], + }); + }); + await waitFor(() => + expect(screen.getByText(/don.t have permission/i)).toBeTruthy(), + ); + + expect(client.getQueryData(other)).toBeTruthy(); + }); +}); + +// A SUPERSEDED REFUSAL MUST NOT ERASE A NEWER SUCCESS (issue #1121). +// +// Two fetches overlap on one key. The older one is superseded — TanStack +// cancels it when the newer starts — but the request itself is already in +// flight and eventually rejects with 403. Its catch then ran and deleted the +// answer the NEWER fetch had just written, leaving the query in a state no +// component can read correctly: status `success`, fetchStatus `idle`, `data` +// undefined and `error` null. The row has no refusal to report and no +// declaration to show, so it says "This source declares no trigger" about a +// source whose latest read succeeded. +// +// The condition is the one the lifecycle already records: delete only if no +// newer success replaced what this fetch was reading. `dataUpdatedAt` is that +// fact, so the fix reads the field it already writes rather than adding a +// mechanism beside it. +describe("a superseded refusal", () => { + const KEY = ["source-trigger-declaration", "org-1", SOURCE] as const; + + function overlapping() { + let call = 0; + let release403: (() => void) | undefined; + const held = new Promise((resolve) => { + release403 = resolve; + }); + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(twoSources), + ), + http.post( + rpc("DatasourceService", "GetSourceTriggerDeclaration"), + async ({ request }) => { + const body = (await request.json()) as { sourceId?: string }; + if (body.sourceId !== SOURCE) { + return HttpResponse.json({ + declaration: declaredB, + delegations: [], + children: [], + }); + } + call++; + if (call === 1) { + return HttpResponse.json({ + declaration: declared, + delegations: [], + children: [], + }); + } + if (call === 2) { + // The OLD fetch: superseded, answers last, and answers 403. + await held; + return HttpResponse.json( + { code: "permission_denied" }, + { status: 403 }, + ); + } + // The NEWER fetch, which succeeds with a different answer. + return HttpResponse.json({ + declaration: { + ...declared, + schedule: { ...declared.schedule, cron: "45 * * * *" }, + }, + delegations: [], + children: [], + }); + }, + ), + ); + return () => release403?.(); + } + + it("does not erase the newer answer it was superseded by", async () => { + const release = overlapping(); + const { client } = renderInApp(); + await screen.findByText("*/30 * * * *"); + + // The old fetch starts and is left in flight. + const stale = client + .refetchQueries({ queryKey: KEY, exact: true }) + .catch(() => undefined); + // The newer fetch supersedes it and lands. + await act(async () => { + await client.refetchQueries({ queryKey: KEY, exact: true }); + }); + await screen.findByText("45 * * * *"); + + // Now the superseded request finally answers 403. + release(); + await act(async () => { + await stale; + }); + + const state = client.getQueryState([...KEY]); + expect(state?.status).toBe("success"); + // The newer answer is still there, and still on screen. + expect(client.getQueryData([...KEY])).toBeTruthy(); + expect(screen.getByText("45 * * * *")).toBeTruthy(); + expect(screen.queryByText("This source declares no trigger.")).toBeNull(); + }); + + // The deletion itself must survive the guard: a refusal with nothing newer + // behind it still clears, including when no component is mounted to see it. + it("still deletes a refusal that nothing newer replaced, with the view unmounted", async () => { + let denied = false; + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => + denied + ? HttpResponse.json({ code: "permission_denied" }, { status: 403 }) + : HttpResponse.json({ + declaration: declared, + delegations: [], + children: [], + }), + ), + ); + const { client } = renderInApp(); + await screen.findByText("*/30 * * * *"); + expect(client.getQueryData([...KEY])).toBeTruthy(); + + cleanup(); + denied = true; + await act(async () => { + await client + .refetchQueries({ queryKey: KEY, exact: true, type: "all" }) + .catch(() => undefined); + }); + + expect(client.getQueryData([...KEY])).toBeUndefined(); + }); +}); + +// THE GENERATION OF A SUCCESS IS NOT ITS CLOCK READING (issue #1121, r23). +// +// The first guard compared `dataUpdatedAt`, a MILLISECOND timestamp. Two +// successes in the same millisecond carry the same value, so "has a newer +// success replaced what I was reading?" answered no, and the superseded +// refusal deleted the newer answer after all — the very bug the guard was +// added for, surviving at sub-millisecond spacing, which is exactly the +// spacing an overlapping refetch has. +// +// `dataUpdateCount` is the lifecycle's own generation counter: it increments on +// every write and cannot tie. This test freezes the clock so both successes +// share a timestamp, which is what makes it a test of the FIELD CHOICE rather +// than of the comparison. +describe("a superseded refusal when both answers share a millisecond", () => { + const KEY = ["source-trigger-declaration", "org-1", SOURCE] as const; + + afterEach(() => vi.useRealTimers()); + + it("does not erase a newer success that landed in the same millisecond", async () => { + // Only Date is faked: timers, promises and MSW keep working, while + // every `Date.now()` TanStack takes returns one instant. + vi.useFakeTimers({ toFake: ["Date"] }); + vi.setSystemTime(new Date("2026-10-13T12:00:00.000Z")); + + let call = 0; + let release403: (() => void) | undefined; + const held = new Promise((resolve) => { + release403 = resolve; + }); + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post( + rpc("DatasourceService", "GetSourceTriggerDeclaration"), + async () => { + call++; + if (call === 1) { + return HttpResponse.json({ + declaration: declared, + delegations: [], + children: [], + }); + } + if (call === 2) { + await held; + return HttpResponse.json( + { code: "permission_denied" }, + { status: 403 }, + ); + } + return HttpResponse.json({ + declaration: { + ...declared, + schedule: { ...declared.schedule, cron: "45 * * * *" }, + }, + delegations: [], + children: [], + }); + }, + ), + ); + const { client } = renderInApp(); + await screen.findByText("*/30 * * * *"); + + const stale = client + .refetchQueries({ queryKey: KEY, exact: true }) + .catch(() => undefined); + await act(async () => { + await client.refetchQueries({ queryKey: KEY, exact: true }); + }); + + // The premise of the test, asserted rather than assumed: the newer + // success carries the SAME timestamp as the answer the old fetch was + // reading, and a later generation. + const after = client.getQueryState([...KEY]); + expect(after?.dataUpdatedAt).toBe( + new Date("2026-10-13T12:00:00.000Z").getTime(), + ); + expect(after?.dataUpdateCount).toBeGreaterThan(1); + + release403?.(); + await act(async () => { + await stale; + }); + + expect(client.getQueryData([...KEY])).toBeTruthy(); + expect(client.getQueryState([...KEY])?.status).toBe("success"); + }); +}); + +// THE TWO LIFECYCLE PATHS MY OWN SUITE HAD MISSED (issue #1121, r23's +// request-order note). Both were named by the reviewer against the generation +// guard, and both are about the guard NOT swallowing the deletion it sits +// beside. +// +// 1. An observer that unmounts WHILE the refusal is in flight. This is not the +// same path as refetching an already-inactive query: removing the last +// observer mid-fetch takes TanStack's `removeObserver` route, which may +// cancel and revert the in-flight fetch's state. A guard that compared the +// reverted generation wrongly would stop deleting exactly here — where no +// component is mounted to show anything, and the next mount would serve the +// refused answer from cache. +// +// 2. RETRY, which the real client has and this test harness does not: +// `src/lib/providers.tsx` sets `retry: 1`, `src/test/container.tsx` sets +// `retry: false`. So every refusal test in this file has been exercising a +// single attempt, and the retried shape — queryFn entered twice for one +// logical read, each attempt capturing its own generation — was untested. +describe("the deletion under the lifecycle paths the harness hides", () => { + const KEY = ["source-trigger-declaration", "org-1", SOURCE] as const; + + function retrying() { + return new QueryClient({ + defaultOptions: { queries: { retry: 1, retryDelay: 0 } }, + }); + } + + it("still deletes when the observer unmounts before the refusal arrives", async () => { + let denied = false; + let release403: (() => void) | undefined; + const held = new Promise((resolve) => { + release403 = resolve; + }); + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post( + rpc("DatasourceService", "GetSourceTriggerDeclaration"), + async () => { + if (!denied) { + return HttpResponse.json({ + declaration: declared, + delegations: [], + children: [], + }); + } + await held; + return HttpResponse.json( + { code: "permission_denied" }, + { status: 403 }, + ); + }, + ), + ); + const { client, unmount } = renderInApp( + , + ); + await screen.findByText("*/30 * * * *"); + + // The refusal starts while the view is mounted... + denied = true; + const refused = client + .refetchQueries({ queryKey: KEY, exact: true }) + .catch(() => undefined); + // ...and the view goes away before it answers. + unmount(); + release403?.(); + await act(async () => { + await refused; + }); + + expect(client.getQueryData([...KEY])).toBeUndefined(); + }); + + it("deletes a refused read that the client retried", async () => { + let attempts = 0; + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => { + attempts++; + return attempts === 1 + ? HttpResponse.json({ + declaration: declared, + delegations: [], + children: [], + }) + : HttpResponse.json({ code: "permission_denied" }, { status: 403 }); + }), + ); + const client = retrying(); + renderInApp(, client); + await screen.findByText("*/30 * * * *"); + + await act(async () => { + await client + .refetchQueries({ queryKey: KEY, exact: true }) + .catch(() => undefined); + }); + + // Two attempts for one logical read, and the snapshot is gone after + // them rather than restored by the second attempt's own capture. + expect(attempts).toBe(3); + expect(client.getQueryData([...KEY])).toBeUndefined(); + await waitFor(() => + expect(screen.getByText(/don.t have permission/i)).toBeTruthy(), + ); + }); + + // And the retry's happy path: a transient failure that succeeds on the + // retry must not lose the answer the retry just wrote. + it("keeps the answer a retry recovered after a transient failure", async () => { + let attempts = 0; + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => { + attempts++; + if (attempts === 1) { + return HttpResponse.json({ message: "boom" }, { status: 500 }); + } + return HttpResponse.json({ + declaration: declared, + delegations: [], + children: [], + }); + }), + ); + const client = retrying(); + renderInApp(, client); + + await screen.findByText("*/30 * * * *"); + expect(attempts).toBe(2); + expect(client.getQueryData([...KEY])).toBeTruthy(); + }); +}); + +// A PAUSED READ HAS NOT ANSWERED (issue #1121, the read-lifecycle review). +// +// Offline, TanStack parks a cold query at status `pending` with fetchStatus +// `paused` — and `isFetching` is FALSE, because that flag means "a request is +// on the wire". Every gate in this file was written against `isFetching`, so a +// paused read read as "finished, nothing came back" and the row stated "This +// source declares no trigger" about a source nobody had asked the host about +// yet. The source LIST beside it already had this right: +// `sources.isPending && sources.fetchStatus !== "idle"`, which separates a read +// still coming (fetching or paused) from a read that was never issued +// (disabled, idle). That is the model these rows now reuse. +describe("a declaration read paused by the browser being offline", () => { + afterEach(() => onlineManager.setOnline(true)); + + it("claims nothing while the read is paused, and recovers when online", async () => { + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => + HttpResponse.json({ + declaration: declared, + delegations: [], + children: [], + }), + ), + ); + // The list is already in the cache — the reported shape — so the panel + // renders its rows while the per-source read cannot leave the gate. + const client = new QueryClient({ + defaultOptions: { queries: { retry: false } }, + }); + client.setQueryData(["unattended-sources", "org-1"], sources.datasources); + onlineManager.setOnline(false); + + renderInApp(, client); + await screen.findByText("acme/handbook"); + + // The premise, asserted rather than assumed. + await waitFor(() => { + const state = client.getQueryState([ + "source-trigger-declaration", + "org-1", + SOURCE, + ]); + expect(state?.fetchStatus).toBe("paused"); + expect(state?.status).toBe("pending"); + }); + + expect(screen.queryByText("This source declares no trigger.")).toBeNull(); + expect( + screen.queryByText("None — occurrences would be refused"), + ).toBeNull(); + expect(document.querySelector('[data-slot="host-sweep"]')).toBeNull(); + + // Back online, the read runs and the row fills in. + onlineManager.setOnline(true); + await screen.findByText("*/30 * * * *"); + }); +}); + +// THE STATE MY OWN DELETION CREATES (issue #1121, r24's paused-retry case). +// +// Initial success, then a refetch whose first attempt is refused: the query +// function deletes the retained answer, correctly. The retry then PAUSES +// because the browser is offline, and the query sits in a shape no single flag +// describes — status `success` (it had data once), fetchStatus `paused`, data +// undefined, error null (the fetch has not finished failing). `isPending` is +// FALSE, so `isPending && fetchStatus !== "idle"` reads it as answered, and the +// row said "This source declares no trigger" again. +// +// What is true of every one of these states is simpler than the states: there +// is nothing in hand, nothing has failed yet, and a fetch is not idle. That is +// the predicate, and it lives in the read seam beside the other three. +describe("a refused refetch whose retry is paused offline", () => { + const KEY = ["source-trigger-declaration", "org-1", SOURCE] as const; + + afterEach(() => onlineManager.setOnline(true)); + + it("claims nothing in the state the deletion leaves behind, and recovers", async () => { + let call = 0; + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => { + call++; + if (call === 1) { + return HttpResponse.json({ + declaration: declared, + delegations: [], + children: [], + }); + } + if (call === 2) { + // The refusal lands and the browser drops offline with it, so + // the retry has to pause rather than race. + onlineManager.setOnline(false); + return HttpResponse.json( + { code: "permission_denied" }, + { status: 403 }, + ); + } + return HttpResponse.json({ + declaration: declared, + delegations: [], + children: [], + }); + }), + ); + const client = new QueryClient({ + defaultOptions: { queries: { retry: 1, retryDelay: 0 } }, + }); + renderInApp(, client); + await screen.findByText("*/30 * * * *"); + + // NOT awaited: a paused retry never settles, so awaiting the refetch + // here would hang rather than observe the state it produces. + const refetching = client + .refetchQueries({ queryKey: KEY, exact: true }) + .catch(() => undefined); + + // The premise, asserted exactly: this is the composite state, not a + // plain pending one. + await waitFor(() => { + const state = client.getQueryState([...KEY]); + expect(state?.status).toBe("success"); + expect(state?.fetchStatus).toBe("paused"); + expect(state?.data).toBeUndefined(); + expect(state?.error).toBeNull(); + }); + + expect(screen.queryByText("This source declares no trigger.")).toBeNull(); + expect( + screen.queryByText("None — occurrences would be refused"), + ).toBeNull(); + expect(screen.queryByText("*/30 * * * *")).toBeNull(); + + onlineManager.setOnline(true); + await act(async () => { + await refetching; + }); + await screen.findByText("*/30 * * * *"); + }); + + // r24 ALSO asks that an existing error survive a paused retry. In the + // installed TanStack it cannot, and the reason is worth recording where the + // next person will look: starting a refetch RESETS the query, so a refetch + // that then pauses leaves status `pending`, fetchStatus `paused`, data + // undefined and **error null** — the refusal is gone from the state, not + // hidden by a gate. Asserted below rather than described. + // + // So the row cannot keep showing a refusal it can no longer substantiate, + // and what matters is that it substitutes nothing: no "declares no + // trigger", no identity claim. The predicate's no-error clause stays as the + // guard for an error that IS in hand, which is unit-tested directly + // (`readHasNotAnswered` in shared/lib) because no app path reaches + // error-present with a non-idle fetch in this version. + it("claims nothing when an offline refetch resets a refusal to a paused read", async () => { + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => + HttpResponse.json({ code: "permission_denied" }, { status: 403 }), + ), + ); + const client = new QueryClient({ + defaultOptions: { queries: { retry: false } }, + }); + renderInApp(, client); + await waitFor(() => + expect(screen.getByText(/don.t have permission/i)).toBeTruthy(), + ); + + onlineManager.setOnline(false); + await act(async () => { + await client + .refetchQueries({ queryKey: KEY, exact: true }) + .catch(() => undefined); + }); + // What the library actually does with the refusal. + const state = client.getQueryState([...KEY]); + expect(state?.status).toBe("pending"); + expect(state?.fetchStatus).toBe("paused"); + expect(state?.error).toBeNull(); + + // And the row asserts nothing in its place. + await act(async () => { + await new Promise((resolve) => setTimeout(resolve, 60)); + }); + expect(screen.queryByText("This source declares no trigger.")).toBeNull(); + expect( + screen.queryByText("None — occurrences would be refused"), + ).toBeNull(); + expect(document.querySelector('[data-slot="host-sweep"]')).toBeNull(); + // The manual-pass table is always there: it comes from this browser, + // not from the read. + expect( + document.querySelector('[data-slot="source-trigger"]'), + ).not.toBeNull(); + }); +}); diff --git a/module/services/frontend/code/src/features/unattended-work/ui/source-trigger-schedules.tsx b/module/services/frontend/code/src/features/unattended-work/ui/source-trigger-schedules.tsx index 50cbe35ba..7587f7c47 100644 --- a/module/services/frontend/code/src/features/unattended-work/ui/source-trigger-schedules.tsx +++ b/module/services/frontend/code/src/features/unattended-work/ui/source-trigger-schedules.tsx @@ -10,6 +10,7 @@ import { useEffect, useMemo, useState } from "react"; import { EmptyState } from "@/components/empty-state"; import { mayKeepRetainedRows, + readHasNotAnswered, readOutcome, readOutcomeMessage, staleReadNotice, @@ -28,6 +29,7 @@ import { TableHead, TableHeader, TableRow, + useLoadingPhase, } from "@/shared/ui"; import { sourceLabel } from "../model/source-label"; import { @@ -50,11 +52,21 @@ import { * "next occurrence" that would never happen, which is the most misleading * thing a schedule panel can show. * - * "Next" is computed from the declared cron and is what the declaration SAYS. - * Once a composed module fires the trigger the authoritative cursor is that - * module's and this host will not hold one; while the stopgap runs, the cron - * and the stored instant it sweeps on are derived from the same interval, so - * the two agree without either reading the other. + * "Next occurrence" is computed from the declared cron and is what the + * declaration SAYS. Once a composed module fires the trigger the authoritative + * cursor is that module's and this host will not hold one. + * + * WHILE THE STOPGAP RUNS, THAT IS NOT WHEN THE PASS HAPPENS (issue #1121, N6). + * The two share a period and not a phase: the declared cron for a sub-hourly + * interval steps by the minute inside the hour, due on the quarter or half + * hour, while the sweep + * fires on the source's stored instant, which every pass moves to + * `now + interval` — an arbitrary offset inside the period. This panel used to + * claim the two agreed "without either reading the other", which was wrong in + * the most misleading direction available: a reader was shown 14:30 for a pass + * that would happen at 14:07. So both are shown, each labelled with who acts + * on it, and the host's own row disappears when an operator turns the stopgap + * off. * * A person's "Sync now" is listed in the SAME table as those occurrences, and * that is the panel's claim rather than a convenience: both admit @@ -86,12 +98,16 @@ export function SourceTriggerSchedules({ orgId }: { orgId: string }) { Reconcile schedules - Each connected source declares its reconcile schedule as a trigger an - executing module is meant to fire. Until a composed runtime consumes - that declaration, this host still fires the schedule itself, as a - stopgap. A person's “Sync now” admits the same - operation with an effect identity of its own, so it is listed beside - the occurrences rather than apart from them. + Each connected source declares its reconcile schedule as a trigger for + a module that executes declared work. Whether one consumes that + declaration is not something this host can confirm, so nothing below + claims it: what is shown is what this host declares, and what this + host itself does about it — the stopgap sweep, which fires on the + source's own stored instant rather than on the declared cron, so + those two rows are two different facts. A person's “Sync + now” admits the same operation with an effect identity of its + own, so it is listed beside the occurrences rather than apart from + them. @@ -152,7 +168,24 @@ function SourceTriggerRow({ passes: AdmittedReconcilePass[]; }) { const read = useSourceTriggerDeclaration(orgId, sourceId); + // THIS ROW'S OWN READ IS CLASSIFIED, not just its data (issue #1121). The + // source LIST is classified by the panel above; the per-source declaration + // was not, so a refused read, a read still in flight and a source whose + // trigger genuinely has no identity all rendered the same sentence — "None + // — occurrences would be refused", which is a statement about this source's + // authority that the host never made. A viewer denied the read was told the + // trigger has no identity rather than that they cannot see it. + const outcome = readOutcome(read.isError, read.error); const declaration = read.data?.declaration; + const stale = declaration ? staleReadNotice(outcome, "this trigger") : null; + // AN ANSWER IS STILL COMING, asked once in the read seam rather than + // re-derived here. `isPending && fetchStatus !== "idle"` was closer than + // `isFetching` and still missed the state a refused refetch leaves — status + // `success`, data deleted, retry paused — which is how this row said "no + // trigger is declared" a third time (issue #1121, r24). + const unanswered = readHasNotAnswered(read); + const phase = useLoadingPhase(unanswered); + const waiting = unanswered || phase.indicator || phase.quiet; const identity = useMemo(() => declaredIdentity(declaration), [declaration]); // The operation is read off the declaration so the manual rows name the // same string the scheduled ones do. A literal here would be this page's @@ -163,22 +196,50 @@ function SourceTriggerRow({ // A source that declares no trigger still takes a manual pass: the // declaration is refused for the interval it carries, not for the // operation, and a person's pass does not go through a schedule at all. So - // the undeclarable reason replaces the SCHEDULE's rows, never the table. + // the undeclarable reason replaces the SCHEDULE's rows, never the table — + // and neither does a read that did not answer, which is why the manual rows + // below sit outside every declaration branch. return (
{label} - {declaration?.undeclarableReason ? ( - Declares no trigger - ) : ( - {declaration?.schedule?.cron ?? "—"} - )} + {declaration ? ( + declaration.undeclarableReason ? ( + Declares no trigger + ) : ( + {declaration.schedule?.cron ?? "—"} + ) + ) : null}
-
- - - -
+ + {stale && ( +

+ {stale} +

+ )} + {/* + * The declaration's facts need a declaration. Without one the read + * either has not answered or was refused, and the message says + * which — never a dash, which would read as "this host has none". + */} + {declaration ? ( +
+ + + +
+ ) : waiting ? null : ( +

+ {readOutcomeMessage( + outcome, + "this source's declared trigger", + "This source declares no trigger.", + )} +

