diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d84c281b1..75f333792 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -457,6 +457,8 @@ jobs: run: codefly generate contracts saas-starter --check - name: Check derived source operations run: codefly generate runnables saas-starter --check + - name: Check generated libraries are reproducible with the pinned CLI + run: bash scripts/ci/check-generated-libraries.sh module-package: name: Immutable module package diff --git a/AGENTS.md b/AGENTS.md index 8aa54ade4..1cc7bfab8 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -184,6 +184,9 @@ Skills in `.claude/skills/`, loaded when the task calls for them: ## Building, testing, and CI +- CI and local runtime qualification use released Codefly CLI **v0.1.215**, + pinned in `scripts/ci/install-codefly.sh`. It resolves the Codefly-owned + `egress` dependency and exports the multi-package host-interface contract. - Canonical **service** gate: `codefly ci run`. It owns lint, compile/typecheck, tests, dependency/vuln audit, SBOM, and container build for every service in the graph. See [RELEASE_GATES.md](./RELEASE_GATES.md). diff --git a/configuration_defaults_test.go b/configuration_defaults_test.go index 1553af731..e83ae191e 100644 --- a/configuration_defaults_test.go +++ b/configuration_defaults_test.go @@ -120,9 +120,22 @@ func moduleDefaultFiles(group string) []string { names = append(names, name) } } + // A document group (read with WorkspaceConfigurationDocument) is one YAML + // document, .yaml, which is how Codefly reads a configuration + // document; its default is a document that states at least one key. + name := group + ".yaml" + if data, err := os.ReadFile(filepath.Join(moduleConfigLocalDir, name)); err == nil && statesADocument(data) { + names = append(names, name) + } return names } +// statesADocument reports whether data is one YAML mapping with at least one key. +func statesADocument(data []byte) bool { + var document map[string]any + return yaml.Unmarshal(data, &document) == nil && len(document) > 0 +} + // repoRootMirrorsModule verifies the repo-root entry for name is a symlink that // resolves to the module default of the same name. shipsDefault(workspace, …) // alone is too weak: os.ReadFile follows the link, so it also passes a symlink @@ -234,11 +247,12 @@ func assertSecretDefaultIsPlaceholder(t *testing.T, name string) { func TestEveryDeclaredGroupShipsALocalDefault(t *testing.T) { for _, group := range declaredWorkspaceConfigGroups(t) { - // CLI supplies this group per native run. An authored path (even an - // empty placeholder) conflicts with its render-owned declaration. - if group == "artifact-cache" { + // The CLI supplies these groups: artifact-cache per native run, egress + // from the environment's egress declaration. An authored path (even an + // empty placeholder) conflicts with its CLI-owned declaration. + if group == "artifact-cache" || group == "egress" { for _, directory := range []string{moduleConfigLocalDir, workspaceConfigLocalDir} { - for _, suffix := range []string{".env", ".secret.env"} { + for _, suffix := range []string{".env", ".secret.env", ".yaml"} { path := filepath.Join(directory, group+suffix) if _, err := os.Lstat(path); !os.IsNotExist(err) { t.Errorf("CLI-owned group %s must have no authored default at %s", group, path) @@ -250,7 +264,7 @@ func TestEveryDeclaredGroupShipsALocalDefault(t *testing.T) { // The base-synced location is what a base-synced consumer inherits. moduleDefaults := moduleDefaultFiles(group) if len(moduleDefaults) == 0 { - t.Errorf("declared config group %q has no default under the base-synced module subtree: add a %s/%s.env (or .secret.env) that assigns at least one variable, so a base-synced solution inherits it instead of dying at runtime-init with \"no configuration found for %s\"", + t.Errorf("declared config group %q has no default under the base-synced module subtree: add a %s/%s.env (or .secret.env, or a .yaml document) that assigns at least one variable, so a base-synced solution inherits it instead of dying at runtime-init with \"no configuration found for %s\"", group, moduleConfigLocalDir, group, group) } // Each module default this group ships must be mirrored by a repo-root diff --git a/configurations/local/fixture-grants.yaml b/configurations/local/fixture-grants.yaml new file mode 120000 index 000000000..79bcabfde --- /dev/null +++ b/configurations/local/fixture-grants.yaml @@ -0,0 +1 @@ +../../module/configurations/local/fixture-grants.yaml \ No newline at end of file diff --git a/go.mod b/go.mod index fbcf8bb45..70ee5ec07 100644 --- a/go.mod +++ b/go.mod @@ -1,9 +1,9 @@ module github.com/codefly-dev/agents/modules/saas-starter -go 1.27.0 +go 1.27.3 require ( - github.com/codefly-dev/core v0.18.0 + github.com/codefly-dev/core v0.19.7-0.20261025161440-4e7f8ef01ed2 gopkg.in/yaml.v3 v3.0.1 ) @@ -16,20 +16,20 @@ require ( github.com/Masterminds/semver/v3 v3.5.0 // indirect github.com/antlr4-go/antlr/v4 v4.13.1 // indirect github.com/go-openapi/analysis v1.0.0 // indirect - github.com/go-openapi/errors v0.22.8 // indirect + github.com/go-openapi/errors v0.22.9 // indirect github.com/go-openapi/jsonpointer v1.0.1 // indirect github.com/go-openapi/jsonreference v1.0.2 // indirect github.com/go-openapi/loads v0.25.3 // indirect github.com/go-openapi/spec v1.0.1 // indirect github.com/go-openapi/strfmt v0.27.2 // indirect - github.com/go-openapi/swag/conv v0.29.1 // indirect - github.com/go-openapi/swag/jsonutils v0.29.1 // indirect - github.com/go-openapi/swag/loading v0.29.1 // indirect - github.com/go-openapi/swag/mangling v0.29.1 // indirect - github.com/go-openapi/swag/pools v0.29.1 // indirect - github.com/go-openapi/swag/stringutils v0.29.1 // indirect - github.com/go-openapi/swag/typeutils v0.29.1 // indirect - github.com/go-openapi/swag/yamlutils v0.29.1 // indirect + github.com/go-openapi/swag/conv v0.29.2 // indirect + github.com/go-openapi/swag/jsonutils v0.29.2 // indirect + github.com/go-openapi/swag/loading v0.29.2 // indirect + github.com/go-openapi/swag/mangling v0.29.2 // indirect + github.com/go-openapi/swag/pools v0.29.2 // indirect + github.com/go-openapi/swag/stringutils v0.29.2 // indirect + github.com/go-openapi/swag/typeutils v0.29.2 // indirect + github.com/go-openapi/swag/yamlutils v0.29.2 // indirect github.com/go-viper/mapstructure/v2 v2.5.0 // indirect github.com/google/uuid v1.6.0 // indirect github.com/hashicorp/errwrap v1.1.0 // indirect @@ -41,14 +41,14 @@ require ( github.com/rogpeppe/go-internal v1.14.1 // indirect github.com/yoheimuta/go-protoparser/v4 v4.14.2 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect - golang.org/x/exp v0.0.0-20260820142414-ca536658362e // indirect + golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba // indirect golang.org/x/net v0.60.0 // indirect - golang.org/x/sys v0.48.0 // indirect + golang.org/x/sys v0.49.0 // indirect golang.org/x/term v0.46.0 // indirect golang.org/x/text v0.42.0 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 // indirect - google.golang.org/grpc v1.83.2 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect + google.golang.org/grpc v1.84.0 // indirect google.golang.org/protobuf v1.36.12 // indirect gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect ) diff --git a/go.sum b/go.sum index f91b517d1..98fdbf35e 100644 --- a/go.sum +++ b/go.sum @@ -28,8 +28,8 @@ github.com/cheggaaa/pb/v3 v3.2.1 h1:aprZbFRG+B7+ug76S8QZ6Y1PW168UHzOmbC3wa+aU6I= github.com/cheggaaa/pb/v3 v3.2.1/go.mod h1:U9hSVxoKqJrZIE3PkFG1xXXNaK/Ilzg+EF/scpXzEdw= github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk= github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM= -github.com/codefly-dev/core v0.18.0 h1:G7KmDlTUUfiTHQVKLEs9Vo+YywxjhmI11RqEBUA0L7Q= -github.com/codefly-dev/core v0.18.0/go.mod h1:FKBqn6GMGIsx9b3LNY6kKCRxCEjjeswvqt2CxSZWq20= +github.com/codefly-dev/core v0.19.7-0.20261025161440-4e7f8ef01ed2 h1:vxgPJMO0Ds4X/oDPCDqIy47xFwj919JRNcnC+5RSFVk= +github.com/codefly-dev/core v0.19.7-0.20261025161440-4e7f8ef01ed2/go.mod h1:1ina3kP+YSAL4tlZvnEYd4P8bFGnJECfkP86ojeeF1A= github.com/codefly-dev/gortk v0.2.0 h1:7bOlS5valYz2zil+fZctQNcPCYBcPj86abcw9N8h1hQ= github.com/codefly-dev/gortk v0.2.0/go.mod h1:dDWUMFgAP063OCGhTEpV7FFUj9+zTcxxO/nV80VKEwg= github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI= @@ -37,14 +37,14 @@ github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE= github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= -github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= -github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk= github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM= github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= -github.com/docker/go-connections v0.8.1 h1:JibmG5hULs5qXSr/cp/w3Pw5fZuStt4MOHMUExb29/M= -github.com/docker/go-connections v0.8.1/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q= +github.com/docker/go-connections v0.8.2 h1:9d9DEokx5W7qlr0shkFXIxEA7+TTD+llwzcykSlxMNc= +github.com/docker/go-connections v0.8.2/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q= github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4= github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk= github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w= @@ -53,8 +53,8 @@ github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeO github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE= github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho= github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo= -github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA= -github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og= +github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk= +github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og= github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= @@ -63,8 +63,8 @@ github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE= github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78= github.com/go-openapi/analysis v1.0.0 h1:sNvbAGCJqUTqIAodr9IVqJMmuZas3YS9ms1dGK9yiJ4= github.com/go-openapi/analysis v1.0.0/go.mod h1:NhYjJ57fnE+bcE7UwrJyMkhWA3Dfz7TdiBfTVAnos4Y= -github.com/go-openapi/errors v0.22.8 h1:oP7sW7TWc3wFFjrzzj0nI83H2qMBkNjNfSd+XRejk/I= -github.com/go-openapi/errors v0.22.8/go.mod h1:BuUoHcYrU6E7V9gfj1I5wLQqgtIHnup/alXZ8KdgQ0w= +github.com/go-openapi/errors v0.22.9 h1:HI9+SyVYiRzyeBQGv0CbWbQa+u2S0nny7G7AhY+UMiM= +github.com/go-openapi/errors v0.22.9/go.mod h1:R73q66sXP2smzAGgFOI4nqtusRK2xN5pYCjsij+KX58= github.com/go-openapi/jsonpointer v1.0.1 h1:2KxywRmNwJkT/FMBa3iRNHEaAxSJvjqoufQZy3au1Mg= github.com/go-openapi/jsonpointer v1.0.1/go.mod h1:wI7ZYsFmbIi9nBXOZqgDaS/bqOchRGZjqxFli7FBYxY= github.com/go-openapi/jsonreference v1.0.2 h1:oS4et8FOf3p3UQxEo4Xt0esijmBUM+F259Xl72OSZsc= @@ -75,44 +75,44 @@ github.com/go-openapi/spec v1.0.1 h1:lj2vdGpNDcVgwRc6qXdw6qt/KQpCtSa9tnUH6vpDPDk github.com/go-openapi/spec v1.0.1/go.mod h1:M//GWQGtDUAjnP37gE6fInLgaczB+FatoipV3H1fYw8= github.com/go-openapi/strfmt v0.27.2 h1:SG32SlbwNy92s0KJiVxt2joJeFdqIYHvwrA0OU6HqzQ= github.com/go-openapi/strfmt v0.27.2/go.mod h1:M4CKsMO0Fb8qR10+1Ra75wCKNNquy+Vj+4LWZrhTo2E= -github.com/go-openapi/swag v0.28.0 h1:xkgbOSKj6DZziNpyqRRAOt3GJGtgjgsd2RoyT30VWuw= -github.com/go-openapi/swag v0.28.0/go.mod h1:4qYnT3Cqr1p1VknOdPo70evN4rgQnAg6jwApHyxSGIg= -github.com/go-openapi/swag/cmdutils v0.28.0 h1:7TOeNtkYru1SG8Y34tDh9WBbLsMqGnptuxWiHREPZ4Q= -github.com/go-openapi/swag/cmdutils v0.28.0/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM= -github.com/go-openapi/swag/conv v0.29.1 h1:AC4Eh/5c/eUDOUCzzsRC9ghmFgOSBHeRMGIngY0ZUGA= -github.com/go-openapi/swag/conv v0.29.1/go.mod h1:S1X7/ZrBEZOC0Wc8AGxjbcGS92l3WEjA7aPtpl+RaqM= -github.com/go-openapi/swag/fileutils v0.28.0 h1:Z04XWQD7R8Eq+7GnOrjovBxPPmZzsS4gt2H2GPGIViU= -github.com/go-openapi/swag/fileutils v0.28.0/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8= -github.com/go-openapi/swag/jsonutils v0.29.1 h1:AFCxs0eQZ24/QyfhVHM2t49rMz7Vv3XCsZQI6yrNy+c= -github.com/go-openapi/swag/jsonutils v0.29.1/go.mod h1:u3+sCfJpttDpcmS5kpm0yxL6GK0eWgODsx8Yw8fcqNM= -github.com/go-openapi/swag/jsonutils/fixtures_test v0.29.1 h1:BiiXE31Bx9SfpsMmOQj5KYpUhTZBpLVriVhJDuLuY2o= -github.com/go-openapi/swag/jsonutils/fixtures_test v0.29.1/go.mod h1:julgTUKZ9/D0j6O7GKajmRs+812FWxQg/mMpGunWSjg= -github.com/go-openapi/swag/loading v0.29.1 h1:FCv5fG8UhTdDJa2R7w+5O9Ekpcbw7tt0nFWvmDKGBjc= -github.com/go-openapi/swag/loading v0.29.1/go.mod h1:N0ESuem4p2oedKal8EJhciqnJ9Q9Wmt83L1CRB3Fouw= -github.com/go-openapi/swag/mangling v0.29.1 h1:lHALtvYCdxVnRl4GrHmFPwfBTZYIObqdGNSKyu/8D6I= -github.com/go-openapi/swag/mangling v0.29.1/go.mod h1:SAop9pB7PUjQ/CGCNf/JmCKTRK+GDO+RqE9UHqC/N6s= -github.com/go-openapi/swag/netutils v0.28.0 h1:YXN6TALEi2pzts8/8GNm6T61HTAZsieukGZidap989k= -github.com/go-openapi/swag/netutils v0.28.0/go.mod h1:J+WYyFMLtvtCGqa6jLv+YNUmIKI3ZRQRrvfNDMoQoEQ= -github.com/go-openapi/swag/pools v0.29.1 h1:NRogYxdEW9SjRM4mkAOji9iefO4MRXq3p/ZJcoQbUKg= -github.com/go-openapi/swag/pools v0.29.1/go.mod h1:leDcaghjkRAhCuCRv9NfJU5f0mjoU3cT/XZObhMk3pc= -github.com/go-openapi/swag/stringutils v0.29.1 h1:1ykunK7iJQk1uOO7+oUH1ukbsK85fFCOiCFMOVSY+F0= -github.com/go-openapi/swag/stringutils v0.29.1/go.mod h1:7fSqZ+z8Qc0tOfAAK0jVa5qFGrnIlRi6n7NeGGrr1vc= -github.com/go-openapi/swag/typeutils v0.29.1 h1:Nzv9nhnlLCRBPQqfOX+7lB6Guju370or8StT+lIOf6M= -github.com/go-openapi/swag/typeutils v0.29.1/go.mod h1:hxpgDZJVBkBsi/d3MIUosafoFdE5exaQRmVp0zwu3YE= -github.com/go-openapi/swag/yamlutils v0.29.1 h1:69w3tsBajm7MR/fejLy7HD/3J68Ys1SeeZMEzZ3w2sk= -github.com/go-openapi/swag/yamlutils v0.29.1/go.mod h1:rgsp3vT/QdWzKwn43CigDwjOGIenPyTZMKnxEM8jZOA= +github.com/go-openapi/swag v0.29.2 h1:9n8frkcsuQRA0INU31VbxNxt1zBaHxrHYGEf5BUjFi4= +github.com/go-openapi/swag v0.29.2/go.mod h1:RkCiX1gCVXWgLOavDXE3ALJrQ/VO2ziiIzOUs3z10xo= +github.com/go-openapi/swag/cmdutils v0.29.2 h1:cXEzX/nWCODon251f+1HgL75/R4XXML5IZxgLCWMoro= +github.com/go-openapi/swag/cmdutils v0.29.2/go.mod h1:XziaSVzYqkDvpWXzASfWajw2YvJrLscq610O2XiyqJw= +github.com/go-openapi/swag/conv v0.29.2 h1:8c9shoB8l0QRSR6ymq1llHdBWDqpIgJfjTGHx3Vuhm0= +github.com/go-openapi/swag/conv v0.29.2/go.mod h1:AZS0YigTNf8qNtD6WqJz/N4RUNmpr76SyjFGkq4+p6Q= +github.com/go-openapi/swag/fileutils v0.29.2 h1:mdUL+Vw5ah1fO1AvFCoHeIyv7YZsCz2MN3KNqd/lLVI= +github.com/go-openapi/swag/fileutils v0.29.2/go.mod h1:7QKmmodjAebaq61lGVJa8ldLdGeMF4DSgYv8tXOGGo0= +github.com/go-openapi/swag/jsonutils v0.29.2 h1:uZNSD2/rJDYAfvsLYkykTzXuyxM3QpDKV9jhRHrMu6k= +github.com/go-openapi/swag/jsonutils v0.29.2/go.mod h1:ONTdNvj3Y+IXRzfa17E+Rgt2ns/qiSOYjIo2K7v2yDs= +github.com/go-openapi/swag/jsonutils/fixtures_test v0.29.2 h1:w+Fd6EBOMGlC74GYGHqCLGyb3Bpams8TtNrgM/SG4jo= +github.com/go-openapi/swag/jsonutils/fixtures_test v0.29.2/go.mod h1:HC2egPORFzbj/gf05Zrfgz8Mgplx3oW7hgGi7pjZVhM= +github.com/go-openapi/swag/loading v0.29.2 h1:QU1ry24e6r6Shoxe380Nx0X5iKkpRO+hJffsyJ2dVlY= +github.com/go-openapi/swag/loading v0.29.2/go.mod h1:DqilDjuiJKETecsS4TRopWG1acUDsfqN39ZmQhPu6uI= +github.com/go-openapi/swag/mangling v0.29.2 h1:ltdo3K0tTP4P6zWhVVWDU9D37/YYBuMJRdZxiS2Dtog= +github.com/go-openapi/swag/mangling v0.29.2/go.mod h1:RjDi4TnItAenS3cgCXSpIl1kKbjG7il6pnmQVl/8bp8= +github.com/go-openapi/swag/netutils v0.29.2 h1:dBli6jyUa93sDS/XYWShJzf4+nnVfFKfvY9SLUaUzB8= +github.com/go-openapi/swag/netutils v0.29.2/go.mod h1:1pM6Xg/Um8E1eps3umWl8Hme3ByWXOtHsvFC0CULHUE= +github.com/go-openapi/swag/pools v0.29.2 h1:PlGoDRF8WtSyXkedZZkpW3f9wDhFf3u8KtaBcmgmh8c= +github.com/go-openapi/swag/pools v0.29.2/go.mod h1:V3lhxVT4qDYRqc2MRSSbLsTYIYV/2HlHafhyEkmzLIc= +github.com/go-openapi/swag/stringutils v0.29.2 h1:lcnBxwAaysT3bMUVBfn9V/PkfVqkurpqufKU6rTUMGk= +github.com/go-openapi/swag/stringutils v0.29.2/go.mod h1:i9cdh7sGaa0nm3CqIvH5IM5h2QClk1wns2ktKeILvRI= +github.com/go-openapi/swag/typeutils v0.29.2 h1:O7aVvkTs3pXwikgtrPLenigEMdQFgONKRooQA9pgf2I= +github.com/go-openapi/swag/typeutils v0.29.2/go.mod h1:7+GDG+uz9Ke+eVt4rClZg7wklSDp8hT/mKNh/pC26TE= +github.com/go-openapi/swag/yamlutils v0.29.2 h1:IFKFFeDnuIwzfsuWRQU+rI8iL3g4XyAYjV/RlnlxPLM= +github.com/go-openapi/swag/yamlutils v0.29.2/go.mod h1:7MGqtcrK73sxQ4ceiyIf8qiXS/s09JLMdR5esK5euYQ= github.com/go-openapi/testify/enable/yaml/v2 v2.7.0 h1:wPW6YRgx3+SID1yUy/Xwa17L8kFEaEKod2VRbJDZNUs= github.com/go-openapi/testify/enable/yaml/v2 v2.7.0/go.mod h1:mI1M88etYbc3PhgHsWQK2kwvNwW5aGFqMPbmib+SGIs= -github.com/go-openapi/testify/v2 v2.7.0 h1:bycOreEj6wfBvijg3YFogZ/sFjTCDmQnwSodSzHa3X8= -github.com/go-openapi/testify/v2 v2.7.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw= +github.com/go-openapi/testify/v2 v2.8.0 h1:19QDx5b57p8KjO2E4sgs/woL4Akp+FGLRlVm2xn0Rho= +github.com/go-openapi/testify/v2 v2.8.0/go.mod h1:4gUN8jC+RqOE2qjW/vDmfyTvl5BCht4qL7oca0odrak= github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro= github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM= github.com/gofrs/flock v0.13.1 h1:jjREztyBeSKBZYAC+mgc1laB+xsgy4kYMf3FbKF2UBo= github.com/gofrs/flock v0.13.1/go.mod h1:sf4BFiHwnvgxa25DlQoDqXQnwRMEOwqxRq37P6MzzmE= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= -github.com/google/gnostic-models v0.6.9 h1:MU/8wDLif2qCXZmzncUQ/BOfxWfthHi63KqpoNbWqVw= -github.com/google/gnostic-models v0.6.9/go.mod h1:CiWsm0s6BSQd1hRn8/QmxqB6BesYcbSZxsz9b0KuDBw= +github.com/google/gnostic-models v0.7.1 h1:SisTfuFKJSKM5CPZkffwi6coztzzeYUhc3v4yxLWH8c= +github.com/google/gnostic-models v0.7.1/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/go-github/v89 v89.0.0 h1:35bEK5XoEcF3PZrlVbl9XN63f5BcJRA/UGkxeC9xPg0= @@ -186,36 +186,38 @@ github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.71.0 h1:B2h3uqicet1CT2N5TOFhS+Gq++9i0/CLmaxvhmhtP5s= -go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.71.0/go.mod h1:dylvB+ZiiwMvsDij9O84Uy7SijLgHMX4mbkncds+4Sw= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04= -go.opentelemetry.io/otel v1.46.0 h1:FHt5/CDyVxi/8IM1CH7VE/rRgq3kLHa2mSTVMO8AWyc= -go.opentelemetry.io/otel v1.46.0/go.mod h1:Gj3SEScelsNC45tp4nSxRYlS+f5iez7W8XPMCt905kE= -go.opentelemetry.io/otel/metric v1.46.0 h1:yBnkXvgV7AXFILZc5K6IZe/CBFF3OS7BJ8ov6/lj0K8= -go.opentelemetry.io/otel/metric v1.46.0/go.mod h1:iPmdWqifKUdzziPkvvzIJXITl56fQx2mGM/DHLB3/2o= -go.opentelemetry.io/otel/trace v1.46.0 h1:OULy7ccdJnZtJ0UDYFOIGaCmiWzJ8Vi2G/Rsu60qs1c= -go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFjLU+d9WuUxDLI= -go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI= -go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU= +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.72.0 h1:Tq+E65HaNbZTeqcLw6QUhsV+/EIWdkfUH2CQzcrlE5M= +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.72.0/go.mod h1:A+EVhDakAj1waJBPhmTszZaSr08ww8MRRKy1nB1rqck= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 h1:3g7B90UzBltIDKq1/5mrTGxTnOFDV0ICOhLoxiZ8jlg= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0/go.mod h1:Ef8SuTh59BT7+ofpDxN9z+yOlc4t2GjLmKDgYNJL/NU= +go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM= +go.opentelemetry.io/otel v1.47.0/go.mod h1:8wS9O2qfXrYrzp6hIF/HOYJJf/wIhFPhR2xLuP+iXQU= +go.opentelemetry.io/otel/log v1.47.0 h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI= +go.opentelemetry.io/otel/log v1.47.0/go.mod h1:9byitSQ5pLC6PpqwGXjqdMKya6ZTswHRZh2vvXT33nw= +go.opentelemetry.io/otel/metric v1.47.0 h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY= +go.opentelemetry.io/otel/metric v1.47.0/go.mod h1:ADGSXxRrXM6bjbvLo535EstVFlPpPYZm4LBKixjDHwU= +go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM= +go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0= +go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= +go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= -golang.org/x/exp v0.0.0-20260820142414-ca536658362e h1:01Ju2A/fZKkci4zqx0eZxw//DnRYOnBiGJG14hFBhO8= -golang.org/x/exp v0.0.0-20260820142414-ca536658362e/go.mod h1:zeBbvyFKDaLwa7CH/zI8KXt7gTl14SF7sO08Pl5jBCM= +golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba h1:Ck8QetSgk912qxWLMCKxd0in+aiyBQyDSMae6e/xmpU= +golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba/go.mod h1:50RgIsmK7OwqzTTeqcSXQW8SswW0o8fRcDxmqGluJ8E= golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= -golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= -golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= +golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= -google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 h1:ax2KzoSRIZU/M0cIxri3pKxy99vniH1PVxWC6si/eZI= -google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688/go.mod h1:1RJ9BQGyNdZwkGc1eTqkErfRZ6RJyYPHZo73BZ1vQqI= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5 h1:1VUiZAXyC+zmiFYi+WLtBzr68Cj8wOofHjjrA/kkizc= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260825221802-da73d73af1c5/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA= -google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= -google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc h1:rZHRz0ogq4Pid1IKtA/ivHi8XONVF5tqUQXA2TtgpkE= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:K/n0XLazCJHjD73YuMyNJsN38BPPy1kfFnKxUXaThFU= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc h1:4bNTbnb44EqGVy9HaQxSY2jnafSUdgV3qHtedvNpDKg= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc= +google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0= +google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0= google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= @@ -225,11 +227,11 @@ gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnf gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -k8s.io/kube-openapi v0.0.0-20241212222426-2c72e554b1e7 h1:hcha5B1kVACrLujCKLbr8XWMxCxzQx42DY8QKYJrDLg= -k8s.io/kube-openapi v0.0.0-20241212222426-2c72e554b1e7/go.mod h1:GewRfANuJ70iYzvn+i4lezLDAFzvjxZYK1gn1lWcfas= +k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A= +k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I= sigs.k8s.io/kustomize/api v0.21.1 h1:lzqbzvz2CSvsjIUZUBNFKtIMsEw7hVLJp0JeSIVmuJs= sigs.k8s.io/kustomize/api v0.21.1/go.mod h1:f3wkKByTrgpgltLgySCntrYoq5d3q7aaxveSagwTlwI= sigs.k8s.io/kustomize/kyaml v0.21.1 h1:IVlbmhC076nf6foyL6Taw4BkrLuEsXUXNpsE+ScX7fI= sigs.k8s.io/kustomize/kyaml v0.21.1/go.mod h1:hmxADesM3yUN2vbA5z1/YTBnzLJ1dajdqpQonwBL1FQ= -sigs.k8s.io/yaml v1.5.0 h1:M10b2U7aEUY6hRtU870n2VTPgR5RZiL/I6Lcc2F4NUQ= -sigs.k8s.io/yaml v1.5.0/go.mod h1:wZs27Rbxoai4C0f8/9urLZtZtF3avA3gKvGyPdDqTO4= +sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs= +sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4= diff --git a/libraries/source-read-sdk/README.md b/libraries/source-read-sdk/README.md index 8568922ef..b40a49f44 100644 --- a/libraries/source-read-sdk/README.md +++ b/libraries/source-read-sdk/README.md @@ -1,80 +1,75 @@ -# Source collection projection SDK +# Accounts module-tier client -Generated Go client for the Accounts module-facing capability service. Import +Generated Go client for Accounts' module tier (`ModuleCapabilitiesService` on +the `authority` endpoint): the connected-source seams (ClaimJobs, HeartbeatJob, +AckJob, NackJob, FetchDatasourceBlob, FetchDatasourceFiles, +MintSourceOperationContext, ListReadableSourceCollections) and the rest of the +module capability surface. Import `github.com/codefly-dev/module-saas-starter/libraries/source-read-sdk/go` at the -reviewed commit. The standalone Go module has no consumer-local replacement. +reviewed commit. + +The bindings and the facade are `codefly generate client` output and are never +edited by hand. The library carries every descriptor it needs and imports no +other SDK, so a binary that links it registers each `saas.*` proto once. Do +not link it beside another copy of the same descriptors (an older SDK that +vendors `saas/events/v1` too): pick one. ```go -client, err := accounts.NewInternal(internalURL, authenticatedOptions...) +client, err := accounts.NewInternal(authorityURL, connect.WithInterceptors(workContext)) // Handle err before using client. -result, err := client.ModuleCapabilities(). - ListReadableSourceCollections(ctx, &accountsv1.ListReadableSourceCollectionsRequest{ - PageSize: 1000, PageToken: cursor, - }) +jobs, err := client.ModuleCapabilities().ClaimJobs(ctx, &accountsv1.ModuleClaimJobsRequest{Queue: "datasource"}) ``` -`NewInternal` selects HTTP/2 gRPC for the Accounts internal endpoint (h2c for -`http://`, certificate-verified TLS for `https://`). Credentials are supplied -through Connect interceptors. `New(gateway, options...)` also enforces gRPC; -a custom gateway must provide an HTTP/2-capable client. -Source projection calls must carry one original signed viewer Work Context in -`x-codefly-work-context`, audience the calling module's registration prefix and -kind-wide `read` on a resource type that module declares its content under, plus -the cluster-internal perimeter credential. Only the declared types are honoured; -a module that declares none reads nothing. Installation/module credentials -are not a viewer. Never put either credential or a minting secret in a browser. -The empty request contains no tenant, subject, scopes, or boundary authority. +`NewInternal` selects HTTP/2 gRPC for the Accounts `authority` endpoint (h2c for +`http://`, certificate-verified TLS for `https://`). The facade skips streaming +RPCs; for FetchDatasourceBlob and FetchDatasourceFiles build the generated +`accountsv1connect` client on `InternalGateway(authorityURL)` with +`connect.WithGRPC()`. -Drain `next_page_token` until empty. Each collection has `source_id`, -`boundary_id`, `origin`, `container`, `ref`, and literal `paths`. Empty means -no current readable sources; any error invalidates a partial enumeration. -Changed source/grant or authorization revisions invalidate existing cursors; -standing-grant expiration also requires a restart. Source pages are joined and -limited in the database, under the same snapshot as authority verification. Current owner and -all delegated actor grants are intersected in the authenticated tenant. -Every provider the host connects is projected. `container` is what the -consuming module's ingest keys the source's entries under: the repository for -a GitHub source, the source id for every other provider. +## Credentials -A server adapter deriving the active session organization from authenticated -identity and exchanging a bearer for a viewer Work Context remains a separate -runtime seam. Never choose the first membership or trust browser scopes. +Every call proves the calling module itself; no shared perimeter credential is +sent or accepted on this tier. -Regenerate from the repository root after exporting contracts: +- The module-capability calls carry the module's own Work Context in + `x-codefly-work-context`: the one the authority issues the workload for + audience `module-capabilities` (Issue, from the workload's credential). +- ListReadableSourceCollections carries the original signed viewer Work + Context instead: audience the calling module's registration prefix and + kind-wide `read` on a resource type that module declares. +- ExchangeDelegatedReadAudience and ExchangeDelegatedOperationAudience carry + the module's own Work Context in the header and the viewer parent only in the + request body. Never substitute one for the other. +- MintSourceOperationContext authenticates with the module pod's workload + credential in the request (`service_account_token`), which Accounts reviews + and binds to the running build. -```sh -codefly generate contracts saas-starter -(cd libraries/source-read-sdk/go && go run ./cmd/generate --root ../../..) -``` +Never put a Work Context or a workload credential in a browser, and never log +request or response bodies. -The generated client imports policy, jobs and Work Context descriptors from -`github.com/codefly-dev/saas-sdk-go`; it does not vendor duplicates. It can be -composed with consumers of that SDK in one Go binary. Applications embedding -private Accounts module-capability descriptors must still use one binding set -for those owner types. +## Source collections -The generator trims the descriptor set to the selected service’s transitive -imports before invoking Codefly, then pins the facade to the internal gRPC -protocol. Unrelated Accounts services are not generated. +Drain `next_page_token` until empty. Each collection has `source_id`, +`boundary_id`, `origin`, `container`, `ref`, and literal `paths`. Empty means +no current readable sources; any error invalidates a partial enumeration. +Changed source/grant or authorization revisions invalidate existing cursors. +`container` is what the consuming module's ingest keys the source's entries +under: the repository for a GitHub source, the source id for every other +provider. -## Delegated read-only audience exchange +## Regenerate -The same public client exposes: +Requires released Codefly CLI **v0.1.215** (the CI pin). From the repository root: -```go -child, err := client.ModuleCapabilities().ExchangeDelegatedReadAudience(ctx, - &accountsv1.ModuleExchangeDelegatedReadAudienceRequest{ - BindingId: "installed-read", - ParentWorkContextToken: originalViewerToken, - }) +```sh +codefly generate client --from saas-starter/accounts/authority --name source-read-sdk \ + --language go --services ModuleCapabilitiesService \ + --go-module github.com/codefly-dev/module-saas-starter/libraries/source-read-sdk/go \ + --output libraries/source-read-sdk ``` -For this method, the interceptor sends the **calling module's own** signed Work -Context in `x-codefly-work-context` and the internal perimeter credential in -`x-codefly-internal-token`. The viewer parent is exclusively in the request body. -Do not substitute the viewer for the module credential or the module for the -viewer parent. Installation fixes the incoming audience, target audience and -read scopes; the parent must already admit them. Before using `child.token`, the -consumer must verify its signature, target audience and preserved viewer lineage. -Do not log request/response bodies or credentials. This read-only exchange does -not grant mutation scopes or provide durable bearer custody. +CLI v0.1.215 applies `--services ModuleCapabilitiesService` to both the facade +and the contract's transitive descriptor closure. Use `--force` once when +replacing an older broad generated library; subsequent regeneration must work +without it. `TestContractContainsOnlyRequiredDescriptors` verifies the single +service and its required descriptors, and CI checks regeneration for drift. diff --git a/libraries/source-read-sdk/contract/catalog.codefly.json b/libraries/source-read-sdk/contract/catalog.codefly.json index 2450bab01..bfbc830ca 100644 --- a/libraries/source-read-sdk/contract/catalog.codefly.json +++ b/libraries/source-read-sdk/contract/catalog.codefly.json @@ -1,16 +1,16 @@ { "schema": "codefly/module-api-contracts/v1", - "package": "codefly/saas-starter", - "version": "0.1.0", + "package": "local", + "version": "0.0.0", "endpoints": [ { "service": "accounts", - "endpoint": "connect", - "api": "connect", + "endpoint": "authority", + "api": "grpc", "kind": "protobuf", "package": "saas.accounts.v1", "path": "contract.binpb", - "digest": "sha256:a0fb4ae81270a9648d4d119f5b7c87dff9ce0aaf0fc8e3de0a6213ec32aa70da", + "digest": "sha256:30bfd77c270428933734b6ae35f5cca165db62fbe181c3f7717a663b1aa0ed73", "services": [ { "name": "ModuleCapabilitiesService", @@ -45,6 +45,7 @@ "/saas.accounts.v1.ModuleCapabilitiesService/PublishEvent", "/saas.accounts.v1.ModuleCapabilitiesService/ReplayEvents", "/saas.accounts.v1.ModuleCapabilitiesService/RequestApproval", + "/saas.accounts.v1.ModuleCapabilitiesService/ResolveWorkContextAuthority", "/saas.accounts.v1.ModuleCapabilitiesService/RevokeExecutableArtifact", "/saas.accounts.v1.ModuleCapabilitiesService/Subscribe", "/saas.accounts.v1.ModuleCapabilitiesService/Unsubscribe" diff --git a/libraries/source-read-sdk/contract/contract.binpb b/libraries/source-read-sdk/contract/contract.binpb index 7d227b5f8..0ce03e21e 100644 Binary files a/libraries/source-read-sdk/contract/contract.binpb and b/libraries/source-read-sdk/contract/contract.binpb differ diff --git a/libraries/source-read-sdk/go/accounts_facade.pb.go b/libraries/source-read-sdk/go/accounts_facade.pb.go index d93161cbd..9b4400b27 100644 --- a/libraries/source-read-sdk/go/accounts_facade.pb.go +++ b/libraries/source-read-sdk/go/accounts_facade.pb.go @@ -27,7 +27,7 @@ type Client struct { // New binds the facade to a gateway. Extra connect.ClientOptions are // forwarded to every sub-client. func New(gw Gateway, opts ...connect.ClientOption) *Client { - return &Client{gw: gw, opts: append(opts, connect.WithGRPC())} + return &Client{gw: gw, opts: opts} } // ModuleCapabilities returns the typed ModuleCapabilitiesService facade. @@ -284,3 +284,11 @@ func (a *ModuleCapabilitiesClient) ReplayEvents(ctx context.Context, req *v1.Mod } return resp.Msg, nil } + +func (a *ModuleCapabilitiesClient) ResolveWorkContextAuthority(ctx context.Context, req *v1.ModuleResolveWorkContextAuthorityRequest) (*v1.ModuleResolveWorkContextAuthorityResponse, error) { + resp, err := a.inner.ResolveWorkContextAuthority(ctx, connect.NewRequest(req)) + if err != nil { + return nil, err + } + return resp.Msg, nil +} diff --git a/libraries/source-read-sdk/go/cmd/generate/main.go b/libraries/source-read-sdk/go/cmd/generate/main.go deleted file mode 100644 index ddbb2ed49..000000000 --- a/libraries/source-read-sdk/go/cmd/generate/main.go +++ /dev/null @@ -1,200 +0,0 @@ -// Command generate narrows the exported descriptor to ModuleCapabilitiesService's -// dependency closure before invoking Codefly's client generator. -package main - -import ( - "crypto/sha256" - "encoding/hex" - "encoding/json" - "flag" - "fmt" - "os" - "os/exec" - "path/filepath" - "strings" - - "google.golang.org/protobuf/proto" - "google.golang.org/protobuf/types/descriptorpb" -) - -func main() { - root := flag.String("root", "../../..", "repository root") - flag.Parse() - if err := generate(*root); err != nil { - fmt.Fprintln(os.Stderr, err) - os.Exit(1) - } -} -func generate(root string) error { - root, err := filepath.Abs(root) - if err != nil { - return err - } - raw, err := os.ReadFile(filepath.Join(root, "module/contracts/api/accounts/connect/contract.binpb")) - if err != nil { - return err - } - var set descriptorpb.FileDescriptorSet - if err := proto.Unmarshal(raw, &set); err != nil { - return err - } - byName := map[string]*descriptorpb.FileDescriptorProto{} - for _, f := range set.File { - byName[f.GetName()] = f - } - needed := map[string]bool{} - var visit func(string) error - visit = func(name string) error { - if needed[name] { - return nil - } - f := byName[name] - if f == nil { - return fmt.Errorf("missing descriptor %s", name) - } - needed[name] = true - for _, dep := range f.Dependency { - if err := visit(dep); err != nil { - return err - } - } - return nil - } - if err := visit("saas/accounts/v1/module_capabilities.proto"); err != nil { - return err - } - var narrowed descriptorpb.FileDescriptorSet - for _, f := range set.File { - if needed[f.GetName()] { - // Imported files supply message types, not extra client services. - f = proto.Clone(f).