+ )} {declaration?.undeclarableReason && (

{declaration.undeclarableReason} @@ -194,7 +255,22 @@ function SourceTriggerRow({ - {!declaration?.undeclarableReason && ( + {/* + * THREE SEPARATE CONDITIONS, because they answer three + * questions and one flag answered them all wrongly + * (issue #1121, the final-amendment review). + * + * The declaration's own rows need a declaration that + * declares something. The host's sweep needs only a + * declaration to have ARRIVED — it sweeps a source whose + * interval no cron can express just the same. And neither + * may render before the read lands: `!declaration?.x` is + * true when `declaration` is undefined, so the old guard + * rendered the whole block over a read that had failed, + * reporting the sweep as "off" about a host nothing had + * been established for. + */} + {declaration && !declaration.undeclarableReason && ( <> @@ -210,7 +286,7 @@ function SourceTriggerRow({ - Scheduled · next occurrence + Declared · next occurrence {MINTED_BY_THE_FIRING_MODULE} @@ -222,6 +298,46 @@ function SourceTriggerRow({ )} + {/* + * What this host will actually do, for ANY source whose + * declaration has arrived — including one that declares no + * trigger, which the sweep reconciles on its stored instant + * every interval. Hiding it there told an operator this host + * does nothing for a source it refreshes on a timer. + * + * The instant is a different one from the declared + * occurrence above, on purpose: see the panel's note. + */} + {declaration && ( + + + {/* + * Three states, because the facts supplied are three + * (issue #1121). Enabled WITH an instant is a pass + * due. Enabled with none is a source the sweep will + * not reach — a parked source, whose stored instant + * the park path cleared — and "next pass —" read as a + * pass whose time was unknown. Disabled is neither. + */} + {!declaration.hostSweepEnabled + ? "This host’s stopgap sweep · off" + : declaration.hostSweepDueAt + ? "This host’s stopgap sweep · next pass" + : "This host’s stopgap sweep · on, nothing due for this source"} + + + {!declaration.hostSweepEnabled + ? SWEEP_OFF_FIRES_NOTHING_HERE + : declaration.hostSweepDueAt + ? NO_EFFECT_IDENTITY + : SWEEP_ON_NOTHING_DUE} + + + {instant(declaration.hostSweepDueAt)} + + — + + )} {passes.map((pass) => ( @@ -266,14 +382,39 @@ const RECONCILE_OPERATION = * minted by the module that fires the trigger, so this host never sees one and * has nothing to print. A dash would read as "it has none", which would make * the admission look unlike the manual pass beside it. - * - * The stopgap sweep is a third case and is deliberately claimed as neither: it - * enqueues under a key derived from the schedule instant and admits no - * operation at all, so it has no effect identity to show and appears here only - * as a "last occurrence" moving. */ const MINTED_BY_THE_FIRING_MODULE = "Minted by the firing module"; +/** + * The stopgap sweep is a third case and claims neither: it enqueues under a key + * derived from the schedule instant and admits no operation at all, so it has + * no effect identity, and its pass shows up in "last occurrence" rather than as + * an admission of its own. + */ +const NO_EFFECT_IDENTITY = "None — the sweep admits no operation"; + +/** + * What a switched-off sweep means, and the one thing it does not mean. + * + * It said "An executing module fires the declaration", which asserts that + * something else does — and nothing this host holds verifies that (issue + * #1121, F1). The switch says only that THIS host stopped sweeping, so a + * deployment that turned it off before a module consumed the declaration read + * as covered while nothing fired at all. The honest statement is the negative + * one plus the gap. + */ +/** + * The sweep is running and this source has no instant in it. Said rather than + * shown as a missing time: the stored instant is what the park and restore + * paths clear, so its absence is the source being off the schedule — a fact, + * not a gap in what the host answered. + */ +const SWEEP_ON_NOTHING_DUE = + "None — this source is not on the sweep's schedule"; + +const SWEEP_OFF_FIRES_NOTHING_HERE = + "This host does not fire it — whether an executing module does is unverified here"; + /** * One labelled fact. Exported because the playground renders the same * declaration facts in its own card, and two copies of this would be two @@ -326,20 +467,30 @@ function useAdmittedPasses(): AdmittedReconcilePass[] { * state an installing module refuses rather than running the work as itself, * so it is said plainly instead of being left blank. * - * The reference arm does NOT name which module's delegation it is (issue - * #1112, m5). The reference value is the source id, so every delegation on one - * source reads back the same and the host resolves whichever module holds an - * active one at mint. Naming one here would be this page's own guess: an - * operator whose executing module holds no delegation would read that a - * reference is bound to it when another module's is. The references table - * names each module, which is where that question is answerable. + * The arm's own value cannot say whose delegation it is — it is the source id, + * so every delegation on one source reads back the same — so the declaration + * reports the holder beside it and this names that module. + * + * IT DOES NOT CLAIM THE EXECUTOR HOLDS IT (issue #1121, F1). The host sets the + * arm for a self-addressed delegation, which is the one shape a source-id + * reference can serve, but nothing it holds declares WHICH module executes the + * release: those bindings are generic and a deployment may have several. So a + * source whose only self-addressed delegation belongs to module A reads as a + * candidate under A's name, and if the composed executor is B — holding none — + * B's mint is refused and this page must not have said otherwise. Saying "the + * executing module holds it" was that claim, and it is withdrawn. */ export function declaredIdentity(declaration?: { identity?: { source: string; binding: string }; + identityHolder?: string; }): string { const identity = declaration?.identity; - if (identity?.source) - return "A delegation reference — whichever module holds an active one"; + if (identity?.source) { + const holder = declaration?.identityHolder; + return holder + ? `A delegation reference held by ${holder} — whether it executes this release is unverified` + : "A delegation reference — its holder was not reported"; + } if (identity?.binding) return "An installation binding"; return "None — occurrences would be refused"; } diff --git a/module/services/frontend/code/src/features/unattended-work/ui/unattended-work-playground.container.test.tsx b/module/services/frontend/code/src/features/unattended-work/ui/unattended-work-playground.container.test.tsx index 82418429b..207281bc6 100644 --- a/module/services/frontend/code/src/features/unattended-work/ui/unattended-work-playground.container.test.tsx +++ b/module/services/frontend/code/src/features/unattended-work/ui/unattended-work-playground.container.test.tsx @@ -1,8 +1,16 @@ -import { cleanup, fireEvent, screen, waitFor } from "@testing-library/react"; +import { onlineManager, QueryClient } from "@tanstack/react-query"; +import { + act, + cleanup, + fireEvent, + screen, + waitFor, + within, +} from "@testing-library/react"; import { HttpResponse, http, type JsonBodyType } from "msw"; import { toast } from "sonner"; import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; -import Page from "@/app/admin/platform/unattended-work/page"; +import Page from "@/app/admin/unattended-work/page"; import type { OrgRole, PlatformRole } from "@/lib/auth-session"; import { renderInApp, rpc } from "@/test/container"; import { server } from "@/test/setup"; @@ -59,6 +67,10 @@ const declared = { inputJson: '{"org_id":"org-1","source_id":"' + SOURCE + '"}', }, identity: { source: SOURCE }, + // Whose delegation the reference resolves to. The arm cannot carry it (the + // value is the source id), and it is NOT a claim that this module executes + // the release — see declaredIdentity (issue #1121, F1). + identityHolder: "docstore", digest: "4f1c", nextOccurrenceAt: "2026-10-12T18:30:00Z", }; @@ -147,13 +159,16 @@ describe("UnattendedWorkPlayground", () => { // Which arm it names, said in words: a declaration that named neither // would have its occurrences refused, and the page says so rather than // leaving the field blank. - // It does not claim WHICH module's reference: the reference value is the - // source id, so the host resolves whichever module holds an active one. + // It names the HOLDER, which the arm's own value cannot carry, and + // refuses to claim that the holder is the module which executes this + // release — nothing the host holds declares that, so a source whose + // only self-addressed delegation belongs to another module would read + // as ready while the composed executor's mint was refused + // (issue #1121, F1). expect( - screen.getByText( - "A delegation reference — whichever module holds an active one", - ), + screen.getByText(/A delegation reference held by docstore/), ).toBeTruthy(); + expect(screen.getByText(/unverified/)).toBeTruthy(); // The reference an operator bound, with whose authority it carries and // exactly what it allows — never the module's own authority. @@ -245,3 +260,471 @@ describe("UnattendedWorkPlayground", () => { ).toBeTruthy(); }); }); + +// THE PLAYGROUND IS THE OTHER CONSUMER OF THE SHARED DECLARATION QUERY +// (issue #1121, r22 F1 closure). It already withheld retained rows on refusal, +// which is the half that was right; what it did not do is SAY so — the facts +// rendered as em dashes, which read as "this host declares nothing" to a viewer +// who is simply not allowed to see it. The fix to the shared query deletes the +// snapshot, so this card must now explain the state rather than dash it. +describe("the playground's declaration card when the read does not succeed", () => { + function serveDeclaration(handler: () => Response) { + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => + handler(), + ), + ); + } + + it("says a refused declaration was refused, rather than dashing its facts", async () => { + serveDeclaration(() => + HttpResponse.json({ code: "permission_denied" }, { status: 403 }), + ); + renderInApp(); + await screen.findByText("acme/handbook"); + + // Scoped to the DECLARATION card: the delegations card below it carries + // its own refusal message, so a page-wide match would pass without this + // card saying anything at all. + const card = await waitFor(() => { + const found = document.querySelector( + '[data-slot="declared-trigger"]', + ); + expect(found).not.toBeNull(); + return found as HTMLElement; + }); + await waitFor(() => + expect(within(card).getByText(/don.t have permission/i)).toBeTruthy(), + ); + // No invented facts: the release and operation are the host's answer, + // and it gave none. + expect(screen.queryByText("saas_datasource_reconcile")).toBeNull(); + }); + + it("recovers the declaration card when a later read succeeds", async () => { + let denied = true; + serveDeclaration(() => + denied + ? HttpResponse.json({ code: "permission_denied" }, { status: 403 }) + : HttpResponse.json({ + declaration: declared, + delegations: [reference], + children: [child], + }), + ); + const { client } = renderInApp(); + // Scoped to the declaration card: the delegations card carries the same + // sentence about its own read, so an unscoped match is ambiguous. + const card = await waitFor(() => { + const found = document.querySelector( + '[data-slot="declared-trigger"]', + ); + expect(found).not.toBeNull(); + return found as HTMLElement; + }); + await waitFor(() => + expect(within(card).getByText(/don.t have permission/i)).toBeTruthy(), + ); + + denied = false; + await act(async () => { + await client.refetchQueries({ queryKey: ["source-trigger-declaration"] }); + }); + + await screen.findByText("saas_datasource_reconcile"); + expect( + within( + document.querySelector('[data-slot="declared-trigger"]') as HTMLElement, + ).queryByText(/don.t have permission/i), + ).toBeNull(); + }); +}); + +// A READ IN FLIGHT CLAIMS NOTHING ABOUT THE IDENTITY EITHER (issue #1121). +// +// The card learned to say which state its read was in and still fell into the +// facts list while the read was in flight: the `

` rendered dashes, and the +// Identity row, computed from no declaration at all, said "None — occurrences +// would be refused". That is the same false statement about authority the +// schedule row was fixed for, surviving in the other consumer because the +// branch tested `!declaration && !read.isFetching` — true only once the read +// had finished, and so false for the whole of the pending window. +describe("the playground's declaration card while the read is in flight", () => { + it("claims no identity before the declaration arrives", async () => { + let release: (() => void) | undefined; + const gate = new Promise((resolve) => { + release = resolve; + }); + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post( + rpc("DatasourceService", "GetSourceTriggerDeclaration"), + async () => { + await gate; + return HttpResponse.json({ + declaration: declared, + delegations: [reference], + children: [], + }); + }, + ), + ); + renderInApp(); + + const card = await waitFor(() => { + const found = document.querySelector( + '[data-slot="declared-trigger"]', + ); + expect(found).not.toBeNull(); + return found as HTMLElement; + }); + // Nothing about the identity, and no facts spelled as dashes, while the + // host has not answered. + expect( + within(card).queryByText("None — occurrences would be refused"), + ).toBeNull(); + expect(within(card).queryByText("Identity")).toBeNull(); + + release?.(); + await screen.findByText("saas_datasource_reconcile"); + }); +}); + +// AND THE SAME PAUSED READ IN THE PLAYGROUND'S CARD (issue #1121, the +// read-lifecycle review). Offline, a cold query parks at status `pending` with +// fetchStatus `paused`, and `isFetching` is FALSE — so the card's gate read it +// as "finished, nothing came back" and said this source declares no trigger +// about a read that never left the gate. The source list beside it already +// distinguishes paused from disabled with `isPending && fetchStatus !== "idle"`. +describe("the playground's declaration card when the read is paused", () => { + afterEach(() => onlineManager.setOnline(true)); + + it("claims nothing while paused, and recovers when online", async () => { + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => + HttpResponse.json({ + declaration: declared, + delegations: [reference], + children: [], + }), + ), + ); + const client = new QueryClient({ + defaultOptions: { queries: { retry: false } }, + }); + client.setQueryData(["unattended-sources", "org-1"], sources.datasources); + onlineManager.setOnline(false); + + renderInApp(, client); + const card = await waitFor(() => { + const found = document.querySelector( + '[data-slot="declared-trigger"]', + ); + expect(found).not.toBeNull(); + return found as HTMLElement; + }); + await waitFor(() => { + const state = client.getQueryState([ + "source-trigger-declaration", + "org-1", + SOURCE, + ]); + expect(state?.fetchStatus).toBe("paused"); + }); + + expect( + within(card).queryByText("This source declares no trigger."), + ).toBeNull(); + expect( + within(card).queryByText("None — occurrences would be refused"), + ).toBeNull(); + + onlineManager.setOnline(true); + await screen.findByText("saas_datasource_reconcile"); + }); +}); + +// THE CHILDREN CARD AND THE ACTION'S EXPLANATION READ THE SAME RESPONSE +// (issue #1121, r24). Both asserted an absence straight off an array length, +// so a read that had not answered — cold refusal, held request, paused offline +// — produced "No child has been minted against this source's references" and a +// tooltip reading "No live reference: an occurrence would be refused". Neither +// is a fact the host had supplied; a true empty is only knowable after a +// successful read. +// +// The button's disabled state is deliberately NOT part of this fix: refusing to +// act on an unknown reference set is correct. What changes is what the operator +// is TOLD about why. +const CHILDREN_EMPTY = + "No child has been minted against this source's references."; +const NO_LIVE_REFERENCE = "No live reference: an occurrence would be refused"; + +describe("the children card and the occurrence button on a read that has not answered", () => { + afterEach(() => onlineManager.setOnline(true)); + + function held() { + let release: (() => void) | undefined; + const gate = new Promise((resolve) => { + release = resolve; + }); + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post( + rpc("DatasourceService", "GetSourceTriggerDeclaration"), + async () => { + await gate; + return HttpResponse.json({ + declaration: declared, + delegations: [reference], + children: [child], + }); + }, + ), + ); + return () => release?.(); + } + + function refuse() { + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => + HttpResponse.json({ code: "permission_denied" }, { status: 403 }), + ), + ); + } + + it("claims no absent child while the request is still held", async () => { + const release = held(); + renderInApp(); + await screen.findByText("acme/handbook"); + + expect(screen.queryByText(CHILDREN_EMPTY)).toBeNull(); + expect(screen.queryByTitle(NO_LIVE_REFERENCE)).toBeNull(); + + release(); + await screen.findByText("docstore"); + }); + + it("says a refused read was refused rather than reporting no children", async () => { + refuse(); + renderInApp(); + await screen.findByText("acme/handbook"); + + await waitFor(() => expect(screen.queryByText(CHILDREN_EMPTY)).toBeNull()); + expect(screen.queryByTitle(NO_LIVE_REFERENCE)).toBeNull(); + // The action stays refused — authorization is unchanged — and says why. + const run = screen.getByRole("button", { name: /Run one occurrence/ }); + expect(run.hasAttribute("disabled")).toBe(true); + expect(run.getAttribute("title")).toMatch(/permission/i); + }); + + it("claims no absent child while the read is paused offline", async () => { + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => + HttpResponse.json({ + declaration: declared, + delegations: [reference], + children: [child], + }), + ), + ); + const client = new QueryClient({ + defaultOptions: { queries: { retry: false } }, + }); + client.setQueryData(["unattended-sources", "org-1"], sources.datasources); + onlineManager.setOnline(false); + renderInApp(, client); + await screen.findByText("acme/handbook"); + + await waitFor(() => { + const state = client.getQueryState([ + "source-trigger-declaration", + "org-1", + SOURCE, + ]); + expect(state?.fetchStatus).toBe("paused"); + }); + expect(screen.queryByText(CHILDREN_EMPTY)).toBeNull(); + expect(screen.queryByTitle(NO_LIVE_REFERENCE)).toBeNull(); + + onlineManager.setOnline(true); + await screen.findByText("docstore"); + }); + + // A TRUE EMPTY IS STILL SAID — after a read that succeeded. Suppressing it + // everywhere would trade one false statement for a blank card. + it("reports no children once a successful read says so", async () => { + serve({ declaration: declared, delegations: [reference], children: [] }); + renderInApp(); + + expect(await screen.findByText(CHILDREN_EMPTY)).toBeTruthy(); + }); + + // And a transient failure keeps what the last good read said, under a + // notice, rather than reporting an absence it cannot see. + it("keeps the children a transient failure left behind", async () => { + let down = false; + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => + down + ? HttpResponse.json({ message: "boom" }, { status: 500 }) + : HttpResponse.json({ + declaration: declared, + delegations: [reference], + children: [child], + }), + ), + ); + const { client } = renderInApp(); + await screen.findByText("docstore"); + + down = true; + await act(async () => { + await client + .refetchQueries({ queryKey: ["source-trigger-declaration"] }) + .catch(() => undefined); + }); + + expect(screen.getByText("docstore")).toBeTruthy(); + expect(screen.queryByText(CHILDREN_EMPTY)).toBeNull(); + }); +}); + +// ALL THREE CARDS READ ONE RESPONSE, SO ALL THREE ARE CLASSIFIED THE SAME WAY +// (issue #1121, r24/r25). The references card was the third: it tested +// `outcome === "empty"`, and `empty` from the classifier means "nothing has +// failed", NOT "the read succeeded" — so a pending read said "No reference is +// bound to this source's triggers. An occurrence would be refused." +// +// And the paused-RETRY state reaches these cards too: initial success, a +// refetch refused (the query function deletes the answer), the retry paused +// offline. Status `success`, fetchStatus `paused`, data undefined, error null. +const REFERENCES_EMPTY = + "No reference is bound to this source's triggers. An occurrence would be refused."; + +describe("the cards on one response, in the states that are not an answer", () => { + afterEach(() => onlineManager.setOnline(true)); + + it("claims no absent reference while the read is still in flight", async () => { + let release: (() => void) | undefined; + const gate = new Promise((resolve) => { + release = resolve; + }); + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post( + rpc("DatasourceService", "GetSourceTriggerDeclaration"), + async () => { + await gate; + return HttpResponse.json({ + declaration: declared, + delegations: [reference], + children: [child], + }); + }, + ), + ); + renderInApp(); + await screen.findByText("acme/handbook"); + + expect(screen.queryByText(REFERENCES_EMPTY)).toBeNull(); + + release?.(); + await screen.findByText("saas_datasource_reconcile"); + }); + + // The true empty is still said once a successful read says so. + it("reports no reference once a successful read says so", async () => { + serve({ declaration: declared, delegations: [], children: [] }); + renderInApp(); + + expect(await screen.findByText(REFERENCES_EMPTY)).toBeTruthy(); + }); + + it("claims nothing in the state a refused refetch and a paused retry leave", async () => { + let call = 0; + server.use( + http.post(rpc("DatasourceService", "ListSources"), () => + HttpResponse.json(sources), + ), + http.post(rpc("DatasourceService", "GetSourceTriggerDeclaration"), () => { + call++; + if (call === 1) { + return HttpResponse.json({ + declaration: declared, + delegations: [reference], + children: [child], + }); + } + if (call === 2) { + onlineManager.setOnline(false); + return HttpResponse.json( + { code: "permission_denied" }, + { status: 403 }, + ); + } + return HttpResponse.json({ + declaration: declared, + delegations: [reference], + children: [child], + }); + }), + ); + const client = new QueryClient({ + defaultOptions: { queries: { retry: 1, retryDelay: 0 } }, + }); + renderInApp(, client); + await screen.findByText("saas_datasource_reconcile"); + + const refetching = client + .refetchQueries({ + queryKey: ["source-trigger-declaration", "org-1", SOURCE], + exact: true, + }) + .catch(() => undefined); + + await waitFor(() => { + const state = client.getQueryState([ + "source-trigger-declaration", + "org-1", + SOURCE, + ]); + expect(state?.status).toBe("success"); + expect(state?.fetchStatus).toBe("paused"); + expect(state?.data).toBeUndefined(); + expect(state?.error).toBeNull(); + }); + + // None of the three cards asserts an absence in this state. + expect(screen.queryByText(REFERENCES_EMPTY)).toBeNull(); + expect(screen.queryByText(CHILDREN_EMPTY)).toBeNull(); + expect(screen.queryByText("This source declares no trigger.")).toBeNull(); + expect(screen.queryByTitle(NO_LIVE_REFERENCE)).toBeNull(); + + onlineManager.setOnline(true); + await act(async () => { + await refetching; + }); + await screen.findByText("saas_datasource_reconcile"); + }); +}); diff --git a/module/services/frontend/code/src/features/unattended-work/ui/unattended-work-playground.tsx b/module/services/frontend/code/src/features/unattended-work/ui/unattended-work-playground.tsx index 86e603c11..5f8356329 100644 --- a/module/services/frontend/code/src/features/unattended-work/ui/unattended-work-playground.tsx +++ b/module/services/frontend/code/src/features/unattended-work/ui/unattended-work-playground.tsx @@ -8,6 +8,7 @@ import { OrgSelector } from "@/components/org-selector"; import { useAuth } from "@/lib/auth"; import { mayKeepRetainedRows, + readHasNotAnswered, readOutcome, readOutcomeMessage, staleReadNotice, @@ -32,6 +33,7 @@ import { TableHead, TableHeader, TableRow, + useLoadingPhase, } from "@/shared/ui"; import { sourceLabel } from "../model/source-label"; import { @@ -186,6 +188,21 @@ function TriggerIdentityPanel({ const outcome = readOutcome(read.isError, read.error); const withheld = !mayKeepRetainedRows(outcome); const declaration = withheld ? undefined : read.data?.declaration; + // Only meaningful when an answer survived: a refusal has nothing to be + // stale about, having just been deleted at the query boundary. + const declarationStale = declaration + ? staleReadNotice(outcome, "this trigger") + : null; + // ALL THREE CARDS BELOW READ THIS ONE RESPONSE, so they are classified + // once, here, from the read seam's own predicate. Every per-card flag I + // reached for was a near miss: `isFetching` is false while paused, and + // `isPending` is false in the state a refused refetch leaves behind — + // status `success`, the answer deleted, the retry paused (issue #1121, + // r24/r25). + const unanswered = readHasNotAnswered(read); + const declarationPhase = useLoadingPhase(unanswered); + const waiting = + unanswered || declarationPhase.indicator || declarationPhase.quiet; const references = withheld ? [] : (read.data?.delegations ?? []); const children = withheld ? [] : (read.data?.children ?? []); const live = references.filter((reference) => reference.active); @@ -201,49 +218,86 @@ function TriggerIdentityPanel({ host still runs the schedule itself as a stopgap. - - {declaration?.undeclarableReason ? ( + + {/* + * THE CARD SAYS WHICH STATE THE READ IS IN (issue #1121, r22 + * F1). It withheld refused rows already, which is right, and + * then rendered every fact as an em dash — which reads as + * "this host declares nothing" to a viewer who is simply not + * allowed to see it. A refusal and a failure are now said in + * the card they are about; a transient failure keeps the + * prior answer under a stale notice. + */} + + {declarationStale && ( +

+ {declarationStale} +

+ )} + {/* + * THE FACTS NEED A DECLARATION — the branch is on having + * one, never on the read having finished. Testing + * `!declaration && !read.isFetching` meant the pending + * window fell through to the facts list, which rendered + * dashes and an Identity row computed from no declaration + * at all: "None — occurrences would be refused", the exact + * false claim about authority the schedule row was fixed + * for (issue #1121). + */} + {declaration ? null : waiting ? null : ( +

+ {readOutcomeMessage( + outcome, + "this source's declared trigger", + "This source declares no trigger.", + )} +

+ )} + {!declaration ? null : declaration.undeclarableReason ? (

{declaration.undeclarableReason}

) : (
- +
@@ -281,15 +335,33 @@ function TriggerIdentityPanel({ + {/* + * `outcome === "empty"` means nothing has FAILED, not that the + * read succeeded — so a read still in flight produced "No + * reference is bound … an occurrence would be refused", which + * is both an absence and a prediction, neither of them the + * host's (issue #1121, r25). The sentence now waits for the + * read that licenses it, exactly as the children card does. + */} + {references.length === 0 ? ( -

- {outcome === "empty" - ? "No reference is bound to this source's triggers. An occurrence would be refused." - : readOutcomeMessage(outcome, "this source's delegations", "")} -

+ unanswered ? null : ( +

+ {read.isSuccess + ? "No reference is bound to this source's triggers. An occurrence would be refused." + : readOutcomeMessage( + outcome, + "this source's delegations", + "", + )} +

+ ) ) : ( @@ -377,10 +449,24 @@ function TriggerIdentityPanel({ onError: (error) => toast.error(String(error)), }) } + // The DISABLED state is unchanged: refusing to act on a + // reference set this page cannot see is correct, and this + // change is not about what the button does. What changes is + // what the operator is TOLD — "No live reference" is a claim + // about the host's answer, and a read that has not answered + // has made none (issue #1121, r24). disabled={reconcile.isPending || live.length === 0} title={ live.length === 0 - ? "No live reference: an occurrence would be refused" + ? unanswered + ? "Still reading this source’s references" + : !read.isSuccess + ? readOutcomeMessage( + outcome, + "this source’s references", + "No live reference: an occurrence would be refused", + ) + : "No live reference: an occurrence would be refused" : undefined } > @@ -389,14 +475,23 @@ function TriggerIdentityPanel({ - {children.length === 0 ? ( -

- No child has been minted against this source's references. -

- ) : ( + {/* + * A TRUE EMPTY IS ONLY KNOWABLE AFTER A SUCCESSFUL READ. This + * card reads the same response as the declaration above it, and + * reported "no child has been minted" off an array length — so a + * held request, a paused read and a refusal all produced a + * statement about this source's children that the host had never + * made (issue #1121, r24). The empty sentence now waits for the + * read that licenses it; everything else says which state it is + * in. A transient failure keeps the rows, because those children + * were really minted and one request not coming back does not + * unmint them. + */} + + {children.length > 0 ? (
@@ -427,6 +522,24 @@ function TriggerIdentityPanel({ ))}
+ ) : unanswered ? null : read.isSuccess ? ( +

+ No child has been minted against this source's references. +

+ ) : ( +

+ {readOutcomeMessage( + outcome, + "the children this source minted", + "No child has been minted against this source’s references.", + )} +