(*descriptorpb.FileDescriptorProto) - if f.GetName() != "saas/accounts/v1/module_capabilities.proto" { - f.Service = nil - } - narrowed.File = append(narrowed.File, f) - } - } - raw, err = proto.MarshalOptions{Deterministic: true}.Marshal(&narrowed) - if err != nil { - return err - } - digest := sha256.Sum256(raw) - catalogRaw, err := os.ReadFile(filepath.Join(root, "module/contracts/api/catalog.codefly.json")) - if err != nil { - return err - } - var catalog map[string]any - if err := json.Unmarshal(catalogRaw, &catalog); err != nil { - return err - } - var endpoint map[string]any - for _, entry := range catalog["endpoints"].([]any) { - e := entry.(map[string]any) - if e["service"] == "accounts" && e["endpoint"] == "connect" { - endpoint = e - break - } - } - if endpoint == nil { - return fmt.Errorf("accounts contract missing") - } - var services []any - for _, entry := range endpoint["services"].([]any) { - if entry.(map[string]any)["name"] == "ModuleCapabilitiesService" { - services = append(services, entry) - } - } - endpoint["services"] = services - endpoint["path"] = "contracts/api/contract.binpb" - endpoint["digest"] = "sha256:" + hex.EncodeToString(digest[:]) - catalog["endpoints"] = []any{endpoint} - catalogRaw, err = json.MarshalIndent(catalog, "", " ") - if err != nil { - return err - } - temp, err := os.MkdirTemp("", "source-read-contract-") - if err != nil { - return err - } - defer func() { _ = os.RemoveAll(temp) }() - if err := os.MkdirAll(filepath.Join(temp, "contracts/api"), 0755); err != nil { - return err - } - if err := os.WriteFile(filepath.Join(temp, "contracts/api/contract.binpb"), raw, 0644); err != nil { - return err - } - if err := os.WriteFile(filepath.Join(temp, "contracts/api/catalog.codefly.json"), catalogRaw, 0644); err != nil { - return err - } - output := filepath.Join(root, "libraries/source-read-sdk") - // Only generated bindings are replaced; authored transport, tests and this - // generator remain intact. Removed descriptor files cannot linger on reruns. - if err := os.RemoveAll(filepath.Join(output, "go/gen")); err != nil { - return err - } - cmd := exec.Command("codefly", "generate", "client", "--from", "contracts:"+temp, "--endpoint", "accounts/connect", "--name", "source-read-sdk", "--language", "go", "--services", "ModuleCapabilitiesService", "--go-module", "github.com/codefly-dev/module-saas-starter/libraries/source-read-sdk/go", "--output", output, "--force") - cmd.Dir = root - cmd.Stdout = os.Stdout - cmd.Stderr = os.Stderr - if err := cmd.Run(); err != nil { - return err - } - // Regenerate owned bindings with canonical shared Host descriptor imports. - // The public SDK and an embedded owner must not register a second policy, - // jobs or Work Context descriptor under the same protobuf full name. - own := "github.com/codefly-dev/module-saas-starter/libraries/source-read-sdk/go/gen/" - shared := "github.com/codefly-dev/saas-sdk-go/gen/" - options := []string{"paths=source_relative", - "Msaas/accounts/v1/module_capabilities.proto=" + own + "saas/accounts/v1;accountsv1", - "Msaas/accounts/v1/module_registration.proto=" + own + "saas/accounts/v1;accountsv1", - "Msaas/events/v1/events.proto=" + own + "saas/events/v1;eventsv1", - "Msaas/accounts/v1/work_contexts.proto=" + shared + "saas/accounts/v1", - "Msaas/jobs/v1/jobs.proto=" + shared + "saas/jobs/v1", - "Msaas/policy/v1/options.proto=" + shared + "saas/policy/v1"} - template, err := json.Marshal(map[string]any{"version": "v1", "plugins": []any{ - map[string]any{"name": "go", "out": filepath.Join(output, "go/gen"), "opt": options}, - map[string]any{"name": "connect-go", "out": filepath.Join(output, "go/gen"), "opt": options}, - }}) - if err != nil { - return err - } - if err = os.RemoveAll(filepath.Join(output, "go/gen")); err != nil { - return err - } - bindings := exec.Command("buf", "generate", filepath.Join(temp, "contracts/api/contract.binpb"), "--path", "saas/accounts/v1/module_capabilities.proto", "--path", "saas/accounts/v1/module_registration.proto", "--path", "saas/events/v1/events.proto", "--template", string(template)) - bindings.Stdout = os.Stdout - bindings.Stderr = os.Stderr - if err = bindings.Run(); err != nil { - return err - } - // Preserve the facade's public result name without duplicating its descriptor. - alias := []byte("package accountsv1\n\nimport shared \"github.com/codefly-dev/saas-sdk-go/gen/saas/accounts/v1\"\n\n// IssuedWorkContext is the canonical shared Host wire type.\ntype IssuedWorkContext = shared.IssuedWorkContext\n") - if err = os.WriteFile(filepath.Join(output, "go/gen/saas/accounts/v1/shared.go"), alias, 0644); err != nil { - return err - } - dependency := exec.Command("go", "mod", "edit", "-require=github.com/codefly-dev/saas-sdk-go@v0.0.3-0.20260903161219-eec695334b45") - dependency.Dir = filepath.Join(output, "go") - dependency.Stdout = os.Stdout - dependency.Stderr = os.Stderr - if err = dependency.Run(); err != nil { - return err - } - tidy := exec.Command("go", "mod", "tidy") - tidy.Dir = filepath.Join(output, "go") - tidy.Stdout = os.Stdout - tidy.Stderr = os.Stderr - if err = tidy.Run(); err != nil { - return err - } - facade := filepath.Join(output, "go/accounts_facade.pb.go") - raw, err = os.ReadFile(facade) - if err != nil { - return err - } - old := "return &Client{gw: gw, opts: opts}" - if strings.Count(string(raw), old) != 1 { - return fmt.Errorf("facade constructor changed; cannot enforce internal gRPC transport") - } - raw = []byte(strings.Replace(string(raw), old, "return &Client{gw: gw, opts: append(opts, connect.WithGRPC())}", 1)) - return os.WriteFile(facade, raw, 0644) -} diff --git a/libraries/source-read-sdk/go/gen/saas/accounts/v1/accountsv1connect/module_capabilities.connect.go b/libraries/source-read-sdk/go/gen/saas/accounts/v1/accountsv1connect/module_capabilities.connect.go index 58f71a350..dd98e414c 100644 --- a/libraries/source-read-sdk/go/gen/saas/accounts/v1/accountsv1connect/module_capabilities.connect.go +++ b/libraries/source-read-sdk/go/gen/saas/accounts/v1/accountsv1connect/module_capabilities.connect.go @@ -5,14 +5,14 @@ package accountsv1connect import ( - connect "connectrpc.com/connect" context "context" errors "errors" - v1 "github.com/codefly-dev/module-saas-starter/libraries/source-read-sdk/go/gen/saas/accounts/v1" - v11 "github.com/codefly-dev/saas-sdk-go/gen/saas/accounts/v1" - emptypb "google.golang.org/protobuf/types/known/emptypb" http "net/http" strings "strings" + + connect "connectrpc.com/connect" + v1 "github.com/codefly-dev/module-saas-starter/libraries/source-read-sdk/go/gen/saas/accounts/v1" + emptypb "google.golang.org/protobuf/types/known/emptypb" ) // This is a compile-time assertion to ensure that this generated file and the connect package are @@ -132,6 +132,9 @@ const ( // ModuleCapabilitiesServiceReplayEventsProcedure is the fully-qualified name of the // ModuleCapabilitiesService's ReplayEvents RPC. ModuleCapabilitiesServiceReplayEventsProcedure = "/saas.accounts.v1.ModuleCapabilitiesService/ReplayEvents" + // ModuleCapabilitiesServiceResolveWorkContextAuthorityProcedure is the fully-qualified name of the + // ModuleCapabilitiesService's ResolveWorkContextAuthority RPC. + ModuleCapabilitiesServiceResolveWorkContextAuthorityProcedure = "/saas.accounts.v1.ModuleCapabilitiesService/ResolveWorkContextAuthority" ) // ModuleCapabilitiesServiceClient is a client for the saas.accounts.v1.ModuleCapabilitiesService @@ -148,11 +151,11 @@ type ModuleCapabilitiesServiceClient interface { RevokeExecutableArtifact(context.Context, *connect.Request[v1.ModuleRevokeExecutableArtifactRequest]) (*connect.Response[v1.ModuleExecutableArtifactResponse], error) // ExchangeDelegatedReadAudience authenticates the module independently of a // current parent context and exchanges only its installed read-only binding. - ExchangeDelegatedReadAudience(context.Context, *connect.Request[v1.ModuleExchangeDelegatedReadAudienceRequest]) (*connect.Response[v11.IssuedWorkContext], error) + ExchangeDelegatedReadAudience(context.Context, *connect.Request[v1.ModuleExchangeDelegatedReadAudienceRequest]) (*connect.Response[v1.IssuedWorkContext], error) // ExchangeDelegatedOperationAudience authenticates the module independently // of a current parent context and exchanges only an installed operation's // invoke scopes, or its read-only receipt-lookup subset. - ExchangeDelegatedOperationAudience(context.Context, *connect.Request[v1.ModuleExchangeDelegatedOperationAudienceRequest]) (*connect.Response[v11.IssuedWorkContext], error) + ExchangeDelegatedOperationAudience(context.Context, *connect.Request[v1.ModuleExchangeDelegatedOperationAudienceRequest]) (*connect.Response[v1.IssuedWorkContext], error) // Checks current owner and every delegated actor against true record placement, // intersected with the verified capability's attenuated resource/action scope. CheckWorkContextRecordAccess(context.Context, *connect.Request[v1.CheckWorkContextRecordAccessRequest]) (*connect.Response[v1.CheckWorkContextRecordAccessResponse], error) @@ -165,7 +168,10 @@ type ModuleCapabilitiesServiceClient interface { // access oracles can resolve it. Bounded by the resource types the caller // principal's grant declares. PlaceRecord(context.Context, *connect.Request[v1.ModulePlaceRecordRequest]) (*connect.Response[v1.ModulePlaceRecordResponse], error) - // EnqueueJob appends durable work for a tenant- or subject-scoped queue. + // EnqueueJob appends durable work for a tenant- or subject-scoped queue. A + // subject-scoped job whose subject is not a member of the tenant is + // FAILED_PRECONDITION with reason TENANT_MEMBERSHIP_MISSING; see REFUSALS, + // and key on the reason rather than the code. EnqueueJob(context.Context, *connect.Request[v1.ModuleEnqueueJobRequest]) (*connect.Response[v1.ModuleEnqueueJobResponse], error) // ClaimJobs leases a bounded batch of ready jobs from an allowed queue. ClaimJobs(context.Context, *connect.Request[v1.ModuleClaimJobsRequest]) (*connect.Response[v1.ModuleClaimJobsResponse], error) @@ -175,10 +181,17 @@ type ModuleCapabilitiesServiceClient interface { AckJob(context.Context, *connect.Request[v1.ModuleAckJobRequest]) (*connect.Response[emptypb.Empty], error) // NackJob fails a leased job as retryable or permanent. NackJob(context.Context, *connect.Request[v1.ModuleNackJobRequest]) (*connect.Response[emptypb.Empty], error) - // NotifyUser delivers a notification subject to category policy. + // NotifyUser delivers a notification subject to category policy. A recipient + // who is not a member of the tenant is FAILED_PRECONDITION with reason + // TENANT_MEMBERSHIP_MISSING, never PERMISSION_DENIED. An idempotency_key + // already used for different content, and a host that cannot re-read live + // authority, are FAILED_PRECONDITION too under their own reasons, so the + // reason — not the code — says which happened; see REFUSALS. NotifyUser(context.Context, *connect.Request[v1.ModuleNotifyUserRequest]) (*connect.Response[v1.ModuleNotifyUserResponse], error) // NotifyOrgAdmins notifies a tenant's administrators, resolved at send time; - // see the request. + // see the request. It names no recipient, so it has no non-member refusal; an + // idempotency_key already used for different content is FAILED_PRECONDITION + // with reason NOTIFICATION_IDEMPOTENCY_CONFLICT. NotifyOrgAdmins(context.Context, *connect.Request[v1.ModuleNotifyOrgAdminsRequest]) (*connect.Response[v1.ModuleNotifyOrgAdminsResponse], error) // RequestApproval opens a pending approval whose resume job the module claims. RequestApproval(context.Context, *connect.Request[v1.ModuleRequestApprovalRequest]) (*connect.Response[v1.ModuleRequestApprovalResponse], error) @@ -192,7 +205,11 @@ type ModuleCapabilitiesServiceClient interface { // into the namespaces the operator bound to it; see the request. DeclareAuditEventTypes(context.Context, *connect.Request[v1.ModuleDeclareAuditEventTypesRequest]) (*connect.Response[v1.ModuleDeclareAuditEventTypesResponse], error) // ListSubjectVisibility projects the tenant's team tree onto one viewer: the - // whole set of other subjects whose rows that viewer may read. + // whole set of other subjects whose rows that viewer may read. A viewer who + // is not a member of the tenant is FAILED_PRECONDITION with reason + // TENANT_MEMBERSHIP_MISSING; a set too large to serve whole is + // FAILED_PRECONDITION with reason SUBJECT_VISIBILITY_SET_TOO_LARGE, and only + // the reason tells a consumer which it got. ListSubjectVisibility(context.Context, *connect.Request[v1.ModuleListSubjectVisibilityRequest]) (*connect.Response[v1.ModuleListSubjectVisibilityResponse], error) // FetchDatasourceBlob streams one datasource file blob to the module that // resolves a change set's blob sha. Authorized by the caller principal's @@ -244,6 +261,14 @@ type ModuleCapabilitiesServiceClient interface { ListSubscriptions(context.Context, *connect.Request[v1.ModuleListSubscriptionsRequest]) (*connect.Response[v1.ModuleListSubscriptionsResponse], error) // ReplayEvents re-delivers durable events to the caller's own subscriptions. ReplayEvents(context.Context, *connect.Request[v1.ModuleReplayEventsRequest]) (*connect.Response[v1.ModuleReplayEventsResponse], error) + // ResolveWorkContextAuthority answers one live value a callee's verifier + // holds a capability's seal against: the installation it was sealed to and + // its revision, a principal's epoch, the build the issuer approves for a + // principal, an operation binding, the authorization revision a capability's + // owner carries, or an approval grant. It is the surface a composed module + // builds its seal, revision and grant sources on; see the block above + // ModuleResolveWorkContextAuthorityRequest for what a caller may ask. + ResolveWorkContextAuthority(context.Context, *connect.Request[v1.ModuleResolveWorkContextAuthorityRequest]) (*connect.Response[v1.ModuleResolveWorkContextAuthorityResponse], error) } // NewModuleCapabilitiesServiceClient constructs a client for the @@ -281,13 +306,13 @@ func NewModuleCapabilitiesServiceClient(httpClient connect.HTTPClient, baseURL s connect.WithSchema(moduleCapabilitiesServiceMethods.ByName("RevokeExecutableArtifact")), connect.WithClientOptions(opts...), ), - exchangeDelegatedReadAudience: connect.NewClient[v1.ModuleExchangeDelegatedReadAudienceRequest, v11.IssuedWorkContext]( + exchangeDelegatedReadAudience: connect.NewClient[v1.ModuleExchangeDelegatedReadAudienceRequest, v1.IssuedWorkContext]( httpClient, baseURL+ModuleCapabilitiesServiceExchangeDelegatedReadAudienceProcedure, connect.WithSchema(moduleCapabilitiesServiceMethods.ByName("ExchangeDelegatedReadAudience")), connect.WithClientOptions(opts...), ), - exchangeDelegatedOperationAudience: connect.NewClient[v1.ModuleExchangeDelegatedOperationAudienceRequest, v11.IssuedWorkContext]( + exchangeDelegatedOperationAudience: connect.NewClient[v1.ModuleExchangeDelegatedOperationAudienceRequest, v1.IssuedWorkContext]( httpClient, baseURL+ModuleCapabilitiesServiceExchangeDelegatedOperationAudienceProcedure, connect.WithSchema(moduleCapabilitiesServiceMethods.ByName("ExchangeDelegatedOperationAudience")), @@ -449,6 +474,12 @@ func NewModuleCapabilitiesServiceClient(httpClient connect.HTTPClient, baseURL s connect.WithSchema(moduleCapabilitiesServiceMethods.ByName("ReplayEvents")), connect.WithClientOptions(opts...), ), + resolveWorkContextAuthority: connect.NewClient[v1.ModuleResolveWorkContextAuthorityRequest, v1.ModuleResolveWorkContextAuthorityResponse]( + httpClient, + baseURL+ModuleCapabilitiesServiceResolveWorkContextAuthorityProcedure, + connect.WithSchema(moduleCapabilitiesServiceMethods.ByName("ResolveWorkContextAuthority")), + connect.WithClientOptions(opts...), + ), } } @@ -458,8 +489,8 @@ type moduleCapabilitiesServiceClient struct { approveExecutableArtifact *connect.Client[v1.ModuleExecutableArtifactRequest, v1.ModuleExecutableArtifactResponse] authorizeExecutableArtifact *connect.Client[v1.ModuleExecutableArtifactRequest, v1.ModuleExecutableArtifactResponse] revokeExecutableArtifact *connect.Client[v1.ModuleRevokeExecutableArtifactRequest, v1.ModuleExecutableArtifactResponse] - exchangeDelegatedReadAudience *connect.Client[v1.ModuleExchangeDelegatedReadAudienceRequest, v11.IssuedWorkContext] - exchangeDelegatedOperationAudience *connect.Client[v1.ModuleExchangeDelegatedOperationAudienceRequest, v11.IssuedWorkContext] + exchangeDelegatedReadAudience *connect.Client[v1.ModuleExchangeDelegatedReadAudienceRequest, v1.IssuedWorkContext] + exchangeDelegatedOperationAudience *connect.Client[v1.ModuleExchangeDelegatedOperationAudienceRequest, v1.IssuedWorkContext] checkWorkContextRecordAccess *connect.Client[v1.CheckWorkContextRecordAccessRequest, v1.CheckWorkContextRecordAccessResponse] listReadableSourceCollections *connect.Client[v1.ListReadableSourceCollectionsRequest, v1.ListReadableSourceCollectionsResponse] placeRecord *connect.Client[v1.ModulePlaceRecordRequest, v1.ModulePlaceRecordResponse] @@ -486,6 +517,7 @@ type moduleCapabilitiesServiceClient struct { unsubscribe *connect.Client[v1.ModuleUnsubscribeRequest, emptypb.Empty] listSubscriptions *connect.Client[v1.ModuleListSubscriptionsRequest, v1.ModuleListSubscriptionsResponse] replayEvents *connect.Client[v1.ModuleReplayEventsRequest, v1.ModuleReplayEventsResponse] + resolveWorkContextAuthority *connect.Client[v1.ModuleResolveWorkContextAuthorityRequest, v1.ModuleResolveWorkContextAuthorityResponse] } // GetCurrentInstallation calls saas.accounts.v1.ModuleCapabilitiesService.GetCurrentInstallation. @@ -513,13 +545,13 @@ func (c *moduleCapabilitiesServiceClient) RevokeExecutableArtifact(ctx context.C // ExchangeDelegatedReadAudience calls // saas.accounts.v1.ModuleCapabilitiesService.ExchangeDelegatedReadAudience. -func (c *moduleCapabilitiesServiceClient) ExchangeDelegatedReadAudience(ctx context.Context, req *connect.Request[v1.ModuleExchangeDelegatedReadAudienceRequest]) (*connect.Response[v11.IssuedWorkContext], error) { +func (c *moduleCapabilitiesServiceClient) ExchangeDelegatedReadAudience(ctx context.Context, req *connect.Request[v1.ModuleExchangeDelegatedReadAudienceRequest]) (*connect.Response[v1.IssuedWorkContext], error) { return c.exchangeDelegatedReadAudience.CallUnary(ctx, req) } // ExchangeDelegatedOperationAudience calls // saas.accounts.v1.ModuleCapabilitiesService.ExchangeDelegatedOperationAudience. -func (c *moduleCapabilitiesServiceClient) ExchangeDelegatedOperationAudience(ctx context.Context, req *connect.Request[v1.ModuleExchangeDelegatedOperationAudienceRequest]) (*connect.Response[v11.IssuedWorkContext], error) { +func (c *moduleCapabilitiesServiceClient) ExchangeDelegatedOperationAudience(ctx context.Context, req *connect.Request[v1.ModuleExchangeDelegatedOperationAudienceRequest]) (*connect.Response[v1.IssuedWorkContext], error) { return c.exchangeDelegatedOperationAudience.CallUnary(ctx, req) } @@ -659,6 +691,12 @@ func (c *moduleCapabilitiesServiceClient) ReplayEvents(ctx context.Context, req return c.replayEvents.CallUnary(ctx, req) } +// ResolveWorkContextAuthority calls +// saas.accounts.v1.ModuleCapabilitiesService.ResolveWorkContextAuthority. +func (c *moduleCapabilitiesServiceClient) ResolveWorkContextAuthority(ctx context.Context, req *connect.Request[v1.ModuleResolveWorkContextAuthorityRequest]) (*connect.Response[v1.ModuleResolveWorkContextAuthorityResponse], error) { + return c.resolveWorkContextAuthority.CallUnary(ctx, req) +} + // ModuleCapabilitiesServiceHandler is an implementation of the // saas.accounts.v1.ModuleCapabilitiesService service. type ModuleCapabilitiesServiceHandler interface { @@ -673,11 +711,11 @@ type ModuleCapabilitiesServiceHandler interface { RevokeExecutableArtifact(context.Context, *connect.Request[v1.ModuleRevokeExecutableArtifactRequest]) (*connect.Response[v1.ModuleExecutableArtifactResponse], error) // ExchangeDelegatedReadAudience authenticates the module independently of a // current parent context and exchanges only its installed read-only binding. - ExchangeDelegatedReadAudience(context.Context, *connect.Request[v1.ModuleExchangeDelegatedReadAudienceRequest]) (*connect.Response[v11.IssuedWorkContext], error) + ExchangeDelegatedReadAudience(context.Context, *connect.Request[v1.ModuleExchangeDelegatedReadAudienceRequest]) (*connect.Response[v1.IssuedWorkContext], error) // ExchangeDelegatedOperationAudience authenticates the module independently // of a current parent context and exchanges only an installed operation's // invoke scopes, or its read-only receipt-lookup subset. - ExchangeDelegatedOperationAudience(context.Context, *connect.Request[v1.ModuleExchangeDelegatedOperationAudienceRequest]) (*connect.Response[v11.IssuedWorkContext], error) + ExchangeDelegatedOperationAudience(context.Context, *connect.Request[v1.ModuleExchangeDelegatedOperationAudienceRequest]) (*connect.Response[v1.IssuedWorkContext], error) // Checks current owner and every delegated actor against true record placement, // intersected with the verified capability's attenuated resource/action scope. CheckWorkContextRecordAccess(context.Context, *connect.Request[v1.CheckWorkContextRecordAccessRequest]) (*connect.Response[v1.CheckWorkContextRecordAccessResponse], error) @@ -690,7 +728,10 @@ type ModuleCapabilitiesServiceHandler interface { // access oracles can resolve it. Bounded by the resource types the caller // principal's grant declares. PlaceRecord(context.Context, *connect.Request[v1.ModulePlaceRecordRequest]) (*connect.Response[v1.ModulePlaceRecordResponse], error) - // EnqueueJob appends durable work for a tenant- or subject-scoped queue. + // EnqueueJob appends durable work for a tenant- or subject-scoped queue. A + // subject-scoped job whose subject is not a member of the tenant is + // FAILED_PRECONDITION with reason TENANT_MEMBERSHIP_MISSING; see REFUSALS, + // and key on the reason rather than the code. EnqueueJob(context.Context, *connect.Request[v1.ModuleEnqueueJobRequest]) (*connect.Response[v1.ModuleEnqueueJobResponse], error) // ClaimJobs leases a bounded batch of ready jobs from an allowed queue. ClaimJobs(context.Context, *connect.Request[v1.ModuleClaimJobsRequest]) (*connect.Response[v1.ModuleClaimJobsResponse], error) @@ -700,10 +741,17 @@ type ModuleCapabilitiesServiceHandler interface { AckJob(context.Context, *connect.Request[v1.ModuleAckJobRequest]) (*connect.Response[emptypb.Empty], error) // NackJob fails a leased job as retryable or permanent. NackJob(context.Context, *connect.Request[v1.ModuleNackJobRequest]) (*connect.Response[emptypb.Empty], error) - // NotifyUser delivers a notification subject to category policy. + // NotifyUser delivers a notification subject to category policy. A recipient + // who is not a member of the tenant is FAILED_PRECONDITION with reason + // TENANT_MEMBERSHIP_MISSING, never PERMISSION_DENIED. An idempotency_key + // already used for different content, and a host that cannot re-read live + // authority, are FAILED_PRECONDITION too under their own reasons, so the + // reason — not the code — says which happened; see REFUSALS. NotifyUser(context.Context, *connect.Request[v1.ModuleNotifyUserRequest]) (*connect.Response[v1.ModuleNotifyUserResponse], error) // NotifyOrgAdmins notifies a tenant's administrators, resolved at send time; - // see the request. + // see the request. It names no recipient, so it has no non-member refusal; an + // idempotency_key already used for different content is FAILED_PRECONDITION + // with reason NOTIFICATION_IDEMPOTENCY_CONFLICT. NotifyOrgAdmins(context.Context, *connect.Request[v1.ModuleNotifyOrgAdminsRequest]) (*connect.Response[v1.ModuleNotifyOrgAdminsResponse], error) // RequestApproval opens a pending approval whose resume job the module claims. RequestApproval(context.Context, *connect.Request[v1.ModuleRequestApprovalRequest]) (*connect.Response[v1.ModuleRequestApprovalResponse], error) @@ -717,7 +765,11 @@ type ModuleCapabilitiesServiceHandler interface { // into the namespaces the operator bound to it; see the request. DeclareAuditEventTypes(context.Context, *connect.Request[v1.ModuleDeclareAuditEventTypesRequest]) (*connect.Response[v1.ModuleDeclareAuditEventTypesResponse], error) // ListSubjectVisibility projects the tenant's team tree onto one viewer: the - // whole set of other subjects whose rows that viewer may read. + // whole set of other subjects whose rows that viewer may read. A viewer who + // is not a member of the tenant is FAILED_PRECONDITION with reason + // TENANT_MEMBERSHIP_MISSING; a set too large to serve whole is + // FAILED_PRECONDITION with reason SUBJECT_VISIBILITY_SET_TOO_LARGE, and only + // the reason tells a consumer which it got. ListSubjectVisibility(context.Context, *connect.Request[v1.ModuleListSubjectVisibilityRequest]) (*connect.Response[v1.ModuleListSubjectVisibilityResponse], error) // FetchDatasourceBlob streams one datasource file blob to the module that // resolves a change set's blob sha. Authorized by the caller principal's @@ -769,6 +821,14 @@ type ModuleCapabilitiesServiceHandler interface { ListSubscriptions(context.Context, *connect.Request[v1.ModuleListSubscriptionsRequest]) (*connect.Response[v1.ModuleListSubscriptionsResponse], error) // ReplayEvents re-delivers durable events to the caller's own subscriptions. ReplayEvents(context.Context, *connect.Request[v1.ModuleReplayEventsRequest]) (*connect.Response[v1.ModuleReplayEventsResponse], error) + // ResolveWorkContextAuthority answers one live value a callee's verifier + // holds a capability's seal against: the installation it was sealed to and + // its revision, a principal's epoch, the build the issuer approves for a + // principal, an operation binding, the authorization revision a capability's + // owner carries, or an approval grant. It is the surface a composed module + // builds its seal, revision and grant sources on; see the block above + // ModuleResolveWorkContextAuthorityRequest for what a caller may ask. + ResolveWorkContextAuthority(context.Context, *connect.Request[v1.ModuleResolveWorkContextAuthorityRequest]) (*connect.Response[v1.ModuleResolveWorkContextAuthorityResponse], error) } // NewModuleCapabilitiesServiceHandler builds an HTTP handler from the service implementation. It @@ -970,6 +1030,12 @@ func NewModuleCapabilitiesServiceHandler(svc ModuleCapabilitiesServiceHandler, o connect.WithSchema(moduleCapabilitiesServiceMethods.ByName("ReplayEvents")), connect.WithHandlerOptions(opts...), ) + moduleCapabilitiesServiceResolveWorkContextAuthorityHandler := connect.NewUnaryHandler( + ModuleCapabilitiesServiceResolveWorkContextAuthorityProcedure, + svc.ResolveWorkContextAuthority, + connect.WithSchema(moduleCapabilitiesServiceMethods.ByName("ResolveWorkContextAuthority")), + connect.WithHandlerOptions(opts...), + ) return "/saas.accounts.v1.ModuleCapabilitiesService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { switch r.URL.Path { case ModuleCapabilitiesServiceGetCurrentInstallationProcedure: @@ -1036,6 +1102,8 @@ func NewModuleCapabilitiesServiceHandler(svc ModuleCapabilitiesServiceHandler, o moduleCapabilitiesServiceListSubscriptionsHandler.ServeHTTP(w, r) case ModuleCapabilitiesServiceReplayEventsProcedure: moduleCapabilitiesServiceReplayEventsHandler.ServeHTTP(w, r) + case ModuleCapabilitiesServiceResolveWorkContextAuthorityProcedure: + moduleCapabilitiesServiceResolveWorkContextAuthorityHandler.ServeHTTP(w, r) default: http.NotFound(w, r) } @@ -1061,11 +1129,11 @@ func (UnimplementedModuleCapabilitiesServiceHandler) RevokeExecutableArtifact(co return nil, connect.NewError(connect.CodeUnimplemented, errors.New("saas.accounts.v1.ModuleCapabilitiesService.RevokeExecutableArtifact is not implemented")) } -func (UnimplementedModuleCapabilitiesServiceHandler) ExchangeDelegatedReadAudience(context.Context, *connect.Request[v1.ModuleExchangeDelegatedReadAudienceRequest]) (*connect.Response[v11.IssuedWorkContext], error) { +func (UnimplementedModuleCapabilitiesServiceHandler) ExchangeDelegatedReadAudience(context.Context, *connect.Request[v1.ModuleExchangeDelegatedReadAudienceRequest]) (*connect.Response[v1.IssuedWorkContext], error) { return nil, connect.NewError(connect.CodeUnimplemented, errors.New("saas.accounts.v1.ModuleCapabilitiesService.ExchangeDelegatedReadAudience is not implemented")) } -func (UnimplementedModuleCapabilitiesServiceHandler) ExchangeDelegatedOperationAudience(context.Context, *connect.Request[v1.ModuleExchangeDelegatedOperationAudienceRequest]) (*connect.Response[v11.IssuedWorkContext], error) { +func (UnimplementedModuleCapabilitiesServiceHandler) ExchangeDelegatedOperationAudience(context.Context, *connect.Request[v1.ModuleExchangeDelegatedOperationAudienceRequest]) (*connect.Response[v1.IssuedWorkContext], error) { return nil, connect.NewError(connect.CodeUnimplemented, errors.New("saas.accounts.v1.ModuleCapabilitiesService.ExchangeDelegatedOperationAudience is not implemented")) } @@ -1172,3 +1240,7 @@ func (UnimplementedModuleCapabilitiesServiceHandler) ListSubscriptions(context.C func (UnimplementedModuleCapabilitiesServiceHandler) ReplayEvents(context.Context, *connect.Request[v1.ModuleReplayEventsRequest]) (*connect.Response[v1.ModuleReplayEventsResponse], error) { return nil, connect.NewError(connect.CodeUnimplemented, errors.New("saas.accounts.v1.ModuleCapabilitiesService.ReplayEvents is not implemented")) } + +func (UnimplementedModuleCapabilitiesServiceHandler) ResolveWorkContextAuthority(context.Context, *connect.Request[v1.ModuleResolveWorkContextAuthorityRequest]) (*connect.Response[v1.ModuleResolveWorkContextAuthorityResponse], error) { + return nil, connect.NewError(connect.CodeUnimplemented, errors.New("saas.accounts.v1.ModuleCapabilitiesService.ResolveWorkContextAuthority is not implemented")) +} diff --git a/libraries/source-read-sdk/go/gen/saas/accounts/v1/module_capabilities.pb.go b/libraries/source-read-sdk/go/gen/saas/accounts/v1/module_capabilities.pb.go index 504e342ae..34cdcf24a 100644 --- a/libraries/source-read-sdk/go/gen/saas/accounts/v1/module_capabilities.pb.go +++ b/libraries/source-read-sdk/go/gen/saas/accounts/v1/module_capabilities.pb.go @@ -7,20 +7,20 @@ package accountsv1 import ( + reflect "reflect" + sync "sync" + unsafe "unsafe" + _ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate" v11 "github.com/codefly-dev/module-saas-starter/libraries/source-read-sdk/go/gen/saas/events/v1" - v12 "github.com/codefly-dev/saas-sdk-go/gen/saas/accounts/v1" - v1 "github.com/codefly-dev/saas-sdk-go/gen/saas/jobs/v1" - _ "github.com/codefly-dev/saas-sdk-go/gen/saas/policy/v1" + v1 "github.com/codefly-dev/module-saas-starter/libraries/source-read-sdk/go/gen/saas/jobs/v1" + _ "github.com/codefly-dev/module-saas-starter/libraries/source-read-sdk/go/gen/saas/policy/v1" protoreflect "google.golang.org/protobuf/reflect/protoreflect" protoimpl "google.golang.org/protobuf/runtime/protoimpl" durationpb "google.golang.org/protobuf/types/known/durationpb" emptypb "google.golang.org/protobuf/types/known/emptypb" structpb "google.golang.org/protobuf/types/known/structpb" timestamppb "google.golang.org/protobuf/types/known/timestamppb" - reflect "reflect" - sync "sync" - unsafe "unsafe" ) const ( @@ -116,7 +116,7 @@ const ( ModuleAuditEventVisibility_MODULE_AUDIT_EVENT_VISIBILITY_TENANT ModuleAuditEventVisibility = 1 // May additionally be delivered to a tenant's outbound webhook endpoint. // Admitted only in a namespace the operator marked externally deliverable - // (`external_namespaces` of the declaring principal's MODULE_PRINCIPALS + // (`external_namespaces` of the declaring principal's module registry // entry): the producer decides which of its facts are customer-facing, and // the operator decides whether that producer may send anything out at all. ModuleAuditEventVisibility_MODULE_AUDIT_EVENT_VISIBILITY_EXTERNAL ModuleAuditEventVisibility = 2 @@ -379,6 +379,279 @@ func (SourceSyncStage) EnumDescriptor() ([]byte, []int) { return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{5} } +// WorkContextSealState tells a held installation from one the principal does not +// hold. UNSPECIFIED is neither: it is a host that answered nothing. +type WorkContextSealState int32 + +const ( + WorkContextSealState_WORK_CONTEXT_SEAL_STATE_UNSPECIFIED WorkContextSealState = 0 + // HELD: the principal holds this installation, and the answer carries its + // live revision. + WorkContextSealState_WORK_CONTEXT_SEAL_STATE_HELD WorkContextSealState = 1 + // UNHELD: the installation is not active in this organization, or the + // principal is not an active member of it. A capability sealed to it is not a + // credential, so a verifier refuses rather than erroring. + WorkContextSealState_WORK_CONTEXT_SEAL_STATE_UNHELD WorkContextSealState = 2 +) + +// Enum value maps for WorkContextSealState. +var ( + WorkContextSealState_name = map[int32]string{ + 0: "WORK_CONTEXT_SEAL_STATE_UNSPECIFIED", + 1: "WORK_CONTEXT_SEAL_STATE_HELD", + 2: "WORK_CONTEXT_SEAL_STATE_UNHELD", + } + WorkContextSealState_value = map[string]int32{ + "WORK_CONTEXT_SEAL_STATE_UNSPECIFIED": 0, + "WORK_CONTEXT_SEAL_STATE_HELD": 1, + "WORK_CONTEXT_SEAL_STATE_UNHELD": 2, + } +) + +func (x WorkContextSealState) Enum() *WorkContextSealState { + p := new(WorkContextSealState) + *p = x + return p +} + +func (x WorkContextSealState) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (WorkContextSealState) Descriptor() protoreflect.EnumDescriptor { + return file_saas_accounts_v1_module_capabilities_proto_enumTypes[6].Descriptor() +} + +func (WorkContextSealState) Type() protoreflect.EnumType { + return &file_saas_accounts_v1_module_capabilities_proto_enumTypes[6] +} + +func (x WorkContextSealState) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use WorkContextSealState.Descriptor instead. +func (WorkContextSealState) EnumDescriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{6} +} + +// WorkContextPrincipalState tells a principal this organization has an +// authorization record for from one it has never heard of. An unknown principal +// is a refusal, never an epoch of zero. +type WorkContextPrincipalState int32 + +const ( + WorkContextPrincipalState_WORK_CONTEXT_PRINCIPAL_STATE_UNSPECIFIED WorkContextPrincipalState = 0 + WorkContextPrincipalState_WORK_CONTEXT_PRINCIPAL_STATE_KNOWN WorkContextPrincipalState = 1 + WorkContextPrincipalState_WORK_CONTEXT_PRINCIPAL_STATE_UNKNOWN WorkContextPrincipalState = 2 +) + +// Enum value maps for WorkContextPrincipalState. +var ( + WorkContextPrincipalState_name = map[int32]string{ + 0: "WORK_CONTEXT_PRINCIPAL_STATE_UNSPECIFIED", + 1: "WORK_CONTEXT_PRINCIPAL_STATE_KNOWN", + 2: "WORK_CONTEXT_PRINCIPAL_STATE_UNKNOWN", + } + WorkContextPrincipalState_value = map[string]int32{ + "WORK_CONTEXT_PRINCIPAL_STATE_UNSPECIFIED": 0, + "WORK_CONTEXT_PRINCIPAL_STATE_KNOWN": 1, + "WORK_CONTEXT_PRINCIPAL_STATE_UNKNOWN": 2, + } +) + +func (x WorkContextPrincipalState) Enum() *WorkContextPrincipalState { + p := new(WorkContextPrincipalState) + *p = x + return p +} + +func (x WorkContextPrincipalState) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (WorkContextPrincipalState) Descriptor() protoreflect.EnumDescriptor { + return file_saas_accounts_v1_module_capabilities_proto_enumTypes[7].Descriptor() +} + +func (WorkContextPrincipalState) Type() protoreflect.EnumType { + return &file_saas_accounts_v1_module_capabilities_proto_enumTypes[7] +} + +func (x WorkContextPrincipalState) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use WorkContextPrincipalState.Descriptor instead. +func (WorkContextPrincipalState) EnumDescriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{7} +} + +// WorkContextApprovedBuildState separates the three answers this question has, +// because collapsing any two of them is the dangerous direction: a principal +// with an approved build, a principal that BEARS NO EXECUTION — a person's +// session, which is correct and not an error — and anything else, which is a +// refusal carried as an error rather than a state. +type WorkContextApprovedBuildState int32 + +const ( + WorkContextApprovedBuildState_WORK_CONTEXT_APPROVED_BUILD_STATE_UNSPECIFIED WorkContextApprovedBuildState = 0 + WorkContextApprovedBuildState_WORK_CONTEXT_APPROVED_BUILD_STATE_APPROVED WorkContextApprovedBuildState = 1 + // BEARS_NO_EXECUTION: this principal runs no approved build at all. A + // capability of its own carries no execution, and one that carries an + // execution is refused — a process claiming to be a workload. + WorkContextApprovedBuildState_WORK_CONTEXT_APPROVED_BUILD_STATE_BEARS_NO_EXECUTION WorkContextApprovedBuildState = 2 +) + +// Enum value maps for WorkContextApprovedBuildState. +var ( + WorkContextApprovedBuildState_name = map[int32]string{ + 0: "WORK_CONTEXT_APPROVED_BUILD_STATE_UNSPECIFIED", + 1: "WORK_CONTEXT_APPROVED_BUILD_STATE_APPROVED", + 2: "WORK_CONTEXT_APPROVED_BUILD_STATE_BEARS_NO_EXECUTION", + } + WorkContextApprovedBuildState_value = map[string]int32{ + "WORK_CONTEXT_APPROVED_BUILD_STATE_UNSPECIFIED": 0, + "WORK_CONTEXT_APPROVED_BUILD_STATE_APPROVED": 1, + "WORK_CONTEXT_APPROVED_BUILD_STATE_BEARS_NO_EXECUTION": 2, + } +) + +func (x WorkContextApprovedBuildState) Enum() *WorkContextApprovedBuildState { + p := new(WorkContextApprovedBuildState) + *p = x + return p +} + +func (x WorkContextApprovedBuildState) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (WorkContextApprovedBuildState) Descriptor() protoreflect.EnumDescriptor { + return file_saas_accounts_v1_module_capabilities_proto_enumTypes[8].Descriptor() +} + +func (WorkContextApprovedBuildState) Type() protoreflect.EnumType { + return &file_saas_accounts_v1_module_capabilities_proto_enumTypes[8] +} + +func (x WorkContextApprovedBuildState) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use WorkContextApprovedBuildState.Descriptor instead. +func (WorkContextApprovedBuildState) EnumDescriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{8} +} + +// WorkContextOperationBindingState tells a resolved binding from an id that +// names nothing this organization holds. +type WorkContextOperationBindingState int32 + +const ( + WorkContextOperationBindingState_WORK_CONTEXT_OPERATION_BINDING_STATE_UNSPECIFIED WorkContextOperationBindingState = 0 + WorkContextOperationBindingState_WORK_CONTEXT_OPERATION_BINDING_STATE_RESOLVED WorkContextOperationBindingState = 1 + // ABSENT: no such binding — no delegation under that id, or one this + // organization does not entitle the named module to use. An id is a pointer + // and never authority, so guessing one resolves here. + WorkContextOperationBindingState_WORK_CONTEXT_OPERATION_BINDING_STATE_ABSENT WorkContextOperationBindingState = 2 +) + +// Enum value maps for WorkContextOperationBindingState. +var ( + WorkContextOperationBindingState_name = map[int32]string{ + 0: "WORK_CONTEXT_OPERATION_BINDING_STATE_UNSPECIFIED", + 1: "WORK_CONTEXT_OPERATION_BINDING_STATE_RESOLVED", + 2: "WORK_CONTEXT_OPERATION_BINDING_STATE_ABSENT", + } + WorkContextOperationBindingState_value = map[string]int32{ + "WORK_CONTEXT_OPERATION_BINDING_STATE_UNSPECIFIED": 0, + "WORK_CONTEXT_OPERATION_BINDING_STATE_RESOLVED": 1, + "WORK_CONTEXT_OPERATION_BINDING_STATE_ABSENT": 2, + } +) + +func (x WorkContextOperationBindingState) Enum() *WorkContextOperationBindingState { + p := new(WorkContextOperationBindingState) + *p = x + return p +} + +func (x WorkContextOperationBindingState) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (WorkContextOperationBindingState) Descriptor() protoreflect.EnumDescriptor { + return file_saas_accounts_v1_module_capabilities_proto_enumTypes[9].Descriptor() +} + +func (WorkContextOperationBindingState) Type() protoreflect.EnumType { + return &file_saas_accounts_v1_module_capabilities_proto_enumTypes[9] +} + +func (x WorkContextOperationBindingState) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use WorkContextOperationBindingState.Descriptor instead. +func (WorkContextOperationBindingState) EnumDescriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{9} +} + +// WorkContextApprovalGrantState is the state of an approval grant. +// +// This host records none, and NOT_RECORDED is the only state it answers today: +// a capability carrying a grant hop names a decision this host never made, and +// its verifier refuses it. The state is served rather than assumed by a client +// so that the policy has one home — the day this host records approvals, this +// answer grows the record it resolved and a client that does not understand the +// new state keeps refusing, which is the safe direction. +type WorkContextApprovalGrantState int32 + +const ( + WorkContextApprovalGrantState_WORK_CONTEXT_APPROVAL_GRANT_STATE_UNSPECIFIED WorkContextApprovalGrantState = 0 + WorkContextApprovalGrantState_WORK_CONTEXT_APPROVAL_GRANT_STATE_NOT_RECORDED WorkContextApprovalGrantState = 1 +) + +// Enum value maps for WorkContextApprovalGrantState. +var ( + WorkContextApprovalGrantState_name = map[int32]string{ + 0: "WORK_CONTEXT_APPROVAL_GRANT_STATE_UNSPECIFIED", + 1: "WORK_CONTEXT_APPROVAL_GRANT_STATE_NOT_RECORDED", + } + WorkContextApprovalGrantState_value = map[string]int32{ + "WORK_CONTEXT_APPROVAL_GRANT_STATE_UNSPECIFIED": 0, + "WORK_CONTEXT_APPROVAL_GRANT_STATE_NOT_RECORDED": 1, + } +) + +func (x WorkContextApprovalGrantState) Enum() *WorkContextApprovalGrantState { + p := new(WorkContextApprovalGrantState) + *p = x + return p +} + +func (x WorkContextApprovalGrantState) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (WorkContextApprovalGrantState) Descriptor() protoreflect.EnumDescriptor { + return file_saas_accounts_v1_module_capabilities_proto_enumTypes[10].Descriptor() +} + +func (WorkContextApprovalGrantState) Type() protoreflect.EnumType { + return &file_saas_accounts_v1_module_capabilities_proto_enumTypes[10] +} + +func (x WorkContextApprovalGrantState) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use WorkContextApprovalGrantState.Descriptor instead. +func (WorkContextApprovalGrantState) EnumDescriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{10} +} + // ModuleEnqueueJobRequest names the tenant the work belongs to and carries the // same producer-owned NewJob the in-process producer uses. tenant must equal // the caller principal's bound tenant unless the principal holds a cross-tenant @@ -1847,7 +2120,7 @@ type ModuleAuditEventTypeDeclaration struct { state protoimpl.MessageState `protogen:"open.v1"` // .., lowercase snake_case segments. The // namespace must be one the operator bound to this module (the `namespaces` - // of its MODULE_PRINCIPALS entry) and may not be the host's own. + // of its module registry entry) and may not be the host's own. Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"` Description string `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"` Fields []*ModuleAuditFieldDeclaration `protobuf:"bytes,3,rep,name=fields,proto3" json:"fields,omitempty"` @@ -3670,13 +3943,17 @@ func (x *CollectionSyncProvenance) GetRequestedByLabel() string { return "" } -// Tenant and viewer come exclusively from the verified Work Context. +// The calling module authenticates with its own module Work Context in the +// x-codefly-work-context header; the viewer it reads for travels here, and +// must be addressed to that module. Tenant and viewer come exclusively from +// the verified viewer Work Context. type ListReadableSourceCollectionsRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"` - PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + state protoimpl.MessageState `protogen:"open.v1"` + PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"` + PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"` + ViewerWorkContextToken string `protobuf:"bytes,3,opt,name=viewer_work_context_token,json=viewerWorkContextToken,proto3" json:"viewer_work_context_token,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *ListReadableSourceCollectionsRequest) Reset() { @@ -3723,6 +4000,13 @@ func (x *ListReadableSourceCollectionsRequest) GetPageToken() string { return "" } +func (x *ListReadableSourceCollectionsRequest) GetViewerWorkContextToken() string { + if x != nil { + return x.ViewerWorkContextToken + } + return "" +} + type ListReadableSourceCollectionsResponse struct { state protoimpl.MessageState `protogen:"open.v1"` Collections []*ReadableSourceCollection `protobuf:"bytes,1,rep,name=collections,proto3" json:"collections,omitempty"` @@ -3921,15 +4205,19 @@ func (x *ModulePlaceRecordResponse) GetNodeId() string { return "" } -// Exact-record delegated oracle. Tenant and subjects come only from the signed -// forwarded Work Context; a caller cannot provide a scope path or principal. +// Exact-record delegated oracle. The calling module authenticates with its +// own module Work Context in the x-codefly-work-context header; the viewer it +// asks for travels here, and must be addressed to that module. Tenant and +// subjects come only from the signed viewer Work Context; a caller cannot +// provide a scope path or principal. type CheckWorkContextRecordAccessRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - ResourceType string `protobuf:"bytes,1,opt,name=resource_type,json=resourceType,proto3" json:"resource_type,omitempty"` - ResourceId string `protobuf:"bytes,2,opt,name=resource_id,json=resourceId,proto3" json:"resource_id,omitempty"` - Action string `protobuf:"bytes,3,opt,name=action,proto3" json:"action,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + state protoimpl.MessageState `protogen:"open.v1"` + ResourceType string `protobuf:"bytes,1,opt,name=resource_type,json=resourceType,proto3" json:"resource_type,omitempty"` + ResourceId string `protobuf:"bytes,2,opt,name=resource_id,json=resourceId,proto3" json:"resource_id,omitempty"` + Action string `protobuf:"bytes,3,opt,name=action,proto3" json:"action,omitempty"` + ViewerWorkContextToken string `protobuf:"bytes,4,opt,name=viewer_work_context_token,json=viewerWorkContextToken,proto3" json:"viewer_work_context_token,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *CheckWorkContextRecordAccessRequest) Reset() { @@ -3983,6 +4271,13 @@ func (x *CheckWorkContextRecordAccessRequest) GetAction() string { return "" } +func (x *CheckWorkContextRecordAccessRequest) GetViewerWorkContextToken() string { + if x != nil { + return x.ViewerWorkContextToken + } + return "" +} + type CheckWorkContextRecordAccessResponse struct { state protoimpl.MessageState `protogen:"open.v1"` // False also covers an unplaced or inaccessible record; no scope is disclosed. @@ -4647,98 +4942,1124 @@ func (x *ModuleCurrentInstallationResponse) GetBindingId() string { return "" } -var File_saas_accounts_v1_module_capabilities_proto protoreflect.FileDescriptor +// WorkContextSealQuestion asks for the live installation one principal holds. +// Both identifiers must be the ones the presented capability names — its owner +// and the installation it is sealed to — and its revision is the issuer's to +// answer. +type WorkContextSealQuestion struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Both are compared against the presented capability, which is what makes + // them trustworthy — so neither carries a format rule. A uuid constraint + // here would add no safety the comparison does not already give and would + // refuse an installation id this host legitimately holds. + PrincipalId string `protobuf:"bytes,1,opt,name=principal_id,json=principalId,proto3" json:"principal_id,omitempty"` + InstallationId string `protobuf:"bytes,2,opt,name=installation_id,json=installationId,proto3" json:"installation_id,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} -const file_saas_accounts_v1_module_capabilities_proto_rawDesc = "" + - "\n" + - "*saas/accounts/v1/module_capabilities.proto\x12\x10saas.accounts.v1\x1a$saas/accounts/v1/work_contexts.proto\x1a\x1bbuf/validate/validate.proto\x1a\x1bgoogle/protobuf/empty.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a*saas/accounts/v1/module_registration.proto\x1a\x1bsaas/events/v1/events.proto\x1a\x17saas/jobs/v1/jobs.proto\x1a\x1csaas/policy/v1/options.proto\"k\n" + - "\x17ModuleEnqueueJobRequest\x12 \n" + - "\x06tenant\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x06tenant\x12.\n" + - "\x03job\x18\x02 \x01(\v2\x14.saas.jobs.v1.NewJobB\x06\xbaH\x03\xc8\x01\x01R\x03job\"\x8a\x01\n" + - "\x18ModuleEnqueueJobResponse\x12\x1f\n" + - "\x06job_id\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x05jobId\x12M\n" + - "\vdisposition\x18\x02 \x01(\x0e2#.saas.jobs.v1.JobEnqueueDispositionB\x06\xbaH\x03\xc8\x01\x01R\vdisposition\"\xf1\x01\n" + - "\x16ModuleClaimJobsRequest\x125\n" + - "\x05queue\x18\x01 \x01(\tB\x1f\xbaH\x1cr\x1a\x10\x01\x18\x80\x012\x13^[a-z][a-z0-9_.-]*$R\x05queue\x12'\n" + - "\tworker_id\x18\x02 \x01(\tB\n" + - "\xbaH\ar\x05\x10\x01\x18\xff\x01R\bworkerId\x12\x1f\n" + - "\x05limit\x18\x03 \x01(\rB\t\xbaH\x06*\x04\x18d(\x01R\x05limit\x12V\n" + - "\x0elease_duration\x18\x04 \x01(\v2\x19.google.protobuf.DurationB\x14\xbaH\x11\xc8\x01\x01\xaa\x01\v\"\x03\b\x90\x1c2\x04\x10\xc0\x84=R\rleaseDuration\"H\n" + - "\x17ModuleClaimJobsResponse\x12-\n" + - "\x04jobs\x18\x01 \x03(\v2\x19.saas.jobs.v1.JobEnvelopeR\x04jobs\"\xa9\x01\n" + - "\x19ModuleHeartbeatJobRequest\x12=\n" + - "\x05lease\x18\x01 \x01(\v2\x1f.saas.jobs.v1.JobLeaseReferenceB\x06\xbaH\x03\xc8\x01\x01R\x05lease\x12M\n" + - "\textension\x18\x02 \x01(\v2\x19.google.protobuf.DurationB\x14\xbaH\x11\xc8\x01\x01\xaa\x01\v\"\x03\b\x90\x1c2\x04\x10\xc0\x84=R\textension\"R\n" + - "\x1aModuleHeartbeatJobResponse\x124\n" + - "\x05lease\x18\x01 \x01(\v2\x16.saas.jobs.v1.JobLeaseB\x06\xbaH\x03\xc8\x01\x01R\x05lease\"\xc9\x01\n" + - "\x13ModuleAckJobRequest\x12=\n" + - "\x05lease\x18\x01 \x01(\v2\x1f.saas.jobs.v1.JobLeaseReferenceB\x06\xbaH\x03\xc8\x01\x01R\x05lease\x12F\n" + - "\x0eexecution_kind\x18\x02 \x01(\tB\x1f\xbaH\x1cr\x1a\x18@2\x16^$|^[a-z][a-z0-9_.-]*$R\rexecutionKind\x12+\n" + - "\fexecution_id\x18\x03 \x01(\tB\b\xbaH\x05r\x03\x18\xff\x01R\vexecutionId\"\xe6\x01\n" + - "\x14ModuleNackJobRequest\x12=\n" + - "\x05lease\x18\x01 \x01(\v2\x1f.saas.jobs.v1.JobLeaseReferenceB\x06\xbaH\x03\xc8\x01\x01R\x05lease\x12:\n" + - "\afailure\x18\x02 \x01(\v2\x18.saas.jobs.v1.JobFailureB\x06\xbaH\x03\xc8\x01\x01R\afailure\x12\x1c\n" + - "\tretryable\x18\x03 \x01(\bR\tretryable\x125\n" + - "\bretry_at\x18\x04 \x01(\v2\x1a.google.protobuf.TimestampR\aretryAt\"\xbe\x02\n" + - "\x17ModuleNotifyUserRequest\x12 \n" + - "\x06tenant\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x06tenant\x12!\n" + - "\auser_id\x18\x02 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x06userId\x12 \n" + - "\x05title\x18\x03 \x01(\tB\n" + - "\xbaH\ar\x05\x10\x01\x18\xe6\aR\x05title\x12\x1c\n" + - "\x04body\x18\x04 \x01(\tB\b\xbaH\x05r\x03\x18\x80@R\x04body\x12\x1b\n" + - "\x04type\x18\x05 \x01(\tB\a\xbaH\x04r\x02\x18@R\x04type\x12'\n" + - "\n" + - "action_url\x18\x06 \x01(\tB\b\xbaH\x05r\x03\x18\x80\x10R\tactionUrl\x12%\n" + - "\bcategory\x18\a \x01(\tB\t\xbaH\x06r\x04\x10\x01\x18 R\bcategory\x121\n" + - "\x0fidempotency_key\x18\b \x01(\tB\b\xbaH\x05r\x03\x18\xff\x01R\x0eidempotencyKey\"a\n" + - "\x18ModuleNotifyUserResponse\x12'\n" + - "\x0fnotification_id\x18\x01 \x01(\tR\x0enotificationId\x12\x1c\n" + - "\tdelivered\x18\x02 \x01(\bR\tdelivered\"\xa0\x02\n" + - "\x1cModuleNotifyOrgAdminsRequest\x12 \n" + - "\x06tenant\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x06tenant\x12 \n" + - "\x05title\x18\x02 \x01(\tB\n" + - "\xbaH\ar\x05\x10\x01\x18\xe6\aR\x05title\x12\x1c\n" + - "\x04body\x18\x03 \x01(\tB\b\xbaH\x05r\x03\x18\x80@R\x04body\x12\x1b\n" + - "\x04type\x18\x04 \x01(\tB\a\xbaH\x04r\x02\x18@R\x04type\x12'\n" + - "\n" + - "action_url\x18\x05 \x01(\tB\b\xbaH\x05r\x03\x18\x80\x10R\tactionUrl\x12%\n" + - "\bcategory\x18\x06 \x01(\tB\t\xbaH\x06r\x04\x10\x01\x18 R\bcategory\x121\n" + - "\x0fidempotency_key\x18\a \x01(\tB\b\xbaH\x05r\x03\x18\xff\x01R\x0eidempotencyKey\"=\n" + - "\x1dModuleNotifyOrgAdminsResponse\x12\x1c\n" + - "\tdelivered\x18\x01 \x01(\bR\tdelivered\"\x83\x01\n" + - "\x14ModuleApprovalPolicy\x12\x1f\n" + - "\x06quorum\x18\x01 \x01(\rB\a\xbaH\x04*\x02\x18dR\x06quorum\x12+\n" + - "\fapprover_set\x18\x02 \x03(\tB\b\xbaH\x05\x92\x01\x02\x10dR\vapproverSet\x12\x1d\n" + - "\n" + - "allow_self\x18\x03 \x01(\bR\tallowSelf\"\xb2\x01\n" + - "\x0fModuleResumeRef\x125\n" + - "\x05queue\x18\x01 \x01(\tB\x1f\xbaH\x1cr\x1a\x10\x01\x18\x80\x012\x13^[a-z][a-z0-9_.-]*$R\x05queue\x125\n" + - "\x05topic\x18\x02 \x01(\tB\x1f\xbaH\x1cr\x1a\x10\x01\x18\xff\x012\x13^[a-z][a-z0-9_.-]*$R\x05topic\x121\n" + - "\apayload\x18\x03 \x01(\v2\x17.google.protobuf.StructR\apayload\"\xf0\x03\n" + - "\x1cModuleRequestApprovalRequest\x12 \n" + - "\x06tenant\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x06tenant\x12&\n" + - "\bresource\x18\x02 \x01(\tB\n" + - "\xbaH\ar\x05\x10\x01\x18\x80\x01R\bresource\x12\"\n" + - "\x06action\x18\x03 \x01(\tB\n" + - "\xbaH\ar\x05\x10\x01\x18\x80\x01R\x06action\x121\n" + - "\asubject\x18\x04 \x01(\v2\x17.google.protobuf.StructR\asubject\x12-\n" + - "\frequested_by\x18\x05 \x01(\tB\n" + - "\xbaH\ar\x05\x10\x01\x18\xff\x01R\vrequestedBy\x12>\n" + - "\x06policy\x18\x06 \x01(\v2&.saas.accounts.v1.ModuleApprovalPolicyR\x06policy\x12H\n" + - "\n" + - "resume_ref\x18\a \x01(\v2!.saas.accounts.v1.ModuleResumeRefB\x06\xbaH\x03\xc8\x01\x01R\tresumeRef\x129\n" + - "\n" + - "expires_at\x18\b \x01(\v2\x1a.google.protobuf.TimestampR\texpiresAt\x12;\n" + - "\vescalate_at\x18\t \x01(\v2\x1a.google.protobuf.TimestampR\n" + - "escalateAt\"J\n" + - "\x1dModuleRequestApprovalResponse\x12)\n" + - "\vapproval_id\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\n" + - "approvalId\"g\n" + - "\x18ModuleGetApprovalRequest\x12 \n" + - "\x06tenant\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x06tenant\x12)\n" + - "\vapproval_id\x18\x02 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\n" + - "approvalId\"\xe5\x03\n" + - "\x0eModuleApproval\x12\x0e\n" + +func (x *WorkContextSealQuestion) Reset() { + *x = WorkContextSealQuestion{} + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[63] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *WorkContextSealQuestion) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*WorkContextSealQuestion) ProtoMessage() {} + +func (x *WorkContextSealQuestion) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[63] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use WorkContextSealQuestion.ProtoReflect.Descriptor instead. +func (*WorkContextSealQuestion) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{63} +} + +func (x *WorkContextSealQuestion) GetPrincipalId() string { + if x != nil { + return x.PrincipalId + } + return "" +} + +func (x *WorkContextSealQuestion) GetInstallationId() string { + if x != nil { + return x.InstallationId + } + return "" +} + +// WorkContextPrincipalEpochQuestion asks for one principal's live epoch, +// independent of any installation. It is the question asked of the task owner +// and of every actor hop alike, so a delegated actor is revocable on its own — +// and the principal must be one of those: the capability's owner, or a principal +// in its actor chain. +type WorkContextPrincipalEpochQuestion struct { + state protoimpl.MessageState `protogen:"open.v1"` + PrincipalId string `protobuf:"bytes,1,opt,name=principal_id,json=principalId,proto3" json:"principal_id,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *WorkContextPrincipalEpochQuestion) Reset() { + *x = WorkContextPrincipalEpochQuestion{} + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[64] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *WorkContextPrincipalEpochQuestion) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*WorkContextPrincipalEpochQuestion) ProtoMessage() {} + +func (x *WorkContextPrincipalEpochQuestion) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[64] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use WorkContextPrincipalEpochQuestion.ProtoReflect.Descriptor instead. +func (*WorkContextPrincipalEpochQuestion) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{64} +} + +func (x *WorkContextPrincipalEpochQuestion) GetPrincipalId() string { + if x != nil { + return x.PrincipalId + } + return "" +} + +// WorkContextApprovedBuildQuestion asks what execution the issuer APPROVES for +// one principal. It takes no attribute of the workload: resolving by what a +// caller presents is exactly what lets a superseded pod in. The principal must +// be the capability's owner or one in its actor chain, which is every principal +// a verifier holds an execution against. +type WorkContextApprovedBuildQuestion struct { + state protoimpl.MessageState `protogen:"open.v1"` + PrincipalId string `protobuf:"bytes,1,opt,name=principal_id,json=principalId,proto3" json:"principal_id,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *WorkContextApprovedBuildQuestion) Reset() { + *x = WorkContextApprovedBuildQuestion{} + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[65] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *WorkContextApprovedBuildQuestion) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*WorkContextApprovedBuildQuestion) ProtoMessage() {} + +func (x *WorkContextApprovedBuildQuestion) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[65] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use WorkContextApprovedBuildQuestion.ProtoReflect.Descriptor instead. +func (*WorkContextApprovedBuildQuestion) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{65} +} + +func (x *WorkContextApprovedBuildQuestion) GetPrincipalId() string { + if x != nil { + return x.PrincipalId + } + return "" +} + +// WorkContextOperationBindingQuestion resolves one operation binding by its +// opaque id, EXACTLY: the one the presented capability is sealed to, and no +// other. There is deliberately no question that lists bindings or finds one +// whose scopes would admit a call — a search is a predicate somebody writes, and +// one case too generous grants authority nobody reviewed — and none that +// resolves a binding some other capability names, which would make this an +// oracle over other modules' installations. +type WorkContextOperationBindingQuestion struct { + state protoimpl.MessageState `protogen:"open.v1"` + BindingId string `protobuf:"bytes,1,opt,name=binding_id,json=bindingId,proto3" json:"binding_id,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *WorkContextOperationBindingQuestion) Reset() { + *x = WorkContextOperationBindingQuestion{} + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[66] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *WorkContextOperationBindingQuestion) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*WorkContextOperationBindingQuestion) ProtoMessage() {} + +func (x *WorkContextOperationBindingQuestion) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[66] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use WorkContextOperationBindingQuestion.ProtoReflect.Descriptor instead. +func (*WorkContextOperationBindingQuestion) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{66} +} + +func (x *WorkContextOperationBindingQuestion) GetBindingId() string { + if x != nil { + return