)} diff --git a/module/services/frontend/code/src/gen/saas/accounts/v1/datasource_pb.ts b/module/services/frontend/code/src/gen/saas/accounts/v1/datasource_pb.ts index 3675f0313..e4f93e5df 100644 --- a/module/services/frontend/code/src/gen/saas/accounts/v1/datasource_pb.ts +++ b/module/services/frontend/code/src/gen/saas/accounts/v1/datasource_pb.ts @@ -18,7 +18,7 @@ import type { JsonObject, Message } from "@bufbuild/protobuf"; * Describes the file saas/accounts/v1/datasource.proto. */ export const file_saas_accounts_v1_datasource: GenFile = /*@__PURE__*/ - fileDesc("CiFzYWFzL2FjY291bnRzL3YxL2RhdGFzb3VyY2UucHJvdG8SEHNhYXMuYWNjb3VudHMudjEiXgoWR2l0SHViRGF0YXNvdXJjZUNvbmZpZxIMCgRyZXBvGAEgASgJEg0KBXBhdGhzGAIgAygJEg4KBmJyYW5jaBgDIAEoCRIXCg9maWxlX2V4dGVuc2lvbnMYBCADKAki9AEKD0FwaU9BdXRoMkNvbmZpZxI2CgVncmFudBgEIAEoDjInLnNhYXMuYWNjb3VudHMudjEuQXBpT0F1dGgyQ29uZmlnLkdyYW50EhEKCXRva2VuX3VybBgBIAEoCRIRCgljbGllbnRfaWQYAiABKAkSDgoGc2NvcGVzGAMgAygJInMKBUdyYW50EhUKEUdSQU5UX1VOU1BFQ0lGSUVEEAASFwoTR1JBTlRfUkVGUkVTSF9UT0tFThABEhwKGEdSQU5UX0NMSUVOVF9DUkVERU5USUFMUxACEhwKGEdSQU5UX0FVVEhPUklaQVRJT05fQ09ERRADIuoBChNBcGlEYXRhc291cmNlQ29uZmlnEhAKCGJhc2VfdXJsGAEgASgJEhUKDXJlc291cmNlX3BhdGgYAiABKAkSPAoPY3JlZGVudGlhbF9raW5kGAMgASgOMiMuc2Fhcy5hY2NvdW50cy52MS5BcGlDcmVkZW50aWFsS2luZBIZChFjcmVkZW50aWFsX2hlYWRlchgEIAEoCRIeChZjcmVkZW50aWFsX3F1ZXJ5X3BhcmFtGAUgASgJEjEKBm9hdXRoMhgGIAEoCzIhLnNhYXMuYWNjb3VudHMudjEuQXBpT0F1dGgyQ29uZmlnIkEKF0NyYXdsZXJEYXRhc291cmNlQ29uZmlnEhMKC3NpdGVtYXBfdXJsGAEgASgJEhEKCW1heF9wYWdlcxgCIAEoDSKGAQoWVXBsb2FkRGF0YXNvdXJjZUNvbmZpZxIQCghlbmRwb2ludBgBIAEoCRIOCgZyZWdpb24YAiABKAkSDgoGYnVja2V0GAMgASgJEg4KBnByZWZpeBgEIAEoCRIVCg1hY2Nlc3Nfa2V5X2lkGAUgASgJEhMKC21heF9vYmplY3RzGAYgASgNIoMHCgpEYXRhc291cmNlEgoKAmlkGAEgASgJEg4KBm9yZ19pZBgCIAEoCRI2Cghwcm92aWRlchgDIAEoDjIkLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVByb3ZpZGVyEjgKBmdpdGh1YhgFIAEoCzIoLnNhYXMuYWNjb3VudHMudjEuR2l0SHViRGF0YXNvdXJjZUNvbmZpZxIyCgZzdGF0dXMYBiABKA4yIi5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VTdGF0dXMSGgoSd2ViaG9va19jb25maWd1cmVkGAcgASgIEi4KCmNyZWF0ZWRfYXQYCCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCnVwZGF0ZWRfYXQYCSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjIKDmxhc3Rfc3luY2VkX2F0GAogASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIyCgNhcGkYCyABKAsyJS5zYWFzLmFjY291bnRzLnYxLkFwaURhdGFzb3VyY2VDb25maWcSOgoHY3Jhd2xlchgMIAEoCzIpLnNhYXMuYWNjb3VudHMudjEuQ3Jhd2xlckRhdGFzb3VyY2VDb25maWcSOAoGdXBsb2FkGA0gASgLMiguc2Fhcy5hY2NvdW50cy52MS5VcGxvYWREYXRhc291cmNlQ29uZmlnEhgKEGJvdW5kYXJ5X25vZGVfaWQYDiABKAkSNAoQbGFzdF9pbmdlc3RlZF9hdBgPIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASHAoUbGFzdF9pbmdlc3RlZF9jb21taXQYECABKAkSFQoNc3RhdHVzX3JlYXNvbhgRIAEoCRIWCg5ib3VuZGFyeV9sYWJlbBgSIAEoCRISCgpjb25mb3JtYW50GBMgASgIEhcKD2NvbmZvcm1hbmNlX2dhcBgUIAEoCRI/Cg1saXZlX2RlbGl2ZXJ5GBUgASgOMiguc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlTGl2ZURlbGl2ZXJ5EjUKEnJlY29uY2lsZV9pbnRlcnZhbBgWIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkoECAQQBVIRdGFyZ2V0X2NvbGxlY3Rpb24isgMKFkFkZEdpdEh1YlNvdXJjZVJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARI7CgRyZXBvGAIgASgJQi26SCpyKBADGP8BMiFeW0EtWmEtejAtOV8uLV0rL1tBLVphLXowLTlfLi1dKyQSIAoFcGF0aHMYAyADKAlCEbpIDpIBCxBAIgdyBRABGIAEEhgKBmJyYW5jaBgEIAEoCUIIukgFcgMY/wESJAoQYm91bmRhcnlfbm9kZV9pZBgIIAEoCUIIukgFcgOwAQFIABImChBjb2xsZWN0aW9uX2xhYmVsGAkgASgJQgq6SAdyBRABGP8BSAASHgoMYWNjZXNzX3Rva2VuGAYgASgJQgi6SAVyAxiACBIgCg53ZWJob29rX3NlY3JldBgHIAEoCUIIukgFcgMYgAgSSQoPZmlsZV9leHRlbnNpb25zGAogAygJQjC6SC2SASoQICImciQQAhghMh5eXC5bQS1aYS16MC05XVtBLVphLXowLTkuXy1dKiRCEQoIYm91bmRhcnkSBbpIAggBSgQIBRAGUhF0YXJnZXRfY29sbGVjdGlvbiJLChdBZGRHaXRIdWJTb3VyY2VSZXNwb25zZRIwCgpkYXRhc291cmNlGAEgASgLMhwuc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlIsgEChBBZGRTb3VyY2VSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESQgoIcHJvdmlkZXIYAiABKA4yJC5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VQcm92aWRlckIKukgHggEEEAEgABI6CgZnaXRodWIYBCABKAsyKC5zYWFzLmFjY291bnRzLnYxLkdpdEh1YkRhdGFzb3VyY2VDb25maWdIABI0CgNhcGkYBSABKAsyJS5zYWFzLmFjY291bnRzLnYxLkFwaURhdGFzb3VyY2VDb25maWdIABI8CgdjcmF3bGVyGAggASgLMikuc2Fhcy5hY2NvdW50cy52MS5DcmF3bGVyRGF0YXNvdXJjZUNvbmZpZ0gAEjoKBnVwbG9hZBgJIAEoCzIoLnNhYXMuYWNjb3VudHMudjEuVXBsb2FkRGF0YXNvdXJjZUNvbmZpZ0gAEiQKEGJvdW5kYXJ5X25vZGVfaWQYDCABKAlCCLpIBXIDsAEBSAESJgoQY29sbGVjdGlvbl9sYWJlbBgNIAEoCUIKukgHcgUQARj/AUgBEhwKCmNyZWRlbnRpYWwYBiABKAlCCLpIBXIDGIAgEiAKDndlYmhvb2tfc2VjcmV0GAcgASgJQgi6SAVyAxiACBImChRvYXV0aDJfY2xpZW50X3NlY3JldBgKIAEoCUIIukgFcgMYgAhCCAoGY29uZmlnQhEKCGJvdW5kYXJ5EgW6SAIIAUoECAMQBFIRdGFyZ2V0X2NvbGxlY3Rpb24iRQoRQWRkU291cmNlUmVzcG9uc2USMAoKZGF0YXNvdXJjZRgBIAEoCzIcLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZSJaChVEYXRhc291cmNlQ29uZmlnRmllbGQSCwoDa2V5GAEgASgJEhQKDGRpc3BsYXlfbmFtZRgCIAEoCRIMCgRoZWxwGAMgASgJEhAKCHJlcXVpcmVkGAQgASgIIsQBChlEYXRhc291cmNlQ29ubmVjdG9yQnVkZ2V0EhoKEm1heF9pdGVtc19wZXJfY2FsbBgBIAEoDRIaChJtYXhfYnl0ZXNfcGVyX2NhbGwYAiABKAMSFgoObWF4X2l0ZW1fYnl0ZXMYAyABKAMSHQoVb3BlcmF0aW9uc19wZXJfd2luZG93GAQgASgNEhYKDndpbmRvd19zZWNvbmRzGAUgASgDEiAKGGJhY2tncm91bmRfc2hhcmVfcGVyY2VudBgGIAEoDSKqBgocRGF0YXNvdXJjZVByb3ZpZGVyRGVzY3JpcHRvchI2Cghwcm92aWRlchgBIAEoDjIkLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVByb3ZpZGVyEhQKDGRpc3BsYXlfbmFtZRgCIAEoCRITCgtkZXNjcmlwdGlvbhgDIAEoCRI+Cg1jb25maWdfZmllbGRzGAQgAygLMicuc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlQ29uZmlnRmllbGQSGAoQc3VwcG9ydHNfd2ViaG9vaxgFIAEoCBJHChpzdXBwb3J0ZWRfY3JlZGVudGlhbF9raW5kcxgGIAMoDjIjLnNhYXMuYWNjb3VudHMudjEuQXBpQ3JlZGVudGlhbEtpbmQSEQoJY29ubmVjdG9yGAcgASgJEkEKCWludGVyZmFjZRgIIAEoDjIuLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZUNvbm5lY3RvckludGVyZmFjZRJEChBjcmVkZW50aWFsX21vZGVzGAkgAygOMiouc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlQ3JlZGVudGlhbE1vZGUSPwoNcmVhZGVyc19tb2RlbBgKIAEoDjIoLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVJlYWRlcnNNb2RlbBI7CgZidWRnZXQYCyABKAsyKy5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VDb25uZWN0b3JCdWRnZXQSEgoKY29uZm9ybWFudBgMIAEoCBIXCg9jb25mb3JtYW5jZV9nYXAYDSABKAkSGwoTYWNjZXB0c19uZXdfc291cmNlcxgOIAEoCBIgChhsaXZlX2RlbGl2ZXJ5X2NvbmZpZ3VyZWQYDyABKAgSGgoSYWNjZXB0c19vcGVyYXRpb25zGBAgASgIEhYKDm9wZXJhdGlvbnNfZ2FwGBEgASgJEhsKE29hdXRoX2F1dGhvcml6ZV91cmwYEiABKAkSFwoPb2F1dGhfdG9rZW5fdXJsGBMgASgJEhQKDG9hdXRoX3Njb3BlcxgUIAMoCSIdChtHZXREYXRhc291cmNlQ2F0YWxvZ1JlcXVlc3QiYQocR2V0RGF0YXNvdXJjZUNhdGFsb2dSZXNwb25zZRJBCglwcm92aWRlcnMYASADKAsyLi5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VQcm92aWRlckRlc2NyaXB0b3IiLgoSTGlzdFNvdXJjZXNSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQEiSAoTTGlzdFNvdXJjZXNSZXNwb25zZRIxCgtkYXRhc291cmNlcxgBIAMoCzIcLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZSJCChBHZXRTb3VyY2VSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESFAoCaWQYAiABKAlCCLpIBXIDsAEBIkUKEUdldFNvdXJjZVJlc3BvbnNlEjAKCmRhdGFzb3VyY2UYASABKAsyHC5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2UidgoRU3luY1NvdXJjZVJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIUCgJpZBgCIAEoCUIIukgFcgOwAQESHgoMYWNjZXNzX3Rva2VuGAMgASgJQgi6SAVyAxiAIBIRCglyZWNvbm5lY3QYBCABKAgiJAoSU3luY1NvdXJjZVJlc3BvbnNlEg4KBmpvYl9pZBgBIAEoCSJqChRHZXRTb3VyY2VTeW5jUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhsKCXNvdXJjZV9pZBgCIAEoCUIIukgFcgOwAQESGwoGam9iX2lkGAMgASgJQgu6SAjYAQFyA7ABASKVAQoSU291cmNlU3luY0RlbGl2ZXJ5EhgKBmpvYl9pZBgBIAEoCUIIukgFcgOwAQESLQoFc3RhdGUYAiABKA4yFi5zYWFzLmpvYnMudjEuSm9iU3RhdGVCBrpIA8gBARI2CglleGVjdXRpb24YAyABKAsyIy5zYWFzLmpvYnMudjEuSm9iRXhlY3V0aW9uUmVmZXJlbmNlIosBChFTb3VyY2VTeW5jQ2hhbmdlcxINCgVmaWxlcxgBIAEoDRINCgVhZGRlZBgCIAEoDRIQCghtb2RpZmllZBgDIAEoDRIPCgdkZWxldGVkGAQgASgNEhMKC3NwbGl0X2tub3duGAUgASgIEhAKCHNuYXBzaG90GAYgASgIEg4KBmNvbW1pdBgHIAEoCSKtAQoRU291cmNlU3luY0ZhaWx1cmUSOQoGcmVhc29uGAEgASgOMikuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VTeW5jRmFpbHVyZVJlYXNvbhIMCgRjb2RlGAIgASgJEg8KB21lc3NhZ2UYAyABKAkSEAoIcmV0cnlpbmcYBCABKAgSLAoIcmV0cnlfYXQYBSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIoQEChJTb3VyY2VTeW5jUHJvZ3Jlc3MSMAoFcGhhc2UYASABKA4yIS5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVN5bmNQaGFzZRI0Cgd0cmlnZ2VyGAIgASgOMiMuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VTeW5jVHJpZ2dlchItCglxdWV1ZWRfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi8KC2ZldGNoaW5nX2F0GAQgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIvCgtjb21waWxlZF9hdBgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASMQoNaGFuZGVkX29mZl9hdBgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLwoLZmluaXNoZWRfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjQKB2NoYW5nZXMYCCABKAsyIy5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVN5bmNDaGFuZ2VzEjQKB2ZhaWx1cmUYCSABKAsyIy5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVN5bmNGYWlsdXJlEg8KB2F0dGVtcHQYCiABKA0SFAoMbWF4X2F0dGVtcHRzGAsgASgNItIBChVHZXRTb3VyY2VTeW5jUmVzcG9uc2USGAoGam9iX2lkGAEgASgJQgi6SAVyA7ABARItCgVzdGF0ZRgCIAEoDjIWLnNhYXMuam9icy52MS5Kb2JTdGF0ZUIGukgDyAEBEjgKCmRlbGl2ZXJpZXMYAyADKAsyJC5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVN5bmNEZWxpdmVyeRI2Cghwcm9ncmVzcxgEIAEoCzIkLnNhYXMuYWNjb3VudHMudjEuU291cmNlU3luY1Byb2dyZXNzIkUKE0RlbGV0ZVNvdXJjZVJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIUCgJpZBgCIAEoCUIIukgFcgOwAQEiFgoURGVsZXRlU291cmNlUmVzcG9uc2UiVgoTR2l0SHViQXBwUmVwb3NpdG9yeRIMCgRyZXBvGAEgASgJEhYKDmRlZmF1bHRfYnJhbmNoGAIgASgJEhkKEWFscmVhZHlfY29ubmVjdGVkGAMgASgIIjYKGkJlZ2luR2l0SHViQXBwU2V0dXBSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQEicQobQmVnaW5HaXRIdWJBcHBTZXR1cFJlc3BvbnNlEhMKC2luc3RhbGxfdXJsGAEgASgJEg0KBXN0YXRlGAIgASgJEi4KCmV4cGlyZXNfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIpwBCh1Db21wbGV0ZUdpdEh1YkFwcFNldHVwUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhkKBXN0YXRlGAIgASgJQgq6SAdyBRABGP8BEiwKD2luc3RhbGxhdGlvbl9pZBgDIAEoCUITukgQcg4QARggMgheWzAtOV0rJBIYCgRjb2RlGAQgASgJQgq6SAdyBRABGP8BInYKHkNvbXBsZXRlR2l0SHViQXBwU2V0dXBSZXNwb25zZRIXCg9pbnN0YWxsYXRpb25faWQYASABKAkSOwoMcmVwb3NpdG9yaWVzGAIgAygLMiUuc2Fhcy5hY2NvdW50cy52MS5HaXRIdWJBcHBSZXBvc2l0b3J5IlEKH01pZ3JhdGVHaXRIdWJTb3VyY2VUb0FwcFJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIUCgJpZBgCIAEoCUIIukgFcgOwAQEiVAogTWlncmF0ZUdpdEh1YlNvdXJjZVRvQXBwUmVzcG9uc2USMAoKZGF0YXNvdXJjZRgBIAEoCzIcLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZSLEAQoVRGF0YXNvdXJjZUFjY291bnRMaW5rEgoKAmlkGAEgASgJEg4KBm9yZ19pZBgCIAEoCRIPCgd1c2VyX2lkGAMgASgJEhEKCWNvbm5lY3RvchgEIAEoCRIbChNwcm92aWRlcl9hY2NvdW50X2lkGAUgASgJEh4KFnByb3ZpZGVyX2FjY291bnRfbG9naW4YBiABKAkSLgoKY3JlYXRlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAitwEKFkRhdGFzb3VyY2VHcm91cEJpbmRpbmcSCgoCaWQYASABKAkSDgoGb3JnX2lkGAIgASgJEhEKCWNvbm5lY3RvchgDIAEoCRIZChFwcm92aWRlcl9ncm91cF9pZBgEIAEoCRIPCgd0ZWFtX2lkGAUgASgJEhIKCmNyZWF0ZWRfYnkYBiABKAkSLgoKY3JlYXRlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAilAIKGERhdGFzb3VyY2VWZXJpZmllZERvbWFpbhIKCgJpZBgBIAEoCRIOCgZvcmdfaWQYAiABKAkSDgoGZG9tYWluGAMgASgJEjgKBnN0YXR1cxgEIAEoDjIoLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZURvbWFpblN0YXR1cxIXCg90eHRfcmVjb3JkX25hbWUYBSABKAkSGAoQdHh0X3JlY29yZF92YWx1ZRgGIAEoCRIvCgt2ZXJpZmllZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLgoKY3JlYXRlZF9hdBgIIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiMwoXRGF0YXNvdXJjZURpcmVjdG9yeVRlYW0SCgoCaWQYASABKAkSDAoEbmFtZRgCIAEoCSKmAQohQmVnaW5EYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESNAoJY29ubmVjdG9yGAIgASgJQiG6SB5yHBACGCAyFl5bYS16XVthLXowLTktXXsxLDMxfSQSHgoMcmVkaXJlY3RfdXJpGAMgASgJQgi6SAVyAxiAEBIRCglzb3VyY2VfaWQYBCABKAkiegoiQmVnaW5EYXRhc291cmNlQWNjb3VudExpbmtSZXNwb25zZRIVCg1hdXRob3JpemVfdXJsGAEgASgJEg0KBXN0YXRlGAIgASgJEi4KCmV4cGlyZXNfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wInUKJENvbXBsZXRlRGF0YXNvdXJjZUFjY291bnRMaW5rUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhkKBXN0YXRlGAIgASgJQgq6SAdyBRABGIBAEhgKBGNvZGUYAyABKAlCCrpIB3IFEAEY/wEiXgolQ29tcGxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXNwb25zZRI1CgRsaW5rGAEgASgLMicuc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlQWNjb3VudExpbmsiPwojTGlzdE15RGF0YXNvdXJjZUFjY291bnRMaW5rc1JlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABASJeCiRMaXN0TXlEYXRhc291cmNlQWNjb3VudExpbmtzUmVzcG9uc2USNgoFbGlua3MYASADKAsyJy5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VBY2NvdW50TGluayJUCiJEZWxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESFAoCaWQYAiABKAlCCLpIBXIDsAEBIiUKI0RlbGV0ZURhdGFzb3VyY2VBY2NvdW50TGlua1Jlc3BvbnNlIjkKHUdldERhdGFzb3VyY2VEaXJlY3RvcnlSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQEiiwIKHkdldERhdGFzb3VyY2VEaXJlY3RvcnlSZXNwb25zZRI2CgVsaW5rcxgBIAMoCzInLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZUFjY291bnRMaW5rEjoKCGJpbmRpbmdzGAIgAygLMiguc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlR3JvdXBCaW5kaW5nEjsKB2RvbWFpbnMYAyADKAsyKi5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VWZXJpZmllZERvbWFpbhI4CgV0ZWFtcxgEIAMoCzIpLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZURpcmVjdG9yeVRlYW0irgEKGkJpbmREYXRhc291cmNlR3JvdXBSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESNAoJY29ubmVjdG9yGAIgASgJQiG6SB5yHBACGCAyFl5bYS16XVthLXowLTktXXsxLDMxfSQSJQoRcHJvdmlkZXJfZ3JvdXBfaWQYAyABKAlCCrpIB3IFEAEY/wESGQoHdGVhbV9pZBgEIAEoCUIIukgFcgOwAQEiWAobQmluZERhdGFzb3VyY2VHcm91cFJlc3BvbnNlEjkKB2JpbmRpbmcYASABKAsyKC5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VHcm91cEJpbmRpbmciTgocVW5iaW5kRGF0YXNvdXJjZUdyb3VwUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhQKAmlkGAIgASgJQgi6SAVyA7ABASIfCh1VbmJpbmREYXRhc291cmNlR3JvdXBSZXNwb25zZSJUChxDbGFpbURhdGFzb3VyY2VEb21haW5SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESGgoGZG9tYWluGAIgASgJQgq6SAdyBRADGP0BIlsKHUNsYWltRGF0YXNvdXJjZURvbWFpblJlc3BvbnNlEjoKBmRvbWFpbhgBIAEoCzIqLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVZlcmlmaWVkRG9tYWluIk8KHVZlcmlmeURhdGFzb3VyY2VEb21haW5SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESFAoCaWQYAiABKAlCCLpIBXIDsAEBIlwKHlZlcmlmeURhdGFzb3VyY2VEb21haW5SZXNwb25zZRI6CgZkb21haW4YASABKAsyKi5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VWZXJpZmllZERvbWFpbiJPCh1EZWxldGVEYXRhc291cmNlRG9tYWluUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhQKAmlkGAIgASgJQgi6SAVyA7ABASIgCh5EZWxldGVEYXRhc291cmNlRG9tYWluUmVzcG9uc2UingIKEFNvdXJjZURlbGVnYXRpb24SCgoCaWQYASABKAkSEQoJc291cmNlX2lkGAIgASgJEhQKDHByaW5jaXBhbF9pZBgDIAEoCRIOCgZtb2R1bGUYBCABKAkSDwoHYmluZGluZxgFIAEoCRIuCgpjcmVhdGVkX2F0GAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgpyZXZva2VkX2F0GAcgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBJACgpyZXZvY2F0aW9uGAggASgOMiwuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VEZWxlZ2F0aW9uUmV2b2NhdGlvbhISCgpyZXZva2VkX2J5GAkgASgJIoEBChxMaXN0U291cmNlRGVsZWdhdGlvbnNSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESIAoJc291cmNlX2lkGAIgASgJQgi6SAVyA7ABAUgAiAEBEhcKD2luY2x1ZGVfcmV2b2tlZBgDIAEoCEIMCgpfc291cmNlX2lkIlgKHUxpc3RTb3VyY2VEZWxlZ2F0aW9uc1Jlc3BvbnNlEjcKC2RlbGVnYXRpb25zGAEgAygLMiIuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VEZWxlZ2F0aW9uIk8KHVJldm9rZVNvdXJjZURlbGVnYXRpb25SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESFAoCaWQYAiABKAlCCLpIBXIDsAEBIlgKHlJldm9rZVNvdXJjZURlbGVnYXRpb25SZXNwb25zZRI2CgpkZWxlZ2F0aW9uGAEgASgLMiIuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VEZWxlZ2F0aW9uIjIKD1RyaWdnZXJJZGVudGl0eRIOCgZzb3VyY2UYASABKAkSDwoHYmluZGluZxgCIAEoCSKEAQoXRGVjbGFyZWRUcmlnZ2VyU2NoZWR1bGUSDAoEY3JvbhgBIAEoCRIQCgh0aW1lem9uZRgCIAEoCRISCgptaXNzZWRfcnVuGAMgASgJEg8KB292ZXJsYXAYBCABKAkSEAoIZGVhZGxpbmUYBSABKAMSEgoKaW5wdXRfanNvbhgGIAEoCSLnAgoaVHJpZ2dlckRlbGVnYXRpb25SZWZlcmVuY2USEQoJcmVmZXJlbmNlGAEgASgJEhUKDWRlbGVnYXRpb25faWQYAiABKAkSDgoGbW9kdWxlGAMgASgJEg8KB2JpbmRpbmcYBCABKAkSEAoIYXVkaWVuY2UYBSABKAkSDgoGdGVuYW50GAYgASgJEhoKEm93bmVyX3ByaW5jaXBhbF9pZBgHIAEoCRIOCgZzY29wZXMYCCADKAkSDgoGYWN0aXZlGAkgASgIEi4KCmNyZWF0ZWRfYXQYCiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCnJldm9rZWRfYXQYCyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkAKCnJldm9jYXRpb24YDCABKA4yLC5zYWFzLmFjY291bnRzLnYxLlNvdXJjZURlbGVnYXRpb25SZXZvY2F0aW9uIr4BChNUcmlnZ2VyQ2hpbGRDb250ZXh0EhUKDWRlbGVnYXRpb25faWQYASABKAkSDgoGbW9kdWxlGAIgASgJEg8KB2JpbmRpbmcYAyABKAkSEAoIYXVkaWVuY2UYBCABKAkSDgoGc2NvcGVzGAUgAygJEg4KBmxvb2t1cBgGIAEoCBItCgltaW50ZWRfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEg4KBnJlY29yZBgIIAEoCSLNAgoYU291cmNlVHJpZ2dlckRlY2xhcmF0aW9uEg8KB3JlbGVhc2UYASABKAkSEQoJb3BlcmF0aW9uGAIgASgJEjsKCHNjaGVkdWxlGAMgASgLMikuc2Fhcy5hY2NvdW50cy52MS5EZWNsYXJlZFRyaWdnZXJTY2hlZHVsZRIzCghpZGVudGl0eRgEIAEoCzIhLnNhYXMuYWNjb3VudHMudjEuVHJpZ2dlcklkZW50aXR5Eg4KBmRpZ2VzdBgFIAEoCRI2ChJsYXN0X29jY3VycmVuY2VfYXQYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjYKEm5leHRfb2NjdXJyZW5jZV9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGwoTdW5kZWNsYXJhYmxlX3JlYXNvbhgIIAEoCSJWCh1EZWxlZ2F0ZVNvdXJjZVRyaWdnZXJzUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhsKCXNvdXJjZV9pZBgCIAEoCUIIukgFcgOwAQEiYwoeRGVsZWdhdGVTb3VyY2VUcmlnZ2Vyc1Jlc3BvbnNlEkEKC2RlbGVnYXRpb25zGAEgAygLMiwuc2Fhcy5hY2NvdW50cy52MS5UcmlnZ2VyRGVsZWdhdGlvblJlZmVyZW5jZSJbCiJHZXRTb3VyY2VUcmlnZ2VyRGVjbGFyYXRpb25SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESGwoJc291cmNlX2lkGAIgASgJQgi6SAVyA7ABASLiAQojR2V0U291cmNlVHJpZ2dlckRlY2xhcmF0aW9uUmVzcG9uc2USPwoLZGVjbGFyYXRpb24YASABKAsyKi5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVRyaWdnZXJEZWNsYXJhdGlvbhJBCgtkZWxlZ2F0aW9ucxgCIAMoCzIsLnNhYXMuYWNjb3VudHMudjEuVHJpZ2dlckRlbGVnYXRpb25SZWZlcmVuY2USNwoIY2hpbGRyZW4YAyADKAsyJS5zYWFzLmFjY291bnRzLnYxLlRyaWdnZXJDaGlsZENvbnRleHQibgoWUmVjb25jaWxlU291cmNlUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhsKCXNvdXJjZV9pZBgCIAEoCUIIukgFcgOwAQESHQoJZWZmZWN0X2lkGAMgASgJQgq6SAdyBRABGIABIkwKF1JlY29uY2lsZVNvdXJjZVJlc3BvbnNlEhEKCWVmZmVjdF9pZBgBIAEoCRIOCgZzdGF0dXMYAiABKAkSDgoGam9iX2lkGAMgASgJIj0KHExvb2t1cFJlY29uY2lsZVNvdXJjZVJlcXVlc3QSHQoJZWZmZWN0X2lkGAEgASgJQgq6SAdyBRABGIABIvECCg9Tb3VyY2VPcGVyYXRpb24SDAoEbmFtZRgBIAEoCRITCgtkZXNjcmlwdGlvbhgCIAEoCRIOCgZtZXRob2QYAyABKAkSDAoEcGF0aBgEIAEoCRINCgVxdWVyeRgFIAMoCRItCgxpbnB1dF9zY2hlbWEYBiABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0Ei4KDW91dHB1dF9zY2hlbWEYByABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0EjgKBmVmZmVjdBgIIAEoDjIoLnNhYXMuYWNjb3VudHMudjEuU291cmNlT3BlcmF0aW9uLkVmZmVjdBIYChBtYXhfb3V0cHV0X2J5dGVzGAkgASgNEg4KBmRpZ2VzdBgKIAEoCSJLCgZFZmZlY3QSFgoSRUZGRUNUX1VOU1BFQ0lGSUVEEAASFAoQRUZGRUNUX1JFQURfT05MWRABEhMKD0VGRkVDVF9NVVRBVElPThACIo4BCh5EZWNsYXJlU291cmNlT3BlcmF0aW9uc1JlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIbCglzb3VyY2VfaWQYAiABKAlCCLpIBXIDsAEBEjUKCm9wZXJhdGlvbnMYAyADKAsyIS5zYWFzLmFjY291bnRzLnYxLlNvdXJjZU9wZXJhdGlvbiJYCh9EZWNsYXJlU291cmNlT3BlcmF0aW9uc1Jlc3BvbnNlEjUKCm9wZXJhdGlvbnMYASADKAsyIS5zYWFzLmFjY291bnRzLnYxLlNvdXJjZU9wZXJhdGlvbiJUChtMaXN0U291cmNlT3BlcmF0aW9uc1JlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIbCglzb3VyY2VfaWQYAiABKAlCCLpIBXIDsAEBIlUKHExpc3RTb3VyY2VPcGVyYXRpb25zUmVzcG9uc2USNQoKb3BlcmF0aW9ucxgBIAMoCzIhLnNhYXMuYWNjb3VudHMudjEuU291cmNlT3BlcmF0aW9uIsMBChxJbnZva2VTb3VyY2VPcGVyYXRpb25SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESGwoJc291cmNlX2lkGAIgASgJQgi6SAVyA7ABARIwCglvcGVyYXRpb24YAyABKAlCHbpIGnIYMhZeW2Etel1bYS16MC05X117MCw2M30kEh0KCmlucHV0X2pzb24YBCABKAlCCbpIBnIEKICABBIbCgllZmZlY3RfaWQYBSABKAlCCLpIBXIDKIABIn8KFlNvdXJjZU9wZXJhdGlvblJlY2VpcHQSEQoJZWZmZWN0X2lkGAEgASgJEhQKDGNvbW1pdHRlZF9hdBgCIAEoCRIOCgZzdGF0dXMYAyABKAkSFwoPcHJvdmlkZXJfc3RhdHVzGAQgASgNEhMKC291dHB1dF9qc29uGAUgASgJIm8KHUludm9rZVNvdXJjZU9wZXJhdGlvblJlc3BvbnNlEhMKC291dHB1dF9qc29uGAEgASgJEjkKB3JlY2VpcHQYAiABKAsyKC5zYWFzLmFjY291bnRzLnYxLlNvdXJjZU9wZXJhdGlvblJlY2VpcHQiQwoiTG9va3VwSW52b2tlU291cmNlT3BlcmF0aW9uUmVxdWVzdBIdCgllZmZlY3RfaWQYASABKAlCCrpIB3IFEAEogAEieQojUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1JlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIbCglzb3VyY2VfaWQYAiABKAlCCLpIBXIDsAEBEhsKCWVmZmVjdF9pZBgDIAEoCUIIukgFcgMogAEiWwokUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1Jlc3BvbnNlEhEKCWVmZmVjdF9pZBgBIAEoCRIQCghyZWNlaXB0cxgCIAEoAxIOCgZzdGF0dXMYAyABKAkiSgopTG9va3VwUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1JlcXVlc3QSHQoJZWZmZWN0X2lkGAEgASgJQgq6SAdyBRABKIABKrcBChJEYXRhc291cmNlUHJvdmlkZXISIwofREFUQVNPVVJDRV9QUk9WSURFUl9VTlNQRUNJRklFRBAAEh4KGkRBVEFTT1VSQ0VfUFJPVklERVJfR0lUSFVCEAESGwoXREFUQVNPVVJDRV9QUk9WSURFUl9BUEkQAhIfChtEQVRBU09VUkNFX1BST1ZJREVSX0NSQVdMRVIQAxIeChpEQVRBU09VUkNFX1BST1ZJREVSX1VQTE9BRBAEKpEBChBEYXRhc291cmNlU3RhdHVzEiEKHURBVEFTT1VSQ0VfU1RBVFVTX1VOU1BFQ0lGSUVEEAASHAoYREFUQVNPVVJDRV9TVEFUVVNfQUNUSVZFEAESHAoYREFUQVNPVVJDRV9TVEFUVVNfUEFVU0VEEAISHgoaREFUQVNPVVJDRV9TVEFUVVNfREVHUkFERUQQAyq8AQoWRGF0YXNvdXJjZUxpdmVEZWxpdmVyeRIoCiREQVRBU09VUkNFX0xJVkVfREVMSVZFUllfVU5TUEVDSUZJRUQQABIhCh1EQVRBU09VUkNFX0xJVkVfREVMSVZFUllfTk9ORRABEisKJ0RBVEFTT1VSQ0VfTElWRV9ERUxJVkVSWV9TT1VSQ0VfV0VCSE9PSxACEigKJERBVEFTT1VSQ0VfTElWRV9ERUxJVkVSWV9BUFBfV0VCSE9PSxADKtYBChFBcGlDcmVkZW50aWFsS2luZBIjCh9BUElfQ1JFREVOVElBTF9LSU5EX1VOU1BFQ0lGSUVEEAASHgoaQVBJX0NSRURFTlRJQUxfS0lORF9CRUFSRVIQARIdChlBUElfQ1JFREVOVElBTF9LSU5EX0JBU0lDEAISHgoaQVBJX0NSRURFTlRJQUxfS0lORF9IRUFERVIQAxIdChlBUElfQ1JFREVOVElBTF9LSU5EX1FVRVJZEAQSHgoaQVBJX0NSRURFTlRJQUxfS0lORF9PQVVUSDIQBSqmAgocRGF0YXNvdXJjZUNvbm5lY3RvckludGVyZmFjZRIuCipEQVRBU09VUkNFX0NPTk5FQ1RPUl9JTlRFUkZBQ0VfVU5TUEVDSUZJRUQQABIoCiREQVRBU09VUkNFX0NPTk5FQ1RPUl9JTlRFUkZBQ0VfRklMRVMQARIoCiREQVRBU09VUkNFX0NPTk5FQ1RPUl9JTlRFUkZBQ0VfUEFHRVMQAhIqCiZEQVRBU09VUkNFX0NPTk5FQ1RPUl9JTlRFUkZBQ0VfUkVDT1JEUxADEisKJ0RBVEFTT1VSQ0VfQ09OTkVDVE9SX0lOVEVSRkFDRV9NRVNTQUdFUxAEEikKJURBVEFTT1VSQ0VfQ09OTkVDVE9SX0lOVEVSRkFDRV9FVkVOVFMQBSrsAQoYRGF0YXNvdXJjZUNyZWRlbnRpYWxNb2RlEioKJkRBVEFTT1VSQ0VfQ1JFREVOVElBTF9NT0RFX1VOU1BFQ0lGSUVEEAASIwofREFUQVNPVVJDRV9DUkVERU5USUFMX01PREVfTk9ORRABEiYKIkRBVEFTT1VSQ0VfQ1JFREVOVElBTF9NT0RFX09SR19BUFAQAhIpCiVEQVRBU09VUkNFX0NSRURFTlRJQUxfTU9ERV9VU0VSX09BVVRIEAMSLAooREFUQVNPVVJDRV9DUkVERU5USUFMX01PREVfU1RBVElDX1NFQ1JFVBAEKpcBChZEYXRhc291cmNlUmVhZGVyc01vZGVsEigKJERBVEFTT1VSQ0VfUkVBREVSU19NT0RFTF9VTlNQRUNJRklFRBAAEioKJkRBVEFTT1VSQ0VfUkVBREVSU19NT0RFTF9TT1VSQ0VfU0NPUEVEEAESJwojREFUQVNPVVJDRV9SRUFERVJTX01PREVMX1RSQU5TTEFURUQQAiruAQoPU291cmNlU3luY1BoYXNlEiEKHVNPVVJDRV9TWU5DX1BIQVNFX1VOU1BFQ0lGSUVEEAASHAoYU09VUkNFX1NZTkNfUEhBU0VfUVVFVUVEEAESHgoaU09VUkNFX1NZTkNfUEhBU0VfRkVUQ0hJTkcQAhIeChpTT1VSQ0VfU1lOQ19QSEFTRV9DT01QSUxFRBADEiAKHFNPVVJDRV9TWU5DX1BIQVNFX0hBTkRFRF9PRkYQBBIaChZTT1VSQ0VfU1lOQ19QSEFTRV9ET05FEAUSHAoYU09VUkNFX1NZTkNfUEhBU0VfRkFJTEVEEAYqpgMKF1NvdXJjZVN5bmNGYWlsdXJlUmVhc29uEioKJlNPVVJDRV9TWU5DX0ZBSUxVUkVfUkVBU09OX1VOU1BFQ0lGSUVEEAASKwonU09VUkNFX1NZTkNfRkFJTFVSRV9SRUFTT05fUkFURV9MSU1JVEVEEAESKQolU09VUkNFX1NZTkNfRkFJTFVSRV9SRUFTT05fQ1JFREVOVElBTBACEiwKKFNPVVJDRV9TWU5DX0ZBSUxVUkVfUkVBU09OX0FDQ0VTU19ERU5JRUQQAxIoCiRTT1VSQ0VfU1lOQ19GQUlMVVJFX1JFQVNPTl9OT1RfRk9VTkQQBBIoCiRTT1VSQ0VfU1lOQ19GQUlMVVJFX1JFQVNPTl9UT09fTEFSR0UQBRIvCitTT1VSQ0VfU1lOQ19GQUlMVVJFX1JFQVNPTl9IT1NUX1VOQVZBSUxBQkxFEAYSJAogU09VUkNFX1NZTkNfRkFJTFVSRV9SRUFTT05fT1RIRVIQBxIuCipTT1VSQ0VfU1lOQ19GQUlMVVJFX1JFQVNPTl9ERUxJVkVSWV9GQUlMRUQQCCqcAQoRU291cmNlU3luY1RyaWdnZXISIwofU09VUkNFX1NZTkNfVFJJR0dFUl9VTlNQRUNJRklFRBAAEh4KGlNPVVJDRV9TWU5DX1RSSUdHRVJfTUFOVUFMEAESIQodU09VUkNFX1NZTkNfVFJJR0dFUl9TQ0hFRFVMRUQQAhIfChtTT1VSQ0VfU1lOQ19UUklHR0VSX1dFQkhPT0sQAyqPAQoWRGF0YXNvdXJjZURvbWFpblN0YXR1cxIoCiREQVRBU09VUkNFX0RPTUFJTl9TVEFUVVNfVU5TUEVDSUZJRUQQABIkCiBEQVRBU09VUkNFX0RPTUFJTl9TVEFUVVNfUEVORElORxABEiUKIURBVEFTT1VSQ0VfRE9NQUlOX1NUQVRVU19WRVJJRklFRBACKpUDChpTb3VyY2VEZWxlZ2F0aW9uUmV2b2NhdGlvbhIsCihTT1VSQ0VfREVMRUdBVElPTl9SRVZPQ0FUSU9OX1VOU1BFQ0lGSUVEEAASKAokU09VUkNFX0RFTEVHQVRJT05fUkVWT0NBVElPTl9SRVZPS0VEEAESKQolU09VUkNFX0RFTEVHQVRJT05fUkVWT0NBVElPTl9SRVBMQUNFRBACEi8KK1NPVVJDRV9ERUxFR0FUSU9OX1JFVk9DQVRJT05fU09VUkNFX0RFTEVURUQQAxIvCitTT1VSQ0VfREVMRUdBVElPTl9SRVZPQ0FUSU9OX01FTUJFUl9SRU1PVkVEEAQSMAosU09VUkNFX0RFTEVHQVRJT05fUkVWT0NBVElPTl9QRVJNSVNTSU9OX0xPU1QQBRIuCipTT1VSQ0VfREVMRUdBVElPTl9SRVZPQ0FUSU9OX1VTRVJfSU5BQ1RJVkUQBhIwCixTT1VSQ0VfREVMRUdBVElPTl9SRVZPQ0FUSU9OX0JJTkRJTkdfQ0hBTkdFRBAHMok4ChFEYXRhc291cmNlU2VydmljZRK5AwocUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0cxI1LnNhYXMuYWNjb3VudHMudjEuUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1JlcXVlc3QaNi5zYWFzLmFjY291bnRzLnYxLlBydW5lU291cmNlT3BlcmF0aW9uUmVjZWlwdHNSZXNwb25zZSKpAsLzGGwIAhADGhFkYXRhc291cmNlOmludm9rZSIRZGF0YXNvdXJjZTppbnZva2UqDwoJc291cmNlX2lkEAQYAzABOiMKH3NhYXMuZGF0YXNvdXJjZS5yZWNlaXB0cy5wcnVuZWQQAkADSARQA1gDYAHa8xi0AQoCCDwSAwjYBBgFIgIIAioLVU5BVkFJTEFCTEUqElJFU09VUkNFX0VYSEFVU1RFRCoHQUJPUlRFRDIPc2Fhcy1kYXRhc291cmNlSkYvc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlU2VydmljZS9Mb29rdXBQcnVuZVNvdXJjZU9wZXJhdGlvblJlY2VpcHRzUIAgWIAgYAFyGAoGc291cmNlEgZpbnZva2USBHJlYWQYARLmAQoiTG9va3VwUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0cxI7LnNhYXMuYWNjb3VudHMudjEuTG9va3VwUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1JlcXVlc3QaNi5zYWFzLmFjY291bnRzLnYxLlBydW5lU291cmNlT3BlcmF0aW9uUmVjZWlwdHNSZXNwb25zZSJLwvMYRwgCEAMaD2RhdGFzb3VyY2U6cmVhZCIPZGF0YXNvdXJjZTpyZWFkKg8KCWVmZmVjdF9pZBAEGAMwAToCEAFAAUgDUANYA2ABEvwDChVJbnZva2VTb3VyY2VPcGVyYXRpb24SLi5zYWFzLmFjY291bnRzLnYxLkludm9rZVNvdXJjZU9wZXJhdGlvblJlcXVlc3QaLy5zYWFzLmFjY291bnRzLnYxLkludm9rZVNvdXJjZU9wZXJhdGlvblJlc3BvbnNlIoEDwvMYbggCEAMaEWRhdGFzb3VyY2U6aW52b2tlIhFkYXRhc291cmNlOmludm9rZSoPCglzb3VyY2VfaWQQBBgDMAE6JQohc2Fhcy5kYXRhc291cmNlLm9wZXJhdGlvbi5pbnZva2VkEARAA0gEUARYBGAB2vMYrwEKAgg8EgMI2AQYBSICCAIqC1VOQVZBSUxBQkxFKhJSRVNPVVJDRV9FWEhBVVNURUQqB0FCT1JURUQyD3NhYXMtZGF0YXNvdXJjZUo/L3NhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVNlcnZpY2UvTG9va3VwSW52b2tlU291cmNlT3BlcmF0aW9uUICABFiAgEBgAXIYCgZzb3VyY2USBmludm9rZRIEcmVhZBgBgtPkkwJVOgEqIlAvdjEvb3JnYW5pemF0aW9ucy97b3JnX2lkfS9kYXRhc291cmNlcy97c291cmNlX2lkfS9vcGVyYXRpb25zL3tvcGVyYXRpb259Omludm9rZRKHAgobTG9va3VwSW52b2tlU291cmNlT3BlcmF0aW9uEjQuc2Fhcy5hY2NvdW50cy52MS5Mb29rdXBJbnZva2VTb3VyY2VPcGVyYXRpb25SZXF1ZXN0Gi8uc2Fhcy5hY2NvdW50cy52MS5JbnZva2VTb3VyY2VPcGVyYXRpb25SZXNwb25zZSKAAcLzGEcIAhADGg9kYXRhc291cmNlOnJlYWQiD2RhdGFzb3VyY2U6cmVhZCoPCgllZmZlY3RfaWQQBBgDMAE6AhABQAFIA1ADWARgAYLT5JMCLxItL3YxL2RhdGFzb3VyY2Utb3BlcmF0aW9uLXJlY2VpcHRzL3tlZmZlY3RfaWR9EoUCChRMaXN0U291cmNlT3BlcmF0aW9ucxItLnNhYXMuYWNjb3VudHMudjEuTGlzdFNvdXJjZU9wZXJhdGlvbnNSZXF1ZXN0Gi4uc2Fhcy5hY2NvdW50cy52MS5MaXN0U291cmNlT3BlcmF0aW9uc1Jlc3BvbnNlIo0BwvMYRAgCEAMaD2RhdGFzb3VyY2U6cmVhZCIPZGF0YXNvdXJjZTpyZWFkKgwKBm9yZ19pZBACGAEwAToCEAFAAUgDUANYA2ABgtPkkwI/Ej0vdjEvb3JnYW5pemF0aW9ucy97b3JnX2lkfS9kYXRhc291cmNlcy97c291cmNlX2lkfS9vcGVyYXRpb25zEpMCChdEZWNsYXJlU291cmNlT3BlcmF0aW9ucxIwLnNhYXMuYWNjb3VudHMudjEuRGVjbGFyZVNvdXJjZU9wZXJhdGlvbnNSZXF1ZXN0GjEuc2Fhcy5hY2NvdW50cy52MS5EZWNsYXJlU291cmNlT3BlcmF0aW9uc1Jlc3BvbnNlIpIBwvMYRggCEAQqDAoGb3JnX2lkEAIYATABOiYKInNhYXMuZGF0YXNvdXJjZS5vcGVyYXRpb24uZGVjbGFyZWQQAkABSARQA1gDYAGC0+STAkI6ASoiPS92MS9vcmdhbml6YXRpb25zL3tvcmdfaWR9L2RhdGFzb3VyY2VzL3tzb3VyY2VfaWR9L29wZXJhdGlvbnMSrAEKD0FkZEdpdEh1YlNvdXJjZRIoLnNhYXMuYWNjb3VudHMudjEuQWRkR2l0SHViU291cmNlUmVxdWVzdBopLnNhYXMuYWNjb3VudHMudjEuQWRkR2l0SHViU291cmNlUmVzcG9uc2UiRMLzGEAIAhAEKgwKBm9yZ19pZBACGAEwATogChxzYWFzLmRhdGFzb3VyY2Uuc291cmNlLmFkZGVkEAJAAUgEUARYA2ABEpoBCglBZGRTb3VyY2USIi5zYWFzLmFjY291bnRzLnYxLkFkZFNvdXJjZVJlcXVlc3QaIy5zYWFzLmFjY291bnRzLnYxLkFkZFNvdXJjZVJlc3BvbnNlIkTC8xhACAIQBCoMCgZvcmdfaWQQAhgBMAE6IAocc2Fhcy5kYXRhc291cmNlLnNvdXJjZS5hZGRlZBACQAFIBFAEWANgARKPAQoUR2V0RGF0YXNvdXJjZUNhdGFsb2cSLS5zYWFzLmFjY291bnRzLnYxLkdldERhdGFzb3VyY2VDYXRhbG9nUmVxdWVzdBouLnNhYXMuYWNjb3VudHMudjEuR2V0RGF0YXNvdXJjZUNhdGFsb2dSZXNwb25zZSIYwvMYFAgCEAEwAToCEAFAAUgDUAJYAmABEoIBCgtMaXN0U291cmNlcxIkLnNhYXMuYWNjb3VudHMudjEuTGlzdFNvdXJjZXNSZXF1ZXN0GiUuc2Fhcy5hY2NvdW50cy52MS5MaXN0U291cmNlc1Jlc3BvbnNlIibC8xgiCAIQAyoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARJ8CglHZXRTb3VyY2USIi5zYWFzLmFjY291bnRzLnYxLkdldFNvdXJjZVJlcXVlc3QaIy5zYWFzLmFjY291bnRzLnYxLkdldFNvdXJjZVJlc3BvbnNlIibC8xgiCAIQAyoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARKeAQoKU3luY1NvdXJjZRIjLnNhYXMuYWNjb3VudHMudjEuU3luY1NvdXJjZVJlcXVlc3QaJC5zYWFzLmFjY291bnRzLnYxLlN5bmNTb3VyY2VSZXNwb25zZSJFwvMYQQgCEAQqDAoGb3JnX2lkEAIYATABOiEKHXNhYXMuZGF0YXNvdXJjZS5zb3VyY2Uuc3luY2VkEAJAAUgEUARYAmABEogBCg1HZXRTb3VyY2VTeW5jEiYuc2Fhcy5hY2NvdW50cy52MS5HZXRTb3VyY2VTeW5jUmVxdWVzdBonLnNhYXMuYWNjb3VudHMudjEuR2V0U291cmNlU3luY1Jlc3BvbnNlIibC8xgiCAIQBCoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARKlAQoMRGVsZXRlU291cmNlEiUuc2Fhcy5hY2NvdW50cy52MS5EZWxldGVTb3VyY2VSZXF1ZXN0GiYuc2Fhcy5hY2NvdW50cy52MS5EZWxldGVTb3VyY2VSZXNwb25zZSJGwvMYQggCEAQqDAoGb3JnX2lkEAIYATABOiIKHnNhYXMuZGF0YXNvdXJjZS5zb3VyY2UucmVtb3ZlZBACQAFIBFACWAJgARLEAQoTQmVnaW5HaXRIdWJBcHBTZXR1cBIsLnNhYXMuYWNjb3VudHMudjEuQmVnaW5HaXRIdWJBcHBTZXR1cFJlcXVlc3QaLS5zYWFzLmFjY291bnRzLnYxLkJlZ2luR2l0SHViQXBwU2V0dXBSZXNwb25zZSJQwvMYTAgCEAQqDAoGb3JnX2lkEAIYATABOiwKKHNhYXMuZGF0YXNvdXJjZS5naXRodWJfYXBwLnNldHVwX3N0YXJ0ZWQQAkABSARQAlgEYAESzwEKFkNvbXBsZXRlR2l0SHViQXBwU2V0dXASLy5zYWFzLmFjY291bnRzLnYxLkNvbXBsZXRlR2l0SHViQXBwU2V0dXBSZXF1ZXN0GjAuc2Fhcy5hY2NvdW50cy52MS5Db21wbGV0ZUdpdEh1YkFwcFNldHVwUmVzcG9uc2UiUsLzGE4IAhAEKgwKBm9yZ19pZBACGAEwATouCipzYWFzLmRhdGFzb3VyY2UuZ2l0aHViX2FwcC5zZXR1cF9jb21wbGV0ZWQQAkABSARQBFgDYAESzQEKGE1pZ3JhdGVHaXRIdWJTb3VyY2VUb0FwcBIxLnNhYXMuYWNjb3VudHMudjEuTWlncmF0ZUdpdEh1YlNvdXJjZVRvQXBwUmVxdWVzdBoyLnNhYXMuYWNjb3VudHMudjEuTWlncmF0ZUdpdEh1YlNvdXJjZVRvQXBwUmVzcG9uc2UiSsLzGEYIAhAEKgwKBm9yZ19pZBACGAEwATomCiJzYWFzLmRhdGFzb3VyY2UuY3JlZGVudGlhbC51cGRhdGVkEAJAAUgEUAJYA2ABEtUBChpCZWdpbkRhdGFzb3VyY2VBY2NvdW50TGluaxIzLnNhYXMuYWNjb3VudHMudjEuQmVnaW5EYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0GjQuc2Fhcy5hY2NvdW50cy52MS5CZWdpbkRhdGFzb3VyY2VBY2NvdW50TGlua1Jlc3BvbnNlIkzC8xhICAIQAyoMCgZvcmdfaWQQAhgBMAE6KAokc2Fhcy5kYXRhc291cmNlLmFjY291bnRfbGlua19zdGFydGVkEAJAAUgEUAJYBGABEtgBCh1Db21wbGV0ZURhdGFzb3VyY2VBY2NvdW50TGluaxI2LnNhYXMuYWNjb3VudHMudjEuQ29tcGxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0Gjcuc2Fhcy5hY2NvdW50cy52MS5Db21wbGV0ZURhdGFzb3VyY2VBY2NvdW50TGlua1Jlc3BvbnNlIkbC8xhCCAIQAyoMCgZvcmdfaWQQAhgBMAE6Igoec2Fhcy5kYXRhc291cmNlLmFjY291bnRfbGlua2VkEAJAAUgEUARYA2ABErUBChxMaXN0TXlEYXRhc291cmNlQWNjb3VudExpbmtzEjUuc2Fhcy5hY2NvdW50cy52MS5MaXN0TXlEYXRhc291cmNlQWNjb3VudExpbmtzUmVxdWVzdBo2LnNhYXMuYWNjb3VudHMudjEuTGlzdE15RGF0YXNvdXJjZUFjY291bnRMaW5rc1Jlc3BvbnNlIibC8xgiCAIQAyoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARLUAQobRGVsZXRlRGF0YXNvdXJjZUFjY291bnRMaW5rEjQuc2Fhcy5hY2NvdW50cy52MS5EZWxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0GjUuc2Fhcy5hY2NvdW50cy52MS5EZWxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXNwb25zZSJIwvMYRAgCEAMqDAoGb3JnX2lkEAIYATABOiQKIHNhYXMuZGF0YXNvdXJjZS5hY2NvdW50X3VubGlua2VkEAJAAUgEUAJYA2ABEqMBChZHZXREYXRhc291cmNlRGlyZWN0b3J5Ei8uc2Fhcy5hY2NvdW50cy52MS5HZXREYXRhc291cmNlRGlyZWN0b3J5UmVxdWVzdBowLnNhYXMuYWNjb3VudHMudjEuR2V0RGF0YXNvdXJjZURpcmVjdG9yeVJlc3BvbnNlIibC8xgiCAIQBCoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARK3AQoTQmluZERhdGFzb3VyY2VHcm91cBIsLnNhYXMuYWNjb3VudHMudjEuQmluZERhdGFzb3VyY2VHcm91cFJlcXVlc3QaLS5zYWFzLmFjY291bnRzLnYxLkJpbmREYXRhc291cmNlR3JvdXBSZXNwb25zZSJDwvMYPwgCEAQqDAoGb3JnX2lkEAIYATABOh8KG3NhYXMuZGF0YXNvdXJjZS5ncm91cF9ib3VuZBACQAFIBFACWANgARK/AQoVVW5iaW5kRGF0YXNvdXJjZUdyb3VwEi4uc2Fhcy5hY2NvdW50cy52MS5VbmJpbmREYXRhc291cmNlR3JvdXBSZXF1ZXN0Gi8uc2Fhcy5hY2NvdW50cy52MS5VbmJpbmREYXRhc291cmNlR3JvdXBSZXNwb25zZSJFwvMYQQgCEAQqDAoGb3JnX2lkEAIYATABOiEKHXNhYXMuZGF0YXNvdXJjZS5ncm91cF91bmJvdW5kEAJAAUgEUAJYA2ABEsABChVDbGFpbURhdGFzb3VyY2VEb21haW4SLi5zYWFzLmFjY291bnRzLnYxLkNsYWltRGF0YXNvdXJjZURvbWFpblJlcXVlc3QaLy5zYWFzLmFjY291bnRzLnYxLkNsYWltRGF0YXNvdXJjZURvbWFpblJlc3BvbnNlIkbC8xhCCAIQBCoMCgZvcmdfaWQQAhgBMAE6Igoec2Fhcy5kYXRhc291cmNlLmRvbWFpbl9jbGFpbWVkEAJAAUgEUAJYA2ABEsQBChZWZXJpZnlEYXRhc291cmNlRG9tYWluEi8uc2Fhcy5hY2NvdW50cy52MS5WZXJpZnlEYXRhc291cmNlRG9tYWluUmVxdWVzdBowLnNhYXMuYWNjb3VudHMudjEuVmVyaWZ5RGF0YXNvdXJjZURvbWFpblJlc3BvbnNlIkfC8xhDCAIQBCoMCgZvcmdfaWQQAhgBMAE6Iwofc2Fhcy5kYXRhc291cmNlLmRvbWFpbl92ZXJpZmllZBACQAFIBFACWANgARLDAQoWRGVsZXRlRGF0YXNvdXJjZURvbWFpbhIvLnNhYXMuYWNjb3VudHMudjEuRGVsZXRlRGF0YXNvdXJjZURvbWFpblJlcXVlc3QaMC5zYWFzLmFjY291bnRzLnYxLkRlbGV0ZURhdGFzb3VyY2VEb21haW5SZXNwb25zZSJGwvMYQggCEAQqDAoGb3JnX2lkEAIYATABOiIKHnNhYXMuZGF0YXNvdXJjZS5kb21haW5fcmVtb3ZlZBACQAFIBFACWANgARKgAQoVTGlzdFNvdXJjZURlbGVnYXRpb25zEi4uc2Fhcy5hY2NvdW50cy52MS5MaXN0U291cmNlRGVsZWdhdGlvbnNSZXF1ZXN0Gi8uc2Fhcy5hY2NvdW50cy52MS5MaXN0U291cmNlRGVsZWdhdGlvbnNSZXNwb25zZSImwvMYIggCEAQqDAoGb3JnX2lkEAIYATABOgIQAUABSANQAlgDYAESxwEKFlJldm9rZVNvdXJjZURlbGVnYXRpb24SLy5zYWFzLmFjY291bnRzLnYxLlJldm9rZVNvdXJjZURlbGVnYXRpb25SZXF1ZXN0GjAuc2Fhcy5hY2NvdW50cy52MS5SZXZva2VTb3VyY2VEZWxlZ2F0aW9uUmVzcG9uc2UiSsLzGEYIAhAEKgwKBm9yZ19pZBACGAEwATomCiJzYWFzLmRhdGFzb3VyY2UuZGVsZWdhdGlvbi5yZXZva2VkEAJAAUgEUAJYA2ABEusBChZEZWxlZ2F0ZVNvdXJjZVRyaWdnZXJzEi8uc2Fhcy5hY2NvdW50cy52MS5EZWxlZ2F0ZVNvdXJjZVRyaWdnZXJzUmVxdWVzdBowLnNhYXMuYWNjb3VudHMudjEuRGVsZWdhdGVTb3VyY2VUcmlnZ2Vyc1Jlc3BvbnNlIm7C8xhqCAIQBCoMCgZvcmdfaWQQAhgBMAE6Sgoic2Fhcy5kYXRhc291cmNlLmRlbGVnYXRpb24uY3JlYXRlZAoic2Fhcy5kYXRhc291cmNlLmRlbGVnYXRpb24ucmV2b2tlZBACQAFIBFACWANgARKyAQobR2V0U291cmNlVHJpZ2dlckRlY2xhcmF0aW9uEjQuc2Fhcy5hY2NvdW50cy52MS5HZXRTb3VyY2VUcmlnZ2VyRGVjbGFyYXRpb25SZXF1ZXN0GjUuc2Fhcy5hY2NvdW50cy52MS5HZXRTb3VyY2VUcmlnZ2VyRGVjbGFyYXRpb25SZXNwb25zZSImwvMYIggCEAQqDAoGb3JnX2lkEAIYATABOgIQAUABSANQAlgDYAESgwMKD1JlY29uY2lsZVNvdXJjZRIoLnNhYXMuYWNjb3VudHMudjEuUmVjb25jaWxlU291cmNlUmVxdWVzdBopLnNhYXMuYWNjb3VudHMudjEuUmVjb25jaWxlU291cmNlUmVzcG9uc2UimgLC8xhqCAIQAxoRZGF0YXNvdXJjZTppbnZva2UiEWRhdGFzb3VyY2U6aW52b2tlKg8KCXNvdXJjZV9pZBAEGAMwATohCh1zYWFzLmRhdGFzb3VyY2Uuc291cmNlLnN5bmNlZBACQANIBFACWAJgAdrzGKcBCgIIPBIDCNgEGAUiAggCKgtVTkFWQUlMQUJMRSoSUkVTT1VSQ0VfRVhIQVVTVEVEKgdBQk9SVEVEMg9zYWFzLWRhdGFzb3VyY2VKOS9zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VTZXJ2aWNlL0xvb2t1cFJlY29uY2lsZVNvdXJjZVCAIFiAIGABchgKBnNvdXJjZRIGaW52b2tlEgRyZWFkGAESvwEKFUxvb2t1cFJlY29uY2lsZVNvdXJjZRIuLnNhYXMuYWNjb3VudHMudjEuTG9va3VwUmVjb25jaWxlU291cmNlUmVxdWVzdBopLnNhYXMuYWNjb3VudHMudjEuUmVjb25jaWxlU291cmNlUmVzcG9uc2UiS8LzGEcIAhADGg9kYXRhc291cmNlOnJlYWQiD2RhdGFzb3VyY2U6cmVhZCoPCgllZmZlY3RfaWQQBBgDMAE6AhABQAFIA1ACWAJgAUK3AQoUY29tLnNhYXMuYWNjb3VudHMudjFCD0RhdGFzb3VyY2VQcm90b1ABWixhY2NvdW50cy9wa2cvZ2VuL3NhYXMvYWNjb3VudHMvdjE7YWNjb3VudHN2MaICA1NBWKoCEFNhYXMuQWNjb3VudHMuVjHKAhBTYWFzXEFjY291bnRzXFYx4gIcU2Fhc1xBY2NvdW50c1xWMVxHUEJNZXRhZGF0YeoCElNhYXM6OkFjY291bnRzOjpWMWIGcHJvdG8z", [file_buf_validate_validate, file_codefly_runnable_v0_options, file_google_api_annotations, file_google_protobuf_duration, file_google_protobuf_struct, file_google_protobuf_timestamp, file_saas_jobs_v1_jobs, file_saas_policy_v1_options]); + fileDesc("CiFzYWFzL2FjY291bnRzL3YxL2RhdGFzb3VyY2UucHJvdG8SEHNhYXMuYWNjb3VudHMudjEiXgoWR2l0SHViRGF0YXNvdXJjZUNvbmZpZxIMCgRyZXBvGAEgASgJEg0KBXBhdGhzGAIgAygJEg4KBmJyYW5jaBgDIAEoCRIXCg9maWxlX2V4dGVuc2lvbnMYBCADKAki9AEKD0FwaU9BdXRoMkNvbmZpZxI2CgVncmFudBgEIAEoDjInLnNhYXMuYWNjb3VudHMudjEuQXBpT0F1dGgyQ29uZmlnLkdyYW50EhEKCXRva2VuX3VybBgBIAEoCRIRCgljbGllbnRfaWQYAiABKAkSDgoGc2NvcGVzGAMgAygJInMKBUdyYW50EhUKEUdSQU5UX1VOU1BFQ0lGSUVEEAASFwoTR1JBTlRfUkVGUkVTSF9UT0tFThABEhwKGEdSQU5UX0NMSUVOVF9DUkVERU5USUFMUxACEhwKGEdSQU5UX0FVVEhPUklaQVRJT05fQ09ERRADIuoBChNBcGlEYXRhc291cmNlQ29uZmlnEhAKCGJhc2VfdXJsGAEgASgJEhUKDXJlc291cmNlX3BhdGgYAiABKAkSPAoPY3JlZGVudGlhbF9raW5kGAMgASgOMiMuc2Fhcy5hY2NvdW50cy52MS5BcGlDcmVkZW50aWFsS2luZBIZChFjcmVkZW50aWFsX2hlYWRlchgEIAEoCRIeChZjcmVkZW50aWFsX3F1ZXJ5X3BhcmFtGAUgASgJEjEKBm9hdXRoMhgGIAEoCzIhLnNhYXMuYWNjb3VudHMudjEuQXBpT0F1dGgyQ29uZmlnIkEKF0NyYXdsZXJEYXRhc291cmNlQ29uZmlnEhMKC3NpdGVtYXBfdXJsGAEgASgJEhEKCW1heF9wYWdlcxgCIAEoDSKGAQoWVXBsb2FkRGF0YXNvdXJjZUNvbmZpZxIQCghlbmRwb2ludBgBIAEoCRIOCgZyZWdpb24YAiABKAkSDgoGYnVja2V0GAMgASgJEg4KBnByZWZpeBgEIAEoCRIVCg1hY2Nlc3Nfa2V5X2lkGAUgASgJEhMKC21heF9vYmplY3RzGAYgASgNIoMHCgpEYXRhc291cmNlEgoKAmlkGAEgASgJEg4KBm9yZ19pZBgCIAEoCRI2Cghwcm92aWRlchgDIAEoDjIkLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVByb3ZpZGVyEjgKBmdpdGh1YhgFIAEoCzIoLnNhYXMuYWNjb3VudHMudjEuR2l0SHViRGF0YXNvdXJjZUNvbmZpZxIyCgZzdGF0dXMYBiABKA4yIi5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VTdGF0dXMSGgoSd2ViaG9va19jb25maWd1cmVkGAcgASgIEi4KCmNyZWF0ZWRfYXQYCCABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCnVwZGF0ZWRfYXQYCSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjIKDmxhc3Rfc3luY2VkX2F0GAogASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIyCgNhcGkYCyABKAsyJS5zYWFzLmFjY291bnRzLnYxLkFwaURhdGFzb3VyY2VDb25maWcSOgoHY3Jhd2xlchgMIAEoCzIpLnNhYXMuYWNjb3VudHMudjEuQ3Jhd2xlckRhdGFzb3VyY2VDb25maWcSOAoGdXBsb2FkGA0gASgLMiguc2Fhcy5hY2NvdW50cy52MS5VcGxvYWREYXRhc291cmNlQ29uZmlnEhgKEGJvdW5kYXJ5X25vZGVfaWQYDiABKAkSNAoQbGFzdF9pbmdlc3RlZF9hdBgPIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASHAoUbGFzdF9pbmdlc3RlZF9jb21taXQYECABKAkSFQoNc3RhdHVzX3JlYXNvbhgRIAEoCRIWCg5ib3VuZGFyeV9sYWJlbBgSIAEoCRISCgpjb25mb3JtYW50GBMgASgIEhcKD2NvbmZvcm1hbmNlX2dhcBgUIAEoCRI/Cg1saXZlX2RlbGl2ZXJ5GBUgASgOMiguc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlTGl2ZURlbGl2ZXJ5EjUKEnJlY29uY2lsZV9pbnRlcnZhbBgWIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkoECAQQBVIRdGFyZ2V0X2NvbGxlY3Rpb24isgMKFkFkZEdpdEh1YlNvdXJjZVJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARI7CgRyZXBvGAIgASgJQi26SCpyKBADGP8BMiFeW0EtWmEtejAtOV8uLV0rL1tBLVphLXowLTlfLi1dKyQSIAoFcGF0aHMYAyADKAlCEbpIDpIBCxBAIgdyBRABGIAEEhgKBmJyYW5jaBgEIAEoCUIIukgFcgMY/wESJAoQYm91bmRhcnlfbm9kZV9pZBgIIAEoCUIIukgFcgOwAQFIABImChBjb2xsZWN0aW9uX2xhYmVsGAkgASgJQgq6SAdyBRABGP8BSAASHgoMYWNjZXNzX3Rva2VuGAYgASgJQgi6SAVyAxiACBIgCg53ZWJob29rX3NlY3JldBgHIAEoCUIIukgFcgMYgAgSSQoPZmlsZV9leHRlbnNpb25zGAogAygJQjC6SC2SASoQICImciQQAhghMh5eXC5bQS1aYS16MC05XVtBLVphLXowLTkuXy1dKiRCEQoIYm91bmRhcnkSBbpIAggBSgQIBRAGUhF0YXJnZXRfY29sbGVjdGlvbiJLChdBZGRHaXRIdWJTb3VyY2VSZXNwb25zZRIwCgpkYXRhc291cmNlGAEgASgLMhwuc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlIsgEChBBZGRTb3VyY2VSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESQgoIcHJvdmlkZXIYAiABKA4yJC5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VQcm92aWRlckIKukgHggEEEAEgABI6CgZnaXRodWIYBCABKAsyKC5zYWFzLmFjY291bnRzLnYxLkdpdEh1YkRhdGFzb3VyY2VDb25maWdIABI0CgNhcGkYBSABKAsyJS5zYWFzLmFjY291bnRzLnYxLkFwaURhdGFzb3VyY2VDb25maWdIABI8CgdjcmF3bGVyGAggASgLMikuc2Fhcy5hY2NvdW50cy52MS5DcmF3bGVyRGF0YXNvdXJjZUNvbmZpZ0gAEjoKBnVwbG9hZBgJIAEoCzIoLnNhYXMuYWNjb3VudHMudjEuVXBsb2FkRGF0YXNvdXJjZUNvbmZpZ0gAEiQKEGJvdW5kYXJ5X25vZGVfaWQYDCABKAlCCLpIBXIDsAEBSAESJgoQY29sbGVjdGlvbl9sYWJlbBgNIAEoCUIKukgHcgUQARj/AUgBEhwKCmNyZWRlbnRpYWwYBiABKAlCCLpIBXIDGIAgEiAKDndlYmhvb2tfc2VjcmV0GAcgASgJQgi6SAVyAxiACBImChRvYXV0aDJfY2xpZW50X3NlY3JldBgKIAEoCUIIukgFcgMYgAhCCAoGY29uZmlnQhEKCGJvdW5kYXJ5EgW6SAIIAUoECAMQBFIRdGFyZ2V0X2NvbGxlY3Rpb24iRQoRQWRkU291cmNlUmVzcG9uc2USMAoKZGF0YXNvdXJjZRgBIAEoCzIcLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZSJaChVEYXRhc291cmNlQ29uZmlnRmllbGQSCwoDa2V5GAEgASgJEhQKDGRpc3BsYXlfbmFtZRgCIAEoCRIMCgRoZWxwGAMgASgJEhAKCHJlcXVpcmVkGAQgASgIIsQBChlEYXRhc291cmNlQ29ubmVjdG9yQnVkZ2V0EhoKEm1heF9pdGVtc19wZXJfY2FsbBgBIAEoDRIaChJtYXhfYnl0ZXNfcGVyX2NhbGwYAiABKAMSFgoObWF4X2l0ZW1fYnl0ZXMYAyABKAMSHQoVb3BlcmF0aW9uc19wZXJfd2luZG93GAQgASgNEhYKDndpbmRvd19zZWNvbmRzGAUgASgDEiAKGGJhY2tncm91bmRfc2hhcmVfcGVyY2VudBgGIAEoDSKqBgocRGF0YXNvdXJjZVByb3ZpZGVyRGVzY3JpcHRvchI2Cghwcm92aWRlchgBIAEoDjIkLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVByb3ZpZGVyEhQKDGRpc3BsYXlfbmFtZRgCIAEoCRITCgtkZXNjcmlwdGlvbhgDIAEoCRI+Cg1jb25maWdfZmllbGRzGAQgAygLMicuc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlQ29uZmlnRmllbGQSGAoQc3VwcG9ydHNfd2ViaG9vaxgFIAEoCBJHChpzdXBwb3J0ZWRfY3JlZGVudGlhbF9raW5kcxgGIAMoDjIjLnNhYXMuYWNjb3VudHMudjEuQXBpQ3JlZGVudGlhbEtpbmQSEQoJY29ubmVjdG9yGAcgASgJEkEKCWludGVyZmFjZRgIIAEoDjIuLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZUNvbm5lY3RvckludGVyZmFjZRJEChBjcmVkZW50aWFsX21vZGVzGAkgAygOMiouc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlQ3JlZGVudGlhbE1vZGUSPwoNcmVhZGVyc19tb2RlbBgKIAEoDjIoLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVJlYWRlcnNNb2RlbBI7CgZidWRnZXQYCyABKAsyKy5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VDb25uZWN0b3JCdWRnZXQSEgoKY29uZm9ybWFudBgMIAEoCBIXCg9jb25mb3JtYW5jZV9nYXAYDSABKAkSGwoTYWNjZXB0c19uZXdfc291cmNlcxgOIAEoCBIgChhsaXZlX2RlbGl2ZXJ5X2NvbmZpZ3VyZWQYDyABKAgSGgoSYWNjZXB0c19vcGVyYXRpb25zGBAgASgIEhYKDm9wZXJhdGlvbnNfZ2FwGBEgASgJEhsKE29hdXRoX2F1dGhvcml6ZV91cmwYEiABKAkSFwoPb2F1dGhfdG9rZW5fdXJsGBMgASgJEhQKDG9hdXRoX3Njb3BlcxgUIAMoCSIdChtHZXREYXRhc291cmNlQ2F0YWxvZ1JlcXVlc3QiYQocR2V0RGF0YXNvdXJjZUNhdGFsb2dSZXNwb25zZRJBCglwcm92aWRlcnMYASADKAsyLi5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VQcm92aWRlckRlc2NyaXB0b3IiLgoSTGlzdFNvdXJjZXNSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQEiSAoTTGlzdFNvdXJjZXNSZXNwb25zZRIxCgtkYXRhc291cmNlcxgBIAMoCzIcLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZSJCChBHZXRTb3VyY2VSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESFAoCaWQYAiABKAlCCLpIBXIDsAEBIkUKEUdldFNvdXJjZVJlc3BvbnNlEjAKCmRhdGFzb3VyY2UYASABKAsyHC5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2UidgoRU3luY1NvdXJjZVJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIUCgJpZBgCIAEoCUIIukgFcgOwAQESHgoMYWNjZXNzX3Rva2VuGAMgASgJQgi6SAVyAxiAIBIRCglyZWNvbm5lY3QYBCABKAgiJAoSU3luY1NvdXJjZVJlc3BvbnNlEg4KBmpvYl9pZBgBIAEoCSJqChRHZXRTb3VyY2VTeW5jUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhsKCXNvdXJjZV9pZBgCIAEoCUIIukgFcgOwAQESGwoGam9iX2lkGAMgASgJQgu6SAjYAQFyA7ABASKVAQoSU291cmNlU3luY0RlbGl2ZXJ5EhgKBmpvYl9pZBgBIAEoCUIIukgFcgOwAQESLQoFc3RhdGUYAiABKA4yFi5zYWFzLmpvYnMudjEuSm9iU3RhdGVCBrpIA8gBARI2CglleGVjdXRpb24YAyABKAsyIy5zYWFzLmpvYnMudjEuSm9iRXhlY3V0aW9uUmVmZXJlbmNlIosBChFTb3VyY2VTeW5jQ2hhbmdlcxINCgVmaWxlcxgBIAEoDRINCgVhZGRlZBgCIAEoDRIQCghtb2RpZmllZBgDIAEoDRIPCgdkZWxldGVkGAQgASgNEhMKC3NwbGl0X2tub3duGAUgASgIEhAKCHNuYXBzaG90GAYgASgIEg4KBmNvbW1pdBgHIAEoCSKtAQoRU291cmNlU3luY0ZhaWx1cmUSOQoGcmVhc29uGAEgASgOMikuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VTeW5jRmFpbHVyZVJlYXNvbhIMCgRjb2RlGAIgASgJEg8KB21lc3NhZ2UYAyABKAkSEAoIcmV0cnlpbmcYBCABKAgSLAoIcmV0cnlfYXQYBSABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIoQEChJTb3VyY2VTeW5jUHJvZ3Jlc3MSMAoFcGhhc2UYASABKA4yIS5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVN5bmNQaGFzZRI0Cgd0cmlnZ2VyGAIgASgOMiMuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VTeW5jVHJpZ2dlchItCglxdWV1ZWRfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi8KC2ZldGNoaW5nX2F0GAQgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIvCgtjb21waWxlZF9hdBgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASMQoNaGFuZGVkX29mZl9hdBgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLwoLZmluaXNoZWRfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjQKB2NoYW5nZXMYCCABKAsyIy5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVN5bmNDaGFuZ2VzEjQKB2ZhaWx1cmUYCSABKAsyIy5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVN5bmNGYWlsdXJlEg8KB2F0dGVtcHQYCiABKA0SFAoMbWF4X2F0dGVtcHRzGAsgASgNItIBChVHZXRTb3VyY2VTeW5jUmVzcG9uc2USGAoGam9iX2lkGAEgASgJQgi6SAVyA7ABARItCgVzdGF0ZRgCIAEoDjIWLnNhYXMuam9icy52MS5Kb2JTdGF0ZUIGukgDyAEBEjgKCmRlbGl2ZXJpZXMYAyADKAsyJC5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVN5bmNEZWxpdmVyeRI2Cghwcm9ncmVzcxgEIAEoCzIkLnNhYXMuYWNjb3VudHMudjEuU291cmNlU3luY1Byb2dyZXNzIkUKE0RlbGV0ZVNvdXJjZVJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIUCgJpZBgCIAEoCUIIukgFcgOwAQEiFgoURGVsZXRlU291cmNlUmVzcG9uc2UiVgoTR2l0SHViQXBwUmVwb3NpdG9yeRIMCgRyZXBvGAEgASgJEhYKDmRlZmF1bHRfYnJhbmNoGAIgASgJEhkKEWFscmVhZHlfY29ubmVjdGVkGAMgASgIIjYKGkJlZ2luR2l0SHViQXBwU2V0dXBSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQEicQobQmVnaW5HaXRIdWJBcHBTZXR1cFJlc3BvbnNlEhMKC2luc3RhbGxfdXJsGAEgASgJEg0KBXN0YXRlGAIgASgJEi4KCmV4cGlyZXNfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wIpwBCh1Db21wbGV0ZUdpdEh1YkFwcFNldHVwUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhkKBXN0YXRlGAIgASgJQgq6SAdyBRABGP8BEiwKD2luc3RhbGxhdGlvbl9pZBgDIAEoCUITukgQcg4QARggMgheWzAtOV0rJBIYCgRjb2RlGAQgASgJQgq6SAdyBRABGP8BInYKHkNvbXBsZXRlR2l0SHViQXBwU2V0dXBSZXNwb25zZRIXCg9pbnN0YWxsYXRpb25faWQYASABKAkSOwoMcmVwb3NpdG9yaWVzGAIgAygLMiUuc2Fhcy5hY2NvdW50cy52MS5HaXRIdWJBcHBSZXBvc2l0b3J5IlEKH01pZ3JhdGVHaXRIdWJTb3VyY2VUb0FwcFJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIUCgJpZBgCIAEoCUIIukgFcgOwAQEiVAogTWlncmF0ZUdpdEh1YlNvdXJjZVRvQXBwUmVzcG9uc2USMAoKZGF0YXNvdXJjZRgBIAEoCzIcLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZSLEAQoVRGF0YXNvdXJjZUFjY291bnRMaW5rEgoKAmlkGAEgASgJEg4KBm9yZ19pZBgCIAEoCRIPCgd1c2VyX2lkGAMgASgJEhEKCWNvbm5lY3RvchgEIAEoCRIbChNwcm92aWRlcl9hY2NvdW50X2lkGAUgASgJEh4KFnByb3ZpZGVyX2FjY291bnRfbG9naW4YBiABKAkSLgoKY3JlYXRlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAitwEKFkRhdGFzb3VyY2VHcm91cEJpbmRpbmcSCgoCaWQYASABKAkSDgoGb3JnX2lkGAIgASgJEhEKCWNvbm5lY3RvchgDIAEoCRIZChFwcm92aWRlcl9ncm91cF9pZBgEIAEoCRIPCgd0ZWFtX2lkGAUgASgJEhIKCmNyZWF0ZWRfYnkYBiABKAkSLgoKY3JlYXRlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAilAIKGERhdGFzb3VyY2VWZXJpZmllZERvbWFpbhIKCgJpZBgBIAEoCRIOCgZvcmdfaWQYAiABKAkSDgoGZG9tYWluGAMgASgJEjgKBnN0YXR1cxgEIAEoDjIoLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZURvbWFpblN0YXR1cxIXCg90eHRfcmVjb3JkX25hbWUYBSABKAkSGAoQdHh0X3JlY29yZF92YWx1ZRgGIAEoCRIvCgt2ZXJpZmllZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLgoKY3JlYXRlZF9hdBgIIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXAiMwoXRGF0YXNvdXJjZURpcmVjdG9yeVRlYW0SCgoCaWQYASABKAkSDAoEbmFtZRgCIAEoCSKmAQohQmVnaW5EYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESNAoJY29ubmVjdG9yGAIgASgJQiG6SB5yHBACGCAyFl5bYS16XVthLXowLTktXXsxLDMxfSQSHgoMcmVkaXJlY3RfdXJpGAMgASgJQgi6SAVyAxiAEBIRCglzb3VyY2VfaWQYBCABKAkiegoiQmVnaW5EYXRhc291cmNlQWNjb3VudExpbmtSZXNwb25zZRIVCg1hdXRob3JpemVfdXJsGAEgASgJEg0KBXN0YXRlGAIgASgJEi4KCmV4cGlyZXNfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wInUKJENvbXBsZXRlRGF0YXNvdXJjZUFjY291bnRMaW5rUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhkKBXN0YXRlGAIgASgJQgq6SAdyBRABGIBAEhgKBGNvZGUYAyABKAlCCrpIB3IFEAEY/wEiXgolQ29tcGxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXNwb25zZRI1CgRsaW5rGAEgASgLMicuc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlQWNjb3VudExpbmsiPwojTGlzdE15RGF0YXNvdXJjZUFjY291bnRMaW5rc1JlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABASJeCiRMaXN0TXlEYXRhc291cmNlQWNjb3VudExpbmtzUmVzcG9uc2USNgoFbGlua3MYASADKAsyJy5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VBY2NvdW50TGluayJUCiJEZWxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESFAoCaWQYAiABKAlCCLpIBXIDsAEBIiUKI0RlbGV0ZURhdGFzb3VyY2VBY2NvdW50TGlua1Jlc3BvbnNlIjkKHUdldERhdGFzb3VyY2VEaXJlY3RvcnlSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQEiiwIKHkdldERhdGFzb3VyY2VEaXJlY3RvcnlSZXNwb25zZRI2CgVsaW5rcxgBIAMoCzInLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZUFjY291bnRMaW5rEjoKCGJpbmRpbmdzGAIgAygLMiguc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlR3JvdXBCaW5kaW5nEjsKB2RvbWFpbnMYAyADKAsyKi5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VWZXJpZmllZERvbWFpbhI4CgV0ZWFtcxgEIAMoCzIpLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZURpcmVjdG9yeVRlYW0irgEKGkJpbmREYXRhc291cmNlR3JvdXBSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESNAoJY29ubmVjdG9yGAIgASgJQiG6SB5yHBACGCAyFl5bYS16XVthLXowLTktXXsxLDMxfSQSJQoRcHJvdmlkZXJfZ3JvdXBfaWQYAyABKAlCCrpIB3IFEAEY/wESGQoHdGVhbV9pZBgEIAEoCUIIukgFcgOwAQEiWAobQmluZERhdGFzb3VyY2VHcm91cFJlc3BvbnNlEjkKB2JpbmRpbmcYASABKAsyKC5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VHcm91cEJpbmRpbmciTgocVW5iaW5kRGF0YXNvdXJjZUdyb3VwUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhQKAmlkGAIgASgJQgi6SAVyA7ABASIfCh1VbmJpbmREYXRhc291cmNlR3JvdXBSZXNwb25zZSJUChxDbGFpbURhdGFzb3VyY2VEb21haW5SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESGgoGZG9tYWluGAIgASgJQgq6SAdyBRADGP0BIlsKHUNsYWltRGF0YXNvdXJjZURvbWFpblJlc3BvbnNlEjoKBmRvbWFpbhgBIAEoCzIqLnNhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVZlcmlmaWVkRG9tYWluIk8KHVZlcmlmeURhdGFzb3VyY2VEb21haW5SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESFAoCaWQYAiABKAlCCLpIBXIDsAEBIlwKHlZlcmlmeURhdGFzb3VyY2VEb21haW5SZXNwb25zZRI6CgZkb21haW4YASABKAsyKi5zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VWZXJpZmllZERvbWFpbiJPCh1EZWxldGVEYXRhc291cmNlRG9tYWluUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhQKAmlkGAIgASgJQgi6SAVyA7ABASIgCh5EZWxldGVEYXRhc291cmNlRG9tYWluUmVzcG9uc2UingIKEFNvdXJjZURlbGVnYXRpb24SCgoCaWQYASABKAkSEQoJc291cmNlX2lkGAIgASgJEhQKDHByaW5jaXBhbF9pZBgDIAEoCRIOCgZtb2R1bGUYBCABKAkSDwoHYmluZGluZxgFIAEoCRIuCgpjcmVhdGVkX2F0GAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgpyZXZva2VkX2F0GAcgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBJACgpyZXZvY2F0aW9uGAggASgOMiwuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VEZWxlZ2F0aW9uUmV2b2NhdGlvbhISCgpyZXZva2VkX2J5GAkgASgJIoEBChxMaXN0U291cmNlRGVsZWdhdGlvbnNSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESIAoJc291cmNlX2lkGAIgASgJQgi6SAVyA7ABAUgAiAEBEhcKD2luY2x1ZGVfcmV2b2tlZBgDIAEoCEIMCgpfc291cmNlX2lkIlgKHUxpc3RTb3VyY2VEZWxlZ2F0aW9uc1Jlc3BvbnNlEjcKC2RlbGVnYXRpb25zGAEgAygLMiIuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VEZWxlZ2F0aW9uIk8KHVJldm9rZVNvdXJjZURlbGVnYXRpb25SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESFAoCaWQYAiABKAlCCLpIBXIDsAEBIlgKHlJldm9rZVNvdXJjZURlbGVnYXRpb25SZXNwb25zZRI2CgpkZWxlZ2F0aW9uGAEgASgLMiIuc2Fhcy5hY2NvdW50cy52MS5Tb3VyY2VEZWxlZ2F0aW9uIjIKD1RyaWdnZXJJZGVudGl0eRIOCgZzb3VyY2UYASABKAkSDwoHYmluZGluZxgCIAEoCSKEAQoXRGVjbGFyZWRUcmlnZ2VyU2NoZWR1bGUSDAoEY3JvbhgBIAEoCRIQCgh0aW1lem9uZRgCIAEoCRISCgptaXNzZWRfcnVuGAMgASgJEg8KB292ZXJsYXAYBCABKAkSEAoIZGVhZGxpbmUYBSABKAMSEgoKaW5wdXRfanNvbhgGIAEoCSLnAgoaVHJpZ2dlckRlbGVnYXRpb25SZWZlcmVuY2USEQoJcmVmZXJlbmNlGAEgASgJEhUKDWRlbGVnYXRpb25faWQYAiABKAkSDgoGbW9kdWxlGAMgASgJEg8KB2JpbmRpbmcYBCABKAkSEAoIYXVkaWVuY2UYBSABKAkSDgoGdGVuYW50GAYgASgJEhoKEm93bmVyX3ByaW5jaXBhbF9pZBgHIAEoCRIOCgZzY29wZXMYCCADKAkSDgoGYWN0aXZlGAkgASgIEi4KCmNyZWF0ZWRfYXQYCiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi4KCnJldm9rZWRfYXQYCyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEkAKCnJldm9jYXRpb24YDCABKA4yLC5zYWFzLmFjY291bnRzLnYxLlNvdXJjZURlbGVnYXRpb25SZXZvY2F0aW9uIr4BChNUcmlnZ2VyQ2hpbGRDb250ZXh0EhUKDWRlbGVnYXRpb25faWQYASABKAkSDgoGbW9kdWxlGAIgASgJEg8KB2JpbmRpbmcYAyABKAkSEAoIYXVkaWVuY2UYBCABKAkSDgoGc2NvcGVzGAUgAygJEg4KBmxvb2t1cBgGIAEoCBItCgltaW50ZWRfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEg4KBnJlY29yZBgIIAEoCSK5AwoYU291cmNlVHJpZ2dlckRlY2xhcmF0aW9uEg8KB3JlbGVhc2UYASABKAkSEQoJb3BlcmF0aW9uGAIgASgJEjsKCHNjaGVkdWxlGAMgASgLMikuc2Fhcy5hY2NvdW50cy52MS5EZWNsYXJlZFRyaWdnZXJTY2hlZHVsZRIzCghpZGVudGl0eRgEIAEoCzIhLnNhYXMuYWNjb3VudHMudjEuVHJpZ2dlcklkZW50aXR5Eg4KBmRpZ2VzdBgFIAEoCRI2ChJsYXN0X29jY3VycmVuY2VfYXQYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjYKEm5leHRfb2NjdXJyZW5jZV9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGwoTdW5kZWNsYXJhYmxlX3JlYXNvbhgIIAEoCRIaChJob3N0X3N3ZWVwX2VuYWJsZWQYCSABKAgSNQoRaG9zdF9zd2VlcF9kdWVfYXQYCiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEhcKD2lkZW50aXR5X2hvbGRlchgLIAEoCSJWCh1EZWxlZ2F0ZVNvdXJjZVRyaWdnZXJzUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhsKCXNvdXJjZV9pZBgCIAEoCUIIukgFcgOwAQEiYwoeRGVsZWdhdGVTb3VyY2VUcmlnZ2Vyc1Jlc3BvbnNlEkEKC2RlbGVnYXRpb25zGAEgAygLMiwuc2Fhcy5hY2NvdW50cy52MS5UcmlnZ2VyRGVsZWdhdGlvblJlZmVyZW5jZSJbCiJHZXRTb3VyY2VUcmlnZ2VyRGVjbGFyYXRpb25SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESGwoJc291cmNlX2lkGAIgASgJQgi6SAVyA7ABASLiAQojR2V0U291cmNlVHJpZ2dlckRlY2xhcmF0aW9uUmVzcG9uc2USPwoLZGVjbGFyYXRpb24YASABKAsyKi5zYWFzLmFjY291bnRzLnYxLlNvdXJjZVRyaWdnZXJEZWNsYXJhdGlvbhJBCgtkZWxlZ2F0aW9ucxgCIAMoCzIsLnNhYXMuYWNjb3VudHMudjEuVHJpZ2dlckRlbGVnYXRpb25SZWZlcmVuY2USNwoIY2hpbGRyZW4YAyADKAsyJS5zYWFzLmFjY291bnRzLnYxLlRyaWdnZXJDaGlsZENvbnRleHQibgoWUmVjb25jaWxlU291cmNlUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEhsKCXNvdXJjZV9pZBgCIAEoCUIIukgFcgOwAQESHQoJZWZmZWN0X2lkGAMgASgJQgq6SAdyBRABGIABIkwKF1JlY29uY2lsZVNvdXJjZVJlc3BvbnNlEhEKCWVmZmVjdF9pZBgBIAEoCRIOCgZzdGF0dXMYAiABKAkSDgoGam9iX2lkGAMgASgJIj0KHExvb2t1cFJlY29uY2lsZVNvdXJjZVJlcXVlc3QSHQoJZWZmZWN0X2lkGAEgASgJQgq6SAdyBRABGIABIvECCg9Tb3VyY2VPcGVyYXRpb24SDAoEbmFtZRgBIAEoCRITCgtkZXNjcmlwdGlvbhgCIAEoCRIOCgZtZXRob2QYAyABKAkSDAoEcGF0aBgEIAEoCRINCgVxdWVyeRgFIAMoCRItCgxpbnB1dF9zY2hlbWEYBiABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0Ei4KDW91dHB1dF9zY2hlbWEYByABKAsyFy5nb29nbGUucHJvdG9idWYuU3RydWN0EjgKBmVmZmVjdBgIIAEoDjIoLnNhYXMuYWNjb3VudHMudjEuU291cmNlT3BlcmF0aW9uLkVmZmVjdBIYChBtYXhfb3V0cHV0X2J5dGVzGAkgASgNEg4KBmRpZ2VzdBgKIAEoCSJLCgZFZmZlY3QSFgoSRUZGRUNUX1VOU1BFQ0lGSUVEEAASFAoQRUZGRUNUX1JFQURfT05MWRABEhMKD0VGRkVDVF9NVVRBVElPThACIo4BCh5EZWNsYXJlU291cmNlT3BlcmF0aW9uc1JlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIbCglzb3VyY2VfaWQYAiABKAlCCLpIBXIDsAEBEjUKCm9wZXJhdGlvbnMYAyADKAsyIS5zYWFzLmFjY291bnRzLnYxLlNvdXJjZU9wZXJhdGlvbiJYCh9EZWNsYXJlU291cmNlT3BlcmF0aW9uc1Jlc3BvbnNlEjUKCm9wZXJhdGlvbnMYASADKAsyIS5zYWFzLmFjY291bnRzLnYxLlNvdXJjZU9wZXJhdGlvbiJUChtMaXN0U291cmNlT3BlcmF0aW9uc1JlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIbCglzb3VyY2VfaWQYAiABKAlCCLpIBXIDsAEBIlUKHExpc3RTb3VyY2VPcGVyYXRpb25zUmVzcG9uc2USNQoKb3BlcmF0aW9ucxgBIAMoCzIhLnNhYXMuYWNjb3VudHMudjEuU291cmNlT3BlcmF0aW9uIsMBChxJbnZva2VTb3VyY2VPcGVyYXRpb25SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESGwoJc291cmNlX2lkGAIgASgJQgi6SAVyA7ABARIwCglvcGVyYXRpb24YAyABKAlCHbpIGnIYMhZeW2Etel1bYS16MC05X117MCw2M30kEh0KCmlucHV0X2pzb24YBCABKAlCCbpIBnIEKICABBIbCgllZmZlY3RfaWQYBSABKAlCCLpIBXIDKIABIn8KFlNvdXJjZU9wZXJhdGlvblJlY2VpcHQSEQoJZWZmZWN0X2lkGAEgASgJEhQKDGNvbW1pdHRlZF9hdBgCIAEoCRIOCgZzdGF0dXMYAyABKAkSFwoPcHJvdmlkZXJfc3RhdHVzGAQgASgNEhMKC291dHB1dF9qc29uGAUgASgJIm8KHUludm9rZVNvdXJjZU9wZXJhdGlvblJlc3BvbnNlEhMKC291dHB1dF9qc29uGAEgASgJEjkKB3JlY2VpcHQYAiABKAsyKC5zYWFzLmFjY291bnRzLnYxLlNvdXJjZU9wZXJhdGlvblJlY2VpcHQiQwoiTG9va3VwSW52b2tlU291cmNlT3BlcmF0aW9uUmVxdWVzdBIdCgllZmZlY3RfaWQYASABKAlCCrpIB3IFEAEogAEieQojUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1JlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIbCglzb3VyY2VfaWQYAiABKAlCCLpIBXIDsAEBEhsKCWVmZmVjdF9pZBgDIAEoCUIIukgFcgMogAEiWwokUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1Jlc3BvbnNlEhEKCWVmZmVjdF9pZBgBIAEoCRIQCghyZWNlaXB0cxgCIAEoAxIOCgZzdGF0dXMYAyABKAkiSgopTG9va3VwUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1JlcXVlc3QSHQoJZWZmZWN0X2lkGAEgASgJQgq6SAdyBRABKIABKrcBChJEYXRhc291cmNlUHJvdmlkZXISIwofREFUQVNPVVJDRV9QUk9WSURFUl9VTlNQRUNJRklFRBAAEh4KGkRBVEFTT1VSQ0VfUFJPVklERVJfR0lUSFVCEAESGwoXREFUQVNPVVJDRV9QUk9WSURFUl9BUEkQAhIfChtEQVRBU09VUkNFX1BST1ZJREVSX0NSQVdMRVIQAxIeChpEQVRBU09VUkNFX1BST1ZJREVSX1VQTE9BRBAEKpEBChBEYXRhc291cmNlU3RhdHVzEiEKHURBVEFTT1VSQ0VfU1RBVFVTX1VOU1BFQ0lGSUVEEAASHAoYREFUQVNPVVJDRV9TVEFUVVNfQUNUSVZFEAESHAoYREFUQVNPVVJDRV9TVEFUVVNfUEFVU0VEEAISHgoaREFUQVNPVVJDRV9TVEFUVVNfREVHUkFERUQQAyq8AQoWRGF0YXNvdXJjZUxpdmVEZWxpdmVyeRIoCiREQVRBU09VUkNFX0xJVkVfREVMSVZFUllfVU5TUEVDSUZJRUQQABIhCh1EQVRBU09VUkNFX0xJVkVfREVMSVZFUllfTk9ORRABEisKJ0RBVEFTT1VSQ0VfTElWRV9ERUxJVkVSWV9TT1VSQ0VfV0VCSE9PSxACEigKJERBVEFTT1VSQ0VfTElWRV9ERUxJVkVSWV9BUFBfV0VCSE9PSxADKtYBChFBcGlDcmVkZW50aWFsS2luZBIjCh9BUElfQ1JFREVOVElBTF9LSU5EX1VOU1BFQ0lGSUVEEAASHgoaQVBJX0NSRURFTlRJQUxfS0lORF9CRUFSRVIQARIdChlBUElfQ1JFREVOVElBTF9LSU5EX0JBU0lDEAISHgoaQVBJX0NSRURFTlRJQUxfS0lORF9IRUFERVIQAxIdChlBUElfQ1JFREVOVElBTF9LSU5EX1FVRVJZEAQSHgoaQVBJX0NSRURFTlRJQUxfS0lORF9PQVVUSDIQBSqmAgocRGF0YXNvdXJjZUNvbm5lY3RvckludGVyZmFjZRIuCipEQVRBU09VUkNFX0NPTk5FQ1RPUl9JTlRFUkZBQ0VfVU5TUEVDSUZJRUQQABIoCiREQVRBU09VUkNFX0NPTk5FQ1RPUl9JTlRFUkZBQ0VfRklMRVMQARIoCiREQVRBU09VUkNFX0NPTk5FQ1RPUl9JTlRFUkZBQ0VfUEFHRVMQAhIqCiZEQVRBU09VUkNFX0NPTk5FQ1RPUl9JTlRFUkZBQ0VfUkVDT1JEUxADEisKJ0RBVEFTT1VSQ0VfQ09OTkVDVE9SX0lOVEVSRkFDRV9NRVNTQUdFUxAEEikKJURBVEFTT1VSQ0VfQ09OTkVDVE9SX0lOVEVSRkFDRV9FVkVOVFMQBSrsAQoYRGF0YXNvdXJjZUNyZWRlbnRpYWxNb2RlEioKJkRBVEFTT1VSQ0VfQ1JFREVOVElBTF9NT0RFX1VOU1BFQ0lGSUVEEAASIwofREFUQVNPVVJDRV9DUkVERU5USUFMX01PREVfTk9ORRABEiYKIkRBVEFTT1VSQ0VfQ1JFREVOVElBTF9NT0RFX09SR19BUFAQAhIpCiVEQVRBU09VUkNFX0NSRURFTlRJQUxfTU9ERV9VU0VSX09BVVRIEAMSLAooREFUQVNPVVJDRV9DUkVERU5USUFMX01PREVfU1RBVElDX1NFQ1JFVBAEKpcBChZEYXRhc291cmNlUmVhZGVyc01vZGVsEigKJERBVEFTT1VSQ0VfUkVBREVSU19NT0RFTF9VTlNQRUNJRklFRBAAEioKJkRBVEFTT1VSQ0VfUkVBREVSU19NT0RFTF9TT1VSQ0VfU0NPUEVEEAESJwojREFUQVNPVVJDRV9SRUFERVJTX01PREVMX1RSQU5TTEFURUQQAiruAQoPU291cmNlU3luY1BoYXNlEiEKHVNPVVJDRV9TWU5DX1BIQVNFX1VOU1BFQ0lGSUVEEAASHAoYU09VUkNFX1NZTkNfUEhBU0VfUVVFVUVEEAESHgoaU09VUkNFX1NZTkNfUEhBU0VfRkVUQ0hJTkcQAhIeChpTT1VSQ0VfU1lOQ19QSEFTRV9DT01QSUxFRBADEiAKHFNPVVJDRV9TWU5DX1BIQVNFX0hBTkRFRF9PRkYQBBIaChZTT1VSQ0VfU1lOQ19QSEFTRV9ET05FEAUSHAoYU09VUkNFX1NZTkNfUEhBU0VfRkFJTEVEEAYqpgMKF1NvdXJjZVN5bmNGYWlsdXJlUmVhc29uEioKJlNPVVJDRV9TWU5DX0ZBSUxVUkVfUkVBU09OX1VOU1BFQ0lGSUVEEAASKwonU09VUkNFX1NZTkNfRkFJTFVSRV9SRUFTT05fUkFURV9MSU1JVEVEEAESKQolU09VUkNFX1NZTkNfRkFJTFVSRV9SRUFTT05fQ1JFREVOVElBTBACEiwKKFNPVVJDRV9TWU5DX0ZBSUxVUkVfUkVBU09OX0FDQ0VTU19ERU5JRUQQAxIoCiRTT1VSQ0VfU1lOQ19GQUlMVVJFX1JFQVNPTl9OT1RfRk9VTkQQBBIoCiRTT1VSQ0VfU1lOQ19GQUlMVVJFX1JFQVNPTl9UT09fTEFSR0UQBRIvCitTT1VSQ0VfU1lOQ19GQUlMVVJFX1JFQVNPTl9IT1NUX1VOQVZBSUxBQkxFEAYSJAogU09VUkNFX1NZTkNfRkFJTFVSRV9SRUFTT05fT1RIRVIQBxIuCipTT1VSQ0VfU1lOQ19GQUlMVVJFX1JFQVNPTl9ERUxJVkVSWV9GQUlMRUQQCCqcAQoRU291cmNlU3luY1RyaWdnZXISIwofU09VUkNFX1NZTkNfVFJJR0dFUl9VTlNQRUNJRklFRBAAEh4KGlNPVVJDRV9TWU5DX1RSSUdHRVJfTUFOVUFMEAESIQodU09VUkNFX1NZTkNfVFJJR0dFUl9TQ0hFRFVMRUQQAhIfChtTT1VSQ0VfU1lOQ19UUklHR0VSX1dFQkhPT0sQAyqPAQoWRGF0YXNvdXJjZURvbWFpblN0YXR1cxIoCiREQVRBU09VUkNFX0RPTUFJTl9TVEFUVVNfVU5TUEVDSUZJRUQQABIkCiBEQVRBU09VUkNFX0RPTUFJTl9TVEFUVVNfUEVORElORxABEiUKIURBVEFTT1VSQ0VfRE9NQUlOX1NUQVRVU19WRVJJRklFRBACKpUDChpTb3VyY2VEZWxlZ2F0aW9uUmV2b2NhdGlvbhIsCihTT1VSQ0VfREVMRUdBVElPTl9SRVZPQ0FUSU9OX1VOU1BFQ0lGSUVEEAASKAokU09VUkNFX0RFTEVHQVRJT05fUkVWT0NBVElPTl9SRVZPS0VEEAESKQolU09VUkNFX0RFTEVHQVRJT05fUkVWT0NBVElPTl9SRVBMQUNFRBACEi8KK1NPVVJDRV9ERUxFR0FUSU9OX1JFVk9DQVRJT05fU09VUkNFX0RFTEVURUQQAxIvCitTT1VSQ0VfREVMRUdBVElPTl9SRVZPQ0FUSU9OX01FTUJFUl9SRU1PVkVEEAQSMAosU09VUkNFX0RFTEVHQVRJT05fUkVWT0NBVElPTl9QRVJNSVNTSU9OX0xPU1QQBRIuCipTT1VSQ0VfREVMRUdBVElPTl9SRVZPQ0FUSU9OX1VTRVJfSU5BQ1RJVkUQBhIwCixTT1VSQ0VfREVMRUdBVElPTl9SRVZPQ0FUSU9OX0JJTkRJTkdfQ0hBTkdFRBAHMok4ChFEYXRhc291cmNlU2VydmljZRK5AwocUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0cxI1LnNhYXMuYWNjb3VudHMudjEuUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1JlcXVlc3QaNi5zYWFzLmFjY291bnRzLnYxLlBydW5lU291cmNlT3BlcmF0aW9uUmVjZWlwdHNSZXNwb25zZSKpAsLzGGwIAhADGhFkYXRhc291cmNlOmludm9rZSIRZGF0YXNvdXJjZTppbnZva2UqDwoJc291cmNlX2lkEAQYAzABOiMKH3NhYXMuZGF0YXNvdXJjZS5yZWNlaXB0cy5wcnVuZWQQAkADSARQA1gDYAHa8xi0AQoCCDwSAwjYBBgFIgIIAioLVU5BVkFJTEFCTEUqElJFU09VUkNFX0VYSEFVU1RFRCoHQUJPUlRFRDIPc2Fhcy1kYXRhc291cmNlSkYvc2Fhcy5hY2NvdW50cy52MS5EYXRhc291cmNlU2VydmljZS9Mb29rdXBQcnVuZVNvdXJjZU9wZXJhdGlvblJlY2VpcHRzUIAgWIAgYAFyGAoGc291cmNlEgZpbnZva2USBHJlYWQYARLmAQoiTG9va3VwUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0cxI7LnNhYXMuYWNjb3VudHMudjEuTG9va3VwUHJ1bmVTb3VyY2VPcGVyYXRpb25SZWNlaXB0c1JlcXVlc3QaNi5zYWFzLmFjY291bnRzLnYxLlBydW5lU291cmNlT3BlcmF0aW9uUmVjZWlwdHNSZXNwb25zZSJLwvMYRwgCEAMaD2RhdGFzb3VyY2U6cmVhZCIPZGF0YXNvdXJjZTpyZWFkKg8KCWVmZmVjdF9pZBAEGAMwAToCEAFAAUgDUANYA2ABEvwDChVJbnZva2VTb3VyY2VPcGVyYXRpb24SLi5zYWFzLmFjY291bnRzLnYxLkludm9rZVNvdXJjZU9wZXJhdGlvblJlcXVlc3QaLy5zYWFzLmFjY291bnRzLnYxLkludm9rZVNvdXJjZU9wZXJhdGlvblJlc3BvbnNlIoEDwvMYbggCEAMaEWRhdGFzb3VyY2U6aW52b2tlIhFkYXRhc291cmNlOmludm9rZSoPCglzb3VyY2VfaWQQBBgDMAE6JQohc2Fhcy5kYXRhc291cmNlLm9wZXJhdGlvbi5pbnZva2VkEARAA0gEUARYBGAB2vMYrwEKAgg8EgMI2AQYBSICCAIqC1VOQVZBSUxBQkxFKhJSRVNPVVJDRV9FWEhBVVNURUQqB0FCT1JURUQyD3NhYXMtZGF0YXNvdXJjZUo/L3NhYXMuYWNjb3VudHMudjEuRGF0YXNvdXJjZVNlcnZpY2UvTG9va3VwSW52b2tlU291cmNlT3BlcmF0aW9uUICABFiAgEBgAXIYCgZzb3VyY2USBmludm9rZRIEcmVhZBgBgtPkkwJVOgEqIlAvdjEvb3JnYW5pemF0aW9ucy97b3JnX2lkfS9kYXRhc291cmNlcy97c291cmNlX2lkfS9vcGVyYXRpb25zL3tvcGVyYXRpb259Omludm9rZRKHAgobTG9va3VwSW52b2tlU291cmNlT3BlcmF0aW9uEjQuc2Fhcy5hY2NvdW50cy52MS5Mb29rdXBJbnZva2VTb3VyY2VPcGVyYXRpb25SZXF1ZXN0Gi8uc2Fhcy5hY2NvdW50cy52MS5JbnZva2VTb3VyY2VPcGVyYXRpb25SZXNwb25zZSKAAcLzGEcIAhADGg9kYXRhc291cmNlOnJlYWQiD2RhdGFzb3VyY2U6cmVhZCoPCgllZmZlY3RfaWQQBBgDMAE6AhABQAFIA1ADWARgAYLT5JMCLxItL3YxL2RhdGFzb3VyY2Utb3BlcmF0aW9uLXJlY2VpcHRzL3tlZmZlY3RfaWR9EoUCChRMaXN0U291cmNlT3BlcmF0aW9ucxItLnNhYXMuYWNjb3VudHMudjEuTGlzdFNvdXJjZU9wZXJhdGlvbnNSZXF1ZXN0Gi4uc2Fhcy5hY2NvdW50cy52MS5MaXN0U291cmNlT3BlcmF0aW9uc1Jlc3BvbnNlIo0BwvMYRAgCEAMaD2RhdGFzb3VyY2U6cmVhZCIPZGF0YXNvdXJjZTpyZWFkKgwKBm9yZ19pZBACGAEwAToCEAFAAUgDUANYA2ABgtPkkwI/Ej0vdjEvb3JnYW5pemF0aW9ucy97b3JnX2lkfS9kYXRhc291cmNlcy97c291cmNlX2lkfS9vcGVyYXRpb25zEpMCChdEZWNsYXJlU291cmNlT3BlcmF0aW9ucxIwLnNhYXMuYWNjb3VudHMudjEuRGVjbGFyZVNvdXJjZU9wZXJhdGlvbnNSZXF1ZXN0GjEuc2Fhcy5hY2NvdW50cy52MS5EZWNsYXJlU291cmNlT3BlcmF0aW9uc1Jlc3BvbnNlIpIBwvMYRggCEAQqDAoGb3JnX2lkEAIYATABOiYKInNhYXMuZGF0YXNvdXJjZS5vcGVyYXRpb24uZGVjbGFyZWQQAkABSARQA1gDYAGC0+STAkI6ASoiPS92MS9vcmdhbml6YXRpb25zL3tvcmdfaWR9L2RhdGFzb3VyY2VzL3tzb3VyY2VfaWR9L29wZXJhdGlvbnMSrAEKD0FkZEdpdEh1YlNvdXJjZRIoLnNhYXMuYWNjb3VudHMudjEuQWRkR2l0SHViU291cmNlUmVxdWVzdBopLnNhYXMuYWNjb3VudHMudjEuQWRkR2l0SHViU291cmNlUmVzcG9uc2UiRMLzGEAIAhAEKgwKBm9yZ19pZBACGAEwATogChxzYWFzLmRhdGFzb3VyY2Uuc291cmNlLmFkZGVkEAJAAUgEUARYA2ABEpoBCglBZGRTb3VyY2USIi5zYWFzLmFjY291bnRzLnYxLkFkZFNvdXJjZVJlcXVlc3QaIy5zYWFzLmFjY291bnRzLnYxLkFkZFNvdXJjZVJlc3BvbnNlIkTC8xhACAIQBCoMCgZvcmdfaWQQAhgBMAE6IAocc2Fhcy5kYXRhc291cmNlLnNvdXJjZS5hZGRlZBACQAFIBFAEWANgARKPAQoUR2V0RGF0YXNvdXJjZUNhdGFsb2cSLS5zYWFzLmFjY291bnRzLnYxLkdldERhdGFzb3VyY2VDYXRhbG9nUmVxdWVzdBouLnNhYXMuYWNjb3VudHMudjEuR2V0RGF0YXNvdXJjZUNhdGFsb2dSZXNwb25zZSIYwvMYFAgCEAEwAToCEAFAAUgDUAJYAmABEoIBCgtMaXN0U291cmNlcxIkLnNhYXMuYWNjb3VudHMudjEuTGlzdFNvdXJjZXNSZXF1ZXN0GiUuc2Fhcy5hY2NvdW50cy52MS5MaXN0U291cmNlc1Jlc3BvbnNlIibC8xgiCAIQAyoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARJ8CglHZXRTb3VyY2USIi5zYWFzLmFjY291bnRzLnYxLkdldFNvdXJjZVJlcXVlc3QaIy5zYWFzLmFjY291bnRzLnYxLkdldFNvdXJjZVJlc3BvbnNlIibC8xgiCAIQAyoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARKeAQoKU3luY1NvdXJjZRIjLnNhYXMuYWNjb3VudHMudjEuU3luY1NvdXJjZVJlcXVlc3QaJC5zYWFzLmFjY291bnRzLnYxLlN5bmNTb3VyY2VSZXNwb25zZSJFwvMYQQgCEAQqDAoGb3JnX2lkEAIYATABOiEKHXNhYXMuZGF0YXNvdXJjZS5zb3VyY2Uuc3luY2VkEAJAAUgEUARYAmABEogBCg1HZXRTb3VyY2VTeW5jEiYuc2Fhcy5hY2NvdW50cy52MS5HZXRTb3VyY2VTeW5jUmVxdWVzdBonLnNhYXMuYWNjb3VudHMudjEuR2V0U291cmNlU3luY1Jlc3BvbnNlIibC8xgiCAIQBCoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARKlAQoMRGVsZXRlU291cmNlEiUuc2Fhcy5hY2NvdW50cy52MS5EZWxldGVTb3VyY2VSZXF1ZXN0GiYuc2Fhcy5hY2NvdW50cy52MS5EZWxldGVTb3VyY2VSZXNwb25zZSJGwvMYQggCEAQqDAoGb3JnX2lkEAIYATABOiIKHnNhYXMuZGF0YXNvdXJjZS5zb3VyY2UucmVtb3ZlZBACQAFIBFACWAJgARLEAQoTQmVnaW5HaXRIdWJBcHBTZXR1cBIsLnNhYXMuYWNjb3VudHMudjEuQmVnaW5HaXRIdWJBcHBTZXR1cFJlcXVlc3QaLS5zYWFzLmFjY291bnRzLnYxLkJlZ2luR2l0SHViQXBwU2V0dXBSZXNwb25zZSJQwvMYTAgCEAQqDAoGb3JnX2lkEAIYATABOiwKKHNhYXMuZGF0YXNvdXJjZS5naXRodWJfYXBwLnNldHVwX3N0YXJ0ZWQQAkABSARQAlgEYAESzwEKFkNvbXBsZXRlR2l0SHViQXBwU2V0dXASLy5zYWFzLmFjY291bnRzLnYxLkNvbXBsZXRlR2l0SHViQXBwU2V0dXBSZXF1ZXN0GjAuc2Fhcy5hY2NvdW50cy52MS5Db21wbGV0ZUdpdEh1YkFwcFNldHVwUmVzcG9uc2UiUsLzGE4IAhAEKgwKBm9yZ19pZBACGAEwATouCipzYWFzLmRhdGFzb3VyY2UuZ2l0aHViX2FwcC5zZXR1cF9jb21wbGV0ZWQQAkABSARQBFgDYAESzQEKGE1pZ3JhdGVHaXRIdWJTb3VyY2VUb0FwcBIxLnNhYXMuYWNjb3VudHMudjEuTWlncmF0ZUdpdEh1YlNvdXJjZVRvQXBwUmVxdWVzdBoyLnNhYXMuYWNjb3VudHMudjEuTWlncmF0ZUdpdEh1YlNvdXJjZVRvQXBwUmVzcG9uc2UiSsLzGEYIAhAEKgwKBm9yZ19pZBACGAEwATomCiJzYWFzLmRhdGFzb3VyY2UuY3JlZGVudGlhbC51cGRhdGVkEAJAAUgEUAJYA2ABEtUBChpCZWdpbkRhdGFzb3VyY2VBY2NvdW50TGluaxIzLnNhYXMuYWNjb3VudHMudjEuQmVnaW5EYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0GjQuc2Fhcy5hY2NvdW50cy52MS5CZWdpbkRhdGFzb3VyY2VBY2NvdW50TGlua1Jlc3BvbnNlIkzC8xhICAIQAyoMCgZvcmdfaWQQAhgBMAE6KAokc2Fhcy5kYXRhc291cmNlLmFjY291bnRfbGlua19zdGFydGVkEAJAAUgEUAJYBGABEtgBCh1Db21wbGV0ZURhdGFzb3VyY2VBY2NvdW50TGluaxI2LnNhYXMuYWNjb3VudHMudjEuQ29tcGxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0Gjcuc2Fhcy5hY2NvdW50cy52MS5Db21wbGV0ZURhdGFzb3VyY2VBY2NvdW50TGlua1Jlc3BvbnNlIkbC8xhCCAIQAyoMCgZvcmdfaWQQAhgBMAE6Igoec2Fhcy5kYXRhc291cmNlLmFjY291bnRfbGlua2VkEAJAAUgEUARYA2ABErUBChxMaXN0TXlEYXRhc291cmNlQWNjb3VudExpbmtzEjUuc2Fhcy5hY2NvdW50cy52MS5MaXN0TXlEYXRhc291cmNlQWNjb3VudExpbmtzUmVxdWVzdBo2LnNhYXMuYWNjb3VudHMudjEuTGlzdE15RGF0YXNvdXJjZUFjY291bnRMaW5rc1Jlc3BvbnNlIibC8xgiCAIQAyoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARLUAQobRGVsZXRlRGF0YXNvdXJjZUFjY291bnRMaW5rEjQuc2Fhcy5hY2NvdW50cy52MS5EZWxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXF1ZXN0GjUuc2Fhcy5hY2NvdW50cy52MS5EZWxldGVEYXRhc291cmNlQWNjb3VudExpbmtSZXNwb25zZSJIwvMYRAgCEAMqDAoGb3JnX2lkEAIYATABOiQKIHNhYXMuZGF0YXNvdXJjZS5hY2NvdW50X3VubGlua2VkEAJAAUgEUAJYA2ABEqMBChZHZXREYXRhc291cmNlRGlyZWN0b3J5Ei8uc2Fhcy5hY2NvdW50cy52MS5HZXREYXRhc291cmNlRGlyZWN0b3J5UmVxdWVzdBowLnNhYXMuYWNjb3VudHMudjEuR2V0RGF0YXNvdXJjZURpcmVjdG9yeVJlc3BvbnNlIibC8xgiCAIQBCoMCgZvcmdfaWQQAhgBMAE6AhABQAFIA1ACWANgARK3AQoTQmluZERhdGFzb3VyY2VHcm91cBIsLnNhYXMuYWNjb3VudHMudjEuQmluZERhdGFzb3VyY2VHcm91cFJlcXVlc3QaLS5zYWFzLmFjY291bnRzLnYxLkJpbmREYXRhc291cmNlR3JvdXBSZXNwb25zZSJDwvMYPwgCEAQqDAoGb3JnX2lkEAIYATABOh8KG3NhYXMuZGF0YXNvdXJjZS5ncm91cF9ib3VuZBACQAFIBFACWANgARK/AQoVVW5iaW5kRGF0YXNvdXJjZUdyb3VwEi4uc2Fhcy5hY2NvdW50cy52MS5VbmJpbmREYXRhc291cmNlR3JvdXBSZXF1ZXN0Gi8uc2Fhcy5hY2NvdW50cy52MS5VbmJpbmREYXRhc291cmNlR3JvdXBSZXNwb25zZSJFwvMYQQgCEAQqDAoGb3JnX2lkEAIYATABOiEKHXNhYXMuZGF0YXNvdXJjZS5ncm91cF91bmJvdW5kEAJAAUgEUAJYA2ABEsABChVDbGFpbURhdGFzb3VyY2VEb21haW4SLi5zYWFzLmFjY291bnRzLnYxLkNsYWltRGF0YXNvdXJjZURvbWFpblJlcXVlc3QaLy5zYWFzLmFjY291bnRzLnYxLkNsYWltRGF0YXNvdXJjZURvbWFpblJlc3BvbnNlIkbC8xhCCAIQBCoMCgZvcmdfaWQQAhgBMAE6Igoec2Fhcy5kYXRhc291cmNlLmRvbWFpbl9jbGFpbWVkEAJAAUgEUAJYA2ABEsQBChZWZXJpZnlEYXRhc291cmNlRG9tYWluEi8uc2Fhcy5hY2NvdW50cy52MS5WZXJpZnlEYXRhc291cmNlRG9tYWluUmVxdWVzdBowLnNhYXMuYWNjb3VudHMudjEuVmVyaWZ5RGF0YXNvdXJjZURvbWFpblJlc3BvbnNlIkfC8xhDCAIQBCoMCgZvcmdfaWQQAhgBMAE6Iwofc2Fhcy5kYXRhc291cmNlLmRvbWFpbl92ZXJpZmllZBACQAFIBFACWANgARLDAQoWRGVsZXRlRGF0YXNvdXJjZURvbWFpbhIvLnNhYXMuYWNjb3VudHMudjEuRGVsZXRlRGF0YXNvdXJjZURvbWFpblJlcXVlc3QaMC5zYWFzLmFjY291bnRzLnYxLkRlbGV0ZURhdGFzb3VyY2VEb21haW5SZXNwb25zZSJGwvMYQggCEAQqDAoGb3JnX2lkEAIYATABOiIKHnNhYXMuZGF0YXNvdXJjZS5kb21haW5fcmVtb3ZlZBACQAFIBFACWANgARKgAQoVTGlzdFNvdXJjZURlbGVnYXRpb25zEi4uc2Fhcy5hY2NvdW50cy52MS5MaXN0U291cmNlRGVsZWdhdGlvbnNSZXF1ZXN0Gi8uc2Fhcy5hY2NvdW50cy52MS5MaXN0U291cmNlRGVsZWdhdGlvbnNSZXNwb25zZSImwvMYIggCEAQqDAoGb3JnX2lkEAIYATABOgIQAUABSANQAlgDYAESxwEKFlJldm9rZVNvdXJjZURlbGVnYXRpb24SLy5zYWFzLmFjY291bnRzLnYxLlJldm9rZVNvdXJjZURlbGVnYXRpb25SZXF1ZXN0GjAuc2Fhcy5hY2NvdW50cy52MS5SZXZva2VTb3VyY2VEZWxlZ2F0aW9uUmVzcG9uc2UiSsLzGEYIAhAEKgwKBm9yZ19pZBACGAEwATomCiJzYWFzLmRhdGFzb3VyY2UuZGVsZWdhdGlvbi5yZXZva2VkEAJAAUgEUAJYA2ABEusBChZEZWxlZ2F0ZVNvdXJjZVRyaWdnZXJzEi8uc2Fhcy5hY2NvdW50cy52MS5EZWxlZ2F0ZVNvdXJjZVRyaWdnZXJzUmVxdWVzdBowLnNhYXMuYWNjb3VudHMudjEuRGVsZWdhdGVTb3VyY2VUcmlnZ2Vyc1Jlc3BvbnNlIm7C8xhqCAIQBCoMCgZvcmdfaWQQAhgBMAE6Sgoic2Fhcy5kYXRhc291cmNlLmRlbGVnYXRpb24uY3JlYXRlZAoic2Fhcy5kYXRhc291cmNlLmRlbGVnYXRpb24ucmV2b2tlZBACQAFIBFACWANgARKyAQobR2V0U291cmNlVHJpZ2dlckRlY2xhcmF0aW9uEjQuc2Fhcy5hY2NvdW50cy52MS5HZXRTb3VyY2VUcmlnZ2VyRGVjbGFyYXRpb25SZXF1ZXN0GjUuc2Fhcy5hY2NvdW50cy52MS5HZXRTb3VyY2VUcmlnZ2VyRGVjbGFyYXRpb25SZXNwb25zZSImwvMYIggCEAQqDAoGb3JnX2lkEAIYATABOgIQAUABSANQAlgDYAESgwMKD1JlY29uY2lsZVNvdXJjZRIoLnNhYXMuYWNjb3VudHMudjEuUmVjb25jaWxlU291cmNlUmVxdWVzdBopLnNhYXMuYWNjb3VudHMudjEuUmVjb25jaWxlU291cmNlUmVzcG9uc2UimgLC8xhqCAIQAxoRZGF0YXNvdXJjZTppbnZva2UiEWRhdGFzb3VyY2U6aW52b2tlKg8KCXNvdXJjZV9pZBAEGAMwATohCh1zYWFzLmRhdGFzb3VyY2Uuc291cmNlLnN5bmNlZBACQANIBFACWAJgAdrzGKcBCgIIPBIDCNgEGAUiAggCKgtVTkFWQUlMQUJMRSoSUkVTT1VSQ0VfRVhIQVVTVEVEKgdBQk9SVEVEMg9zYWFzLWRhdGFzb3VyY2VKOS9zYWFzLmFjY291bnRzLnYxLkRhdGFzb3VyY2VTZXJ2aWNlL0xvb2t1cFJlY29uY2lsZVNvdXJjZVCAIFiAIGABchgKBnNvdXJjZRIGaW52b2tlEgRyZWFkGAESvwEKFUxvb2t1cFJlY29uY2lsZVNvdXJjZRIuLnNhYXMuYWNjb3VudHMudjEuTG9va3VwUmVjb25jaWxlU291cmNlUmVxdWVzdBopLnNhYXMuYWNjb3VudHMudjEuUmVjb25jaWxlU291cmNlUmVzcG9uc2UiS8LzGEcIAhADGg9kYXRhc291cmNlOnJlYWQiD2RhdGFzb3VyY2U6cmVhZCoPCgllZmZlY3RfaWQQBBgDMAE6AhABQAFIA1ACWAJgAUK3AQoUY29tLnNhYXMuYWNjb3VudHMudjFCD0RhdGFzb3VyY2VQcm90b1ABWixhY2NvdW50cy9wa2cvZ2VuL3NhYXMvYWNjb3VudHMvdjE7YWNjb3VudHN2MaICA1NBWKoCEFNhYXMuQWNjb3VudHMuVjHKAhBTYWFzXEFjY291bnRzXFYx4gIcU2Fhc1xBY2NvdW50c1xWMVxHUEJNZXRhZGF0YeoCElNhYXM6OkFjY291bnRzOjpWMWIGcHJvdG8z", [file_buf_validate_validate, file_codefly_runnable_v0_options, file_google_api_annotations, file_google_protobuf_duration, file_google_protobuf_struct, file_google_protobuf_timestamp, file_saas_jobs_v1_jobs, file_saas_policy_v1_options]); /** * GitHubDatasourceConfig is the public, non-secret configuration of a GitHub @@ -2416,6 +2416,24 @@ export const RevokeSourceDelegationResponseSchema: GenMessage = /*@__PURE__*/ messageDesc(file_saas_accounts_v1_platform_admin, 51); +/** + * @generated from message saas.accounts.v1.ResolveModuleTenantIdentityRequest + */ +export type ResolveModuleTenantIdentityRequest = Message<"saas.accounts.v1.ResolveModuleTenantIdentityRequest"> & { + /** + * prefix is the module principal's registration prefix and binding the key + * of its operation_audiences entry. + * + * @generated from field: string prefix = 1; + */ + prefix: string; + + /** + * @generated from field: string binding = 2; + */ + binding: string; + + /** + * organization_id is the tenant the capability would act for. + * + * @generated from field: string organization_id = 3; + */ + organizationId: string; +}; + +/** + * Describes the message saas.accounts.v1.ResolveModuleTenantIdentityRequest. + * Use `create(ResolveModuleTenantIdentityRequestSchema)` to create a new message. + */ +export const ResolveModuleTenantIdentityRequestSchema: GenMessage = /*@__PURE__*/ + messageDesc(file_saas_accounts_v1_platform_admin, 52); + +/** + * ModuleTenantIdentity is what one per-tenant mint would assert. Every field is + * the host's: nothing here is requestable. + * + * @generated from message saas.accounts.v1.ModuleTenantIdentity + */ +export type ModuleTenantIdentity = Message<"saas.accounts.v1.ModuleTenantIdentity"> & { + /** + * principal_id is the module's own service principal, which owns the + * capability and acts directly — there is no person and no actor hop. + * + * @generated from field: string principal_id = 1; + */ + principalId: string; + + /** + * tenant is the organization it would act for, and audience the service the + * binding declares it may call. A binding whose audience is the module's own + * prefix is one the module admits itself, which is how unattended work is + * admitted by the module that executes it. + * + * @generated from field: string tenant = 2; + */ + tenant: string; + + /** + * @generated from field: string audience = 3; + */ + audience: string; + + /** + * scopes is exactly what the capability would carry, as + * `kind:action[:resource]`: the binding's headless_scopes narrowed by THIS + * organization's installation scope. Never its invoke_scopes, which describe + * authority exercised on a person's behalf. + * + * @generated from field: repeated string scopes = 4; + */ + scopes: string[]; + + /** + * lifetime_seconds is the fixed lifetime every such capability carries. + * + * @generated from field: int64 lifetime_seconds = 5; + */ + lifetimeSeconds: bigint; + + /** + * revision is the authorization revision it would be sealed with: a digest + * of the module's whole effective entry, so any change to the entry stops + * confirming every capability minted under the old one. + * + * @generated from field: uint64 revision = 6; + */ + revision: bigint; + + /** + * shared says the principal is unpinned and declares cross_tenant, so it may + * act for more than one organization. A pinned principal reads false and can + * only ever name the tenant its envelope declares. + * + * @generated from field: bool shared = 7; + */ + shared: boolean; +}; + +/** + * Describes the message saas.accounts.v1.ModuleTenantIdentity. + * Use `create(ModuleTenantIdentitySchema)` to create a new message. + */ +export const ModuleTenantIdentitySchema: GenMessage = /*@__PURE__*/ + messageDesc(file_saas_accounts_v1_platform_admin, 53); + +/** + * ModuleTenantIdentityMint is one capability actually issued, as the audit + * trail recorded it. There is no other record: a capability lives a minute and + * nothing caches one. + * + * @generated from message saas.accounts.v1.ModuleTenantIdentityMint + */ +export type ModuleTenantIdentityMint = Message<"saas.accounts.v1.ModuleTenantIdentityMint"> & { + /** + * @generated from field: string record = 1; + */ + record: string; + + /** + * @generated from field: string tenant = 2; + */ + tenant: string; + + /** + * @generated from field: string binding = 3; + */ + binding: string; + + /** + * @generated from field: string audience = 4; + */ + audience: string; + + /** + * @generated from field: repeated string scopes = 5; + */ + scopes: string[]; + + /** + * @generated from field: google.protobuf.Timestamp minted_at = 6; + */ + mintedAt?: Timestamp; +}; + +/** + * Describes the message saas.accounts.v1.ModuleTenantIdentityMint. + * Use `create(ModuleTenantIdentityMintSchema)` to create a new message. + */ +export const ModuleTenantIdentityMintSchema: GenMessage = /*@__PURE__*/ + messageDesc(file_saas_accounts_v1_platform_admin, 54); + +/** + * @generated from message saas.accounts.v1.ResolveModuleTenantIdentityResponse + */ +export type ResolveModuleTenantIdentityResponse = Message<"saas.accounts.v1.ResolveModuleTenantIdentityResponse"> & { + /** + * identity is set when a mint for this organization would be issued; refusal + * says why it would not. Exactly one is present, and a refusal is a decision + * about declared authority rather than an outage. + * + * @generated from field: saas.accounts.v1.ModuleTenantIdentity identity = 1; + */ + identity?: ModuleTenantIdentity; + + /** + * @generated from field: string refusal = 2; + */ + refusal: string; + + /** + * recent is the trail of capabilities this module was actually issued for + * this organization, newest first. + * + * @generated from field: repeated saas.accounts.v1.ModuleTenantIdentityMint recent = 3; + */ + recent: ModuleTenantIdentityMint[]; +}; + +/** + * Describes the message saas.accounts.v1.ResolveModuleTenantIdentityResponse. + * Use `create(ResolveModuleTenantIdentityResponseSchema)` to create a new message. + */ +export const ResolveModuleTenantIdentityResponseSchema: GenMessage = /*@__PURE__*/ + messageDesc(file_saas_accounts_v1_platform_admin, 55); + /** * CatalogueEntryKind distinguishes a composed module from a solution. * @@ -2018,6 +2203,18 @@ export const PlatformAdminService: GenService<{ input: typeof PutModuleEnvelopeRequestSchema; output: typeof PutModuleEnvelopeResponseSchema; }, + /** + * ResolveModuleTenantIdentity answers what a per-tenant module operation + * context would assert for one module, one of its bindings and one + * organization — or why it would be refused. It issues no capability. + * + * @generated from rpc saas.accounts.v1.PlatformAdminService.ResolveModuleTenantIdentity + */ + resolveModuleTenantIdentity: { + methodKind: "unary"; + input: typeof ResolveModuleTenantIdentityRequestSchema; + output: typeof ResolveModuleTenantIdentityResponseSchema; + }, }> = /*@__PURE__*/ serviceDesc(file_saas_accounts_v1_platform_admin, 0); diff --git a/module/services/frontend/code/src/gen/saas/frontend/v1/plugin_catalog.ts b/module/services/frontend/code/src/gen/saas/frontend/v1/plugin_catalog.ts index 2c316c1bd..14373dfa0 100644 --- a/module/services/frontend/code/src/gen/saas/frontend/v1/plugin_catalog.ts +++ b/module/services/frontend/code/src/gen/saas/frontend/v1/plugin_catalog.ts @@ -59,9 +59,9 @@ export const FRONTEND_ROUTES = [ { path: "/admin/platform/events", sourcePath: "src/app/admin/platform/events/page.tsx", match: "exact", access: "super_admin" }, { path: "/admin/platform/feature-flags", sourcePath: "src/app/admin/platform/feature-flags/page.tsx", match: "exact", access: "super_admin" }, { path: "/admin/platform/jobs", sourcePath: "src/app/admin/platform/jobs/page.tsx", match: "exact", access: "super_admin" }, + { path: "/admin/platform/module-identity", sourcePath: "src/app/admin/platform/module-identity/page.tsx", match: "exact", access: "super_admin" }, { path: "/admin/platform/organizations", sourcePath: "src/app/admin/platform/organizations/page.tsx", match: "exact", access: "super_admin" }, { path: "/admin/platform/plugin-transport", sourcePath: "src/app/admin/platform/plugin-transport/page.tsx", match: "exact", access: "super_admin" }, - { path: "/admin/platform/unattended-work", sourcePath: "src/app/admin/platform/unattended-work/page.tsx", match: "exact", access: "super_admin" }, { path: "/admin/platform/waitlist", sourcePath: "src/app/admin/platform/waitlist/page.tsx", match: "exact", access: "super_admin" }, { path: "/admin/roles", sourcePath: "src/app/admin/roles/page.tsx", match: "exact", access: "admin" }, { path: "/admin/roles/{roleId}", sourcePath: "src/app/admin/roles/[roleId]/page.tsx", match: "parameter", access: "admin" }, @@ -70,6 +70,7 @@ export const FRONTEND_ROUTES = [ { path: "/admin/sso", sourcePath: "src/app/admin/sso/page.tsx", match: "exact", access: "admin" }, { path: "/admin/teams", sourcePath: "src/app/admin/teams/page.tsx", match: "exact", access: "authenticated" }, { path: "/admin/teams/{teamId}", sourcePath: "src/app/admin/teams/[teamId]/page.tsx", match: "parameter", access: "authenticated" }, + { path: "/admin/unattended-work", sourcePath: "src/app/admin/unattended-work/page.tsx", match: "exact", access: "admin" }, { path: "/admin/users", sourcePath: "src/app/admin/users/page.tsx", match: "exact", access: "admin" }, { path: "/admin/users/{userId}", sourcePath: "src/app/admin/users/[userId]/page.tsx", match: "parameter", access: "admin" }, { path: "/admin/webhooks", sourcePath: "src/app/admin/webhooks/page.tsx", match: "exact", access: "admin" }, @@ -151,6 +152,7 @@ export const FRONTEND_NAVIGATION: readonly FrontendNavigationItem[] = [ { id: "admin-webhooks", plugin: "core-users", label: "Webhooks", href: "/admin/webhooks", icon: "Globe", group: "Integrations", access: "admin", requiredRole: "admin", requiredPermission: "webhooks:read", surfaces: ["command_palette", "plugin_registry", "sidebar"], order: 400 }, { id: "admin-solutions", plugin: "core-users", label: "Solutions", href: "/admin/solutions", icon: "Layers", group: "Integrations", access: "admin", requiredRole: "admin", requiredPermission: "roles:write", surfaces: ["command_palette", "plugin_registry", "sidebar"], order: 405 }, { id: "admin-datasources", plugin: "core-users", label: "Data sources", href: "/admin/datasources", icon: "HardDriveDownload", group: "Integrations", access: "admin", requiredRole: "admin", surfaces: ["command_palette", "plugin_registry", "sidebar"], order: 410 }, + { id: "admin-unattended-work", plugin: "core-users", label: "Unattended work", href: "/admin/unattended-work", icon: "KeyRound", group: "Integrations", access: "admin", requiredRole: "admin", surfaces: ["command_palette", "plugin_registry", "sidebar"], order: 415 }, { id: "admin-sso", plugin: "core-users", label: "Single Sign-On", href: "/admin/sso", icon: "KeyRound", group: "Integrations", access: "admin", requiredRole: "admin", surfaces: ["sidebar"], order: 420 }, { id: "api-docs", plugin: "audit", label: "API Docs", href: "/docs", icon: "BookOpen", group: "Developer", access: "admin", requiredRole: "admin", surfaces: ["plugin_registry", "sidebar"], order: 500 }, { id: "sdks", plugin: "audit", label: "SDKs", href: "/docs/sdks", icon: "FileText", group: "Developer", access: "admin", requiredRole: "admin", surfaces: ["plugin_registry", "sidebar"], order: 510 }, diff --git a/module/services/frontend/code/src/lib/__tests__/plugin-bff.test.ts b/module/services/frontend/code/src/lib/__tests__/plugin-bff.test.ts index ba75e0ee6..d2a288c0c 100644 --- a/module/services/frontend/code/src/lib/__tests__/plugin-bff.test.ts +++ b/module/services/frontend/code/src/lib/__tests__/plugin-bff.test.ts @@ -529,6 +529,10 @@ describe("generic frontend plugin BFF", () => { resolve: () => ({ ok: true, value: { + // A Connect alias mounted under a path prefix, which is the + // fixture's default. The handshake is a procedure of that + // alias like any other, so it lands under the prefix + // (issue #1121); the root-prefixed form is beside it. entry: entry("connect"), baseURL: "http://example-api.internal", }, @@ -539,7 +543,7 @@ describe("generic frontend plugin BFF", () => { expect(response.status).toBe(200); const [target, init] = fetchMock.mock.calls[0]; expect(String(target)).toBe( - "http://example-api.internal/saas.frontend.plugin.v1.FrontendPluginCapabilityService/GetFrontendPluginCapabilities", + "http://example-api.internal/api/v1/example/saas.frontend.plugin.v1.FrontendPluginCapabilityService/GetFrontendPluginCapabilities", ); expect(init?.method).toBe("POST"); expect(init?.body).toBe("{}"); @@ -939,6 +943,22 @@ describe("generic frontend plugin BFF", () => { ["RecordService"], ], ["a REST alias declaring the origin root", "rest", "/", null], + // The whole prefix rule, not just the root (issue #1121). The empty + // string is NOT the root, so comparing against the root alone admitted + // it — and `frontendServiceTargetPath("", path)` lands every relative + // path on the upstream ORIGIN, under the viewer's forwarded bearer. + ["a REST alias declaring no prefix", "rest", "", null], + ["a REST alias declaring a relative prefix", "rest", "api/v1", null], + ["a REST alias declaring a traversal", "rest", "/api/../private", null], + ["a connect alias declaring no prefix", "connect", "", null], + // A non-array service list has a `length` and no `every`: the check that + // assumed an array threw out of the handler as a 500. + [ + "a connect alias whose service list is a string", + "connect", + "/", + "example.records.v1.RecordService" as unknown as readonly string[], + ], ])( "refuses to proxy %s at all", async (_label, protocol, routePrefix, connectServices) => { @@ -967,6 +987,74 @@ describe("generic frontend plugin BFF", () => { }, ); + it("refuses the review's whole-upstream probe on a prefix-less REST alias", async () => { + // The probe as the review ran it: `admin/secret` under an entry whose + // `routePrefix` is `""`. Before this it was forwarded to + // `http://example-api.internal/admin/secret` and answered 200 under the + // viewer's own bearer. The refusal is the alias's, so nothing is sent. + const fetchMock = vi.fn(async () => new Response("secret") as Response); + const response = await handlePluginBffRequest( + request("/api/plugins/example/api/admin/secret"), + { ...params, path: ["admin", "secret"] }, + dependencies({ + ...resolved("rest", ""), + fetch: fetchMock as typeof fetch, + }), + ); + expect(response.status).toBe(503); + expect(await problemCode(response)).toBe("backend_unavailable"); + expect(fetchMock).not.toHaveBeenCalled(); + }); + + it("probes the capability handshake under a connect