x.BindingId + } + return "" +} + +// WorkContextAuthorizationRevisionQuestion asks the authorization revision a +// capability owned by one principal carries. +// +// It names the OWNER, and core's RevisionSource is keyed by tenant alone. That +// is not a widening: this host's revision is the greater of the organization's +// and the owner's own (a module principal's is its installed grant), so an answer +// for a tenant without an owner would be a different number from the one the mint +// stamped. The owner must be the presented capability's own owner, so naming a +// principal whose revision happens to be lower is not expressible. +type WorkContextAuthorizationRevisionQuestion struct { + state protoimpl.MessageState `protogen:"open.v1"` + OwnerPrincipalId string `protobuf:"bytes,1,opt,name=owner_principal_id,json=ownerPrincipalId,proto3" json:"owner_principal_id,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *WorkContextAuthorizationRevisionQuestion) Reset() { + *x = WorkContextAuthorizationRevisionQuestion{} + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[67] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *WorkContextAuthorizationRevisionQuestion) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*WorkContextAuthorizationRevisionQuestion) ProtoMessage() {} + +func (x *WorkContextAuthorizationRevisionQuestion) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[67] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use WorkContextAuthorizationRevisionQuestion.ProtoReflect.Descriptor instead. +func (*WorkContextAuthorizationRevisionQuestion) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{67} +} + +func (x *WorkContextAuthorizationRevisionQuestion) GetOwnerPrincipalId() string { + if x != nil { + return x.OwnerPrincipalId + } + return "" +} + +// WorkContextApprovalGrantQuestion resolves the approval a capability's grant +// hop claims. The id must be the one the presented capability's hop claims, so a +// capability carrying no grant hop has no grant to ask about. +type WorkContextApprovalGrantQuestion struct { + state protoimpl.MessageState `protogen:"open.v1"` + GrantId string `protobuf:"bytes,1,opt,name=grant_id,json=grantId,proto3" json:"grant_id,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *WorkContextApprovalGrantQuestion) Reset() { + *x = WorkContextApprovalGrantQuestion{} + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[68] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *WorkContextApprovalGrantQuestion) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*WorkContextApprovalGrantQuestion) ProtoMessage() {} + +func (x *WorkContextApprovalGrantQuestion) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[68] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use WorkContextApprovalGrantQuestion.ProtoReflect.Descriptor instead. +func (*WorkContextApprovalGrantQuestion) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{68} +} + +func (x *WorkContextApprovalGrantQuestion) GetGrantId() string { + if x != nil { + return x.GrantId + } + return "" +} + +type WorkContextSealAnswer struct { + state protoimpl.MessageState `protogen:"open.v1"` + State WorkContextSealState `protobuf:"varint,1,opt,name=state,proto3,enum=saas.accounts.v1.WorkContextSealState" json:"state,omitempty"` + // The installation this answer is ABOUT, echoed so a source that resolved + // something else cannot pass for the one that was asked about. + InstallationId string `protobuf:"bytes,2,opt,name=installation_id,json=installationId,proto3" json:"installation_id,omitempty"` + InstallationRevision uint64 `protobuf:"varint,3,opt,name=installation_revision,json=installationRevision,proto3" json:"installation_revision,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *WorkContextSealAnswer) Reset() { + *x = WorkContextSealAnswer{} + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[69] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *WorkContextSealAnswer) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*WorkContextSealAnswer) ProtoMessage() {} + +func (x *WorkContextSealAnswer) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[69] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use WorkContextSealAnswer.ProtoReflect.Descriptor instead. +func (*WorkContextSealAnswer) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{69} +} + +func (x *WorkContextSealAnswer) GetState() WorkContextSealState { + if x != nil { + return x.State + } + return WorkContextSealState_WORK_CONTEXT_SEAL_STATE_UNSPECIFIED +} + +func (x *WorkContextSealAnswer) GetInstallationId() string { + if x != nil { + return x.InstallationId + } + return "" +} + +func (x *WorkContextSealAnswer) GetInstallationRevision() uint64 { + if x != nil { + return x.InstallationRevision + } + return 0 +} + +type WorkContextPrincipalEpochAnswer struct { + state protoimpl.MessageState `protogen:"open.v1"` + State WorkContextPrincipalState `protobuf:"varint,1,opt,name=state,proto3,enum=saas.accounts.v1.WorkContextPrincipalState" json:"state,omitempty"` + PrincipalId string `protobuf:"bytes,2,opt,name=principal_id,json=principalId,proto3" json:"principal_id,omitempty"` + Epoch uint64 `protobuf:"varint,3,opt,name=epoch,proto3" json:"epoch,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *WorkContextPrincipalEpochAnswer) Reset() { + *x = WorkContextPrincipalEpochAnswer{} + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[70] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *WorkContextPrincipalEpochAnswer) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*WorkContextPrincipalEpochAnswer) ProtoMessage() {} + +func (x *WorkContextPrincipalEpochAnswer) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[70] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use WorkContextPrincipalEpochAnswer.ProtoReflect.Descriptor instead. +func (*WorkContextPrincipalEpochAnswer) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{70} +} + +func (x *WorkContextPrincipalEpochAnswer) GetState() WorkContextPrincipalState { + if x != nil { + return x.State + } + return WorkContextPrincipalState_WORK_CONTEXT_PRINCIPAL_STATE_UNSPECIFIED +} + +func (x *WorkContextPrincipalEpochAnswer) GetPrincipalId() string { + if x != nil { + return x.PrincipalId + } + return "" +} + +func (x *WorkContextPrincipalEpochAnswer) GetEpoch() uint64 { + if x != nil { + return x.Epoch + } + return 0 +} + +type WorkContextApprovedBuildAnswer struct { + state protoimpl.MessageState `protogen:"open.v1"` + State WorkContextApprovedBuildState `protobuf:"varint,1,opt,name=state,proto3,enum=saas.accounts.v1.WorkContextApprovedBuildState" json:"state,omitempty"` + PrincipalId string `protobuf:"bytes,2,opt,name=principal_id,json=principalId,proto3" json:"principal_id,omitempty"` + // The digest portion of the approved image, and the incarnation it was + // approved at. Both empty/zero when the principal bears no execution. + ImageDigest string `protobuf:"bytes,3,opt,name=image_digest,json=imageDigest,proto3" json:"image_digest,omitempty"` + BuildIncarnation uint64 `protobuf:"varint,4,opt,name=build_incarnation,json=buildIncarnation,proto3" json:"build_incarnation,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *WorkContextApprovedBuildAnswer) Reset() { + *x = WorkContextApprovedBuildAnswer{} + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[71] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *WorkContextApprovedBuildAnswer) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*WorkContextApprovedBuildAnswer) ProtoMessage() {} + +func (x *WorkContextApprovedBuildAnswer) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[71] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use WorkContextApprovedBuildAnswer.ProtoReflect.Descriptor instead. +func (*WorkContextApprovedBuildAnswer) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{71} +} + +func (x *WorkContextApprovedBuildAnswer) GetState() WorkContextApprovedBuildState { + if x != nil { + return x.State + } + return WorkContextApprovedBuildState_WORK_CONTEXT_APPROVED_BUILD_STATE_UNSPECIFIED +} + +func (x *WorkContextApprovedBuildAnswer) GetPrincipalId() string { + if x != nil { + return x.PrincipalId + } + return "" +} + +func (x *WorkContextApprovedBuildAnswer) GetImageDigest() string { + if x != nil { + return x.ImageDigest + } + return "" +} + +func (x *WorkContextApprovedBuildAnswer) GetBuildIncarnation() uint64 { + if x != nil { + return x.BuildIncarnation + } + return 0 +} + +type WorkContextOperationBindingAnswer struct { + state protoimpl.MessageState `protogen:"open.v1"` + State WorkContextOperationBindingState `protobuf:"varint,1,opt,name=state,proto3,enum=saas.accounts.v1.WorkContextOperationBindingState" json:"state,omitempty"` + // The binding this answer is ABOUT, echoed for the same reason the seal's + // installation is. + BindingId string `protobuf:"bytes,2,opt,name=binding_id,json=bindingId,proto3" json:"binding_id,omitempty"` + // Who holds it, and where. An id whose counters match proves nothing on its + // own: a verifier requires that the binding is granted to the principal + // exercising the capability, within the installation it is sealed to. + PrincipalId string `protobuf:"bytes,3,opt,name=principal_id,json=principalId,proto3" json:"principal_id,omitempty"` + InstallationId string `protobuf:"bytes,4,opt,name=installation_id,json=installationId,proto3" json:"installation_id,omitempty"` + Revision uint64 `protobuf:"varint,5,opt,name=revision,proto3" json:"revision,omitempty"` + Incarnation uint64 `protobuf:"varint,6,opt,name=incarnation,proto3" json:"incarnation,omitempty"` + Revoked bool `protobuf:"varint,7,opt,name=revoked,proto3" json:"revoked,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *WorkContextOperationBindingAnswer) Reset() { + *x = WorkContextOperationBindingAnswer{} + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[72] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *WorkContextOperationBindingAnswer) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*WorkContextOperationBindingAnswer) ProtoMessage() {} + +func (x *WorkContextOperationBindingAnswer) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[72] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use WorkContextOperationBindingAnswer.ProtoReflect.Descriptor instead. +func (*WorkContextOperationBindingAnswer) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{72} +} + +func (x *WorkContextOperationBindingAnswer) GetState() WorkContextOperationBindingState { + if x != nil { + return x.State + } + return WorkContextOperationBindingState_WORK_CONTEXT_OPERATION_BINDING_STATE_UNSPECIFIED +} + +func (x *WorkContextOperationBindingAnswer) GetBindingId() string { + if x != nil { + return x.BindingId + } + return "" +} + +func (x *WorkContextOperationBindingAnswer) GetPrincipalId() string { + if x != nil { + return x.PrincipalId + } + return "" +} + +func (x *WorkContextOperationBindingAnswer) GetInstallationId() string { + if x != nil { + return x.InstallationId + } + return "" +} + +func (x *WorkContextOperationBindingAnswer) GetRevision() uint64 { + if x != nil { + return x.Revision + } + return 0 +} + +func (x *WorkContextOperationBindingAnswer) GetIncarnation() uint64 { + if x != nil { + return x.Incarnation + } + return 0 +} + +func (x *WorkContextOperationBindingAnswer) GetRevoked() bool { + if x != nil { + return x.Revoked + } + return false +} + +type WorkContextAuthorizationRevisionAnswer struct { + state protoimpl.MessageState `protogen:"open.v1"` + OwnerPrincipalId string `protobuf:"bytes,1,opt,name=owner_principal_id,json=ownerPrincipalId,proto3" json:"owner_principal_id,omitempty"` + Revision uint64 `protobuf:"varint,2,opt,name=revision,proto3" json:"revision,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *WorkContextAuthorizationRevisionAnswer) Reset() { + *x = WorkContextAuthorizationRevisionAnswer{} + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[73] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *WorkContextAuthorizationRevisionAnswer) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*WorkContextAuthorizationRevisionAnswer) ProtoMessage() {} + +func (x *WorkContextAuthorizationRevisionAnswer) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[73] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use WorkContextAuthorizationRevisionAnswer.ProtoReflect.Descriptor instead. +func (*WorkContextAuthorizationRevisionAnswer) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{73} +} + +func (x *WorkContextAuthorizationRevisionAnswer) GetOwnerPrincipalId() string { + if x != nil { + return x.OwnerPrincipalId + } + return "" +} + +func (x *WorkContextAuthorizationRevisionAnswer) GetRevision() uint64 { + if x != nil { + return x.Revision + } + return 0 +} + +type WorkContextApprovalGrantAnswer struct { + state protoimpl.MessageState `protogen:"open.v1"` + State WorkContextApprovalGrantState `protobuf:"varint,1,opt,name=state,proto3,enum=saas.accounts.v1.WorkContextApprovalGrantState" json:"state,omitempty"` + GrantId string `protobuf:"bytes,2,opt,name=grant_id,json=grantId,proto3" json:"grant_id,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *WorkContextApprovalGrantAnswer) Reset() { + *x = WorkContextApprovalGrantAnswer{} + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[74] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *WorkContextApprovalGrantAnswer) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*WorkContextApprovalGrantAnswer) ProtoMessage() {} + +func (x *WorkContextApprovalGrantAnswer) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[74] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use WorkContextApprovalGrantAnswer.ProtoReflect.Descriptor instead. +func (*WorkContextApprovalGrantAnswer) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{74} +} + +func (x *WorkContextApprovalGrantAnswer) GetState() WorkContextApprovalGrantState { + if x != nil { + return x.State + } + return WorkContextApprovalGrantState_WORK_CONTEXT_APPROVAL_GRANT_STATE_UNSPECIFIED +} + +func (x *WorkContextApprovalGrantAnswer) GetGrantId() string { + if x != nil { + return x.GrantId + } + return "" +} + +type ModuleResolveWorkContextAuthorityRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The capability being verified, exactly as it was presented to the caller. + // + // It is the subject of the question and the whole of its authorization: the + // host authenticates it, requires it to be addressed to one of the caller's + // own names and to the caller's own tenant, and answers only about the + // identifiers it names. It is not minted from, not derived from, and NOT + // CONSUMED — a single-use capability presented here is still its consumer's + // to spend. + WorkContext string `protobuf:"bytes,1,opt,name=work_context,json=workContext,proto3" json:"work_context,omitempty"` + // Types that are valid to be assigned to Question: + // + // *ModuleResolveWorkContextAuthorityRequest_Seal + // *ModuleResolveWorkContextAuthorityRequest_PrincipalEpoch + // *ModuleResolveWorkContextAuthorityRequest_ApprovedBuild + // *ModuleResolveWorkContextAuthorityRequest_OperationBinding + // *ModuleResolveWorkContextAuthorityRequest_AuthorizationRevision + // *ModuleResolveWorkContextAuthorityRequest_ApprovalGrant + Question isModuleResolveWorkContextAuthorityRequest_Question `protobuf_oneof:"question"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ModuleResolveWorkContextAuthorityRequest) Reset() { + *x = ModuleResolveWorkContextAuthorityRequest{} + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[75] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ModuleResolveWorkContextAuthorityRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ModuleResolveWorkContextAuthorityRequest) ProtoMessage() {} + +func (x *ModuleResolveWorkContextAuthorityRequest) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[75] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ModuleResolveWorkContextAuthorityRequest.ProtoReflect.Descriptor instead. +func (*ModuleResolveWorkContextAuthorityRequest) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{75} +} + +func (x *ModuleResolveWorkContextAuthorityRequest) GetWorkContext() string { + if x != nil { + return x.WorkContext + } + return "" +} + +func (x *ModuleResolveWorkContextAuthorityRequest) GetQuestion() isModuleResolveWorkContextAuthorityRequest_Question { + if x != nil { + return x.Question + } + return nil +} + +func (x *ModuleResolveWorkContextAuthorityRequest) GetSeal() *WorkContextSealQuestion { + if x != nil { + if x, ok := x.Question.(*ModuleResolveWorkContextAuthorityRequest_Seal); ok { + return x.Seal + } + } + return nil +} + +func (x *ModuleResolveWorkContextAuthorityRequest) GetPrincipalEpoch() *WorkContextPrincipalEpochQuestion { + if x != nil { + if x, ok := x.Question.(*ModuleResolveWorkContextAuthorityRequest_PrincipalEpoch); ok { + return x.PrincipalEpoch + } + } + return nil +} + +func (x *ModuleResolveWorkContextAuthorityRequest) GetApprovedBuild() *WorkContextApprovedBuildQuestion { + if x != nil { + if x, ok := x.Question.(*ModuleResolveWorkContextAuthorityRequest_ApprovedBuild); ok { + return x.ApprovedBuild + } + } + return nil +} + +func (x *ModuleResolveWorkContextAuthorityRequest) GetOperationBinding() *WorkContextOperationBindingQuestion { + if x != nil { + if x, ok := x.Question.(*ModuleResolveWorkContextAuthorityRequest_OperationBinding); ok { + return x.OperationBinding + } + } + return nil +} + +func (x *ModuleResolveWorkContextAuthorityRequest) GetAuthorizationRevision() *WorkContextAuthorizationRevisionQuestion { + if x != nil { + if x, ok := x.Question.(*ModuleResolveWorkContextAuthorityRequest_AuthorizationRevision); ok { + return x.AuthorizationRevision + } + } + return nil +} + +func (x *ModuleResolveWorkContextAuthorityRequest) GetApprovalGrant() *WorkContextApprovalGrantQuestion { + if x != nil { + if x, ok := x.Question.(*ModuleResolveWorkContextAuthorityRequest_ApprovalGrant); ok { + return x.ApprovalGrant + } + } + return nil +} + +type isModuleResolveWorkContextAuthorityRequest_Question interface { + isModuleResolveWorkContextAuthorityRequest_Question() +} + +type ModuleResolveWorkContextAuthorityRequest_Seal struct { + Seal *WorkContextSealQuestion `protobuf:"bytes,3,opt,name=seal,proto3,oneof"` +} + +type ModuleResolveWorkContextAuthorityRequest_PrincipalEpoch struct { + PrincipalEpoch *WorkContextPrincipalEpochQuestion `protobuf:"bytes,4,opt,name=principal_epoch,json=principalEpoch,proto3,oneof"` +} + +type ModuleResolveWorkContextAuthorityRequest_ApprovedBuild struct { + ApprovedBuild *WorkContextApprovedBuildQuestion `protobuf:"bytes,5,opt,name=approved_build,json=approvedBuild,proto3,oneof"` +} + +type ModuleResolveWorkContextAuthorityRequest_OperationBinding struct { + OperationBinding *WorkContextOperationBindingQuestion `protobuf:"bytes,6,opt,name=operation_binding,json=operationBinding,proto3,oneof"` +} + +type ModuleResolveWorkContextAuthorityRequest_AuthorizationRevision struct { + AuthorizationRevision *WorkContextAuthorizationRevisionQuestion `protobuf:"bytes,7,opt,name=authorization_revision,json=authorizationRevision,proto3,oneof"` +} + +type ModuleResolveWorkContextAuthorityRequest_ApprovalGrant struct { + ApprovalGrant *WorkContextApprovalGrantQuestion `protobuf:"bytes,8,opt,name=approval_grant,json=approvalGrant,proto3,oneof"` +} + +func (*ModuleResolveWorkContextAuthorityRequest_Seal) isModuleResolveWorkContextAuthorityRequest_Question() { +} + +func (*ModuleResolveWorkContextAuthorityRequest_PrincipalEpoch) isModuleResolveWorkContextAuthorityRequest_Question() { +} + +func (*ModuleResolveWorkContextAuthorityRequest_ApprovedBuild) isModuleResolveWorkContextAuthorityRequest_Question() { +} + +func (*ModuleResolveWorkContextAuthorityRequest_OperationBinding) isModuleResolveWorkContextAuthorityRequest_Question() { +} + +func (*ModuleResolveWorkContextAuthorityRequest_AuthorizationRevision) isModuleResolveWorkContextAuthorityRequest_Question() { +} + +func (*ModuleResolveWorkContextAuthorityRequest_ApprovalGrant) isModuleResolveWorkContextAuthorityRequest_Question() { +} + +type ModuleResolveWorkContextAuthorityResponse struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The answer to the question that was asked, and only that one. A response + // whose arm does not match the question is a host answering something else, + // which a client refuses rather than reads. + // + // Types that are valid to be assigned to Answer: + // + // *ModuleResolveWorkContextAuthorityResponse_Seal + // *ModuleResolveWorkContextAuthorityResponse_PrincipalEpoch + // *ModuleResolveWorkContextAuthorityResponse_ApprovedBuild + // *ModuleResolveWorkContextAuthorityResponse_OperationBinding + // *ModuleResolveWorkContextAuthorityResponse_AuthorizationRevision + // *ModuleResolveWorkContextAuthorityResponse_ApprovalGrant + Answer isModuleResolveWorkContextAuthorityResponse_Answer `protobuf_oneof:"answer"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ModuleResolveWorkContextAuthorityResponse) Reset() { + *x = ModuleResolveWorkContextAuthorityResponse{} + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[76] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ModuleResolveWorkContextAuthorityResponse) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ModuleResolveWorkContextAuthorityResponse) ProtoMessage() {} + +func (x *ModuleResolveWorkContextAuthorityResponse) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_module_capabilities_proto_msgTypes[76] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ModuleResolveWorkContextAuthorityResponse.ProtoReflect.Descriptor instead. +func (*ModuleResolveWorkContextAuthorityResponse) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP(), []int{76} +} + +func (x *ModuleResolveWorkContextAuthorityResponse) GetAnswer() isModuleResolveWorkContextAuthorityResponse_Answer { + if x != nil { + return x.Answer + } + return nil +} + +func (x *ModuleResolveWorkContextAuthorityResponse) GetSeal() *WorkContextSealAnswer { + if x != nil { + if x, ok := x.Answer.(*ModuleResolveWorkContextAuthorityResponse_Seal); ok { + return x.Seal + } + } + return nil +} + +func (x *ModuleResolveWorkContextAuthorityResponse) GetPrincipalEpoch() *WorkContextPrincipalEpochAnswer { + if x != nil { + if x, ok := x.Answer.(*ModuleResolveWorkContextAuthorityResponse_PrincipalEpoch); ok { + return x.PrincipalEpoch + } + } + return nil +} + +func (x *ModuleResolveWorkContextAuthorityResponse) GetApprovedBuild() *WorkContextApprovedBuildAnswer { + if x != nil { + if x, ok := x.Answer.(*ModuleResolveWorkContextAuthorityResponse_ApprovedBuild); ok { + return x.ApprovedBuild + } + } + return nil +} + +func (x *ModuleResolveWorkContextAuthorityResponse) GetOperationBinding() *WorkContextOperationBindingAnswer { + if x != nil { + if x, ok := x.Answer.(*ModuleResolveWorkContextAuthorityResponse_OperationBinding); ok { + return x.OperationBinding + } + } + return nil +} + +func (x *ModuleResolveWorkContextAuthorityResponse) GetAuthorizationRevision() *WorkContextAuthorizationRevisionAnswer { + if x != nil { + if x, ok := x.Answer.(*ModuleResolveWorkContextAuthorityResponse_AuthorizationRevision); ok { + return x.AuthorizationRevision + } + } + return nil +} + +func (x *ModuleResolveWorkContextAuthorityResponse) GetApprovalGrant() *WorkContextApprovalGrantAnswer { + if x != nil { + if x, ok := x.Answer.(*ModuleResolveWorkContextAuthorityResponse_ApprovalGrant); ok { + return x.ApprovalGrant + } + } + return nil +} + +type isModuleResolveWorkContextAuthorityResponse_Answer interface { + isModuleResolveWorkContextAuthorityResponse_Answer() +} + +type ModuleResolveWorkContextAuthorityResponse_Seal struct { + Seal *WorkContextSealAnswer `protobuf:"bytes,1,opt,name=seal,proto3,oneof"` +} + +type ModuleResolveWorkContextAuthorityResponse_PrincipalEpoch struct { + PrincipalEpoch *WorkContextPrincipalEpochAnswer `protobuf:"bytes,2,opt,name=principal_epoch,json=principalEpoch,proto3,oneof"` +} + +type ModuleResolveWorkContextAuthorityResponse_ApprovedBuild struct { + ApprovedBuild *WorkContextApprovedBuildAnswer `protobuf:"bytes,3,opt,name=approved_build,json=approvedBuild,proto3,oneof"` +} + +type ModuleResolveWorkContextAuthorityResponse_OperationBinding struct { + OperationBinding *WorkContextOperationBindingAnswer `protobuf:"bytes,4,opt,name=operation_binding,json=operationBinding,proto3,oneof"` +} + +type ModuleResolveWorkContextAuthorityResponse_AuthorizationRevision struct { + AuthorizationRevision *WorkContextAuthorizationRevisionAnswer `protobuf:"bytes,5,opt,name=authorization_revision,json=authorizationRevision,proto3,oneof"` +} + +type ModuleResolveWorkContextAuthorityResponse_ApprovalGrant struct { + ApprovalGrant *WorkContextApprovalGrantAnswer `protobuf:"bytes,6,opt,name=approval_grant,json=approvalGrant,proto3,oneof"` +} + +func (*ModuleResolveWorkContextAuthorityResponse_Seal) isModuleResolveWorkContextAuthorityResponse_Answer() { +} + +func (*ModuleResolveWorkContextAuthorityResponse_PrincipalEpoch) isModuleResolveWorkContextAuthorityResponse_Answer() { +} + +func (*ModuleResolveWorkContextAuthorityResponse_ApprovedBuild) isModuleResolveWorkContextAuthorityResponse_Answer() { +} + +func (*ModuleResolveWorkContextAuthorityResponse_OperationBinding) isModuleResolveWorkContextAuthorityResponse_Answer() { +} + +func (*ModuleResolveWorkContextAuthorityResponse_AuthorizationRevision) isModuleResolveWorkContextAuthorityResponse_Answer() { +} + +func (*ModuleResolveWorkContextAuthorityResponse_ApprovalGrant) isModuleResolveWorkContextAuthorityResponse_Answer() { +} + +var File_saas_accounts_v1_module_capabilities_proto protoreflect.FileDescriptor + +const file_saas_accounts_v1_module_capabilities_proto_rawDesc = "" + + "\n" + + "*saas/accounts/v1/module_capabilities.proto\x12\x10saas.accounts.v1\x1a$saas/accounts/v1/work_contexts.proto\x1a\x1bbuf/validate/validate.proto\x1a\x1bgoogle/protobuf/empty.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a*saas/accounts/v1/module_registration.proto\x1a\x1bsaas/events/v1/events.proto\x1a\x17saas/jobs/v1/jobs.proto\x1a\x1csaas/policy/v1/options.proto\"k\n" + + "\x17ModuleEnqueueJobRequest\x12 \n" + + "\x06tenant\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x06tenant\x12.\n" + + "\x03job\x18\x02 \x01(\v2\x14.saas.jobs.v1.NewJobB\x06\xbaH\x03\xc8\x01\x01R\x03job\"\x8a\x01\n" + + "\x18ModuleEnqueueJobResponse\x12\x1f\n" + + "\x06job_id\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x05jobId\x12M\n" + + "\vdisposition\x18\x02 \x01(\x0e2#.saas.jobs.v1.JobEnqueueDispositionB\x06\xbaH\x03\xc8\x01\x01R\vdisposition\"\xf1\x01\n" + + "\x16ModuleClaimJobsRequest\x125\n" + + "\x05queue\x18\x01 \x01(\tB\x1f\xbaH\x1cr\x1a\x10\x01\x18\x80\x012\x13^[a-z][a-z0-9_.-]*$R\x05queue\x12'\n" + + "\tworker_id\x18\x02 \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\xff\x01R\bworkerId\x12\x1f\n" + + "\x05limit\x18\x03 \x01(\rB\t\xbaH\x06*\x04\x18d(\x01R\x05limit\x12V\n" + + "\x0elease_duration\x18\x04 \x01(\v2\x19.google.protobuf.DurationB\x14\xbaH\x11\xc8\x01\x01\xaa\x01\v\"\x03\b\x90\x1c2\x04\x10\xc0\x84=R\rleaseDuration\"H\n" + + "\x17ModuleClaimJobsResponse\x12-\n" + + "\x04jobs\x18\x01 \x03(\v2\x19.saas.jobs.v1.JobEnvelopeR\x04jobs\"\xa9\x01\n" + + "\x19ModuleHeartbeatJobRequest\x12=\n" + + "\x05lease\x18\x01 \x01(\v2\x1f.saas.jobs.v1.JobLeaseReferenceB\x06\xbaH\x03\xc8\x01\x01R\x05lease\x12M\n" + + "\textension\x18\x02 \x01(\v2\x19.google.protobuf.DurationB\x14\xbaH\x11\xc8\x01\x01\xaa\x01\v\"\x03\b\x90\x1c2\x04\x10\xc0\x84=R\textension\"R\n" + + "\x1aModuleHeartbeatJobResponse\x124\n" + + "\x05lease\x18\x01 \x01(\v2\x16.saas.jobs.v1.JobLeaseB\x06\xbaH\x03\xc8\x01\x01R\x05lease\"\xc9\x01\n" + + "\x13ModuleAckJobRequest\x12=\n" + + "\x05lease\x18\x01 \x01(\v2\x1f.saas.jobs.v1.JobLeaseReferenceB\x06\xbaH\x03\xc8\x01\x01R\x05lease\x12F\n" + + "\x0eexecution_kind\x18\x02 \x01(\tB\x1f\xbaH\x1cr\x1a\x18@2\x16^$|^[a-z][a-z0-9_.-]*$R\rexecutionKind\x12+\n" + + "\fexecution_id\x18\x03 \x01(\tB\b\xbaH\x05r\x03\x18\xff\x01R\vexecutionId\"\xe6\x01\n" + + "\x14ModuleNackJobRequest\x12=\n" + + "\x05lease\x18\x01 \x01(\v2\x1f.saas.jobs.v1.JobLeaseReferenceB\x06\xbaH\x03\xc8\x01\x01R\x05lease\x12:\n" + + "\afailure\x18\x02 \x01(\v2\x18.saas.jobs.v1.JobFailureB\x06\xbaH\x03\xc8\x01\x01R\afailure\x12\x1c\n" + + "\tretryable\x18\x03 \x01(\bR\tretryable\x125\n" + + "\bretry_at\x18\x04 \x01(\v2\x1a.google.protobuf.TimestampR\aretryAt\"\xbe\x02\n" + + "\x17ModuleNotifyUserRequest\x12 \n" + + "\x06tenant\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x06tenant\x12!\n" + + "\auser_id\x18\x02 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x06userId\x12 \n" + + "\x05title\x18\x03 \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\xe6\aR\x05title\x12\x1c\n" + + "\x04body\x18\x04 \x01(\tB\b\xbaH\x05r\x03\x18\x80@R\x04body\x12\x1b\n" + + "\x04type\x18\x05 \x01(\tB\a\xbaH\x04r\x02\x18@R\x04type\x12'\n" + + "\n" + + "action_url\x18\x06 \x01(\tB\b\xbaH\x05r\x03\x18\x80\x10R\tactionUrl\x12%\n" + + "\bcategory\x18\a \x01(\tB\t\xbaH\x06r\x04\x10\x01\x18 R\bcategory\x121\n" + + "\x0fidempotency_key\x18\b \x01(\tB\b\xbaH\x05r\x03\x18\xff\x01R\x0eidempotencyKey\"a\n" + + "\x18ModuleNotifyUserResponse\x12'\n" + + "\x0fnotification_id\x18\x01 \x01(\tR\x0enotificationId\x12\x1c\n" + + "\tdelivered\x18\x02 \x01(\bR\tdelivered\"\xa0\x02\n" + + "\x1cModuleNotifyOrgAdminsRequest\x12 \n" + + "\x06tenant\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x06tenant\x12 \n" + + "\x05title\x18\x02 \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\xe6\aR\x05title\x12\x1c\n" + + "\x04body\x18\x03 \x01(\tB\b\xbaH\x05r\x03\x18\x80@R\x04body\x12\x1b\n" + + "\x04type\x18\x04 \x01(\tB\a\xbaH\x04r\x02\x18@R\x04type\x12'\n" + + "\n" + + "action_url\x18\x05 \x01(\tB\b\xbaH\x05r\x03\x18\x80\x10R\tactionUrl\x12%\n" + + "\bcategory\x18\x06 \x01(\tB\t\xbaH\x06r\x04\x10\x01\x18 R\bcategory\x121\n" + + "\x0fidempotency_key\x18\a \x01(\tB\b\xbaH\x05r\x03\x18\xff\x01R\x0eidempotencyKey\"=\n" + + "\x1dModuleNotifyOrgAdminsResponse\x12\x1c\n" + + "\tdelivered\x18\x01 \x01(\bR\tdelivered\"\x83\x01\n" + + "\x14ModuleApprovalPolicy\x12\x1f\n" + + "\x06quorum\x18\x01 \x01(\rB\a\xbaH\x04*\x02\x18dR\x06quorum\x12+\n" + + "\fapprover_set\x18\x02 \x03(\tB\b\xbaH\x05\x92\x01\x02\x10dR\vapproverSet\x12\x1d\n" + + "\n" + + "allow_self\x18\x03 \x01(\bR\tallowSelf\"\xb2\x01\n" + + "\x0fModuleResumeRef\x125\n" + + "\x05queue\x18\x01 \x01(\tB\x1f\xbaH\x1cr\x1a\x10\x01\x18\x80\x012\x13^[a-z][a-z0-9_.-]*$R\x05queue\x125\n" + + "\x05topic\x18\x02 \x01(\tB\x1f\xbaH\x1cr\x1a\x10\x01\x18\xff\x012\x13^[a-z][a-z0-9_.