mount prefix", async () => { + // The fixed handshake is a Connect procedure like any other, so on a + // mounted alias it lands under the mount prefix (issue #1121). It used + // to be sent to the origin root unconditionally: a backend mounting + // Connect under `/v1/connect` answered its own 404, the alias was + // reported incompatible, and the mounted form this host advertises + // could never complete a handshake. + const targets: string[] = []; + const fetchMock = vi.fn(async (target: RequestInfo | URL) => { + targets.push(String(target)); + return new Response( + JSON.stringify({ + schemaVersion: 1, + contract: "example.api", + contractMajor: 1, + capabilities: [], + }), + { headers: { "content-type": "application/json" } }, + ); + }); + const response = await handlePluginBffRequest( + request("/api/plugins/example/api/.well-known/capabilities"), + capabilityParams, + dependencies({ + ...resolved("connect", "/v1/connect"), + fetch: fetchMock as typeof fetch, + }), + ); + expect(response.status).toBe(200); + expect(targets).toEqual([ + "http://example-api.internal/v1/connect/saas.frontend.plugin.v1.FrontendPluginCapabilityService/GetFrontendPluginCapabilities", + ]); + + // And a root-prefixed alias still probes the origin root, which is where + // the Connect protocol puts it. + targets.length = 0; + await handlePluginBffRequest( + request("/api/plugins/example/api/.well-known/capabilities"), + capabilityParams, + dependencies({ + ...resolved("connect", "/"), + fetch: fetchMock as typeof fetch, + }), + ); + expect(targets).toEqual([ + "http://example-api.internal/saas.frontend.plugin.v1.FrontendPluginCapabilityService/GetFrontendPluginCapabilities", + ]); + }); + it("carries a connect procedure under the mount prefix its requirement declares", async () => { // The non-root Connect prefix: the prefix says where the upstream mounts // Connect, the declared list says which of its services the alias speaks diff --git a/module/services/frontend/code/src/lib/__tests__/plugin-service-bindings.test.ts b/module/services/frontend/code/src/lib/__tests__/plugin-service-bindings.test.ts index c70384e42..a22f776b0 100644 --- a/module/services/frontend/code/src/lib/__tests__/plugin-service-bindings.test.ts +++ b/module/services/frontend/code/src/lib/__tests__/plugin-service-bindings.test.ts @@ -117,3 +117,66 @@ describe("server-only plugin service binding resolution", () => { } }); }); + +// THE GENERATED ALLOWLIST IS RE-VALIDATED AT LOAD (issue #1121). +// +// It is a build artifact, and this server reads it rather than the composition +// that validated it — so a rule nothing re-checks here is one a stale or +// hand-edited projection walks straight past. The entry is refused as +// `unavailable` rather than `not_installed`, because the alias IS installed and +// what cannot happen is this host serving it. +describe("an entry the composition's own rules would have refused", () => { + function withEntry( + overrides: Partial, + ): FrontendServiceAllowlist { + return { + ...allowlist, + entries: [{ ...allowlist.entries[0], ...overrides }], + }; + } + + it.each([ + // `""` is not the root, which is why comparing against the root alone + // admitted it — and it proxies the whole upstream origin. + ["no route prefix", { routePrefix: "" }], + ["a relative route prefix", { routePrefix: "api/v1" }], + ["a traversal in the prefix", { routePrefix: "/api/../private" }], + ["an empty segment", { routePrefix: "/api//private" }], + ["the origin root on a REST alias", { routePrefix: "/" }], + [ + "a connect alias with no declared services", + { protocol: "connect" as const, routePrefix: "/" }, + ], + [ + "a connect alias whose service list is not a list", + { + protocol: "connect" as const, + routePrefix: "/", + connectServices: + "example.records.v1.RecordService" as unknown as readonly string[], + }, + ], + ])("is unavailable: %s", (_label, overrides) => { + expect( + resolvePluginServiceFrom( + withEntry(overrides), + [endpoint()], + "example", + "api", + ), + ).toEqual({ ok: false, reason: "unavailable" }); + }); + + it("survives an allowlist whose entries are not a list", () => { + // A hand-edited or truncated projection: `find` on a non-array throws, + // and a throw out of the resolver is a 500 where a 404 is the answer. + expect( + resolvePluginServiceFrom( + { ...allowlist, entries: undefined as unknown as [] }, + [endpoint()], + "example", + "api", + ), + ).toEqual({ ok: false, reason: "not_installed" }); + }); +}); diff --git a/module/services/frontend/code/src/shared/lib/__tests__/read-outcome.test.ts b/module/services/frontend/code/src/shared/lib/__tests__/read-outcome.test.ts index 929f66905..653f91bcc 100644 --- a/module/services/frontend/code/src/shared/lib/__tests__/read-outcome.test.ts +++ b/module/services/frontend/code/src/shared/lib/__tests__/read-outcome.test.ts @@ -2,6 +2,7 @@ import { Code, ConnectError } from "@connectrpc/connect"; import { describe, expect, it } from "vitest"; import { mayKeepRetainedRows, + readHasNotAnswered, readOutcome, readOutcomeMessage, staleReadNotice, @@ -89,3 +90,80 @@ describe("what survives a failed refresh", () => { expect(staleReadNotice("empty", "this team's roles")).toBeNull(); }); }); + +// THE QUESTION BEFORE THE OUTCOME (issue #1121). `readOutcome` classifies a +// read that finished; this one says whether it has finished at all, and the +// five states below are the ones that reached production as "finished, nothing +// came back" — each turned by some card into an absence the host never +// reported. +describe("readHasNotAnswered", () => { + it("is true for a cold read on the wire", () => { + expect( + readHasNotAnswered({ + data: undefined, + error: null, + fetchStatus: "fetching", + }), + ).toBe(true); + }); + + it("is true for a cold read paused offline, where isFetching is false", () => { + expect( + readHasNotAnswered({ + data: undefined, + error: null, + fetchStatus: "paused", + }), + ).toBe(true); + }); + + // The state a refused refetch leaves: the refusal deleted the retained + // answer and the retry is paused, so the query reports status `success` + // with nothing in it and no error. `isPending` is false here. + it("is true once a refusal has deleted the answer and its retry is paused", () => { + expect( + readHasNotAnswered({ + data: undefined, + error: null, + fetchStatus: "paused", + }), + ).toBe(true); + }); + + it("is false with an answer in hand, refetching or not", () => { + expect( + readHasNotAnswered({ + data: { any: true }, + error: null, + fetchStatus: "fetching", + }), + ).toBe(false); + expect( + readHasNotAnswered({ + data: { any: true }, + error: null, + fetchStatus: "idle", + }), + ).toBe(false); + }); + + // A failure already answered stays on screen: a paused retry does not hide + // a refusal the reader has already been given. + it("is false once something has failed, even while a retry is paused", () => { + expect( + readHasNotAnswered({ + data: undefined, + error: new Error("permission denied"), + fetchStatus: "paused", + }), + ).toBe(false); + }); + + // A disabled query is idle: a read that was never issued is not in + // progress, which is what keeps a genuine "complete the selection" message. + it("is false for a disabled query, which is idle with nothing in it", () => { + expect( + readHasNotAnswered({ data: undefined, error: null, fetchStatus: "idle" }), + ).toBe(false); + }); +}); diff --git a/module/services/frontend/code/src/shared/lib/read-outcome.ts b/module/services/frontend/code/src/shared/lib/read-outcome.ts index df5e932c3..be9d8f1ad 100644 --- a/module/services/frontend/code/src/shared/lib/read-outcome.ts +++ b/module/services/frontend/code/src/shared/lib/read-outcome.ts @@ -87,3 +87,45 @@ export function staleReadNotice( ? `Couldn't refresh ${subject}, so this may be out of date.` : null; } + +/** + * Whether a read has produced no answer yet — so nothing may be asserted about + * what it would have said. + * + * `readOutcome` classifies a read that FINISHED. This answers the question + * before it, and every surface that states an absence needs both: a card may + * only say "there is nothing here" once a read succeeded and said so. + * + * No single query flag carries it. `isFetching` means a request is on the wire, + * so it is false while a read is PAUSED offline. `isPending` means no data has + * ever arrived, so it is false in the state a refused refetch leaves behind: the + * refusal deletes the retained answer (see `mayKeepRetainedRows`), its retry + * pauses, and the query sits at status `success` with `data` undefined and + * `error` null — answered once, holding nothing, and still trying. Each of + * those read as "finished, nothing came back", and the surfaces above them + * turned it into "no trigger is declared", "no child has been minted", "no + * reference is bound: an occurrence would be refused". + * + * What is true of all of them is simpler than the states themselves: nothing is + * in hand, nothing has failed yet, and a fetch is not idle. + * + * The three parts each carry their weight: + * - `data === undefined` — with an answer in hand there is nothing to wait for; + * a refetch over it is `staleReadNotice`'s business, not this one. + * - no `error` — a failure already answered must stay on screen. A paused retry + * does not hide a refusal the reader has already been given. + * - `fetchStatus !== "idle"` — a DISABLED query is idle, and a read that was + * never issued is not a read in progress. That is what keeps a genuine + * "complete the selection above" attached to an incomplete selection. + */ +export function readHasNotAnswered(read: { + data?: unknown; + error?: unknown; + fetchStatus: "fetching" | "paused" | "idle"; +}): boolean { + return ( + read.data === undefined && + (read.error ?? null) === null && + read.fetchStatus !== "idle" + ); +} diff --git a/module/services/frontend/code/tests/e2e/admin-routes-smoke.spec.ts b/module/services/frontend/code/tests/e2e/admin-routes-smoke.spec.ts index 958bad489..f28894ba7 100644 --- a/module/services/frontend/code/tests/e2e/admin-routes-smoke.spec.ts +++ b/module/services/frontend/code/tests/e2e/admin-routes-smoke.spec.ts @@ -53,7 +53,7 @@ const ROUTES: AdminRoute[] = [ platformGated: true, }, { - path: "/admin/platform/unattended-work", + path: "/admin/unattended-work", heading: /Unattended work/, platformGated: true, }, diff --git a/module/services/frontend/code/tests/e2e/unattended-work.spec.ts b/module/services/frontend/code/tests/e2e/unattended-work.spec.ts index de83e3bbb..cab535fcf 100644 --- a/module/services/frontend/code/tests/e2e/unattended-work.spec.ts +++ b/module/services/frontend/code/tests/e2e/unattended-work.spec.ts @@ -25,9 +25,9 @@ test.describe("unattended work", () => { test("the playground states whose authority an occurrence would run under", async ({ page, }) => { - await page.goto("/admin/platform/unattended-work"); + await page.goto("/admin/unattended-work"); await page.waitForURL( - (url) => url.pathname === "/admin/platform/unattended-work", + (url) => url.pathname === "/admin/unattended-work", { timeout: 15000 }, ); expect(page.url()).not.toContain("/auth/login"); diff --git a/module/services/frontend/code/ui-inventory.json b/module/services/frontend/code/ui-inventory.json index e9f85200b..1ca56615c 100644 --- a/module/services/frontend/code/ui-inventory.json +++ b/module/services/frontend/code/ui-inventory.json @@ -2498,7 +2498,7 @@ "remaining": "Owner stories or a reviewed nonvisual exclusion still required." }, { - "source": "src/app/admin/platform/unattended-work/page.tsx", + "source": "src/app/admin/unattended-work/page.tsx", "imports": [ "@/components/auth/role-gate", "@/features/unattended-work" @@ -2510,6 +2510,37 @@ "coverage": "missing", "remaining": "Owner stories or a reviewed nonvisual exclusion still required." }, + { + "source": "src/app/admin/platform/module-identity/page.tsx", + "imports": [ + "@/components/auth/role-gate", + "@/features/module-tenant-identity" + ], + "owner": "SaaS application", + "disposition": "keep feature-local", + "reason": "Next.js route or layout entry; owns host routing and server/provider composition. Full-page preview coverage is still pending.", + "stories": [], + "coverage": "missing", + "remaining": "Owner stories or a reviewed nonvisual exclusion still required." + }, + { + "source": "src/features/module-tenant-identity/ui/module-tenant-identity-playground.tsx", + "imports": [ + "@bufbuild/protobuf/wkt", + "lucide-react", + "react", + "@/components/empty-state", + "@/shared/lib/read-outcome", + "@/shared/ui", + "../service/queries" + ], + "owner": "SaaS application", + "disposition": "keep feature-local", + "reason": "Platform playground for the per-tenant module identity: it composes the kit's card, table and badge primitives and owns no visual of its own.", + "stories": [], + "coverage": "missing", + "remaining": "Owner stories or a reviewed nonvisual exclusion still required." + }, { "source": "src/app/admin/platform/waitlist/page.tsx", "imports": [ diff --git a/module/services/frontend/frontend.bindings.codefly.yaml b/module/services/frontend/frontend.bindings.codefly.yaml index e6aaf310a..ef6e5ca90 100644 --- a/module/services/frontend/frontend.bindings.codefly.yaml +++ b/module/services/frontend/frontend.bindings.codefly.yaml @@ -291,6 +291,24 @@ navigation: - plugin_registry - sidebar order: 410 + # The identity unattended work runs under, beside the sources it is bound to. + # Organization administrators own this: every RPC behind the page is org-scoped + # and ORG_ADMIN, so `access: admin` matches both the page's own gate and the + # boundary the route catalog derives from `/admin/` (issue #1121). While the + # page sat under /admin/platform/ the catalog derived `super_admin`, which + # disagreed with the gate and left org admins with no way to reach it. + - id: admin-unattended-work + plugin: core-users + label: Unattended work + path: /admin/unattended-work + icon: KeyRound + group: Integrations + access: admin + surfaces: + - command_palette + - plugin_registry + - sidebar + order: 415 - id: admin-sso plugin: core-users label: Single Sign-On diff --git a/module/services/frontend/generated/plugin-catalog.json b/module/services/frontend/generated/plugin-catalog.json index 0bbe6918e..5fd5967a8 100644 --- a/module/services/frontend/generated/plugin-catalog.json +++ b/module/services/frontend/generated/plugin-catalog.json @@ -126,20 +126,20 @@ "access": "FRONTEND_ROUTE_ACCESS_SUPER_ADMIN" }, { - "path": "/admin/platform/organizations", - "source_path": "src/app/admin/platform/organizations/page.tsx", + "path": "/admin/platform/module-identity", + "source_path": "src/app/admin/platform/module-identity/page.tsx", "match": "FRONTEND_ROUTE_MATCH_EXACT", "access": "FRONTEND_ROUTE_ACCESS_SUPER_ADMIN" }, { - "path": "/admin/platform/plugin-transport", - "source_path": "src/app/admin/platform/plugin-transport/page.tsx", + "path": "/admin/platform/organizations", + "source_path": "src/app/admin/platform/organizations/page.tsx", "match": "FRONTEND_ROUTE_MATCH_EXACT", "access": "FRONTEND_ROUTE_ACCESS_SUPER_ADMIN" }, { - "path": "/admin/platform/unattended-work", - "source_path": "src/app/admin/platform/unattended-work/page.tsx", + "path": "/admin/platform/plugin-transport", + "source_path": "src/app/admin/platform/plugin-transport/page.tsx", "match": "FRONTEND_ROUTE_MATCH_EXACT", "access": "FRONTEND_ROUTE_ACCESS_SUPER_ADMIN" }, @@ -191,6 +191,12 @@ "match": "FRONTEND_ROUTE_MATCH_PARAMETER", "access": "FRONTEND_ROUTE_ACCESS_AUTHENTICATED" }, + { + "path": "/admin/unattended-work", + "source_path": "src/app/admin/unattended-work/page.tsx", + "match": "FRONTEND_ROUTE_MATCH_EXACT", + "access": "FRONTEND_ROUTE_ACCESS_ADMIN" + }, { "path": "/admin/users", "source_path": "src/app/admin/users/page.tsx", @@ -723,6 +729,21 @@ ], "order": 410 }, + { + "id": "admin-unattended-work", + "plugin": "core-users", + "label": "Unattended work", + "path": "/admin/unattended-work", + "icon": "KeyRound", + "group": "Integrations", + "access": "FRONTEND_ROUTE_ACCESS_ADMIN", + "surfaces": [ + "FRONTEND_NAVIGATION_SURFACE_COMMAND_PALETTE", + "FRONTEND_NAVIGATION_SURFACE_PLUGIN_REGISTRY", + "FRONTEND_NAVIGATION_SURFACE_SIDEBAR" + ], + "order": 415 + }, { "id": "admin-sso", "plugin": "core-users",