-]*$R\x05topic\x121\n" + + "\apayload\x18\x03 \x01(\v2\x17.google.protobuf.StructR\apayload\"\xf0\x03\n" + + "\x1cModuleRequestApprovalRequest\x12 \n" + + "\x06tenant\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x06tenant\x12&\n" + + "\bresource\x18\x02 \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\x80\x01R\bresource\x12\"\n" + + "\x06action\x18\x03 \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\x80\x01R\x06action\x121\n" + + "\asubject\x18\x04 \x01(\v2\x17.google.protobuf.StructR\asubject\x12-\n" + + "\frequested_by\x18\x05 \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\xff\x01R\vrequestedBy\x12>\n" + + "\x06policy\x18\x06 \x01(\v2&.saas.accounts.v1.ModuleApprovalPolicyR\x06policy\x12H\n" + + "\n" + + "resume_ref\x18\a \x01(\v2!.saas.accounts.v1.ModuleResumeRefB\x06\xbaH\x03\xc8\x01\x01R\tresumeRef\x129\n" + + "\n" + + "expires_at\x18\b \x01(\v2\x1a.google.protobuf.TimestampR\texpiresAt\x12;\n" + + "\vescalate_at\x18\t \x01(\v2\x1a.google.protobuf.TimestampR\n" + + "escalateAt\"J\n" + + "\x1dModuleRequestApprovalResponse\x12)\n" + + "\vapproval_id\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\n" + + "approvalId\"g\n" + + "\x18ModuleGetApprovalRequest\x12 \n" + + "\x06tenant\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x06tenant\x12)\n" + + "\vapproval_id\x18\x02 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\n" + + "approvalId\"\xe5\x03\n" + + "\x0eModuleApproval\x12\x0e\n" + "\x02id\x18\x01 \x01(\tR\x02id\x12\x16\n" + "\x06tenant\x18\x02 \x01(\tR\x06tenant\x12\x1a\n" + "\bresource\x18\x03 \x01(\tR\bresource\x12\x16\n" + @@ -4910,12 +6231,13 @@ const file_saas_accounts_v1_module_capabilities_proto_rawDesc = "" + "\atrigger\x18\x04 \x01(\tR\atrigger\x12W\n" + "\x14requester_disclosure\x18\x05 \x01(\x0e2$.saas.accounts.v1.MetadataDisclosureR\x13requesterDisclosure\x12=\n" + "\frequested_at\x18\x06 \x01(\v2\x1a.google.protobuf.TimestampR\vrequestedAt\x12,\n" + - "\x12requested_by_label\x18\a \x01(\tR\x10requestedByLabel\"x\n" + + "\x12requested_by_label\x18\a \x01(\tR\x10requestedByLabel\"\xc0\x01\n" + "$ListReadableSourceCollectionsRequest\x12'\n" + "\tpage_size\x18\x01 \x01(\x05B\n" + "\xbaH\a\x1a\x05\x18\xe8\a(\x00R\bpageSize\x12'\n" + "\n" + - "page_token\x18\x02 \x01(\tB\b\xbaH\x05r\x03\x18\x80\x10R\tpageToken\"\x9d\x01\n" + + "page_token\x18\x02 \x01(\tB\b\xbaH\x05r\x03\x18\x80\x10R\tpageToken\x12F\n" + + "\x19viewer_work_context_token\x18\x03 \x01(\tB\v\xbaH\br\x06\x10\x01\x18\x80\x80\x02R\x16viewerWorkContextToken\"\x9d\x01\n" + "%ListReadableSourceCollectionsResponse\x12L\n" + "\vcollections\x18\x01 \x03(\v2*.saas.accounts.v1.ReadableSourceCollectionR\vcollections\x12&\n" + "\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"\xa3\x02\n" + @@ -4931,7 +6253,7 @@ const file_saas_accounts_v1_module_capabilities_proto_rawDesc = "" + "\xbaH\ar\x05\x10\x01\x18\x80\x04R\n" + "resourceId\">\n" + "\x19ModulePlaceRecordResponse\x12!\n" + - "\anode_id\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x06nodeId\"\xa7\x01\n" + + "\anode_id\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x06nodeId\"\xef\x01\n" + "#CheckWorkContextRecordAccessRequest\x12/\n" + "\rresource_type\x18\x01 \x01(\tB\n" + "\xbaH\ar\x05\x10\x01\x18\x80\x02R\fresourceType\x12+\n" + @@ -4939,7 +6261,8 @@ const file_saas_accounts_v1_module_capabilities_proto_rawDesc = "" + "\xbaH\ar\x05\x10\x01\x18\x80\x04R\n" + "resourceId\x12\"\n" + "\x06action\x18\x03 \x01(\tB\n" + - "\xbaH\ar\x05\x10\x01\x18\x80\x02R\x06action\"d\n" + + "\xbaH\ar\x05\x10\x01\x18\x80\x02R\x06action\x12F\n" + + "\x19viewer_work_context_token\x18\x04 \x01(\tB\v\xbaH\br\x06\x10\x01\x18\x80\x80\x02R\x16viewerWorkContextToken\"d\n" + "$CheckWorkContextRecordAccessResponse\x12\x18\n" + "\aallowed\x18\x01 \x01(\bR\aallowed\x12\"\n" + "\rscope_node_id\x18\x02 \x01(\tR\vscopeNodeId\"\x9f\x01\n" + @@ -4993,7 +6316,73 @@ const file_saas_accounts_v1_module_capabilities_proto_rawDesc = "" + "\ttenant_id\x18\x02 \x01(\tR\btenantId\x12%\n" + "\ttarget_id\x18\x04 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\btargetId\x12\x1d\n" + "\n" + - "binding_id\x18\x05 \x01(\tR\tbindingIdJ\x04\b\x03\x10\x04R\x13solution_identifier*\xb8\x02\n" + + "binding_id\x18\x05 \x01(\tR\tbindingIdJ\x04\b\x03\x10\x04R\x13solution_identifier\"}\n" + + "\x17WorkContextSealQuestion\x12-\n" + + "\fprincipal_id\x18\x01 \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\x80\x04R\vprincipalId\x123\n" + + "\x0finstallation_id\x18\x02 \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\x80\x04R\x0einstallationId\"R\n" + + "!WorkContextPrincipalEpochQuestion\x12-\n" + + "\fprincipal_id\x18\x01 \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\x80\x04R\vprincipalId\"Q\n" + + " WorkContextApprovedBuildQuestion\x12-\n" + + "\fprincipal_id\x18\x01 \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\x80\x04R\vprincipalId\"P\n" + + "#WorkContextOperationBindingQuestion\x12)\n" + + "\n" + + "binding_id\x18\x01 \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\x80\x04R\tbindingId\"d\n" + + "(WorkContextAuthorizationRevisionQuestion\x128\n" + + "\x12owner_principal_id\x18\x01 \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\x80\x04R\x10ownerPrincipalId\"I\n" + + " WorkContextApprovalGrantQuestion\x12%\n" + + "\bgrant_id\x18\x01 \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\x80\x02R\agrantId\"\xb3\x01\n" + + "\x15WorkContextSealAnswer\x12<\n" + + "\x05state\x18\x01 \x01(\x0e2&.saas.accounts.v1.WorkContextSealStateR\x05state\x12'\n" + + "\x0finstallation_id\x18\x02 \x01(\tR\x0einstallationId\x123\n" + + "\x15installation_revision\x18\x03 \x01(\x04R\x14installationRevision\"\x9d\x01\n" + + "\x1fWorkContextPrincipalEpochAnswer\x12A\n" + + "\x05state\x18\x01 \x01(\x0e2+.saas.accounts.v1.WorkContextPrincipalStateR\x05state\x12!\n" + + "\fprincipal_id\x18\x02 \x01(\tR\vprincipalId\x12\x14\n" + + "\x05epoch\x18\x03 \x01(\x04R\x05epoch\"\xda\x01\n" + + "\x1eWorkContextApprovedBuildAnswer\x12E\n" + + "\x05state\x18\x01 \x01(\x0e2/.saas.accounts.v1.WorkContextApprovedBuildStateR\x05state\x12!\n" + + "\fprincipal_id\x18\x02 \x01(\tR\vprincipalId\x12!\n" + + "\fimage_digest\x18\x03 \x01(\tR\vimageDigest\x12+\n" + + "\x11build_incarnation\x18\x04 \x01(\x04R\x10buildIncarnation\"\xb0\x02\n" + + "!WorkContextOperationBindingAnswer\x12H\n" + + "\x05state\x18\x01 \x01(\x0e22.saas.accounts.v1.WorkContextOperationBindingStateR\x05state\x12\x1d\n" + + "\n" + + "binding_id\x18\x02 \x01(\tR\tbindingId\x12!\n" + + "\fprincipal_id\x18\x03 \x01(\tR\vprincipalId\x12'\n" + + "\x0finstallation_id\x18\x04 \x01(\tR\x0einstallationId\x12\x1a\n" + + "\brevision\x18\x05 \x01(\x04R\brevision\x12 \n" + + "\vincarnation\x18\x06 \x01(\x04R\vincarnation\x12\x18\n" + + "\arevoked\x18\a \x01(\bR\arevoked\"r\n" + + "&WorkContextAuthorizationRevisionAnswer\x12,\n" + + "\x12owner_principal_id\x18\x01 \x01(\tR\x10ownerPrincipalId\x12\x1a\n" + + "\brevision\x18\x02 \x01(\x04R\brevision\"\x82\x01\n" + + "\x1eWorkContextApprovalGrantAnswer\x12E\n" + + "\x05state\x18\x01 \x01(\x0e2/.saas.accounts.v1.WorkContextApprovalGrantStateR\x05state\x12\x19\n" + + "\bgrant_id\x18\x02 \x01(\tR\agrantId\"\xb3\x05\n" + + "(ModuleResolveWorkContextAuthorityRequest\x12.\n" + + "\fwork_context\x18\x01 \x01(\tB\v\xbaH\br\x06\x10\x01\x18\x80\x80\x02R\vworkContext\x12?\n" + + "\x04seal\x18\x03 \x01(\v2).saas.accounts.v1.WorkContextSealQuestionH\x00R\x04seal\x12^\n" + + "\x0fprincipal_epoch\x18\x04 \x01(\v23.saas.accounts.v1.WorkContextPrincipalEpochQuestionH\x00R\x0eprincipalEpoch\x12[\n" + + "\x0eapproved_build\x18\x05 \x01(\v22.saas.accounts.v1.WorkContextApprovedBuildQuestionH\x00R\rapprovedBuild\x12d\n" + + "\x11operation_binding\x18\x06 \x01(\v25.saas.accounts.v1.WorkContextOperationBindingQuestionH\x00R\x10operationBinding\x12s\n" + + "\x16authorization_revision\x18\a \x01(\v2:.saas.accounts.v1.WorkContextAuthorizationRevisionQuestionH\x00R\x15authorizationRevision\x12[\n" + + "\x0eapproval_grant\x18\b \x01(\v22.saas.accounts.v1.WorkContextApprovalGrantQuestionH\x00R\rapprovalGrantB\x11\n" + + "\bquestion\x12\x05\xbaH\x02\b\x01J\x04\b\x02\x10\x03R\baudience\"\xdf\x04\n" + + ")ModuleResolveWorkContextAuthorityResponse\x12=\n" + + "\x04seal\x18\x01 \x01(\v2'.saas.accounts.v1.WorkContextSealAnswerH\x00R\x04seal\x12\\\n" + + "\x0fprincipal_epoch\x18\x02 \x01(\v21.saas.accounts.v1.WorkContextPrincipalEpochAnswerH\x00R\x0eprincipalEpoch\x12Y\n" + + "\x0eapproved_build\x18\x03 \x01(\v20.saas.accounts.v1.WorkContextApprovedBuildAnswerH\x00R\rapprovedBuild\x12b\n" + + "\x11operation_binding\x18\x04 \x01(\v23.saas.accounts.v1.WorkContextOperationBindingAnswerH\x00R\x10operationBinding\x12q\n" + + "\x16authorization_revision\x18\x05 \x01(\v28.saas.accounts.v1.WorkContextAuthorizationRevisionAnswerH\x00R\x15authorizationRevision\x12Y\n" + + "\x0eapproval_grant\x18\x06 \x01(\v20.saas.accounts.v1.WorkContextApprovalGrantAnswerH\x00R\rapprovalGrantB\b\n" + + "\x06answer*\xb8\x02\n" + "\x14ModuleAuditFieldKind\x12'\n" + "#MODULE_AUDIT_FIELD_KIND_UNSPECIFIED\x10\x00\x12\"\n" + "\x1eMODULE_AUDIT_FIELD_KIND_STRING\x10\x01\x12 \n" + @@ -5022,7 +6411,26 @@ const file_saas_accounts_v1_module_capabilities_proto_rawDesc = "" + "\x1cMETADATA_DISCLOSURE_WITHHELD\x10\x02*\\\n" + "\x0fSourceSyncStage\x12!\n" + "\x1dSOURCE_SYNC_STAGE_UNSPECIFIED\x10\x00\x12&\n" + - "\"SOURCE_SYNC_STAGE_CHANGES_ENQUEUED\x10\x012\xad&\n" + + "\"SOURCE_SYNC_STAGE_CHANGES_ENQUEUED\x10\x01*\x85\x01\n" + + "\x14WorkContextSealState\x12'\n" + + "#WORK_CONTEXT_SEAL_STATE_UNSPECIFIED\x10\x00\x12 \n" + + "\x1cWORK_CONTEXT_SEAL_STATE_HELD\x10\x01\x12\"\n" + + "\x1eWORK_CONTEXT_SEAL_STATE_UNHELD\x10\x02*\x9b\x01\n" + + "\x19WorkContextPrincipalState\x12,\n" + + "(WORK_CONTEXT_PRINCIPAL_STATE_UNSPECIFIED\x10\x00\x12&\n" + + "\"WORK_CONTEXT_PRINCIPAL_STATE_KNOWN\x10\x01\x12(\n" + + "$WORK_CONTEXT_PRINCIPAL_STATE_UNKNOWN\x10\x02*\xbc\x01\n" + + "\x1dWorkContextApprovedBuildState\x121\n" + + "-WORK_CONTEXT_APPROVED_BUILD_STATE_UNSPECIFIED\x10\x00\x12.\n" + + "*WORK_CONTEXT_APPROVED_BUILD_STATE_APPROVED\x10\x01\x128\n" + + "4WORK_CONTEXT_APPROVED_BUILD_STATE_BEARS_NO_EXECUTION\x10\x02*\xbc\x01\n" + + " WorkContextOperationBindingState\x124\n" + + "0WORK_CONTEXT_OPERATION_BINDING_STATE_UNSPECIFIED\x10\x00\x121\n" + + "-WORK_CONTEXT_OPERATION_BINDING_STATE_RESOLVED\x10\x01\x12/\n" + + "+WORK_CONTEXT_OPERATION_BINDING_STATE_ABSENT\x10\x02*\x86\x01\n" + + "\x1dWorkContextApprovalGrantState\x121\n" + + "-WORK_CONTEXT_APPROVAL_GRANT_STATE_UNSPECIFIED\x10\x00\x122\n" + + ".WORK_CONTEXT_APPROVAL_GRANT_STATE_NOT_RECORDED\x10\x012\xe0'\n" + "\x19ModuleCapabilitiesService\x12\x9b\x01\n" + "\x16GetCurrentInstallation\x122.saas.accounts.v1.ModuleCurrentInstallationRequest\x1a3.saas.accounts.v1.ModuleCurrentInstallationResponse\"\x18\xc2\xf3\x18\x14\b\x03\x10\x010\x01:\x02\x10\x01@\x01H\aP\x04X\x03`\x01\x12\xc6\x01\n" + "\x19ApproveExecutableArtifact\x121.saas.accounts.v1.ModuleExecutableArtifactRequest\x1a2.saas.accounts.v1.ModuleExecutableArtifactResponse\"B\xc2\xf3\x18>\b\x03\x10\x010\x01:,\n" + @@ -5066,7 +6474,9 @@ const file_saas_accounts_v1_module_capabilities_proto_rawDesc = "" + "\tSubscribe\x12(.saas.accounts.v1.ModuleSubscribeRequest\x1a).saas.accounts.v1.ModuleSubscribeResponse\"\x18\xc2\xf3\x18\x14\b\x03\x10\x010\x01:\x02\x10\x01@\x01H\aP\x03X\x03`\x01\x12k\n" + "\vUnsubscribe\x12*.saas.accounts.v1.ModuleUnsubscribeRequest\x1a\x16.google.protobuf.Empty\"\x18\xc2\xf3\x18\x14\b\x03\x10\x010\x01:\x02\x10\x01@\x01H\aP\x03X\x03`\x01\x12\x92\x01\n" + "\x11ListSubscriptions\x120.saas.accounts.v1.ModuleListSubscriptionsRequest\x1a1.saas.accounts.v1.ModuleListSubscriptionsResponse\"\x18\xc2\xf3\x18\x14\b\x03\x10\x010\x01:\x02\x10\x01@\x01H\aP\x03X\x03`\x01\x12\x83\x01\n" + - "\fReplayEvents\x12+.saas.accounts.v1.ModuleReplayEventsRequest\x1a,.saas.accounts.v1.ModuleReplayEventsResponse\"\x18\xc2\xf3\x18\x14\b\x03\x10\x010\x01:\x02\x10\x01@\x01H\aP\x03X\x03`\x01b\x06proto3" + "\fReplayEvents\x12+.saas.accounts.v1.ModuleReplayEventsRequest\x1a,.saas.accounts.v1.ModuleReplayEventsResponse\"\x18\xc2\xf3\x18\x14\b\x03\x10\x010\x01:\x02\x10\x01@\x01H\aP\x03X\x03`\x01\x12\xb0\x01\n" + + "\x1bResolveWorkContextAuthority\x12:.saas.accounts.v1.ModuleResolveWorkContextAuthorityRequest\x1a;.saas.accounts.v1.ModuleResolveWorkContextAuthorityResponse\"\x18\xc2\xf3\x18\x14\b\x03\x10\x010\x01:\x02\x10\x01@\x01H\aP\x03X\x03`\x01B\xe6\x01\n" + + "\x14com.saas.accounts.v1B\x17ModuleCapabilitiesProtoP\x01ZSgithub.com/codefly-dev/cli/pkg/builder/clients/accounts/saas/accounts/v1;accountsv1\xa2\x02\x03SAX\xaa\x02\x10Saas.Accounts.V1\xca\x02\x10Saas\\Accounts\\V1\xe2\x02\x1cSaas\\Accounts\\V1\\GPBMetadata\xea\x02\x12Saas::Accounts::V1b\x06proto3" var ( file_saas_accounts_v1_module_capabilities_proto_rawDescOnce sync.Once @@ -5080,8 +6490,8 @@ func file_saas_accounts_v1_module_capabilities_proto_rawDescGZIP() []byte { return file_saas_accounts_v1_module_capabilities_proto_rawDescData } -var file_saas_accounts_v1_module_capabilities_proto_enumTypes = make([]protoimpl.EnumInfo, 6) -var file_saas_accounts_v1_module_capabilities_proto_msgTypes = make([]protoimpl.MessageInfo, 63) +var file_saas_accounts_v1_module_capabilities_proto_enumTypes = make([]protoimpl.EnumInfo, 11) +var file_saas_accounts_v1_module_capabilities_proto_msgTypes = make([]protoimpl.MessageInfo, 77) var file_saas_accounts_v1_module_capabilities_proto_goTypes = []any{ (ModuleAuditFieldKind)(0), // 0: saas.accounts.v1.ModuleAuditFieldKind (ModuleAuditEventVisibility)(0), // 1: saas.accounts.v1.ModuleAuditEventVisibility @@ -5089,210 +6499,248 @@ var file_saas_accounts_v1_module_capabilities_proto_goTypes = []any{ (EventDelivery)(0), // 3: saas.accounts.v1.EventDelivery (MetadataDisclosure)(0), // 4: saas.accounts.v1.MetadataDisclosure (SourceSyncStage)(0), // 5: saas.accounts.v1.SourceSyncStage - (*ModuleEnqueueJobRequest)(nil), // 6: saas.accounts.v1.ModuleEnqueueJobRequest - (*ModuleEnqueueJobResponse)(nil), // 7: saas.accounts.v1.ModuleEnqueueJobResponse - (*ModuleClaimJobsRequest)(nil), // 8: saas.accounts.v1.ModuleClaimJobsRequest - (*ModuleClaimJobsResponse)(nil), // 9: saas.accounts.v1.ModuleClaimJobsResponse - (*ModuleHeartbeatJobRequest)(nil), // 10: saas.accounts.v1.ModuleHeartbeatJobRequest - (*ModuleHeartbeatJobResponse)(nil), // 11: saas.accounts.v1.ModuleHeartbeatJobResponse - (*ModuleAckJobRequest)(nil), // 12: saas.accounts.v1.ModuleAckJobRequest - (*ModuleNackJobRequest)(nil), // 13: saas.accounts.v1.ModuleNackJobRequest - (*ModuleNotifyUserRequest)(nil), // 14: saas.accounts.v1.ModuleNotifyUserRequest - (*ModuleNotifyUserResponse)(nil), // 15: saas.accounts.v1.ModuleNotifyUserResponse - (*ModuleNotifyOrgAdminsRequest)(nil), // 16: saas.accounts.v1.ModuleNotifyOrgAdminsRequest - (*ModuleNotifyOrgAdminsResponse)(nil), // 17: saas.accounts.v1.ModuleNotifyOrgAdminsResponse - (*ModuleApprovalPolicy)(nil), // 18: saas.accounts.v1.ModuleApprovalPolicy - (*ModuleResumeRef)(nil), // 19: saas.accounts.v1.ModuleResumeRef - (*ModuleRequestApprovalRequest)(nil), // 20: saas.accounts.v1.ModuleRequestApprovalRequest - (*ModuleRequestApprovalResponse)(nil), // 21: saas.accounts.v1.ModuleRequestApprovalResponse - (*ModuleGetApprovalRequest)(nil), // 22: saas.accounts.v1.ModuleGetApprovalRequest - (*ModuleApproval)(nil), // 23: saas.accounts.v1.ModuleApproval - (*ModuleCancelApprovalRequest)(nil), // 24: saas.accounts.v1.ModuleCancelApprovalRequest - (*ModuleEmitAuditEventRequest)(nil), // 25: saas.accounts.v1.ModuleEmitAuditEventRequest - (*ModuleAuditFieldDeclaration)(nil), // 26: saas.accounts.v1.ModuleAuditFieldDeclaration - (*ModuleAuditEventTypeDeclaration)(nil), // 27: saas.accounts.v1.ModuleAuditEventTypeDeclaration - (*ModuleDeclareAuditEventTypesRequest)(nil), // 28: saas.accounts.v1.ModuleDeclareAuditEventTypesRequest - (*ModuleDeclareAuditEventTypesResponse)(nil), // 29: saas.accounts.v1.ModuleDeclareAuditEventTypesResponse - (*SubjectVisibilityGrant)(nil), // 30: saas.accounts.v1.SubjectVisibilityGrant - (*ModuleListSubjectVisibilityRequest)(nil), // 31: saas.accounts.v1.ModuleListSubjectVisibilityRequest - (*ModuleListSubjectVisibilityResponse)(nil), // 32: saas.accounts.v1.ModuleListSubjectVisibilityResponse - (*FetchDatasourceBlobRequest)(nil), // 33: saas.accounts.v1.FetchDatasourceBlobRequest - (*FetchDatasourceBlobChunk)(nil), // 34: saas.accounts.v1.FetchDatasourceBlobChunk - (*DatasourceFileRef)(nil), // 35: saas.accounts.v1.DatasourceFileRef - (*FetchDatasourceFilesRequest)(nil), // 36: saas.accounts.v1.FetchDatasourceFilesRequest - (*DatasourceProvenance)(nil), // 37: saas.accounts.v1.DatasourceProvenance - (*DatasourceItemReaders)(nil), // 38: saas.accounts.v1.DatasourceItemReaders - (*DatasourceFileHeader)(nil), // 39: saas.accounts.v1.DatasourceFileHeader - (*FetchDatasourceFilesFrame)(nil), // 40: saas.accounts.v1.FetchDatasourceFilesFrame - (*ModulePublishEventRequest)(nil), // 41: saas.accounts.v1.ModulePublishEventRequest - (*ModulePublishEventResponse)(nil), // 42: saas.accounts.v1.ModulePublishEventResponse - (*ModuleSubscribeRequest)(nil), // 43: saas.accounts.v1.ModuleSubscribeRequest - (*ModuleSubscription)(nil), // 44: saas.accounts.v1.ModuleSubscription - (*ModuleSubscribeResponse)(nil), // 45: saas.accounts.v1.ModuleSubscribeResponse - (*ModuleUnsubscribeRequest)(nil), // 46: saas.accounts.v1.ModuleUnsubscribeRequest - (*ModuleListSubscriptionsRequest)(nil), // 47: saas.accounts.v1.ModuleListSubscriptionsRequest - (*ModuleListSubscriptionsResponse)(nil), // 48: saas.accounts.v1.ModuleListSubscriptionsResponse - (*ModuleReplayEventsRequest)(nil), // 49: saas.accounts.v1.ModuleReplayEventsRequest - (*ModuleReplayEventsResponse)(nil), // 50: saas.accounts.v1.ModuleReplayEventsResponse - (*ReadableSourceCollection)(nil), // 51: saas.accounts.v1.ReadableSourceCollection - (*ReadableCollectionGrant)(nil), // 52: saas.accounts.v1.ReadableCollectionGrant - (*CollectionSyncProvenance)(nil), // 53: saas.accounts.v1.CollectionSyncProvenance - (*ListReadableSourceCollectionsRequest)(nil), // 54: saas.accounts.v1.ListReadableSourceCollectionsRequest - (*ListReadableSourceCollectionsResponse)(nil), // 55: saas.accounts.v1.ListReadableSourceCollectionsResponse - (*ModulePlaceRecordRequest)(nil), // 56: saas.accounts.v1.ModulePlaceRecordRequest - (*ModulePlaceRecordResponse)(nil), // 57: saas.accounts.v1.ModulePlaceRecordResponse - (*CheckWorkContextRecordAccessRequest)(nil), // 58: saas.accounts.v1.CheckWorkContextRecordAccessRequest - (*CheckWorkContextRecordAccessResponse)(nil), // 59: saas.accounts.v1.CheckWorkContextRecordAccessResponse - (*ModuleExchangeDelegatedReadAudienceRequest)(nil), // 60: saas.accounts.v1.ModuleExchangeDelegatedReadAudienceRequest - (*ModuleExchangeDelegatedOperationAudienceRequest)(nil), // 61: saas.accounts.v1.ModuleExchangeDelegatedOperationAudienceRequest - (*ExecutableArtifactContract)(nil), // 62: saas.accounts.v1.ExecutableArtifactContract - (*ExecutableArtifactIdentity)(nil), // 63: saas.accounts.v1.ExecutableArtifactIdentity - (*ModuleExecutableArtifactRequest)(nil), // 64: saas.accounts.v1.ModuleExecutableArtifactRequest - (*ModuleRevokeExecutableArtifactRequest)(nil), // 65: saas.accounts.v1.ModuleRevokeExecutableArtifactRequest - (*ModuleExecutableArtifactResponse)(nil), // 66: saas.accounts.v1.ModuleExecutableArtifactResponse - (*ModuleCurrentInstallationRequest)(nil), // 67: saas.accounts.v1.ModuleCurrentInstallationRequest - (*ModuleCurrentInstallationResponse)(nil), // 68: saas.accounts.v1.ModuleCurrentInstallationResponse - (*v1.NewJob)(nil), // 69: saas.jobs.v1.NewJob - (v1.JobEnqueueDisposition)(0), // 70: saas.jobs.v1.JobEnqueueDisposition - (*durationpb.Duration)(nil), // 71: google.protobuf.Duration - (*v1.JobEnvelope)(nil), // 72: saas.jobs.v1.JobEnvelope - (*v1.JobLeaseReference)(nil), // 73: saas.jobs.v1.JobLeaseReference - (*v1.JobLease)(nil), // 74: saas.jobs.v1.JobLease - (*v1.JobFailure)(nil), // 75: saas.jobs.v1.JobFailure - (*timestamppb.Timestamp)(nil), // 76: google.protobuf.Timestamp - (*structpb.Struct)(nil), // 77: google.protobuf.Struct - (*v11.EventEnvelope)(nil), // 78: saas.events.v1.EventEnvelope - (*ModuleMintWorkContextRequest)(nil), // 79: saas.accounts.v1.ModuleMintWorkContextRequest - (*ModuleMintOperationContextRequest)(nil), // 80: saas.accounts.v1.ModuleMintOperationContextRequest - (*ModuleMintSourceOperationContextRequest)(nil), // 81: saas.accounts.v1.ModuleMintSourceOperationContextRequest - (*v12.IssuedWorkContext)(nil), // 82: saas.accounts.v1.IssuedWorkContext - (*emptypb.Empty)(nil), // 83: google.protobuf.Empty - (*ModuleMintWorkContextResponse)(nil), // 84: saas.accounts.v1.ModuleMintWorkContextResponse - (*ModuleMintOperationContextResponse)(nil), // 85: saas.accounts.v1.ModuleMintOperationContextResponse - (*ModuleMintSourceOperationContextResponse)(nil), // 86: saas.accounts.v1.ModuleMintSourceOperationContextResponse + (WorkContextSealState)(0), // 6: saas.accounts.v1.WorkContextSealState + (WorkContextPrincipalState)(0), // 7: saas.accounts.v1.WorkContextPrincipalState + (WorkContextApprovedBuildState)(0), // 8: saas.accounts.v1.WorkContextApprovedBuildState + (WorkContextOperationBindingState)(0), // 9: saas.accounts.v1.WorkContextOperationBindingState + (WorkContextApprovalGrantState)(0), // 10: saas.accounts.v1.WorkContextApprovalGrantState + (*ModuleEnqueueJobRequest)(nil), // 11: saas.accounts.v1.ModuleEnqueueJobRequest + (*ModuleEnqueueJobResponse)(nil), // 12: saas.accounts.v1.ModuleEnqueueJobResponse + (*ModuleClaimJobsRequest)(nil), // 13: saas.accounts.v1.ModuleClaimJobsRequest + (*ModuleClaimJobsResponse)(nil), // 14: saas.accounts.v1.ModuleClaimJobsResponse + (*ModuleHeartbeatJobRequest)(nil), // 15: saas.accounts.v1.ModuleHeartbeatJobRequest + (*ModuleHeartbeatJobResponse)(nil), // 16: saas.accounts.v1.ModuleHeartbeatJobResponse + (*ModuleAckJobRequest)(nil), // 17: saas.accounts.v1.ModuleAckJobRequest + (*ModuleNackJobRequest)(nil), // 18: saas.accounts.v1.ModuleNackJobRequest + (*ModuleNotifyUserRequest)(nil), // 19: saas.accounts.v1.ModuleNotifyUserRequest + (*ModuleNotifyUserResponse)(nil), // 20: saas.accounts.v1.ModuleNotifyUserResponse + (*ModuleNotifyOrgAdminsRequest)(nil), // 21: saas.accounts.v1.ModuleNotifyOrgAdminsRequest + (*ModuleNotifyOrgAdminsResponse)(nil), // 22: saas.accounts.v1.ModuleNotifyOrgAdminsResponse + (*ModuleApprovalPolicy)(nil), // 23: saas.accounts.v1.ModuleApprovalPolicy + (*ModuleResumeRef)(nil), // 24: saas.accounts.v1.ModuleResumeRef + (*ModuleRequestApprovalRequest)(nil), // 25: saas.accounts.v1.ModuleRequestApprovalRequest + (*ModuleRequestApprovalResponse)(nil), // 26: saas.accounts.v1.ModuleRequestApprovalResponse + (*ModuleGetApprovalRequest)(nil), // 27: saas.accounts.v1.ModuleGetApprovalRequest + (*ModuleApproval)(nil), // 28: saas.accounts.v1.ModuleApproval + (*ModuleCancelApprovalRequest)(nil), // 29: saas.accounts.v1.ModuleCancelApprovalRequest + (*ModuleEmitAuditEventRequest)(nil), // 30: saas.accounts.v1.ModuleEmitAuditEventRequest + (*ModuleAuditFieldDeclaration)(nil), // 31: saas.accounts.v1.ModuleAuditFieldDeclaration + (*ModuleAuditEventTypeDeclaration)(nil), // 32: saas.accounts.v1.ModuleAuditEventTypeDeclaration + (*ModuleDeclareAuditEventTypesRequest)(nil), // 33: saas.accounts.v1.ModuleDeclareAuditEventTypesRequest + (*ModuleDeclareAuditEventTypesResponse)(nil), // 34: saas.accounts.v1.ModuleDeclareAuditEventTypesResponse + (*SubjectVisibilityGrant)(nil), // 35: saas.accounts.v1.SubjectVisibilityGrant + (*ModuleListSubjectVisibilityRequest)(nil), // 36: saas.accounts.v1.ModuleListSubjectVisibilityRequest + (*ModuleListSubjectVisibilityResponse)(nil), // 37: saas.accounts.v1.ModuleListSubjectVisibilityResponse + (*FetchDatasourceBlobRequest)(nil), // 38: saas.accounts.v1.FetchDatasourceBlobRequest + (*FetchDatasourceBlobChunk)(nil), // 39: saas.accounts.v1.FetchDatasourceBlobChunk + (*DatasourceFileRef)(nil), // 40: saas.accounts.v1.DatasourceFileRef + (*FetchDatasourceFilesRequest)(nil), // 41: saas.accounts.v1.FetchDatasourceFilesRequest + (*DatasourceProvenance)(nil), // 42: saas.accounts.v1.DatasourceProvenance + (*DatasourceItemReaders)(nil), // 43: saas.accounts.v1.DatasourceItemReaders + (*DatasourceFileHeader)(nil), // 44: saas.accounts.v1.DatasourceFileHeader + (*FetchDatasourceFilesFrame)(nil), // 45: saas.accounts.v1.FetchDatasourceFilesFrame + (*ModulePublishEventRequest)(nil), // 46: saas.accounts.v1.ModulePublishEventRequest + (*ModulePublishEventResponse)(nil), // 47: saas.accounts.v1.ModulePublishEventResponse + (*ModuleSubscribeRequest)(nil), // 48: saas.accounts.v1.ModuleSubscribeRequest + (*ModuleSubscription)(nil), // 49: saas.accounts.v1.ModuleSubscription + (*ModuleSubscribeResponse)(nil), // 50: saas.accounts.v1.ModuleSubscribeResponse + (*ModuleUnsubscribeRequest)(nil), // 51: saas.accounts.v1.ModuleUnsubscribeRequest + (*ModuleListSubscriptionsRequest)(nil), // 52: saas.accounts.v1.ModuleListSubscriptionsRequest + (*ModuleListSubscriptionsResponse)(nil), // 53: saas.accounts.v1.ModuleListSubscriptionsResponse + (*ModuleReplayEventsRequest)(nil), // 54: saas.accounts.v1.ModuleReplayEventsRequest + (*ModuleReplayEventsResponse)(nil), // 55: saas.accounts.v1.ModuleReplayEventsResponse + (*ReadableSourceCollection)(nil), // 56: saas.accounts.v1.ReadableSourceCollection + (*ReadableCollectionGrant)(nil), // 57: saas.accounts.v1.ReadableCollectionGrant + (*CollectionSyncProvenance)(nil), // 58: saas.accounts.v1.CollectionSyncProvenance + (*ListReadableSourceCollectionsRequest)(nil), // 59: saas.accounts.v1.ListReadableSourceCollectionsRequest + (*ListReadableSourceCollectionsResponse)(nil), // 60: saas.accounts.v1.ListReadableSourceCollectionsResponse + (*ModulePlaceRecordRequest)(nil), // 61: saas.accounts.v1.ModulePlaceRecordRequest + (*ModulePlaceRecordResponse)(nil), // 62: saas.accounts.v1.ModulePlaceRecordResponse + (*CheckWorkContextRecordAccessRequest)(nil), // 63: saas.accounts.v1.CheckWorkContextRecordAccessRequest + (*CheckWorkContextRecordAccessResponse)(nil), // 64: saas.accounts.v1.CheckWorkContextRecordAccessResponse + (*ModuleExchangeDelegatedReadAudienceRequest)(nil), // 65: saas.accounts.v1.ModuleExchangeDelegatedReadAudienceRequest + (*ModuleExchangeDelegatedOperationAudienceRequest)(nil), // 66: saas.accounts.v1.ModuleExchangeDelegatedOperationAudienceRequest + (*ExecutableArtifactContract)(nil), // 67: saas.accounts.v1.ExecutableArtifactContract + (*ExecutableArtifactIdentity)(nil), // 68: saas.accounts.v1.ExecutableArtifactIdentity + (*ModuleExecutableArtifactRequest)(nil), // 69: saas.accounts.v1.ModuleExecutableArtifactRequest + (*ModuleRevokeExecutableArtifactRequest)(nil), // 70: saas.accounts.v1.ModuleRevokeExecutableArtifactRequest + (*ModuleExecutableArtifactResponse)(nil), // 71: saas.accounts.v1.ModuleExecutableArtifactResponse + (*ModuleCurrentInstallationRequest)(nil), // 72: saas.accounts.v1.ModuleCurrentInstallationRequest + (*ModuleCurrentInstallationResponse)(nil), // 73: saas.accounts.v1.ModuleCurrentInstallationResponse + (*WorkContextSealQuestion)(nil), // 74: saas.accounts.v1.WorkContextSealQuestion + (*WorkContextPrincipalEpochQuestion)(nil), // 75: saas.accounts.v1.WorkContextPrincipalEpochQuestion + (*WorkContextApprovedBuildQuestion)(nil), // 76: saas.accounts.v1.WorkContextApprovedBuildQuestion + (*WorkContextOperationBindingQuestion)(nil), // 77: saas.accounts.v1.WorkContextOperationBindingQuestion + (*WorkContextAuthorizationRevisionQuestion)(nil), // 78: saas.accounts.v1.WorkContextAuthorizationRevisionQuestion + (*WorkContextApprovalGrantQuestion)(nil), // 79: saas.accounts.v1.WorkContextApprovalGrantQuestion + (*WorkContextSealAnswer)(nil), // 80: saas.accounts.v1.WorkContextSealAnswer + (*WorkContextPrincipalEpochAnswer)(nil), // 81: saas.accounts.v1.WorkContextPrincipalEpochAnswer + (*WorkContextApprovedBuildAnswer)(nil), // 82: saas.accounts.v1.WorkContextApprovedBuildAnswer + (*WorkContextOperationBindingAnswer)(nil), // 83: saas.accounts.v1.WorkContextOperationBindingAnswer + (*WorkContextAuthorizationRevisionAnswer)(nil), // 84: saas.accounts.v1.WorkContextAuthorizationRevisionAnswer + (*WorkContextApprovalGrantAnswer)(nil), // 85: saas.accounts.v1.WorkContextApprovalGrantAnswer + (*ModuleResolveWorkContextAuthorityRequest)(nil), // 86: saas.accounts.v1.ModuleResolveWorkContextAuthorityRequest + (*ModuleResolveWorkContextAuthorityResponse)(nil), // 87: saas.accounts.v1.ModuleResolveWorkContextAuthorityResponse + (*v1.NewJob)(nil), // 88: saas.jobs.v1.NewJob + (v1.JobEnqueueDisposition)(0), // 89: saas.jobs.v1.JobEnqueueDisposition + (*durationpb.Duration)(nil), // 90: google.protobuf.Duration + (*v1.JobEnvelope)(nil), // 91: saas.jobs.v1.JobEnvelope + (*v1.JobLeaseReference)(nil), // 92: saas.jobs.v1.JobLeaseReference + (*v1.JobLease)(nil), // 93: saas.jobs.v1.JobLease + (*v1.JobFailure)(nil), // 94: saas.jobs.v1.JobFailure + (*timestamppb.Timestamp)(nil), // 95: google.protobuf.Timestamp + (*structpb.Struct)(nil), // 96: google.protobuf.Struct + (*v11.EventEnvelope)(nil), // 97: saas.events.v1.EventEnvelope + (*ModuleMintWorkContextRequest)(nil), // 98: saas.accounts.v1.ModuleMintWorkContextRequest + (*ModuleMintOperationContextRequest)(nil), // 99: saas.accounts.v1.ModuleMintOperationContextRequest + (*ModuleMintSourceOperationContextRequest)(nil), // 100: saas.accounts.v1.ModuleMintSourceOperationContextRequest + (*IssuedWorkContext)(nil), // 101: saas.accounts.v1.IssuedWorkContext + (*emptypb.Empty)(nil), // 102: google.protobuf.Empty + (*ModuleMintWorkContextResponse)(nil), // 103: saas.accounts.v1.ModuleMintWorkContextResponse + (*ModuleMintOperationContextResponse)(nil), // 104: saas.accounts.v1.ModuleMintOperationContextResponse + (*ModuleMintSourceOperationContextResponse)(nil), // 105: saas.accounts.v1.ModuleMintSourceOperationContextResponse } var file_saas_accounts_v1_module_capabilities_proto_depIdxs = []int32{ - 69, // 0: saas.accounts.v1.ModuleEnqueueJobRequest.job:type_name -> saas.jobs.v1.NewJob - 70, // 1: saas.accounts.v1.ModuleEnqueueJobResponse.disposition:type_name -> saas.jobs.v1.JobEnqueueDisposition - 71, // 2: saas.accounts.v1.ModuleClaimJobsRequest.lease_duration:type_name -> google.protobuf.Duration - 72, // 3: saas.accounts.v1.ModuleClaimJobsResponse.jobs:type_name -> saas.jobs.v1.JobEnvelope - 73, // 4: saas.accounts.v1.ModuleHeartbeatJobRequest.lease:type_name -> saas.jobs.v1.JobLeaseReference - 71, // 5: saas.accounts.v1.ModuleHeartbeatJobRequest.extension:type_name -> google.protobuf.Duration - 74, // 6: saas.accounts.v1.ModuleHeartbeatJobResponse.lease:type_name -> saas.jobs.v1.JobLease - 73, // 7: saas.accounts.v1.ModuleAckJobRequest.lease:type_name -> saas.jobs.v1.JobLeaseReference - 73, // 8: saas.accounts.v1.ModuleNackJobRequest.lease:type_name -> saas.jobs.v1.JobLeaseReference - 75, // 9: saas.accounts.v1.ModuleNackJobRequest.failure:type_name -> saas.jobs.v1.JobFailure - 76, // 10: saas.accounts.v1.ModuleNackJobRequest.retry_at:type_name -> google.protobuf.Timestamp - 77, // 11: saas.accounts.v1.ModuleResumeRef.payload:type_name -> google.protobuf.Struct - 77, // 12: saas.accounts.v1.ModuleRequestApprovalRequest.subject:type_name -> google.protobuf.Struct - 18, // 13: saas.accounts.v1.ModuleRequestApprovalRequest.policy:type_name -> saas.accounts.v1.ModuleApprovalPolicy - 19, // 14: saas.accounts.v1.ModuleRequestApprovalRequest.resume_ref:type_name -> saas.accounts.v1.ModuleResumeRef - 76, // 15: saas.accounts.v1.ModuleRequestApprovalRequest.expires_at:type_name -> google.protobuf.Timestamp - 76, // 16: saas.accounts.v1.ModuleRequestApprovalRequest.escalate_at:type_name -> google.protobuf.Timestamp - 77, // 17: saas.accounts.v1.ModuleApproval.subject:type_name -> google.protobuf.Struct - 19, // 18: saas.accounts.v1.ModuleApproval.resume_ref:type_name -> saas.accounts.v1.ModuleResumeRef - 76, // 19: saas.accounts.v1.ModuleApproval.expires_at:type_name -> google.protobuf.Timestamp - 76, // 20: saas.accounts.v1.ModuleApproval.escalate_at:type_name -> google.protobuf.Timestamp - 76, // 21: saas.accounts.v1.ModuleApproval.created_at:type_name -> google.protobuf.Timestamp - 77, // 22: saas.accounts.v1.ModuleEmitAuditEventRequest.fields:type_name -> google.protobuf.Struct - 0, // 23: saas.accounts.v1.ModuleAuditFieldDeclaration.kind:type_name -> saas.accounts.v1.ModuleAuditFieldKind - 26, // 24: saas.accounts.v1.ModuleAuditEventTypeDeclaration.fields:type_name -> saas.accounts.v1.ModuleAuditFieldDeclaration - 1, // 25: saas.accounts.v1.ModuleAuditEventTypeDeclaration.visibility:type_name -> saas.accounts.v1.ModuleAuditEventVisibility - 27, // 26: saas.accounts.v1.ModuleDeclareAuditEventTypesRequest.types:type_name -> saas.accounts.v1.ModuleAuditEventTypeDeclaration - 76, // 27: saas.accounts.v1.SubjectVisibilityGrant.expires_at:type_name -> google.protobuf.Timestamp - 30, // 28: saas.accounts.v1.ModuleListSubjectVisibilityResponse.grants:type_name -> saas.accounts.v1.SubjectVisibilityGrant - 35, // 29: saas.accounts.v1.FetchDatasourceFilesRequest.files:type_name -> saas.accounts.v1.DatasourceFileRef - 2, // 30: saas.accounts.v1.DatasourceItemReaders.basis:type_name -> saas.accounts.v1.DatasourceItemReadersBasis - 37, // 31: saas.accounts.v1.DatasourceFileHeader.provenance:type_name -> saas.accounts.v1.DatasourceProvenance - 38, // 32: saas.accounts.v1.DatasourceFileHeader.readers:type_name -> saas.accounts.v1.DatasourceItemReaders - 39, // 33: saas.accounts.v1.FetchDatasourceFilesFrame.header:type_name -> saas.accounts.v1.DatasourceFileHeader - 78, // 34: saas.accounts.v1.ModulePublishEventRequest.envelope:type_name -> saas.events.v1.EventEnvelope - 3, // 35: saas.accounts.v1.ModuleSubscribeRequest.delivery:type_name -> saas.accounts.v1.EventDelivery - 3, // 36: saas.accounts.v1.ModuleSubscription.delivery:type_name -> saas.accounts.v1.EventDelivery - 76, // 37: saas.accounts.v1.ModuleSubscription.created_at:type_name -> google.protobuf.Timestamp - 44, // 38: saas.accounts.v1.ModuleSubscribeResponse.subscription:type_name -> saas.accounts.v1.ModuleSubscription - 44, // 39: saas.accounts.v1.ModuleListSubscriptionsResponse.subscriptions:type_name -> saas.accounts.v1.ModuleSubscription - 76, // 40: saas.accounts.v1.ModuleReplayEventsRequest.since:type_name -> google.protobuf.Timestamp - 4, // 41: saas.accounts.v1.ReadableSourceCollection.grant_disclosure:type_name -> saas.accounts.v1.MetadataDisclosure - 52, // 42: saas.accounts.v1.ReadableSourceCollection.read_grants:type_name -> saas.accounts.v1.ReadableCollectionGrant - 53, // 43: saas.accounts.v1.ReadableSourceCollection.sync:type_name -> saas.accounts.v1.CollectionSyncProvenance - 76, // 44: saas.accounts.v1.ReadableCollectionGrant.expires_at:type_name -> google.protobuf.Timestamp - 5, // 45: saas.accounts.v1.CollectionSyncProvenance.stage:type_name -> saas.accounts.v1.SourceSyncStage - 76, // 46: saas.accounts.v1.CollectionSyncProvenance.at:type_name -> google.protobuf.Timestamp - 4, // 47: saas.accounts.v1.CollectionSyncProvenance.requester_disclosure:type_name -> saas.accounts.v1.MetadataDisclosure - 76, // 48: saas.accounts.v1.CollectionSyncProvenance.requested_at:type_name -> google.protobuf.Timestamp - 51, // 49: saas.accounts.v1.ListReadableSourceCollectionsResponse.collections:type_name -> saas.accounts.v1.ReadableSourceCollection - 62, // 50: saas.accounts.v1.ExecutableArtifactIdentity.contracts:type_name -> saas.accounts.v1.ExecutableArtifactContract - 63, // 51: saas.accounts.v1.ModuleExecutableArtifactRequest.identity:type_name -> saas.accounts.v1.ExecutableArtifactIdentity - 67, // 52: saas.accounts.v1.ModuleCapabilitiesService.GetCurrentInstallation:input_type -> saas.accounts.v1.ModuleCurrentInstallationRequest - 64, // 53: saas.accounts.v1.ModuleCapabilitiesService.ApproveExecutableArtifact:input_type -> saas.accounts.v1.ModuleExecutableArtifactRequest - 64, // 54: saas.accounts.v1.ModuleCapabilitiesService.AuthorizeExecutableArtifact:input_type -> saas.accounts.v1.ModuleExecutableArtifactRequest - 65, // 55: saas.accounts.v1.ModuleCapabilitiesService.RevokeExecutableArtifact:input_type -> saas.accounts.v1.ModuleRevokeExecutableArtifactRequest - 60, // 56: saas.accounts.v1.ModuleCapabilitiesService.ExchangeDelegatedReadAudience:input_type -> saas.accounts.v1.ModuleExchangeDelegatedReadAudienceRequest - 61, // 57: saas.accounts.v1.ModuleCapabilitiesService.ExchangeDelegatedOperationAudience:input_type -> saas.accounts.v1.ModuleExchangeDelegatedOperationAudienceRequest - 58, // 58: saas.accounts.v1.ModuleCapabilitiesService.CheckWorkContextRecordAccess:input_type -> saas.accounts.v1.CheckWorkContextRecordAccessRequest - 54, // 59: saas.accounts.v1.ModuleCapabilitiesService.ListReadableSourceCollections:input_type -> saas.accounts.v1.ListReadableSourceCollectionsRequest - 56, // 60: saas.accounts.v1.ModuleCapabilitiesService.PlaceRecord:input_type -> saas.accounts.v1.ModulePlaceRecordRequest - 6, // 61: saas.accounts.v1.ModuleCapabilitiesService.EnqueueJob:input_type -> saas.accounts.v1.ModuleEnqueueJobRequest - 8, // 62: saas.accounts.v1.ModuleCapabilitiesService.ClaimJobs:input_type -> saas.accounts.v1.ModuleClaimJobsRequest - 10, // 63: saas.accounts.v1.ModuleCapabilitiesService.HeartbeatJob:input_type -> saas.accounts.v1.ModuleHeartbeatJobRequest - 12, // 64: saas.accounts.v1.ModuleCapabilitiesService.AckJob:input_type -> saas.accounts.v1.ModuleAckJobRequest - 13, // 65: saas.accounts.v1.ModuleCapabilitiesService.NackJob:input_type -> saas.accounts.v1.ModuleNackJobRequest - 14, // 66: saas.accounts.v1.ModuleCapabilitiesService.NotifyUser:input_type -> saas.accounts.v1.ModuleNotifyUserRequest - 16, // 67: saas.accounts.v1.ModuleCapabilitiesService.NotifyOrgAdmins:input_type -> saas.accounts.v1.ModuleNotifyOrgAdminsRequest - 20, // 68: saas.accounts.v1.ModuleCapabilitiesService.RequestApproval:input_type -> saas.accounts.v1.ModuleRequestApprovalRequest - 22, // 69: saas.accounts.v1.ModuleCapabilitiesService.GetApproval:input_type -> saas.accounts.v1.ModuleGetApprovalRequest - 24, // 70: saas.accounts.v1.ModuleCapabilitiesService.CancelApproval:input_type -> saas.accounts.v1.ModuleCancelApprovalRequest - 25, // 71: saas.accounts.v1.ModuleCapabilitiesService.EmitAuditEvent:input_type -> saas.accounts.v1.ModuleEmitAuditEventRequest - 28, // 72: saas.accounts.v1.ModuleCapabilitiesService.DeclareAuditEventTypes:input_type -> saas.accounts.v1.ModuleDeclareAuditEventTypesRequest - 31, // 73: saas.accounts.v1.ModuleCapabilitiesService.ListSubjectVisibility:input_type -> saas.accounts.v1.ModuleListSubjectVisibilityRequest - 33, // 74: saas.accounts.v1.ModuleCapabilitiesService.FetchDatasourceBlob:input_type -> saas.accounts.v1.FetchDatasourceBlobRequest - 36, // 75: saas.accounts.v1.ModuleCapabilitiesService.FetchDatasourceFiles:input_type -> saas.accounts.v1.FetchDatasourceFilesRequest - 79, // 76: saas.accounts.v1.ModuleCapabilitiesService.MintModuleWorkContext:input_type -> saas.accounts.v1.ModuleMintWorkContextRequest - 80, // 77: saas.accounts.v1.ModuleCapabilitiesService.MintModuleOperationContext:input_type -> saas.accounts.v1.ModuleMintOperationContextRequest - 81, // 78: saas.accounts.v1.ModuleCapabilitiesService.MintSourceOperationContext:input_type -> saas.accounts.v1.ModuleMintSourceOperationContextRequest - 41, // 79: saas.accounts.v1.ModuleCapabilitiesService.PublishEvent:input_type -> saas.accounts.v1.ModulePublishEventRequest - 43, // 80: saas.accounts.v1.ModuleCapabilitiesService.Subscribe:input_type -> saas.accounts.v1.ModuleSubscribeRequest - 46, // 81: saas.accounts.v1.ModuleCapabilitiesService.Unsubscribe:input_type -> saas.accounts.v1.ModuleUnsubscribeRequest - 47, // 82: saas.accounts.v1.ModuleCapabilitiesService.ListSubscriptions:input_type -> saas.accounts.v1.ModuleListSubscriptionsRequest - 49, // 83: saas.accounts.v1.ModuleCapabilitiesService.ReplayEvents:input_type -> saas.accounts.v1.ModuleReplayEventsRequest - 68, // 84: saas.accounts.v1.ModuleCapabilitiesService.GetCurrentInstallation:output_type -> saas.accounts.v1.ModuleCurrentInstallationResponse - 66, // 85: saas.accounts.v1.ModuleCapabilitiesService.ApproveExecutableArtifact:output_type -> saas.accounts.v1.ModuleExecutableArtifactResponse - 66, // 86: saas.accounts.v1.ModuleCapabilitiesService.AuthorizeExecutableArtifact:output_type -> saas.accounts.v1.ModuleExecutableArtifactResponse - 66, // 87: saas.accounts.v1.ModuleCapabilitiesService.RevokeExecutableArtifact:output_type -> saas.accounts.v1.ModuleExecutableArtifactResponse - 82, // 88: saas.accounts.v1.ModuleCapabilitiesService.ExchangeDelegatedReadAudience:output_type -> saas.accounts.v1.IssuedWorkContext - 82, // 89: saas.accounts.v1.ModuleCapabilitiesService.ExchangeDelegatedOperationAudience:output_type -> saas.accounts.v1.IssuedWorkContext - 59, // 90: saas.accounts.v1.ModuleCapabilitiesService.CheckWorkContextRecordAccess:output_type -> saas.accounts.v1.CheckWorkContextRecordAccessResponse - 55, // 91: saas.accounts.v1.ModuleCapabilitiesService.ListReadableSourceCollections:output_type -> saas.accounts.v1.ListReadableSourceCollectionsResponse - 57, // 92: saas.accounts.v1.ModuleCapabilitiesService.PlaceRecord:output_type -> saas.accounts.v1.ModulePlaceRecordResponse - 7, // 93: saas.accounts.v1.ModuleCapabilitiesService.EnqueueJob:output_type -> saas.accounts.v1.ModuleEnqueueJobResponse - 9, // 94: saas.accounts.v1.ModuleCapabilitiesService.ClaimJobs:output_type -> saas.accounts.v1.ModuleClaimJobsResponse - 11, // 95: saas.accounts.v1.ModuleCapabilitiesService.HeartbeatJob:output_type -> saas.accounts.v1.ModuleHeartbeatJobResponse - 83, // 96: saas.accounts.v1.ModuleCapabilitiesService.AckJob:output_type -> google.protobuf.Empty - 83, // 97: saas.accounts.v1.ModuleCapabilitiesService.NackJob:output_type -> google.protobuf.Empty - 15, // 98: saas.accounts.v1.ModuleCapabilitiesService.NotifyUser:output_type -> saas.accounts.v1.ModuleNotifyUserResponse - 17, // 99: saas.accounts.v1.ModuleCapabilitiesService.NotifyOrgAdmins:output_type -> saas.accounts.v1.ModuleNotifyOrgAdminsResponse - 21, // 100: saas.accounts.v1.ModuleCapabilitiesService.RequestApproval:output_type -> saas.accounts.v1.ModuleRequestApprovalResponse - 23, // 101: saas.accounts.v1.ModuleCapabilitiesService.GetApproval:output_type -> saas.accounts.v1.ModuleApproval - 83, // 102: saas.accounts.v1.ModuleCapabilitiesService.CancelApproval:output_type -> google.protobuf.Empty - 83, // 103: saas.accounts.v1.ModuleCapabilitiesService.EmitAuditEvent:output_type -> google.protobuf.Empty - 29, // 104: saas.accounts.v1.ModuleCapabilitiesService.DeclareAuditEventTypes:output_type -> saas.accounts.v1.ModuleDeclareAuditEventTypesResponse - 32, // 105: saas.accounts.v1.ModuleCapabilitiesService.ListSubjectVisibility:output_type -> saas.accounts.v1.ModuleListSubjectVisibilityResponse - 34, // 106: saas.accounts.v1.ModuleCapabilitiesService.FetchDatasourceBlob:output_type -> saas.accounts.v1.FetchDatasourceBlobChunk - 40, // 107: saas.accounts.v1.ModuleCapabilitiesService.FetchDatasourceFiles:output_type -> saas.accounts.v1.FetchDatasourceFilesFrame - 84, // 108: saas.accounts.v1.ModuleCapabilitiesService.MintModuleWorkContext:output_type -> saas.accounts.v1.ModuleMintWorkContextResponse - 85, // 109: saas.accounts.v1.ModuleCapabilitiesService.MintModuleOperationContext:output_type -> saas.accounts.v1.ModuleMintOperationContextResponse - 86, // 110: saas.accounts.v1.ModuleCapabilitiesService.MintSourceOperationContext:output_type -> saas.accounts.v1.ModuleMintSourceOperationContextResponse - 42, // 111: saas.accounts.v1.ModuleCapabilitiesService.PublishEvent:output_type -> saas.accounts.v1.ModulePublishEventResponse - 45, // 112: saas.accounts.v1.ModuleCapabilitiesService.Subscribe:output_type -> saas.accounts.v1.ModuleSubscribeResponse - 83, // 113: saas.accounts.v1.ModuleCapabilitiesService.Unsubscribe:output_type -> google.protobuf.Empty - 48, // 114: saas.accounts.v1.ModuleCapabilitiesService.ListSubscriptions:output_type -> saas.accounts.v1.ModuleListSubscriptionsResponse - 50, // 115: saas.accounts.v1.ModuleCapabilitiesService.ReplayEvents:output_type -> saas.accounts.v1.ModuleReplayEventsResponse - 84, // [84:116] is the sub-list for method output_type - 52, // [52:84] is the sub-list for method input_type - 52, // [52:52] is the sub-list for extension type_name - 52, // [52:52] is the sub-list for extension extendee - 0, // [0:52] is the sub-list for field type_name + 88, // 0: saas.accounts.v1.ModuleEnqueueJobRequest.job:type_name -> saas.jobs.v1.NewJob + 89, // 1: saas.accounts.v1.ModuleEnqueueJobResponse.disposition:type_name -> saas.jobs.v1.JobEnqueueDisposition + 90, // 2: saas.accounts.v1.ModuleClaimJobsRequest.lease_duration:type_name -> google.protobuf.Duration + 91, // 3: saas.accounts.v1.ModuleClaimJobsResponse.jobs:type_name -> saas.jobs.v1.JobEnvelope + 92, // 4: saas.accounts.v1.ModuleHeartbeatJobRequest.lease:type_name -> saas.jobs.v1.JobLeaseReference + 90, // 5: saas.accounts.v1.ModuleHeartbeatJobRequest.extension:type_name -> google.protobuf.Duration + 93, // 6: saas.accounts.v1.ModuleHeartbeatJobResponse.lease:type_name -> saas.jobs.v1.JobLease + 92, // 7: saas.accounts.v1.ModuleAckJobRequest.lease:type_name -> saas.jobs.v1.JobLeaseReference + 92, // 8: saas.accounts.v1.ModuleNackJobRequest.lease:type_name -> saas.jobs.v1.JobLeaseReference + 94, // 9: saas.accounts.v1.ModuleNackJobRequest.failure:type_name -> saas.jobs.v1.JobFailure + 95, // 10: saas.accounts.v1.ModuleNackJobRequest.retry_at:type_name -> google.protobuf.Timestamp + 96, // 11: saas.accounts.v1.ModuleResumeRef.payload:type_name -> google.protobuf.Struct + 96, // 12: saas.accounts.v1.ModuleRequestApprovalRequest.subject:type_name -> google.protobuf.Struct + 23, // 13: saas.accounts.v1.ModuleRequestApprovalRequest.policy:type_name -> saas.accounts.v1.ModuleApprovalPolicy + 24, // 14: saas.accounts.v1.ModuleRequestApprovalRequest.resume_ref:type_name -> saas.accounts.v1.ModuleResumeRef + 95, // 15: saas.accounts.v1.ModuleRequestApprovalRequest.expires_at:type_name -> google.protobuf.Timestamp + 95, // 16: saas.accounts.v1.ModuleRequestApprovalRequest.escalate_at:type_name -> google.protobuf.Timestamp + 96, // 17: saas.accounts.v1.ModuleApproval.subject:type_name -> google.protobuf.Struct + 24, // 18: saas.accounts.v1.ModuleApproval.resume_ref:type_name -> saas.accounts.v1.ModuleResumeRef + 95, // 19: saas.accounts.v1.ModuleApproval.expires_at:type_name -> google.protobuf.Timestamp + 95, // 20: saas.accounts.v1.ModuleApproval.escalate_at:type_name -> google.protobuf.Timestamp + 95, // 21: saas.accounts.v1.ModuleApproval.created_at:type_name -> google.protobuf.Timestamp + 96, // 22: saas.accounts.v1.ModuleEmitAuditEventRequest.fields:type_name -> google.protobuf.Struct + 0, // 23: saas.accounts.v1.ModuleAuditFieldDeclaration.kind:type_name -> saas.accounts.v1.ModuleAuditFieldKind + 31, // 24: saas.accounts.v1.ModuleAuditEventTypeDeclaration.fields:type_name -> saas.accounts.v1.ModuleAuditFieldDeclaration + 1, // 25: saas.accounts.v1.ModuleAuditEventTypeDeclaration.visibility:type_name -> saas.accounts.v1.ModuleAuditEventVisibility + 32, // 26: saas.accounts.v1.ModuleDeclareAuditEventTypesRequest.types:type_name -> saas.accounts.v1.ModuleAuditEventTypeDeclaration + 95, // 27: saas.accounts.v1.SubjectVisibilityGrant.expires_at:type_name -> google.protobuf.Timestamp + 35, // 28: saas.accounts.v1.ModuleListSubjectVisibilityResponse.grants:type_name -> saas.accounts.v1.SubjectVisibilityGrant + 40, // 29: saas.accounts.v1.FetchDatasourceFilesRequest.files:type_name -> saas.accounts.v1.DatasourceFileRef + 2, // 30: saas.accounts.v1.DatasourceItemReaders.basis:type_name -> saas.accounts.v1.DatasourceItemReadersBasis + 42, // 31: saas.accounts.v1.DatasourceFileHeader.provenance:type_name -> saas.accounts.v1.DatasourceProvenance + 43, // 32: saas.accounts.v1.DatasourceFileHeader.readers:type_name -> saas.accounts.v1.DatasourceItemReaders + 44, // 33: saas.accounts.v1.FetchDatasourceFilesFrame.header:type_name -> saas.accounts.v1.DatasourceFileHeader + 97, // 34: saas.accounts.v1.ModulePublishEventRequest.envelope:type_name -> saas.events.v1.EventEnvelope + 3, // 35: saas.accounts.v1.ModuleSubscribeRequest.delivery:type_name -> saas.accounts.v1.EventDelivery + 3, // 36: saas.accounts.v1.ModuleSubscription.delivery:type_name -> saas.accounts.v1.EventDelivery + 95, // 37: saas.accounts.v1.ModuleSubscription.created_at:type_name -> google.protobuf.Timestamp + 49, // 38: saas.accounts.v1.ModuleSubscribeResponse.subscription:type_name -> saas.accounts.v1.ModuleSubscription + 49, // 39: saas.accounts.v1.ModuleListSubscriptionsResponse.subscriptions:type_name -> saas.accounts.v1.ModuleSubscription + 95, // 40: saas.accounts.v1.ModuleReplayEventsRequest.since:type_name -> google.protobuf.Timestamp + 4, // 41: saas.accounts.v1.ReadableSourceCollection.grant_disclosure:type_name -> saas.accounts.v1.MetadataDisclosure + 57, // 42: saas.accounts.v1.ReadableSourceCollection.read_grants:type_name -> saas.accounts.v1.ReadableCollectionGrant + 58, // 43: saas.accounts.v1.ReadableSourceCollection.sync:type_name -> saas.accounts.v1.CollectionSyncProvenance + 95, // 44: saas.accounts.v1.ReadableCollectionGrant.expires_at:type_name -> google.protobuf.Timestamp + 5, // 45: saas.accounts.v1.CollectionSyncProvenance.stage:type_name -> saas.accounts.v1.SourceSyncStage + 95, // 46: saas.accounts.v1.CollectionSyncProvenance.at:type_name -> google.protobuf.Timestamp + 4, // 47: saas.accounts.v1.CollectionSyncProvenance.requester_disclosure:type_name -> saas.accounts.v1.MetadataDisclosure + 95, // 48: saas.accounts.v1.CollectionSyncProvenance.requested_at:type_name -> google.protobuf.Timestamp + 56, // 49: saas.accounts.v1.ListReadableSourceCollectionsResponse.collections:type_name -> saas.accounts.v1.ReadableSourceCollection + 67, // 50: saas.accounts.v1.ExecutableArtifactIdentity.contracts:type_name -> saas.accounts.v1.ExecutableArtifactContract + 68, // 51: saas.accounts.v1.ModuleExecutableArtifactRequest.identity:type_name -> saas.accounts.v1.ExecutableArtifactIdentity + 6, // 52: saas.accounts.v1.WorkContextSealAnswer.state:type_name -> saas.accounts.v1.WorkContextSealState + 7, // 53: saas.accounts.v1.WorkContextPrincipalEpochAnswer.state:type_name -> saas.accounts.v1.WorkContextPrincipalState + 8, // 54: saas.accounts.v1.WorkContextApprovedBuildAnswer.state:type_name -> saas.accounts.v1.WorkContextApprovedBuildState + 9, // 55: saas.accounts.v1.WorkContextOperationBindingAnswer.state:type_name -> saas.accounts.v1.WorkContextOperationBindingState + 10, // 56: saas.accounts.v1.WorkContextApprovalGrantAnswer.state:type_name -> saas.accounts.v1.WorkContextApprovalGrantState + 74, // 57: saas.accounts.v1.ModuleResolveWorkContextAuthorityRequest.seal:type_name -> saas.accounts.v1.WorkContextSealQuestion + 75, // 58: saas.accounts.v1.ModuleResolveWorkContextAuthorityRequest.principal_epoch:type_name -> saas.accounts.v1.WorkContextPrincipalEpochQuestion + 76, // 59: saas.accounts.v1.ModuleResolveWorkContextAuthorityRequest.approved_build:type_name -> saas.accounts.v1.WorkContextApprovedBuildQuestion + 77, // 60: saas.accounts.v1.ModuleResolveWorkContextAuthorityRequest.operation_binding:type_name -> saas.accounts.v1.WorkContextOperationBindingQuestion + 78, // 61: saas.accounts.v1.ModuleResolveWorkContextAuthorityRequest.authorization_revision:type_name -> saas.accounts.v1.WorkContextAuthorizationRevisionQuestion + 79, // 62: saas.accounts.v1.ModuleResolveWorkContextAuthorityRequest.approval_grant:type_name -> saas.accounts.v1.WorkContextApprovalGrantQuestion + 80, // 63: saas.accounts.v1.ModuleResolveWorkContextAuthorityResponse.seal:type_name -> saas.accounts.v1.WorkContextSealAnswer + 81, // 64: saas.accounts.v1.ModuleResolveWorkContextAuthorityResponse.principal_epoch:type_name -> saas.accounts.v1.WorkContextPrincipalEpochAnswer + 82, // 65: saas.accounts.v1.ModuleResolveWorkContextAuthorityResponse.approved_build:type_name -> saas.accounts.v1.WorkContextApprovedBuildAnswer + 83, // 66: saas.accounts.v1.ModuleResolveWorkContextAuthorityResponse.operation_binding:type_name -> saas.accounts.v1.WorkContextOperationBindingAnswer + 84, // 67: saas.accounts.v1.ModuleResolveWorkContextAuthorityResponse.authorization_revision:type_name -> saas.accounts.v1.WorkContextAuthorizationRevisionAnswer + 85, // 68: saas.accounts.v1.ModuleResolveWorkContextAuthorityResponse.approval_grant:type_name -> saas.accounts.v1.WorkContextApprovalGrantAnswer + 72, // 69: saas.accounts.v1.ModuleCapabilitiesService.GetCurrentInstallation:input_type -> saas.accounts.v1.ModuleCurrentInstallationRequest + 69, // 70: saas.accounts.v1.ModuleCapabilitiesService.ApproveExecutableArtifact:input_type -> saas.accounts.v1.ModuleExecutableArtifactRequest + 69, // 71: saas.accounts.v1.ModuleCapabilitiesService.AuthorizeExecutableArtifact:input_type -> saas.accounts.v1.ModuleExecutableArtifactRequest + 70, // 72: saas.accounts.v1.ModuleCapabilitiesService.RevokeExecutableArtifact:input_type -> saas.accounts.v1.ModuleRevokeExecutableArtifactRequest + 65, // 73: saas.accounts.v1.ModuleCapabilitiesService.ExchangeDelegatedReadAudience:input_type -> saas.accounts.v1.ModuleExchangeDelegatedReadAudienceRequest + 66, // 74: saas.accounts.v1.ModuleCapabilitiesService.ExchangeDelegatedOperationAudience:input_type -> saas.accounts.v1.ModuleExchangeDelegatedOperationAudienceRequest + 63, // 75: saas.accounts.v1.ModuleCapabilitiesService.CheckWorkContextRecordAccess:input_type -> saas.accounts.v1.CheckWorkContextRecordAccessRequest + 59, // 76: saas.accounts.v1.ModuleCapabilitiesService.ListReadableSourceCollections:input_type -> saas.accounts.v1.ListReadableSourceCollectionsRequest + 61, // 77: saas.accounts.v1.ModuleCapabilitiesService.PlaceRecord:input_type -> saas.accounts.v1.ModulePlaceRecordRequest + 11, // 78: saas.accounts.v1.ModuleCapabilitiesService.EnqueueJob:input_type -> saas.accounts.v1.ModuleEnqueueJobRequest + 13, // 79: saas.accounts.v1.ModuleCapabilitiesService.ClaimJobs:input_type -> saas.accounts.v1.ModuleClaimJobsRequest + 15, // 80: saas.accounts.v1.ModuleCapabilitiesService.HeartbeatJob:input_type -> saas.accounts.v1.ModuleHeartbeatJobRequest + 17, // 81: saas.accounts.v1.ModuleCapabilitiesService.AckJob:input_type -> saas.accounts.v1.ModuleAckJobRequest + 18, // 82: saas.accounts.v1.ModuleCapabilitiesService.NackJob:input_type -> saas.accounts.v1.ModuleNackJobRequest + 19, // 83: saas.accounts.v1.ModuleCapabilitiesService.NotifyUser:input_type -> saas.accounts.v1.ModuleNotifyUserRequest + 21, // 84: saas.accounts.v1.ModuleCapabilitiesService.NotifyOrgAdmins:input_type -> saas.accounts.v1.ModuleNotifyOrgAdminsRequest + 25, // 85: saas.accounts.v1.ModuleCapabilitiesService.RequestApproval:input_type -> saas.accounts.v1.ModuleRequestApprovalRequest + 27, // 86: saas.accounts.v1.ModuleCapabilitiesService.GetApproval:input_type -> saas.accounts.v1.ModuleGetApprovalRequest + 29, // 87: saas.accounts.v1.ModuleCapabilitiesService.CancelApproval:input_type -> saas.accounts.v1.ModuleCancelApprovalRequest + 30, // 88: saas.accounts.v1.ModuleCapabilitiesService.EmitAuditEvent:input_type -> saas.accounts.v1.ModuleEmitAuditEventRequest + 33, // 89: saas.accounts.v1.ModuleCapabilitiesService.DeclareAuditEventTypes:input_type -> saas.accounts.v1.ModuleDeclareAuditEventTypesRequest + 36, // 90: saas.accounts.v1.ModuleCapabilitiesService.ListSubjectVisibility:input_type -> saas.accounts.v1.ModuleListSubjectVisibilityRequest + 38, // 91: saas.accounts.v1.ModuleCapabilitiesService.FetchDatasourceBlob:input_type -> saas.accounts.v1.FetchDatasourceBlobRequest + 41, // 92: saas.accounts.v1.ModuleCapabilitiesService.FetchDatasourceFiles:input_type -> saas.accounts.v1.FetchDatasourceFilesRequest + 98, // 93: saas.accounts.v1.ModuleCapabilitiesService.MintModuleWorkContext:input_type -> saas.accounts.v1.ModuleMintWorkContextRequest + 99, // 94: saas.accounts.v1.ModuleCapabilitiesService.MintModuleOperationContext:input_type -> saas.accounts.v1.ModuleMintOperationContextRequest + 100, // 95: saas.accounts.v1.ModuleCapabilitiesService.MintSourceOperationContext:input_type -> saas.accounts.v1.ModuleMintSourceOperationContextRequest + 46, // 96: saas.accounts.v1.ModuleCapabilitiesService.PublishEvent:input_type -> saas.accounts.v1.ModulePublishEventRequest + 48, // 97: saas.accounts.v1.ModuleCapabilitiesService.Subscribe:input_type -> saas.accounts.v1.ModuleSubscribeRequest + 51, // 98: saas.accounts.v1.ModuleCapabilitiesService.Unsubscribe:input_type -> saas.accounts.v1.ModuleUnsubscribeRequest + 52, // 99: saas.accounts.v1.ModuleCapabilitiesService.ListSubscriptions:input_type -> saas.accounts.v1.ModuleListSubscriptionsRequest + 54, // 100: saas.accounts.v1.ModuleCapabilitiesService.ReplayEvents:input_type -> saas.accounts.v1.ModuleReplayEventsRequest + 86, // 101: saas.accounts.v1.ModuleCapabilitiesService.ResolveWorkContextAuthority:input_type -> saas.accounts.v1.ModuleResolveWorkContextAuthorityRequest + 73, // 102: saas.accounts.v1.ModuleCapabilitiesService.GetCurrentInstallation:output_type -> saas.accounts.v1.ModuleCurrentInstallationResponse + 71, // 103: saas.accounts.v1.ModuleCapabilitiesService.ApproveExecutableArtifact:output_type -> saas.accounts.v1.ModuleExecutableArtifactResponse + 71, // 104: saas.accounts.v1.ModuleCapabilitiesService.AuthorizeExecutableArtifact:output_type -> saas.accounts.v1.ModuleExecutableArtifactResponse + 71, // 105: saas.accounts.v1.ModuleCapabilitiesService.RevokeExecutableArtifact:output_type -> saas.accounts.v1.ModuleExecutableArtifactResponse + 101, // 106: saas.accounts.v1.ModuleCapabilitiesService.ExchangeDelegatedReadAudience:output_type -> saas.accounts.v1.IssuedWorkContext + 101, // 107: saas.accounts.v1.ModuleCapabilitiesService.ExchangeDelegatedOperationAudience:output_type -> saas.accounts.v1.IssuedWorkContext + 64, // 108: saas.accounts.v1.ModuleCapabilitiesService.CheckWorkContextRecordAccess:output_type -> saas.accounts.v1.CheckWorkContextRecordAccessResponse + 60, // 109: saas.accounts.v1.ModuleCapabilitiesService.ListReadableSourceCollections:output_type -> saas.accounts.v1.ListReadableSourceCollectionsResponse + 62, // 110: saas.accounts.v1.ModuleCapabilitiesService.PlaceRecord:output_type -> saas.accounts.v1.ModulePlaceRecordResponse + 12, // 111: saas.accounts.v1.ModuleCapabilitiesService.EnqueueJob:output_type -> saas.accounts.v1.ModuleEnqueueJobResponse + 14, // 112: saas.accounts.v1.ModuleCapabilitiesService.ClaimJobs:output_type -> saas.accounts.v1.ModuleClaimJobsResponse + 16, // 113: saas.accounts.v1.ModuleCapabilitiesService.HeartbeatJob:output_type -> saas.accounts.v1.ModuleHeartbeatJobResponse + 102, // 114: saas.accounts.v1.ModuleCapabilitiesService.AckJob:output_type -> google.protobuf.Empty + 102, // 115: saas.accounts.v1.ModuleCapabilitiesService.NackJob:output_type -> google.protobuf.Empty + 20, // 116: saas.accounts.v1.ModuleCapabilitiesService.NotifyUser:output_type -> saas.accounts.v1.ModuleNotifyUserResponse + 22, // 117: saas.accounts.v1.ModuleCapabilitiesService.NotifyOrgAdmins:output_type -> saas.accounts.v1.ModuleNotifyOrgAdminsResponse + 26, // 118: saas.accounts.v1.ModuleCapabilitiesService.RequestApproval:output_type -> saas.accounts.v1.ModuleRequestApprovalResponse + 28, // 119: saas.accounts.v1.ModuleCapabilitiesService.GetApproval:output_type -> saas.accounts.v1.ModuleApproval + 102, // 120: saas.accounts.v1.ModuleCapabilitiesService.CancelApproval:output_type -> google.protobuf.Empty + 102, // 121: saas.accounts.v1.ModuleCapabilitiesService.EmitAuditEvent:output_type -> google.protobuf.Empty + 34, // 122: saas.accounts.v1.ModuleCapabilitiesService.DeclareAuditEventTypes:output_type -> saas.accounts.v1.ModuleDeclareAuditEventTypesResponse + 37, // 123: saas.accounts.v1.ModuleCapabilitiesService.ListSubjectVisibility:output_type -> saas.accounts.v1.ModuleListSubjectVisibilityResponse + 39, // 124: saas.accounts.v1.ModuleCapabilitiesService.FetchDatasourceBlob:output_type -> saas.accounts.v1.FetchDatasourceBlobChunk + 45, // 125: saas.accounts.v1.ModuleCapabilitiesService.FetchDatasourceFiles:output_type -> saas.accounts.v1.FetchDatasourceFilesFrame + 103, // 126: saas.accounts.v1.ModuleCapabilitiesService.MintModuleWorkContext:output_type -> saas.accounts.v1.ModuleMintWorkContextResponse + 104, // 127: saas.accounts.v1.ModuleCapabilitiesService.MintModuleOperationContext:output_type -> saas.accounts.v1.ModuleMintOperationContextResponse + 105, // 128: saas.accounts.v1.ModuleCapabilitiesService.MintSourceOperationContext:output_type -> saas.accounts.v1.ModuleMintSourceOperationContextResponse + 47, // 129: saas.accounts.v1.ModuleCapabilitiesService.PublishEvent:output_type -> saas.accounts.v1.ModulePublishEventResponse + 50, // 130: saas.accounts.v1.ModuleCapabilitiesService.Subscribe:output_type -> saas.accounts.v1.ModuleSubscribeResponse + 102, // 131: saas.accounts.v1.ModuleCapabilitiesService.Unsubscribe:output_type -> google.protobuf.Empty + 53, // 132: saas.accounts.v1.ModuleCapabilitiesService.ListSubscriptions:output_type -> saas.accounts.v1.ModuleListSubscriptionsResponse + 55, // 133: saas.accounts.v1.ModuleCapabilitiesService.ReplayEvents:output_type -> saas.accounts.v1.ModuleReplayEventsResponse + 87, // 134: saas.accounts.v1.ModuleCapabilitiesService.ResolveWorkContextAuthority:output_type -> saas.accounts.v1.ModuleResolveWorkContextAuthorityResponse + 102, // [102:135] is the sub-list for method output_type + 69, // [69:102] is the sub-list for method input_type + 69, // [69:69] is the sub-list for extension type_name + 69, // [69:69] is the sub-list for extension extendee + 0, // [0:69] is the sub-list for field type_name } func init() { file_saas_accounts_v1_module_capabilities_proto_init() } @@ -5300,18 +6748,35 @@ func file_saas_accounts_v1_module_capabilities_proto_init() { if File_saas_accounts_v1_module_capabilities_proto != nil { return } + file_saas_accounts_v1_work_contexts_proto_init() file_saas_accounts_v1_module_registration_proto_init() file_saas_accounts_v1_module_capabilities_proto_msgTypes[34].OneofWrappers = []any{ (*FetchDatasourceFilesFrame_Header)(nil), (*FetchDatasourceFilesFrame_Data)(nil), } + file_saas_accounts_v1_module_capabilities_proto_msgTypes[75].OneofWrappers = []any{ + (*ModuleResolveWorkContextAuthorityRequest_Seal)(nil), + (*ModuleResolveWorkContextAuthorityRequest_PrincipalEpoch)(nil), + (*ModuleResolveWorkContextAuthorityRequest_ApprovedBuild)(nil), + (*ModuleResolveWorkContextAuthorityRequest_OperationBinding)(nil), + (*ModuleResolveWorkContextAuthorityRequest_AuthorizationRevision)(nil), + (*ModuleResolveWorkContextAuthorityRequest_ApprovalGrant)(nil), + } + file_saas_accounts_v1_module_capabilities_proto_msgTypes[76].OneofWrappers = []any{ + (*ModuleResolveWorkContextAuthorityResponse_Seal)(nil), + (*ModuleResolveWorkContextAuthorityResponse_PrincipalEpoch)(nil), + (*ModuleResolveWorkContextAuthorityResponse_ApprovedBuild)(nil), + (*ModuleResolveWorkContextAuthorityResponse_OperationBinding)(nil), + (*ModuleResolveWorkContextAuthorityResponse_AuthorizationRevision)(nil), + (*ModuleResolveWorkContextAuthorityResponse_ApprovalGrant)(nil), + } type x struct{} out := protoimpl.TypeBuilder{ File: protoimpl.DescBuilder{ GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_saas_accounts_v1_module_capabilities_proto_rawDesc), len(file_saas_accounts_v1_module_capabilities_proto_rawDesc)), - NumEnums: 6, - NumMessages: 63, + NumEnums: 11, + NumMessages: 77, NumExtensions: 0, NumServices: 1, }, diff --git a/libraries/source-read-sdk/go/gen/saas/accounts/v1/module_registration.pb.go b/libraries/source-read-sdk/go/gen/saas/accounts/v1/module_registration.pb.go index ec0b7eb47..ca9aa3363 100644 --- a/libraries/source-read-sdk/go/gen/saas/accounts/v1/module_registration.pb.go +++ b/libraries/source-read-sdk/go/gen/saas/accounts/v1/module_registration.pb.go @@ -7,13 +7,14 @@ package accountsv1 import ( + reflect "reflect" + sync "sync" + unsafe "unsafe" + _ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate" protoreflect "google.golang.org/protobuf/reflect/protoreflect" protoimpl "google.golang.org/protobuf/runtime/protoimpl" timestamppb "google.golang.org/protobuf/types/known/timestamppb" - reflect "reflect" - sync "sync" - unsafe "unsafe" ) const ( @@ -29,9 +30,9 @@ const ( // the workload that principal declares, running the build its authority // document approves. // -// The tenant the capability is bound to is not requested. It is the one declared -// for that principal by the deployment, so a module cannot name a tenant by -// asking, and the response reports which one was sealed. +// A tenant-pinned principal keeps its declared tenant. A shared principal must +// select an organization whose live installation consents to this principal; +// requesting an organization is not authority over it. type ModuleMintWorkContextRequest struct { state protoimpl.MessageState `protogen:"open.v1"` Prefix string `protobuf:"bytes,1,opt,name=prefix,proto3" json:"prefix,omitempty"` @@ -39,8 +40,12 @@ type ModuleMintWorkContextRequest struct { // for the `accounts` audience and read from its projection on every mint // (the kubelet rotates it under the running process). ServiceAccountToken string `protobuf:"bytes,3,opt,name=service_account_token,json=serviceAccountToken,proto3" json:"service_account_token,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + // Required for a shared principal with cross_tenant in its envelope. For a + // tenant-pinned principal, omit or match its tenant. Accounts validates the + // requested organization's live installation after authenticating execution. + OrganizationId string `protobuf:"bytes,4,opt,name=organization_id,json=organizationId,proto3" json:"organization_id,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *ModuleMintWorkContextRequest) Reset() { @@ -87,6 +92,13 @@ func (x *ModuleMintWorkContextRequest) GetServiceAccountToken() string { return "" } +func (x *ModuleMintWorkContextRequest) GetOrganizationId() string { + if x != nil { + return x.OrganizationId + } + return "" +} + // ModuleMintWorkContextResponse carries the signed capability plus the identity // it asserts, so a module can attribute its own work without parsing the token. type ModuleMintWorkContextResponse struct { @@ -174,8 +186,12 @@ type ModuleMintOperationContextRequest struct { // service_account_token is the pod's projected ServiceAccount token, as on // ModuleMintWorkContextRequest. ServiceAccountToken string `protobuf:"bytes,4,opt,name=service_account_token,json=serviceAccountToken,proto3" json:"service_account_token,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + // Required for a shared principal with cross_tenant in its envelope. For a + // tenant-pinned principal, omit or match its tenant. Accounts validates the + // requested organization's live installation after authenticating execution. + OrganizationId string `protobuf:"bytes,5,opt,name=organization_id,json=organizationId,proto3" json:"organization_id,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *ModuleMintOperationContextRequest) Reset() { @@ -229,6 +245,13 @@ func (x *ModuleMintOperationContextRequest) GetServiceAccountToken() string { return "" } +func (x *ModuleMintOperationContextRequest) GetOrganizationId() string { + if x != nil { + return x.OrganizationId + } + return "" +} + // ModuleMintOperationContextResponse carries the signed capability and what it // asserts, so a module can attribute and route its call without parsing it. type ModuleMintOperationContextResponse struct { @@ -552,21 +575,23 @@ var File_saas_accounts_v1_module_registration_proto protoreflect.FileDescriptor const file_saas_accounts_v1_module_registration_proto_rawDesc = "" + "\n" + - "*saas/accounts/v1/module_registration.proto\x12\x10saas.accounts.v1\x1a\x1bbuf/validate/validate.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\xb3\x01\n" + + "*saas/accounts/v1/module_registration.proto\x12\x10saas.accounts.v1\x1a\x1bbuf/validate/validate.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\x89\x02\n" + "\x1cModuleMintWorkContextRequest\x12D\n" + "\x06prefix\x18\x01 \x01(\tB,\xbaH)r'\x10\x01\x18?2!^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$R\x06prefix\x12?\n" + - "\x15service_account_token\x18\x03 \x01(\tB\v\xbaH\br\x06\x10\x01\x18\x80\x80\x04R\x13serviceAccountTokenJ\x04\b\x02\x10\x03R\x06secret\"\xab\x01\n" + + "\x15service_account_token\x18\x03 \x01(\tB\v\xbaH\br\x06\x10\x01\x18\x80\x80\x04R\x13serviceAccountToken\x124\n" + + "\x0forganization_id\x18\x04 \x01(\tB\v\xbaH\b\xd8\x01\x01r\x03\xb0\x01\x01R\x0eorganizationIdJ\x04\b\x02\x10\x03J\x04\b\x05\x10\x06J\x04\b\x06\x10\aR\x06secretR\bupstreamR\bmanifest\"\xab\x01\n" + "\x1dModuleMintWorkContextResponse\x12\x14\n" + "\x05token\x18\x01 \x01(\tR\x05token\x129\n" + "\n" + "expires_at\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\texpiresAt\x12!\n" + "\fprincipal_id\x18\x03 \x01(\tR\vprincipalId\x12\x16\n" + - "\x06tenant\x18\x04 \x01(\tR\x06tenant\"\xde\x01\n" + + "\x06tenant\x18\x04 \x01(\tR\x06tenant\"\x94\x02\n" + "!ModuleMintOperationContextRequest\x12D\n" + "\x06prefix\x18\x01 \x01(\tB,\xbaH)r'\x10\x01\x18?2!^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$R\x06prefix\x12$\n" + "\abinding\x18\x03 \x01(\tB\n" + "\xbaH\ar\x05\x10\x01\x18\x80\x01R\abinding\x12?\n" + - "\x15service_account_token\x18\x04 \x01(\tB\v\xbaH\br\x06\x10\x01\x18\x80\x80\x04R\x13serviceAccountTokenJ\x04\b\x02\x10\x03R\x06secret\"\xe6\x01\n" + + "\x15service_account_token\x18\x04 \x01(\tB\v\xbaH\br\x06\x10\x01\x18\x80\x80\x04R\x13serviceAccountToken\x124\n" + + "\x0forganization_id\x18\x05 \x01(\tB\v\xbaH\b\xd8\x01\x01r\x03\xb0\x01\x01R\x0eorganizationIdJ\x04\b\x02\x10\x03R\x06secret\"\xe6\x01\n" + "\"ModuleMintOperationContextResponse\x12\x14\n" + "\x05token\x18\x01 \x01(\tR\x05token\x129\n" + "\n" + @@ -592,7 +617,8 @@ const file_saas_accounts_v1_module_registration_proto_rawDesc = "" + "\abinding\x18\x06 \x01(\tR\abinding\x12#\n" + "\rdelegation_id\x18\a \x01(\tR\fdelegationId\x12\x1b\n" + "\tsource_id\x18\b \x01(\tR\bsourceId\x12,\n" + - "\x12owner_principal_id\x18\t \x01(\tR\x10ownerPrincipalIdb\x06proto3" + "\x12owner_principal_id\x18\t \x01(\tR\x10ownerPrincipalIdB\xe6\x01\n" + + "\x14com.saas.accounts.v1B\x17ModuleRegistrationProtoP\x01ZSgithub.com/codefly-dev/cli/pkg/builder/clients/accounts/saas/accounts/v1;accountsv1\xa2\x02\x03SAX\xaa\x02\x10Saas.Accounts.V1\xca\x02\x10Saas\\Accounts\\V1\xe2\x02\x1cSaas\\Accounts\\V1\\GPBMetadata\xea\x02\x12Saas::Accounts::V1b\x06proto3" var ( file_saas_accounts_v1_module_registration_proto_rawDescOnce sync.Once diff --git a/libraries/source-read-sdk/go/gen/saas/accounts/v1/shared.go b/libraries/source-read-sdk/go/gen/saas/accounts/v1/shared.go deleted file mode 100644 index 73a99b68f..000000000 --- a/libraries/source-read-sdk/go/gen/saas/accounts/v1/shared.go +++ /dev/null @@ -1,6 +0,0 @@ -package accountsv1 - -import shared "github.com/codefly-dev/saas-sdk-go/gen/saas/accounts/v1" - -// IssuedWorkContext is the canonical shared Host wire type. -type IssuedWorkContext = shared.IssuedWorkContext diff --git a/libraries/source-read-sdk/go/gen/saas/accounts/v1/work_contexts.pb.go b/libraries/source-read-sdk/go/gen/saas/accounts/v1/work_contexts.pb.go new file mode 100644 index 000000000..969efe782 --- /dev/null +++ b/libraries/source-read-sdk/go/gen/saas/accounts/v1/work_contexts.pb.go @@ -0,0 +1,228 @@ +// Code generated by protoc-gen-go. DO NOT EDIT. +// versions: +// protoc-gen-go v1.36.11 +// protoc (unknown) +// source: saas/accounts/v1/work_contexts.proto + +package accountsv1 + +import ( + reflect "reflect" + sync "sync" + unsafe "unsafe" + + protoreflect "google.golang.org/protobuf/reflect/protoreflect" + protoimpl "google.golang.org/protobuf/runtime/protoimpl" + timestamppb "google.golang.org/protobuf/types/known/timestamppb" +) + +const ( + // Verify that this generated code is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) + // Verify that runtime/protoimpl is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) +) + +// IssuedWorkContext is the opaque signed capability plus safe correlation +// fields useful to an SDK caller. Consumers must verify the token rather than +// trusting these duplicated display fields. +type IssuedWorkContext struct { + state protoimpl.MessageState `protogen:"open.v1"` + Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"` + OrgId string `protobuf:"bytes,2,opt,name=org_id,json=orgId,proto3" json:"org_id,omitempty"` + OwnerPrincipalId string `protobuf:"bytes,3,opt,name=owner_principal_id,json=ownerPrincipalId,proto3" json:"owner_principal_id,omitempty"` + TaskId string `protobuf:"bytes,4,opt,name=task_id,json=taskId,proto3" json:"task_id,omitempty"` + SessionId string `protobuf:"bytes,5,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"` + ParentSessionId *string `protobuf:"bytes,6,opt,name=parent_session_id,json=parentSessionId,proto3,oneof" json:"parent_session_id,omitempty"` + CurrentActorPrincipalId string `protobuf:"bytes,7,opt,name=current_actor_principal_id,json=currentActorPrincipalId,proto3" json:"current_actor_principal_id,omitempty"` + AuthorizationRevision uint64 `protobuf:"varint,8,opt,name=authorization_revision,json=authorizationRevision,proto3" json:"authorization_revision,omitempty"` + ExpiresAt *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"` + WorkspaceId *string `protobuf:"bytes,10,opt,name=workspace_id,json=workspaceId,proto3,oneof" json:"workspace_id,omitempty"` + ProjectId *string `protobuf:"bytes,11,opt,name=project_id,json=projectId,proto3,oneof" json:"project_id,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *IssuedWorkContext) Reset() { + *x = IssuedWorkContext{} + mi := &file_saas_accounts_v1_work_contexts_proto_msgTypes[0] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *IssuedWorkContext) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*IssuedWorkContext) ProtoMessage() {} + +func (x *IssuedWorkContext) ProtoReflect() protoreflect.Message { + mi := &file_saas_accounts_v1_work_contexts_proto_msgTypes[0] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use IssuedWorkContext.ProtoReflect.Descriptor instead. +func (*IssuedWorkContext) Descriptor() ([]byte, []int) { + return file_saas_accounts_v1_work_contexts_proto_rawDescGZIP(), []int{0} +} + +func (x *IssuedWorkContext) GetToken() string { + if x != nil { + return x.Token + } + return "" +} + +func (x *IssuedWorkContext) GetOrgId() string { + if x != nil { + return x.OrgId + } + return "" +} + +func (x *IssuedWorkContext) GetOwnerPrincipalId() string { + if x != nil { + return x.OwnerPrincipalId + } + return "" +} + +func (x *IssuedWorkContext) GetTaskId() string { + if x != nil { + return x.TaskId + } + return "" +} + +func (x *IssuedWorkContext) GetSessionId() string { + if x != nil { + return x.SessionId + } + return "" +} + +func (x *IssuedWorkContext) GetParentSessionId() string { + if x != nil && x.ParentSessionId != nil { + return *x.ParentSessionId + } + return "" +} + +func (x *IssuedWorkContext) GetCurrentActorPrincipalId() string { + if x != nil { + return x.CurrentActorPrincipalId + } + return "" +} + +func (x *IssuedWorkContext) GetAuthorizationRevision() uint64 { + if x != nil { + return x.AuthorizationRevision + } + return 0 +} + +func (x *IssuedWorkContext) GetExpiresAt() *timestamppb.Timestamp { + if x != nil { + return x.ExpiresAt + } + return nil +} + +func (x *IssuedWorkContext) GetWorkspaceId() string { + if x != nil && x.WorkspaceId != nil { + return *x.WorkspaceId + } + return "" +} + +func (x *IssuedWorkContext) GetProjectId() string { + if x != nil && x.ProjectId != nil { + return *x.ProjectId + } + return "" +} + +var File_saas_accounts_v1_work_contexts_proto protoreflect.FileDescriptor + +const file_saas_accounts_v1_work_contexts_proto_rawDesc = "" + + "\n" + + "$saas/accounts/v1/work_contexts.proto\x12\x10saas.accounts.v1\x1a\x1fgoogle/protobuf/timestamp.proto\"\x88\x04\n" + + "\x11IssuedWorkContext\x12\x14\n" + + "\x05token\x18\x01 \x01(\tR\x05token\x12\x15\n" + + "\x06org_id\x18\x02 \x01(\tR\x05orgId\x12,\n" + + "\x12owner_principal_id\x18\x03 \x01(\tR\x10ownerPrincipalId\x12\x17\n" + + "\atask_id\x18\x04 \x01(\tR\x06taskId\x12\x1d\n" + + "\n" + + "session_id\x18\x05 \x01(\tR\tsessionId\x12/\n" + + "\x11parent_session_id\x18\x06 \x01(\tH\x00R\x0fparentSessionId\x88\x01\x01\x12;\n" + + "\x1acurrent_actor_principal_id\x18\a \x01(\tR\x17currentActorPrincipalId\x125\n" + + "\x16authorization_revision\x18\b \x01(\x04R\x15authorizationRevision\x129\n" + + "\n" + + "expires_at\x18\t \x01(\v2\x1a.google.protobuf.TimestampR\texpiresAt\x12&\n" + + "\fworkspace_id\x18\n" + + " \x01(\tH\x01R\vworkspaceId\x88\x01\x01\x12\"\n" + + "\n" + + "project_id\x18\v \x01(\tH\x02R\tprojectId\x88\x01\x01B\x14\n" + + "\x12_parent_session_idB\x0f\n" + + "\r_workspace_idB\r\n" + + "\v_project_idB\xe0\x01\n" + + "\x14com.saas.accounts.v1B\x11WorkContextsProtoP\x01ZSgithub.com/codefly-dev/cli/pkg/builder/clients/accounts/saas/accounts/v1;accountsv1\xa2\x02\x03SAX\xaa\x02\x10Saas.Accounts.V1\xca\x02\x10Saas\\Accounts\\V1\xe2\x02\x1cSaas\\Accounts\\V1\\GPBMetadata\xea\x02\x12Saas::Accounts::V1b\x06proto3" + +var ( + file_saas_accounts_v1_work_contexts_proto_rawDescOnce sync.Once + file_saas_accounts_v1_work_contexts_proto_rawDescData []byte +) + +func file_saas_accounts_v1_work_contexts_proto_rawDescGZIP() []byte { + file_saas_accounts_v1_work_contexts_proto_rawDescOnce.Do(func() { + file_saas_accounts_v1_work_contexts_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_saas_accounts_v1_work_contexts_proto_rawDesc), len(file_saas_accounts_v1_work_contexts_proto_rawDesc))) + }) + return file_saas_accounts_v1_work_contexts_proto_rawDescData +} + +var file_saas_accounts_v1_work_contexts_proto_msgTypes = make([]protoimpl.MessageInfo, 1) +var file_saas_accounts_v1_work_contexts_proto_goTypes = []any{ + (*IssuedWorkContext)(nil), // 0: saas.accounts.v1.IssuedWorkContext + (*timestamppb.Timestamp)(nil), // 1: google.protobuf.Timestamp +} +var file_saas_accounts_v1_work_contexts_proto_depIdxs = []int32{ + 1, // 0: saas.accounts.v1.IssuedWorkContext.expires_at:type_name -> google.protobuf.Timestamp + 1, // [1:1] is the sub-list for method output_type + 1, // [1:1] is the sub-list for method input_type + 1, // [1:1] is the sub-list for extension type_name + 1, // [1:1] is the sub-list for extension extendee + 0, // [0:1] is the sub-list for field type_name +} + +func init() { file_saas_accounts_v1_work_contexts_proto_init() } +func file_saas_accounts_v1_work_contexts_proto_init() { + if File_saas_accounts_v1_work_contexts_proto != nil { + return + } + file_saas_accounts_v1_work_contexts_proto_msgTypes[0].OneofWrappers = []any{} + type x struct{} + out := protoimpl.TypeBuilder{ + File: protoimpl.DescBuilder{ + GoPackagePath: reflect.TypeOf(x{}).PkgPath(), + RawDescriptor: unsafe.Slice(unsafe.StringData(file_saas_accounts_v1_work_contexts_proto_rawDesc), len(file_saas_accounts_v1_work_contexts_proto_rawDesc)), + NumEnums: 0, + NumMessages: 1, + NumExtensions: 0, + NumServices: 0, + }, + GoTypes: file_saas_accounts_v1_work_contexts_proto_goTypes, + DependencyIndexes: file_saas_accounts_v1_work_contexts_proto_depIdxs, + MessageInfos: file_saas_accounts_v1_work_contexts_proto_msgTypes, + }.Build() + File_saas_accounts_v1_work_contexts_proto = out.File + file_saas_accounts_v1_work_contexts_proto_goTypes = nil + file_saas_accounts_v1_work_contexts_proto_depIdxs = nil +} diff --git a/libraries/source-read-sdk/go/gen/saas/events/v1/events.pb.go b/libraries/source-read-sdk/go/gen/saas/events/v1/events.pb.go index cceb4ca44..605d55171 100644 --- a/libraries/source-read-sdk/go/gen/saas/events/v1/events.pb.go +++ b/libraries/source-read-sdk/go/gen/saas/events/v1/events.pb.go @@ -7,12 +7,13 @@ package eventsv1 import ( - protoreflect "google.golang.org/protobuf/reflect/protoreflect" - protoimpl "google.golang.org/protobuf/runtime/protoimpl" - timestamppb "google.golang.org/protobuf/types/known/timestamppb" reflect "reflect" sync "sync" unsafe "unsafe" + + protoreflect "google.golang.org/protobuf/reflect/protoreflect" + protoimpl "google.golang.org/protobuf/runtime/protoimpl" + timestamppb "google.golang.org/protobuf/types/known/timestamppb" ) const ( @@ -252,7 +253,8 @@ const file_saas_events_v1_events_proto_rawDesc = "" + "\x12actor_principal_id\x18\x19 \x01(\tR\x10actorPrincipalId\x12,\n" + "\x12owner_principal_id\x18\x1a \x01(\tR\x10ownerPrincipalId\x12 \n" + "\vtraceparent\x18\x1b \x01(\tR\vtraceparent\x12%\n" + - "\x0eschema_version\x18\x1c \x01(\rR\rschemaVersionb\x06proto3" + "\x0eschema_version\x18\x1c \x01(\rR\rschemaVersionB\xcc\x01\n" + + "\x12com.saas.events.v1B\vEventsProtoP\x01ZOgithub.com/codefly-dev/cli/pkg/builder/clients/accounts/saas/events/v1;eventsv1\xa2\x02\x03SEX\xaa\x02\x0eSaas.Events.V1\xca\x02\x0eSaas\\Events\\V1\xe2\x02\x1aSaas\\Events\\V1\\GPBMetadata\xea\x02\x10Saas::Events::V1b\x06proto3" var ( file_saas_events_v1_events_proto_rawDescOnce sync.Once diff --git a/libraries/source-read-sdk/go/gen/saas/jobs/v1/jobs.pb.go b/libraries/source-read-sdk/go/gen/saas/jobs/v1/jobs.pb.go new file mode 100644 index 000000000..bbf941a93 --- /dev/null +++ b/libraries/source-read-sdk/go/gen/saas/jobs/v1/jobs.pb.go @@ -0,0 +1,1129 @@ +// Code generated by protoc-gen-go. DO NOT EDIT. +// versions: +// protoc-gen-go v1.36.11 +// protoc (unknown) +// source: saas/jobs/v1/jobs.proto + +package jobsv1 + +import ( + reflect "reflect" + sync "sync" + unsafe "unsafe" + + _ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate" + protoreflect "google.golang.org/protobuf/reflect/protoreflect" + protoimpl "google.golang.org/protobuf/runtime/protoimpl" + timestamppb "google.golang.org/protobuf/types/known/timestamppb" +) + +const ( + // Verify that this generated code is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) + // Verify that runtime/protoimpl is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) +) + +// JobDirection distinguishes work accepted from an external producer from work +// emitted transactionally for an external consumer. +type JobDirection int32 + +const ( + JobDirection_JOB_DIRECTION_UNSPECIFIED JobDirection = 0 + JobDirection_JOB_DIRECTION_INBOX JobDirection = 1 + JobDirection_JOB_DIRECTION_OUTBOX JobDirection = 2 +) + +// Enum value maps for JobDirection. +var ( + JobDirection_name = map[int32]string{ + 0: "JOB_DIRECTION_UNSPECIFIED", + 1: "JOB_DIRECTION_INBOX", + 2: "JOB_DIRECTION_OUTBOX", + } + JobDirection_value = map[string]int32{ + "JOB_DIRECTION_UNSPECIFIED": 0, + "JOB_DIRECTION_INBOX": 1, + "JOB_DIRECTION_OUTBOX": 2, + } +) + +func (x JobDirection) Enum() *JobDirection { + p := new(JobDirection) + *p = x + return p +} + +func (x JobDirection) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (JobDirection) Descriptor() protoreflect.EnumDescriptor { + return file_saas_jobs_v1_jobs_proto_enumTypes[0].Descriptor() +} + +func (JobDirection) Type() protoreflect.EnumType { + return &file_saas_jobs_v1_jobs_proto_enumTypes[0] +} + +func (x JobDirection) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use JobDirection.Descriptor instead. +func (JobDirection) EnumDescriptor() ([]byte, []int) { + return file_saas_jobs_v1_jobs_proto_rawDescGZIP(), []int{0} +} + +// JobState is the durable message lifecycle. New jobs start pending. Processing +// owns a lease. Retrying becomes claimable at available_at. The remaining +// states are terminal; replay creates a new job linked to the original rather +// than rewriting terminal history. +type JobState int32 + +const ( + JobState_JOB_STATE_UNSPECIFIED JobState = 0 + JobState_JOB_STATE_PENDING JobState = 1 + JobState_JOB_STATE_PROCESSING JobState = 2 + JobState_JOB_STATE_RETRYING JobState = 3 + JobState_JOB_STATE_SUCCEEDED JobState = 4 + JobState_JOB_STATE_DEAD_LETTER JobState = 5 + JobState_JOB_STATE_CANCELED JobState = 6 +) + +// Enum value maps for JobState. +var ( + JobState_name = map[int32]string{ + 0: "JOB_STATE_UNSPECIFIED", + 1: "JOB_STATE_PENDING", + 2: "JOB_STATE_PROCESSING", + 3: "JOB_STATE_RETRYING", + 4: "JOB_STATE_SUCCEEDED", + 5: "JOB_STATE_DEAD_LETTER", + 6: "JOB_STATE_CANCELED", + } + JobState_value = map[string]int32{ + "JOB_STATE_UNSPECIFIED": 0, + "JOB_STATE_PENDING": 1, + "JOB_STATE_PROCESSING": 2, + "JOB_STATE_RETRYING": 3, + "JOB_STATE_SUCCEEDED": 4, + "JOB_STATE_DEAD_LETTER": 5, + "JOB_STATE_CANCELED": 6, + } +) + +func (x JobState) Enum() *JobState { + p := new(JobState) + *p = x + return p +} + +func (x JobState) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (JobState) Descriptor() protoreflect.EnumDescriptor { + return file_saas_jobs_v1_jobs_proto_enumTypes[1].Descriptor() +} + +func (JobState) Type() protoreflect.EnumType { + return &file_saas_jobs_v1_jobs_proto_enumTypes[1] +} + +func (x JobState) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use JobState.Descriptor instead. +func (JobState) EnumDescriptor() ([]byte, []int) { + return file_saas_jobs_v1_jobs_proto_rawDescGZIP(), []int{1} +} + +// JobEnqueueDisposition distinguishes a newly committed message from an exact +// idempotent replay that resolved to the message already stored. +type JobEnqueueDisposition int32 + +const ( + JobEnqueueDisposition_JOB_ENQUEUE_DISPOSITION_UNSPECIFIED JobEnqueueDisposition = 0 + JobEnqueueDisposition_JOB_ENQUEUE_DISPOSITION_INSERTED JobEnqueueDisposition = 1 + JobEnqueueDisposition_JOB_ENQUEUE_DISPOSITION_DUPLICATE JobEnqueueDisposition = 2 +) + +// Enum value maps for JobEnqueueDisposition. +var ( + JobEnqueueDisposition_name = map[int32]string{ + 0: "JOB_ENQUEUE_DISPOSITION_UNSPECIFIED", + 1: "JOB_ENQUEUE_DISPOSITION_INSERTED", + 2: "JOB_ENQUEUE_DISPOSITION_DUPLICATE", + } + JobEnqueueDisposition_value = map[string]int32{ + "JOB_ENQUEUE_DISPOSITION_UNSPECIFIED": 0, + "JOB_ENQUEUE_DISPOSITION_INSERTED": 1, + "JOB_ENQUEUE_DISPOSITION_DUPLICATE": 2, + } +) + +func (x JobEnqueueDisposition) Enum() *JobEnqueueDisposition { + p := new(JobEnqueueDisposition) + *p = x + return p +} + +func (x JobEnqueueDisposition) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (JobEnqueueDisposition) Descriptor() protoreflect.EnumDescriptor { + return file_saas_jobs_v1_jobs_proto_enumTypes[2].Descriptor() +} + +func (JobEnqueueDisposition) Type() protoreflect.EnumType { + return &file_saas_jobs_v1_jobs_proto_enumTypes[2] +} + +func (x JobEnqueueDisposition) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use JobEnqueueDisposition.Descriptor instead. +func (JobEnqueueDisposition) EnumDescriptor() ([]byte, []int) { + return file_saas_jobs_v1_jobs_proto_rawDescGZIP(), []int{2} +} + +// JobScope carries the tenant or subject binding enforced when request traffic +// appends a job. Global scope is reserved for the privileged worker boundary. +type JobScope struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Types that are valid to be assigned to Value: + // + // *JobScope_OrganizationId + // *JobScope_SubjectId + // *JobScope_Global + Value isJobScope_Value `protobuf_oneof:"value"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *JobScope) Reset() { + *x = JobScope{} + mi := &file_saas_jobs_v1_jobs_proto_msgTypes[0] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *JobScope) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*JobScope) ProtoMessage() {} + +func (x *JobScope) ProtoReflect() protoreflect.Message { + mi := &file_saas_jobs_v1_jobs_proto_msgTypes[0] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use JobScope.ProtoReflect.Descriptor instead. +func (*JobScope) Descriptor() ([]byte, []int) { + return file_saas_jobs_v1_jobs_proto_rawDescGZIP(), []int{0} +} + +func (x *JobScope) GetValue() isJobScope_Value { + if x != nil { + return x.Value + } + return nil +} + +func (x *JobScope) GetOrganizationId() string { + if x != nil { + if x, ok := x.Value.(*JobScope_OrganizationId); ok { + return x.OrganizationId + } + } + return "" +} + +func (x *JobScope) GetSubjectId() string { + if x != nil { + if x, ok := x.Value.(*JobScope_SubjectId); ok { + return x.SubjectId + } + } + return "" +} + +func (x *JobScope) GetGlobal() bool { + if x != nil { + if x, ok := x.Value.(*JobScope_Global); ok { + return x.Global + } + } + return false +} + +type isJobScope_Value interface { + isJobScope_Value() +} + +type JobScope_OrganizationId struct { + OrganizationId string `protobuf:"bytes,1,opt,name=organization_id,json=organizationId,proto3,oneof"` +} + +type JobScope_SubjectId struct { + SubjectId string `protobuf:"bytes,2,opt,name=subject_id,json=subjectId,proto3,oneof"` +} + +type JobScope_Global struct { + Global bool `protobuf:"varint,3,opt,name=global,proto3,oneof"` +} + +func (*JobScope_OrganizationId) isJobScope_Value() {} + +func (*JobScope_SubjectId) isJobScope_Value() {} + +func (*JobScope_Global) isJobScope_Value() {} + +// JobLease is present only while a job is processing. token is an unguessable +// fencing value: finalization must match both owner and token. +type JobLease struct { + state protoimpl.MessageState `protogen:"open.v1"` + Owner string `protobuf:"bytes,1,opt,name=owner,proto3" json:"owner,omitempty"` + Token string `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"` + ExpiresAt *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expires_at,json=expiresAt,proto3" json:"expires_at,omitempty"` + HeartbeatAt *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=heartbeat_at,json=heartbeatAt,proto3" json:"heartbeat_at,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *JobLease) Reset() { + *x = JobLease{} + mi := &file_saas_jobs_v1_jobs_proto_msgTypes[1] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *JobLease) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*JobLease) ProtoMessage() {} + +func (x *JobLease) ProtoReflect() protoreflect.Message { + mi := &file_saas_jobs_v1_jobs_proto_msgTypes[1] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use JobLease.ProtoReflect.Descriptor instead. +func (*JobLease) Descriptor() ([]byte, []int) { + return file_saas_jobs_v1_jobs_proto_rawDescGZIP(), []int{1} +} + +func (x *JobLease) GetOwner() string { + if x != nil { + return x.Owner + } + return "" +} + +func (x *JobLease) GetToken() string { + if x != nil { + return x.Token + } + return "" +} + +func (x *JobLease) GetExpiresAt() *timestamppb.Timestamp { + if x != nil { + return x.ExpiresAt + } + return nil +} + +func (x *JobLease) GetHeartbeatAt() *timestamppb.Timestamp { + if x != nil { + return x.HeartbeatAt + } + return nil +} + +// JobFailure contains bounded operator-safe diagnostics. It must never contain +// credentials or the original payload. +type JobFailure struct { + state protoimpl.MessageState `protogen:"open.v1"` + Code string `protobuf:"bytes,1,opt,name=code,proto3" json:"code,omitempty"` + Message string `protobuf:"bytes,2,opt,name=message,proto3" json:"message,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *JobFailure) Reset() { + *x = JobFailure{} + mi := &file_saas_jobs_v1_jobs_proto_msgTypes[2] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *JobFailure) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*JobFailure) ProtoMessage() {} + +func (x *JobFailure) ProtoReflect() protoreflect.Message { + mi := &file_saas_jobs_v1_jobs_proto_msgTypes[2] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use JobFailure.ProtoReflect.Descriptor instead. +func (*JobFailure) Descriptor() ([]byte, []int) { + return file_saas_jobs_v1_jobs_proto_rawDescGZIP(), []int{2} +} + +func (x *JobFailure) GetCode() string { + if x != nil { + return x.Code + } + return "" +} + +func (x *JobFailure) GetMessage() string { + if x != nil { + return x.Message + } + return "" +} + +// JobEnvelope is the product-neutral durable inbox/outbox record. payload is +// retained as exact bytes; large artifacts belong in object storage and are +// referenced from the payload. Identity, routing, scope, and payload fields are +// immutable after insertion. +type JobEnvelope struct { + state protoimpl.MessageState `protogen:"open.v1"` + Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` + Direction JobDirection `protobuf:"varint,2,opt,name=direction,proto3,enum=saas.jobs.v1.JobDirection" json:"direction,omitempty"` + Scope *JobScope `protobuf:"bytes,3,opt,name=scope,proto3" json:"scope,omitempty"` + Queue string `protobuf:"bytes,4,opt,name=queue,proto3" json:"queue,omitempty"` + Topic string `protobuf:"bytes,5,opt,name=topic,proto3" json:"topic,omitempty"` + Source string `protobuf:"bytes,6,opt,name=source,proto3" json:"source,omitempty"` + IdempotencyKey string `protobuf:"bytes,7,opt,name=idempotency_key,json=idempotencyKey,proto3" json:"idempotency_key,omitempty"` + OrderingKey string `protobuf:"bytes,8,opt,name=ordering_key,json=orderingKey,proto3" json:"ordering_key,omitempty"` + SchemaVersion uint32 `protobuf:"varint,9,opt,name=schema_version,json=schemaVersion,proto3" json:"schema_version,omitempty"` + Payload []byte `protobuf:"bytes,10,opt,name=payload,proto3" json:"payload,omitempty"` + ContentType string `protobuf:"bytes,11,opt,name=content_type,json=contentType,proto3" json:"content_type,omitempty"` + Attributes map[string]string `protobuf:"bytes,12,rep,name=attributes,proto3" json:"attributes,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` + State JobState `protobuf:"varint,13,opt,name=state,proto3,enum=saas.jobs.v1.JobState" json:"state,omitempty"` + Priority int32 `protobuf:"varint,14,opt,name=priority,proto3" json:"priority,omitempty"` + AttemptCount uint32 `protobuf:"varint,15,opt,name=attempt_count,json=attemptCount,proto3" json:"attempt_count,omitempty"` + MaxAttempts uint32 `protobuf:"varint,16,opt,name=max_attempts,json=maxAttempts,proto3" json:"max_attempts,omitempty"` + Lease *JobLease `protobuf:"bytes,17,opt,name=lease,proto3" json:"lease,omitempty"` + LastFailure *JobFailure `protobuf:"bytes,18,opt,name=last_failure,json=lastFailure,proto3" json:"last_failure,omitempty"` + AvailableAt *timestamppb.Timestamp `protobuf:"bytes,19,opt,name=available_at,json=availableAt,proto3" json:"available_at,omitempty"` + LastAttemptAt *timestamppb.Timestamp `protobuf:"bytes,20,opt,name=last_attempt_at,json=lastAttemptAt,proto3" json:"last_attempt_at,omitempty"` + CompletedAt *timestamppb.Timestamp `protobuf:"bytes,21,opt,name=completed_at,json=completedAt,proto3" json:"completed_at,omitempty"` + DeadLetteredAt *timestamppb.Timestamp `protobuf:"bytes,22,opt,name=dead_lettered_at,json=deadLetteredAt,proto3" json:"dead_lettered_at,omitempty"` + CreatedAt *timestamppb.Timestamp `protobuf:"bytes,23,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"` + UpdatedAt *timestamppb.Timestamp `protobuf:"bytes,24,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"` + StateVersion uint64 `protobuf:"varint,25,opt,name=state_version,json=stateVersion,proto3" json:"state_version,omitempty"` + ReplayOf string `protobuf:"bytes,26,opt,name=replay_of,json=replayOf,proto3" json:"replay_of,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *JobEnvelope) Reset() { + *x = JobEnvelope{} + mi := &file_saas_jobs_v1_jobs_proto_msgTypes[3] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *JobEnvelope) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*JobEnvelope) ProtoMessage() {} + +func (x *JobEnvelope) ProtoReflect() protoreflect.Message { + mi := &file_saas_jobs_v1_jobs_proto_msgTypes[3] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use JobEnvelope.ProtoReflect.Descriptor instead. +func (*JobEnvelope) Descriptor() ([]byte, []int) { + return file_saas_jobs_v1_jobs_proto_rawDescGZIP(), []int{3} +} + +func (x *JobEnvelope) GetId() string { + if x != nil { + return x.Id + } + return "" +} + +func (x *JobEnvelope) GetDirection() JobDirection { + if x != nil { + return x.Direction + } + return JobDirection_JOB_DIRECTION_UNSPECIFIED +} + +func (x *JobEnvelope) GetScope() *JobScope { + if x != nil { + return x.Scope + } + return nil +} + +func (x *JobEnvelope) GetQueue() string { + if x != nil { + return x.Queue + } + return "" +} + +func (x *JobEnvelope) GetTopic() string { + if x != nil { + return x.Topic + } + return "" +} + +func (x *JobEnvelope) GetSource() string { + if x != nil { + return x.Source + } + return "" +} + +func (x *JobEnvelope) GetIdempotencyKey() string { + if x != nil { + return x.IdempotencyKey + } + return "" +} + +func (x *JobEnvelope) GetOrderingKey() string { + if x != nil { + return x.OrderingKey + } + return "" +} + +func (x *JobEnvelope) GetSchemaVersion() uint32 { + if x != nil { + return x.SchemaVersion + } + return 0 +} + +func (x *JobEnvelope) GetPayload() []byte { + if x != nil { + return x.Payload + } + return nil +} + +func (x *JobEnvelope) GetContentType() string { + if x != nil { + return x.ContentType + } + return "" +} + +func (x *JobEnvelope) GetAttributes() map[string]string { + if x != nil { + return x.Attributes + } + return nil +} + +func (x *JobEnvelope) GetState() JobState { + if x != nil { + return x.State + } + return JobState_JOB_STATE_UNSPECIFIED +} + +func (x *JobEnvelope) GetPriority() int32 { + if x != nil { + return x.Priority + } + return 0 +} + +func (x *JobEnvelope) GetAttemptCount() uint32 { + if x != nil { + return x.AttemptCount + } + return 0 +} + +func (x *JobEnvelope) GetMaxAttempts() uint32 { + if x != nil { + return x.MaxAttempts + } + return 0 +} + +func (x *JobEnvelope) GetLease() *JobLease { + if x != nil { + return x.Lease + } + return nil +} + +func (x *JobEnvelope) GetLastFailure() *JobFailure { + if x != nil { + return x.LastFailure + } + return nil +} + +func (x *JobEnvelope) GetAvailableAt() *timestamppb.Timestamp { + if x != nil { + return x.AvailableAt + } + return nil +} + +func (x *JobEnvelope) GetLastAttemptAt() *timestamppb.Timestamp { + if x != nil { + return x.LastAttemptAt + } + return nil +} + +func (x *JobEnvelope) GetCompletedAt() *timestamppb.Timestamp { + if x != nil { + return x.CompletedAt + } + return nil +} + +func (x *JobEnvelope) GetDeadLetteredAt() *timestamppb.Timestamp { + if x != nil { + return x.DeadLetteredAt + } + return nil +} + +func (x *JobEnvelope) GetCreatedAt() *timestamppb.Timestamp { + if x != nil { + return x.CreatedAt + } + return nil +} + +func (x *JobEnvelope) GetUpdatedAt() *timestamppb.Timestamp { + if x != nil { + return x.UpdatedAt + } + return nil +} + +func (x *JobEnvelope) GetStateVersion() uint64 { + if x != nil { + return x.StateVersion + } + return 0 +} + +func (x *JobEnvelope) GetReplayOf() string { + if x != nil { + return x.ReplayOf + } + return "" +} + +// JobOrderingKey is the portable source for one strict FIFO key. The runtime +// encodes each opaque component independently, so component boundaries cannot +// collide even when identifiers contain punctuation or Unicode. +type JobOrderingKey struct { + state protoimpl.MessageState `protogen:"open.v1"` + Namespace string `protobuf:"bytes,1,opt,name=namespace,proto3" json:"namespace,omitempty"` + Components []string `protobuf:"bytes,2,rep,name=components,proto3" json:"components,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *JobOrderingKey) Reset() { + *x = JobOrderingKey{} + mi := &file_saas_jobs_v1_jobs_proto_msgTypes[4] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *JobOrderingKey) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*JobOrderingKey) ProtoMessage() {} + +func (x *JobOrderingKey) ProtoReflect() protoreflect.Message { + mi := &file_saas_jobs_v1_jobs_proto_msgTypes[4] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use JobOrderingKey.ProtoReflect.Descriptor instead. +func (*JobOrderingKey) Descriptor() ([]byte, []int) { + return file_saas_jobs_v1_jobs_proto_rawDescGZIP(), []int{4} +} + +func (x *JobOrderingKey) GetNamespace() string { + if x != nil { + return x.Namespace + } + return "" +} + +func (x *JobOrderingKey) GetComponents() []string { + if x != nil { + return x.Components + } + return nil +} + +// NewJob contains only producer-owned immutable fields. Database-owned ids, +// lifecycle state, attempts, leases, and audit timestamps cannot be supplied by +// a producer. +type NewJob struct { + state protoimpl.MessageState `protogen:"open.v1"` + Direction JobDirection `protobuf:"varint,1,opt,name=direction,proto3,enum=saas.jobs.v1.JobDirection" json:"direction,omitempty"` + Scope *JobScope `protobuf:"bytes,2,opt,name=scope,proto3" json:"scope,omitempty"` + Queue string `protobuf:"bytes,3,opt,name=queue,proto3" json:"queue,omitempty"` + Topic string `protobuf:"bytes,4,opt,name=topic,proto3" json:"topic,omitempty"` + Source string `protobuf:"bytes,5,opt,name=source,proto3" json:"source,omitempty"` + IdempotencyKey string `protobuf:"bytes,6,opt,name=idempotency_key,json=idempotencyKey,proto3" json:"idempotency_key,omitempty"` + Ordering *JobOrderingKey `protobuf:"bytes,7,opt,name=ordering,proto3" json:"ordering,omitempty"` + SchemaVersion uint32 `protobuf:"varint,8,opt,name=schema_version,json=schemaVersion,proto3" json:"schema_version,omitempty"` + Payload []byte `protobuf:"bytes,9,opt,name=payload,proto3" json:"payload,omitempty"` + ContentType string `protobuf:"bytes,10,opt,name=content_type,json=contentType,proto3" json:"content_type,omitempty"` + Attributes map[string]string `protobuf:"bytes,11,rep,name=attributes,proto3" json:"attributes,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` + Priority int32 `protobuf:"varint,12,opt,name=priority,proto3" json:"priority,omitempty"` + MaxAttempts uint32 `protobuf:"varint,13,opt,name=max_attempts,json=maxAttempts,proto3" json:"max_attempts,omitempty"` + AvailableAt *timestamppb.Timestamp `protobuf:"bytes,14,opt,name=available_at,json=availableAt,proto3" json:"available_at,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *NewJob) Reset() { + *x = NewJob{} + mi := &file_saas_jobs_v1_jobs_proto_msgTypes[5] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *NewJob) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*NewJob) ProtoMessage() {} + +func (x *NewJob) ProtoReflect() protoreflect.Message { + mi := &file_saas_jobs_v1_jobs_proto_msgTypes[5] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use NewJob.ProtoReflect.Descriptor instead. +func (*NewJob) Descriptor() ([]byte, []int) { + return file_saas_jobs_v1_jobs_proto_rawDescGZIP(), []int{5} +} + +func (x *NewJob) GetDirection() JobDirection { + if x != nil { + return x.Direction + } + return JobDirection_JOB_DIRECTION_UNSPECIFIED +} + +func (x *NewJob) GetScope() *JobScope { + if x != nil { + return x.Scope + } + return nil +} + +func (x *NewJob) GetQueue() string { + if x != nil { + return x.Queue + } + return "" +} + +func (x *NewJob) GetTopic() string { + if x != nil { + return x.Topic + } + return "" +} + +func (x *NewJob) GetSource() string { + if x != nil { + return x.Source + } + return "" +} + +func (x *NewJob) GetIdempotencyKey() string { + if x != nil { + return x.IdempotencyKey + } + return "" +} + +func (x *NewJob) GetOrdering() *JobOrderingKey { + if x != nil { + return x.Ordering + } + return nil +} + +func (x *NewJob) GetSchemaVersion() uint32 { + if x != nil { + return x.SchemaVersion + } + return 0 +} + +func (x *NewJob) GetPayload() []byte { + if x != nil { + return x.Payload + } + return nil +} + +func (x *NewJob) GetContentType() string { + if x != nil { + return x.ContentType + } + return "" +} + +func (x *NewJob) GetAttributes() map[string]string { + if x != nil { + return x.Attributes + } + return nil +} + +func (x *NewJob) GetPriority() int32 { + if x != nil { + return x.Priority + } + return 0 +} + +func (x *NewJob) GetMaxAttempts() uint32 { + if x != nil { + return x.MaxAttempts + } + return 0 +} + +func (x *NewJob) GetAvailableAt() *timestamppb.Timestamp { + if x != nil { + return x.AvailableAt + } + return nil +} + +// JobLeaseReference fences every heartbeat and finalization by the job, worker, +// and unguessable token issued by the most recent claim. +type JobLeaseReference struct { + state protoimpl.MessageState `protogen:"open.v1"` + JobId string `protobuf:"bytes,1,opt,name=job_id,json=jobId,proto3" json:"job_id,omitempty"` + WorkerId string `protobuf:"bytes,2,opt,name=worker_id,json=workerId,proto3" json:"worker_id,omitempty"` + LeaseToken string `protobuf:"bytes,3,opt,name=lease_token,json=leaseToken,proto3" json:"lease_token,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *JobLeaseReference) Reset() { + *x = JobLeaseReference{} + mi := &file_saas_jobs_v1_jobs_proto_msgTypes[6] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *JobLeaseReference) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*JobLeaseReference) ProtoMessage() {} + +func (x *JobLeaseReference) ProtoReflect() protoreflect.Message { + mi := &file_saas_jobs_v1_jobs_proto_msgTypes[6] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use JobLeaseReference.ProtoReflect.Descriptor instead. +func (*JobLeaseReference) Descriptor() ([]byte, []int) { + return file_saas_jobs_v1_jobs_proto_rawDescGZIP(), []int{6} +} + +func (x *JobLeaseReference) GetJobId() string { + if x != nil { + return x.JobId + } + return "" +} + +func (x *JobLeaseReference) GetWorkerId() string { + if x != nil { + return x.WorkerId + } + return "" +} + +func (x *JobLeaseReference) GetLeaseToken() string { + if x != nil { + return x.LeaseToken + } + return "" +} + +var File_saas_jobs_v1_jobs_proto protoreflect.FileDescriptor + +const file_saas_jobs_v1_jobs_proto_rawDesc = "" + + "\n" + + "\x17saas/jobs/v1/jobs.proto\x12\fsaas.jobs.v1\x1a\x1bbuf/validate/validate.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\x9d\x01\n" + + "\bJobScope\x123\n" + + "\x0forganization_id\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01H\x00R\x0eorganizationId\x12)\n" + + "\n" + + "subject_id\x18\x02 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01H\x00R\tsubjectId\x12!\n" + + "\x06global\x18\x03 \x01(\bB\a\xbaH\x04j\x02\b\x01H\x00R\x06globalB\x0e\n" + + "\x05value\x12\x05\xbaH\x02\b\x01\"\xc6\x01\n" + + "\bJobLease\x12 \n" + + "\x05owner\x18\x01 \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\xff\x01R\x05owner\x12\x1e\n" + + "\x05token\x18\x02 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x05token\x129\n" + + "\n" + + "expires_at\x18\x03 \x01(\v2\x1a.google.protobuf.TimestampR\texpiresAt\x12=\n" + + "\fheartbeat_at\x18\x04 \x01(\v2\x1a.google.protobuf.TimestampR\vheartbeatAt\"e\n" + + "\n" + + "JobFailure\x123\n" + + "\x04code\x18\x01 \x01(\tB\x1f\xbaH\x1cr\x1a\x10\x01\x18\x80\x012\x13^[a-z][a-z0-9_.-]*$R\x04code\x12\"\n" + + "\amessage\x18\x02 \x01(\tB\b\xbaH\x05r\x03\x18\x80 R\amessage\"\xd6\v\n" + + "\vJobEnvelope\x12\x18\n" + + "\x02id\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x02id\x12@\n" + + "\tdirection\x18\x02 \x01(\x0e2\x1a.saas.jobs.v1.JobDirectionB\x06\xbaH\x03\xc8\x01\x01R\tdirection\x124\n" + + "\x05scope\x18\x03 \x01(\v2\x16.saas.jobs.v1.JobScopeB\x06\xbaH\x03\xc8\x01\x01R\x05scope\x125\n" + + "\x05queue\x18\x04 \x01(\tB\x1f\xbaH\x1cr\x1a\x10\x01\x18\x80\x012\x13^[a-z][a-z0-9_.-]*$R\x05queue\x125\n" + + "\x05topic\x18\x05 \x01(\tB\x1f\xbaH\x1cr\x1a\x10\x01\x18\xff\x012\x13^[a-z][a-z0-9_.-]*$R\x05topic\x129\n" + + "\x06source\x18\x06 \x01(\tB!\xbaH\x1er\x1c\x10\x01\x18\xff\x012\x15^[a-z][a-z0-9_.:/-]*$R\x06source\x123\n" + + "\x0fidempotency_key\x18\a \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\xff\x01R\x0eidempotencyKey\x12+\n" + + "\fordering_key\x18\b \x01(\tB\b\xbaH\x05r\x03\x18\xff\x01R\vorderingKey\x12.\n" + + "\x0eschema_version\x18\t \x01(\rB\a\xbaH\x04*\x02 \x00R\rschemaVersion\x12#\n" + + "\apayload\x18\n" + + " \x01(\fB\t\xbaH\x06z\x04\x18\x80\x80@R\apayload\x12-\n" + + "\fcontent_type\x18\v \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\xff\x01R\vcontentType\x12x\n" + + "\n" + + "attributes\x18\f \x03(\v2).saas.jobs.v1.JobEnvelope.AttributesEntryB-\xbaH*\x9a\x01'\x10@\"\x1cr\x1a\x10\x01\x18\x80\x012\x13^[a-z][a-z0-9_.-]*$*\x05r\x03\x18\x80\bR\n" + + "attributes\x124\n" + + "\x05state\x18\r \x01(\x0e2\x16.saas.jobs.v1.JobStateB\x06\xbaH\x03\xc8\x01\x01R\x05state\x12.\n" + + "\bpriority\x18\x0e \x01(\x05B\x12\xbaH\x0f\x1a\r\x18d(\x9c\xff\xff\xff\xff\xff\xff\xff\xff\x01R\bpriority\x12#\n" + + "\rattempt_count\x18\x0f \x01(\rR\fattemptCount\x12*\n" + + "\fmax_attempts\x18\x10 \x01(\rB\a\xbaH\x04*\x02 \x00R\vmaxAttempts\x12,\n" + + "\x05lease\x18\x11 \x01(\v2\x16.saas.jobs.v1.JobLeaseR\x05lease\x12;\n" + + "\flast_failure\x18\x12 \x01(\v2\x18.saas.jobs.v1.JobFailureR\vlastFailure\x12=\n" + + "\favailable_at\x18\x13 \x01(\v2\x1a.google.protobuf.TimestampR\vavailableAt\x12B\n" + + "\x0flast_attempt_at\x18\x14 \x01(\v2\x1a.google.protobuf.TimestampR\rlastAttemptAt\x12=\n" + + "\fcompleted_at\x18\x15 \x01(\v2\x1a.google.protobuf.TimestampR\vcompletedAt\x12D\n" + + "\x10dead_lettered_at\x18\x16 \x01(\v2\x1a.google.protobuf.TimestampR\x0edeadLetteredAt\x129\n" + + "\n" + + "created_at\x18\x17 \x01(\v2\x1a.google.protobuf.TimestampR\tcreatedAt\x129\n" + + "\n" + + "updated_at\x18\x18 \x01(\v2\x1a.google.protobuf.TimestampR\tupdatedAt\x12#\n" + + "\rstate_version\x18\x19 \x01(\x04R\fstateVersion\x12(\n" + + "\treplay_of\x18\x1a \x01(\tB\v\xbaH\b\xd8\x01\x01r\x03\xb0\x01\x01R\breplayOf\x1a=\n" + + "\x0fAttributesEntry\x12\x10\n" + + "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + + "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x83\x01\n" + + "\x0eJobOrderingKey\x12<\n" + + "\tnamespace\x18\x01 \x01(\tB\x1e\xbaH\x1br\x19\x10\x01\x18@2\x13^[a-z][a-z0-9_.-]*$R\tnamespace\x123\n" + + "\n" + + "components\x18\x02 \x03(\tB\x13\xbaH\x10\x92\x01\r\b\x01\x10\b\"\ar\x05\x10\x01\x18\x80\x01R\n" + + "components\"\xed\x06\n" + + "\x06NewJob\x12@\n" + + "\tdirection\x18\x01 \x01(\x0e2\x1a.saas.jobs.v1.JobDirectionB\x06\xbaH\x03\xc8\x01\x01R\tdirection\x124\n" + + "\x05scope\x18\x02 \x01(\v2\x16.saas.jobs.v1.JobScopeB\x06\xbaH\x03\xc8\x01\x01R\x05scope\x125\n" + + "\x05queue\x18\x03 \x01(\tB\x1f\xbaH\x1cr\x1a\x10\x01\x18\x80\x012\x13^[a-z][a-z0-9_.-]*$R\x05queue\x125\n" + + "\x05topic\x18\x04 \x01(\tB\x1f\xbaH\x1cr\x1a\x10\x01\x18\xff\x012\x13^[a-z][a-z0-9_.-]*$R\x05topic\x129\n" + + "\x06source\x18\x05 \x01(\tB!\xbaH\x1er\x1c\x10\x01\x18\xff\x012\x15^[a-z][a-z0-9_.:/-]*$R\x06source\x123\n" + + "\x0fidempotency_key\x18\x06 \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\xff\x01R\x0eidempotencyKey\x128\n" + + "\bordering\x18\a \x01(\v2\x1c.saas.jobs.v1.JobOrderingKeyR\bordering\x12.\n" + + "\x0eschema_version\x18\b \x01(\rB\a\xbaH\x04*\x02 \x00R\rschemaVersion\x12#\n" + + "\apayload\x18\t \x01(\fB\t\xbaH\x06z\x04\x18\x80\x80@R\apayload\x12-\n" + + "\fcontent_type\x18\n" + + " \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\xff\x01R\vcontentType\x12s\n" + + "\n" + + "attributes\x18\v \x03(\v2$.saas.jobs.v1.NewJob.AttributesEntryB-\xbaH*\x9a\x01'\x10@\"\x1cr\x1a\x10\x01\x18\x80\x012\x13^[a-z][a-z0-9_.-]*$*\x05r\x03\x18\x80\bR\n" + + "attributes\x12.\n" + + "\bpriority\x18\f \x01(\x05B\x12\xbaH\x0f\x1a\r\x18d(\x9c\xff\xff\xff\xff\xff\xff\xff\xff\x01R\bpriority\x12,\n" + + "\fmax_attempts\x18\r \x01(\rB\t\xbaH\x06*\x04\x18d(\x01R\vmaxAttempts\x12=\n" + + "\favailable_at\x18\x0e \x01(\v2\x1a.google.protobuf.TimestampR\vavailableAt\x1a=\n" + + "\x0fAttributesEntry\x12\x10\n" + + "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + + "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x88\x01\n" + + "\x11JobLeaseReference\x12\x1f\n" + + "\x06job_id\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x05jobId\x12'\n" + + "\tworker_id\x18\x02 \x01(\tB\n" + + "\xbaH\ar\x05\x10\x01\x18\xff\x01R\bworkerId\x12)\n" + + "\vlease_token\x18\x03 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\n" + + "leaseToken*`\n" + + "\fJobDirection\x12\x1d\n" + + "\x19JOB_DIRECTION_UNSPECIFIED\x10\x00\x12\x17\n" + + "\x13JOB_DIRECTION_INBOX\x10\x01\x12\x18\n" + + "\x14JOB_DIRECTION_OUTBOX\x10\x02*\xba\x01\n" + + "\bJobState\x12\x19\n" + + "\x15JOB_STATE_UNSPECIFIED\x10\x00\x12\x15\n" + + "\x11JOB_STATE_PENDING\x10\x01\x12\x18\n" + + "\x14JOB_STATE_PROCESSING\x10\x02\x12\x16\n" + + "\x12JOB_STATE_RETRYING\x10\x03\x12\x17\n" + + "\x13JOB_STATE_SUCCEEDED\x10\x04\x12\x19\n" + + "\x15JOB_STATE_DEAD_LETTER\x10\x05\x12\x16\n" + + "\x12JOB_STATE_CANCELED\x10\x06*\x8d\x01\n" + + "\x15JobEnqueueDisposition\x12'\n" + + "#JOB_ENQUEUE_DISPOSITION_UNSPECIFIED\x10\x00\x12$\n" + + " JOB_ENQUEUE_DISPOSITION_INSERTED\x10\x01\x12%\n" + + "!JOB_ENQUEUE_DISPOSITION_DUPLICATE\x10\x02B\xbc\x01\n" + + "\x10com.saas.jobs.v1B\tJobsProtoP\x01ZKgithub.com/codefly-dev/cli/pkg/builder/clients/accounts/saas/jobs/v1;jobsv1\xa2\x02\x03SJX\xaa\x02\fSaas.Jobs.V1\xca\x02\fSaas\\Jobs\\V1\xe2\x02\x18Saas\\Jobs\\V1\\GPBMetadata\xea\x02\x0eSaas::Jobs::V1b\x06proto3" + +var ( + file_saas_jobs_v1_jobs_proto_rawDescOnce sync.Once + file_saas_jobs_v1_jobs_proto_rawDescData []byte +) + +func file_saas_jobs_v1_jobs_proto_rawDescGZIP() []byte { + file_saas_jobs_v1_jobs_proto_rawDescOnce.Do(func() { + file_saas_jobs_v1_jobs_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_saas_jobs_v1_jobs_proto_rawDesc), len(file_saas_jobs_v1_jobs_proto_rawDesc))) + }) + return file_saas_jobs_v1_jobs_proto_rawDescData +} + +var file_saas_jobs_v1_jobs_proto_enumTypes = make([]protoimpl.EnumInfo, 3) +var file_saas_jobs_v1_jobs_proto_msgTypes = make([]protoimpl.MessageInfo, 9) +var file_saas_jobs_v1_jobs_proto_goTypes = []any{ + (JobDirection)(0), // 0: saas.jobs.v1.JobDirection + (JobState)(0), // 1: saas.jobs.v1.JobState + (JobEnqueueDisposition)(0), // 2: saas.jobs.v1.JobEnqueueDisposition + (*JobScope)(nil), // 3: saas.jobs.v1.JobScope + (*JobLease)(nil), // 4: saas.jobs.v1.JobLease + (*JobFailure)(nil), // 5: saas.jobs.v1.JobFailure + (*JobEnvelope)(nil), // 6: saas.jobs.v1.JobEnvelope + (*JobOrderingKey)(nil), // 7: saas.jobs.v1.JobOrderingKey + (*NewJob)(nil), // 8: saas.jobs.v1.NewJob + (*JobLeaseReference)(nil), // 9: saas.jobs.v1.JobLeaseReference + nil, // 10: saas.jobs.v1.JobEnvelope.AttributesEntry + nil, // 11: saas.jobs.v1.NewJob.AttributesEntry + (*timestamppb.Timestamp)(nil), // 12: google.protobuf.Timestamp +} +var file_saas_jobs_v1_jobs_proto_depIdxs = []int32{ + 12, // 0: saas.jobs.v1.JobLease.expires_at:type_name -> google.protobuf.Timestamp + 12, // 1: saas.jobs.v1.JobLease.heartbeat_at:type_name -> google.protobuf.Timestamp + 0, // 2: saas.jobs.v1.JobEnvelope.direction:type_name -> saas.jobs.v1.JobDirection + 3, // 3: saas.jobs.v1.JobEnvelope.scope:type_name -> saas.jobs.v1.JobScope + 10, // 4: saas.jobs.v1.JobEnvelope.attributes:type_name -> saas.jobs.v1.JobEnvelope.AttributesEntry + 1, // 5: saas.jobs.v1.JobEnvelope.state:type_name -> saas.jobs.v1.JobState + 4, // 6: saas.jobs.v1.JobEnvelope.lease:type_name -> saas.jobs.v1.JobLease + 5, // 7: saas.jobs.v1.JobEnvelope.last_failure:type_name -> saas.jobs.v1.JobFailure + 12, // 8: saas.jobs.v1.JobEnvelope.available_at:type_name -> google.protobuf.Timestamp + 12, // 9: saas.jobs.v1.JobEnvelope.last_attempt_at:type_name -> google.protobuf.Timestamp + 12, // 10: saas.jobs.v1.JobEnvelope.completed_at:type_name -> google.protobuf.Timestamp + 12, // 11: saas.jobs.v1.JobEnvelope.dead_lettered_at:type_name -> google.protobuf.Timestamp + 12, // 12: saas.jobs.v1.JobEnvelope.created_at:type_name -> google.protobuf.Timestamp + 12, // 13: saas.jobs.v1.JobEnvelope.updated_at:type_name -> google.protobuf.Timestamp + 0, // 14: saas.jobs.v1.NewJob.direction:type_name -> saas.jobs.v1.JobDirection + 3, // 15: saas.jobs.v1.NewJob.scope:type_name -> saas.jobs.v1.JobScope + 7, // 16: saas.jobs.v1.NewJob.ordering:type_name -> saas.jobs.v1.JobOrderingKey + 11, // 17: saas.jobs.v1.NewJob.attributes:type_name -> saas.jobs.v1.NewJob.AttributesEntry + 12, // 18: saas.jobs.v1.NewJob.available_at:type_name -> google.protobuf.Timestamp + 19, // [19:19] is the sub-list for method output_type + 19, // [19:19] is the sub-list for method input_type + 19, // [19:19] is the sub-list for extension type_name + 19, // [19:19] is the sub-list for extension extendee + 0, // [0:19] is the sub-list for field type_name +} + +func init() { file_saas_jobs_v1_jobs_proto_init() } +func file_saas_jobs_v1_jobs_proto_init() { + if File_saas_jobs_v1_jobs_proto != nil { + return + } + file_saas_jobs_v1_jobs_proto_msgTypes[0].OneofWrappers = []any{ + (*JobScope_OrganizationId)(nil), + (*JobScope_SubjectId)(nil), + (*JobScope_Global)(nil), + } + type x struct{} + out := protoimpl.TypeBuilder{ + File: protoimpl.DescBuilder{ + GoPackagePath: reflect.TypeOf(x{}).PkgPath(), + RawDescriptor: unsafe.Slice(unsafe.StringData(file_saas_jobs_v1_jobs_proto_rawDesc), len(file_saas_jobs_v1_jobs_proto_rawDesc)), + NumEnums: 3, + NumMessages: 9, + NumExtensions: 0, + NumServices: 0, + }, + GoTypes: file_saas_jobs_v1_jobs_proto_goTypes, + DependencyIndexes: file_saas_jobs_v1_jobs_proto_depIdxs, + EnumInfos: file_saas_jobs_v1_jobs_proto_enumTypes, + MessageInfos: file_saas_jobs_v1_jobs_proto_msgTypes, + }.Build() + File_saas_jobs_v1_jobs_proto = out.File + file_saas_jobs_v1_jobs_proto_goTypes = nil + file_saas_jobs_v1_jobs_proto_depIdxs = nil +} diff --git a/libraries/source-read-sdk/go/gen/saas/policy/v1/options.pb.go b/libraries/source-read-sdk/go/gen/saas/policy/v1/options.pb.go new file mode 100644 index 000000000..4bf043c3b --- /dev/null +++ b/libraries/source-read-sdk/go/gen/saas/policy/v1/options.pb.go @@ -0,0 +1,1364 @@ +// Code generated by protoc-gen-go. DO NOT EDIT. +// versions: +// protoc-gen-go v1.36.11 +// protoc (unknown) +// source: saas/policy/v1/options.proto + +package policyv1 + +import ( + reflect "reflect" + sync "sync" + unsafe "unsafe" + + protoreflect "google.golang.org/protobuf/reflect/protoreflect" + protoimpl "google.golang.org/protobuf/runtime/protoimpl" + descriptorpb "google.golang.org/protobuf/types/descriptorpb" +) + +const ( + // Verify that this generated code is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) + // Verify that runtime/protoimpl is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) +) + +// Exposure defines which trust boundary may invoke a procedure. +type Exposure int32 + +const ( + Exposure_EXPOSURE_UNSPECIFIED Exposure = 0 + Exposure_EXPOSURE_PUBLIC Exposure = 1 + Exposure_EXPOSURE_AUTHENTICATED Exposure = 2 + Exposure_EXPOSURE_INTERNAL Exposure = 3 +) + +// Enum value maps for Exposure. +var ( + Exposure_name = map[int32]string{ + 0: "EXPOSURE_UNSPECIFIED", + 1: "EXPOSURE_PUBLIC", + 2: "EXPOSURE_AUTHENTICATED", + 3: "EXPOSURE_INTERNAL", + } + Exposure_value = map[string]int32{ + "EXPOSURE_UNSPECIFIED": 0, + "EXPOSURE_PUBLIC": 1, + "EXPOSURE_AUTHENTICATED": 2, + "EXPOSURE_INTERNAL": 3, + } +) + +func (x Exposure) Enum() *Exposure { + p := new(Exposure) + *p = x + return p +} + +func (x Exposure) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Exposure) Descriptor() protoreflect.EnumDescriptor { + return file_saas_policy_v1_options_proto_enumTypes[0].Descriptor() +} + +func (Exposure) Type() protoreflect.EnumType { + return &file_saas_policy_v1_options_proto_enumTypes[0] +} + +func (x Exposure) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Exposure.Descriptor instead. +func (Exposure) EnumDescriptor() ([]byte, []int) { + return file_saas_policy_v1_options_proto_rawDescGZIP(), []int{0} +} + +// TenantRequirement defines the minimum tenant relationship for the caller. +type TenantRequirement int32 + +const ( + TenantRequirement_TENANT_REQUIREMENT_UNSPECIFIED TenantRequirement = 0 + TenantRequirement_TENANT_REQUIREMENT_NONE TenantRequirement = 1 + TenantRequirement_TENANT_REQUIREMENT_USER TenantRequirement = 2 + TenantRequirement_TENANT_REQUIREMENT_ORG_MEMBER TenantRequirement = 3 + TenantRequirement_TENANT_REQUIREMENT_ORG_ADMIN TenantRequirement = 4 + TenantRequirement_TENANT_REQUIREMENT_ORG_OWNER TenantRequirement = 5 + TenantRequirement_TENANT_REQUIREMENT_TEAM_MEMBER TenantRequirement = 6 +) + +// Enum value maps for TenantRequirement. +var ( + TenantRequirement_name = map[int32]string{ + 0: "TENANT_REQUIREMENT_UNSPECIFIED", + 1: "TENANT_REQUIREMENT_NONE", + 2: "TENANT_REQUIREMENT_USER", + 3: "TENANT_REQUIREMENT_ORG_MEMBER", + 4: "TENANT_REQUIREMENT_ORG_ADMIN", + 5: "TENANT_REQUIREMENT_ORG_OWNER", + 6: "TENANT_REQUIREMENT_TEAM_MEMBER", + } + TenantRequirement_value = map[string]int32{ + "TENANT_REQUIREMENT_UNSPECIFIED": 0, + "TENANT_REQUIREMENT_NONE": 1, + "TENANT_REQUIREMENT_USER": 2, + "TENANT_REQUIREMENT_ORG_MEMBER": 3, + "TENANT_REQUIREMENT_ORG_ADMIN": 4, + "TENANT_REQUIREMENT_ORG_OWNER": 5, + "TENANT_REQUIREMENT_TEAM_MEMBER": 6, + } +) + +func (x TenantRequirement) Enum() *TenantRequirement { + p := new(TenantRequirement) + *p = x + return p +} + +func (x TenantRequirement) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (TenantRequirement) Descriptor() protoreflect.EnumDescriptor { + return file_saas_policy_v1_options_proto_enumTypes[1].Descriptor() +} + +func (TenantRequirement) Type() protoreflect.EnumType { + return &file_saas_policy_v1_options_proto_enumTypes[1] +} + +func (x TenantRequirement) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use TenantRequirement.Descriptor instead. +func (TenantRequirement) EnumDescriptor() ([]byte, []int) { + return file_saas_policy_v1_options_proto_rawDescGZIP(), []int{1} +} + +// ResourceTarget identifies what the request field is expected to name. +type ResourceTarget int32 + +const ( + ResourceTarget_RESOURCE_TARGET_UNSPECIFIED ResourceTarget = 0 + ResourceTarget_RESOURCE_TARGET_CALLER_USER ResourceTarget = 1 + ResourceTarget_RESOURCE_TARGET_ORGANIZATION ResourceTarget = 2 + ResourceTarget_RESOURCE_TARGET_TEAM ResourceTarget = 3 + ResourceTarget_RESOURCE_TARGET_OWNED_RESOURCE ResourceTarget = 4 +) + +// Enum value maps for ResourceTarget. +var ( + ResourceTarget_name = map[int32]string{ + 0: "RESOURCE_TARGET_UNSPECIFIED", + 1: "RESOURCE_TARGET_CALLER_USER", + 2: "RESOURCE_TARGET_ORGANIZATION", + 3: "RESOURCE_TARGET_TEAM", + 4: "RESOURCE_TARGET_OWNED_RESOURCE", + } + ResourceTarget_value = map[string]int32{ + "RESOURCE_TARGET_UNSPECIFIED": 0, + "RESOURCE_TARGET_CALLER_USER": 1, + "RESOURCE_TARGET_ORGANIZATION": 2, + "RESOURCE_TARGET_TEAM": 3, + "RESOURCE_TARGET_OWNED_RESOURCE": 4, + } +) + +func (x ResourceTarget) Enum() *ResourceTarget { + p := new(ResourceTarget) + *p = x + return p +} + +func (x ResourceTarget) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ResourceTarget) Descriptor() protoreflect.EnumDescriptor { + return file_saas_policy_v1_options_proto_enumTypes[2].Descriptor() +} + +func (ResourceTarget) Type() protoreflect.EnumType { + return &file_saas_policy_v1_options_proto_enumTypes[2] +} + +func (x ResourceTarget) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ResourceTarget.Descriptor instead. +func (ResourceTarget) EnumDescriptor() ([]byte, []int) { + return file_saas_policy_v1_options_proto_rawDescGZIP(), []int{2} +} + +// ResourceLookup selects a finite server-side binding operation. +type ResourceLookup int32 + +const ( + ResourceLookup_RESOURCE_LOOKUP_UNSPECIFIED ResourceLookup = 0 + ResourceLookup_RESOURCE_LOOKUP_DIRECT_ID ResourceLookup = 1 + ResourceLookup_RESOURCE_LOOKUP_TEAM_TO_ORGANIZATION ResourceLookup = 2 + ResourceLookup_RESOURCE_LOOKUP_RESOURCE_TO_ORGANIZATION ResourceLookup = 3 + ResourceLookup_RESOURCE_LOOKUP_RESOURCE_TO_OWNER ResourceLookup = 4 +) + +// Enum value maps for ResourceLookup. +var ( + ResourceLookup_name = map[int32]string{ + 0: "RESOURCE_LOOKUP_UNSPECIFIED", + 1: "RESOURCE_LOOKUP_DIRECT_ID", + 2: "RESOURCE_LOOKUP_TEAM_TO_ORGANIZATION", + 3: "RESOURCE_LOOKUP_RESOURCE_TO_ORGANIZATION", + 4: "RESOURCE_LOOKUP_RESOURCE_TO_OWNER", + } + ResourceLookup_value = map[string]int32{ + "RESOURCE_LOOKUP_UNSPECIFIED": 0, + "RESOURCE_LOOKUP_DIRECT_ID": 1, + "RESOURCE_LOOKUP_TEAM_TO_ORGANIZATION": 2, + "RESOURCE_LOOKUP_RESOURCE_TO_ORGANIZATION": 3, + "RESOURCE_LOOKUP_RESOURCE_TO_OWNER": 4, + } +) + +func (x ResourceLookup) Enum() *ResourceLookup { + p := new(ResourceLookup) + *p = x + return p +} + +func (x ResourceLookup) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ResourceLookup) Descriptor() protoreflect.EnumDescriptor { + return file_saas_policy_v1_options_proto_enumTypes[3].Descriptor() +} + +func (ResourceLookup) Type() protoreflect.EnumType { + return &file_saas_policy_v1_options_proto_enumTypes[3] +} + +func (x ResourceLookup) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ResourceLookup.Descriptor instead. +func (ResourceLookup) EnumDescriptor() ([]byte, []int) { + return file_saas_policy_v1_options_proto_rawDescGZIP(), []int{3} +} + +// MFARequirement defines the assurance required before handler execution. +type MFARequirement int32 + +const ( + MFARequirement_MFA_REQUIREMENT_UNSPECIFIED MFARequirement = 0 + MFARequirement_MFA_REQUIREMENT_NONE MFARequirement = 1 + MFARequirement_MFA_REQUIREMENT_ENROLLED MFARequirement = 2 + MFARequirement_MFA_REQUIREMENT_RECENT_STEP_UP MFARequirement = 3 + // Require recent step-up when the caller has enrolled a factor. This models + // opt-in MFA policy without pretending that enrollment is mandatory. + MFARequirement_MFA_REQUIREMENT_IF_ENROLLED_RECENT_STEP_UP MFARequirement = 4 +) + +// Enum value maps for MFARequirement. +var ( + MFARequirement_name = map[int32]string{ + 0: "MFA_REQUIREMENT_UNSPECIFIED", + 1: "MFA_REQUIREMENT_NONE", + 2: "MFA_REQUIREMENT_ENROLLED", + 3: "MFA_REQUIREMENT_RECENT_STEP_UP", + 4: "MFA_REQUIREMENT_IF_ENROLLED_RECENT_STEP_UP", + } + MFARequirement_value = map[string]int32{ + "MFA_REQUIREMENT_UNSPECIFIED": 0, + "MFA_REQUIREMENT_NONE": 1, + "MFA_REQUIREMENT_ENROLLED": 2, + "MFA_REQUIREMENT_RECENT_STEP_UP": 3, + "MFA_REQUIREMENT_IF_ENROLLED_RECENT_STEP_UP": 4, + } +) + +func (x MFARequirement) Enum() *MFARequirement { + p := new(MFARequirement) + *p = x + return p +} + +func (x MFARequirement) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (MFARequirement) Descriptor() protoreflect.EnumDescriptor { + return file_saas_policy_v1_options_proto_enumTypes[4].Descriptor() +} + +func (MFARequirement) Type() protoreflect.EnumType { + return &file_saas_policy_v1_options_proto_enumTypes[4] +} + +func (x MFARequirement) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use MFARequirement.Descriptor instead. +func (MFARequirement) EnumDescriptor() ([]byte, []int) { + return file_saas_policy_v1_options_proto_rawDescGZIP(), []int{4} +} + +// PlatformRoleRequirement defines the minimum cross-tenant operator role. The +// role hierarchy is enforced centrally; application methods never compare +// unvalidated role strings from descriptors. +type PlatformRoleRequirement int32 + +const ( + PlatformRoleRequirement_PLATFORM_ROLE_REQUIREMENT_UNSPECIFIED PlatformRoleRequirement = 0 + PlatformRoleRequirement_PLATFORM_ROLE_REQUIREMENT_NONE PlatformRoleRequirement = 1 + PlatformRoleRequirement_PLATFORM_ROLE_REQUIREMENT_ANY PlatformRoleRequirement = 2 + PlatformRoleRequirement_PLATFORM_ROLE_REQUIREMENT_SUPPORT PlatformRoleRequirement = 3 + PlatformRoleRequirement_PLATFORM_ROLE_REQUIREMENT_BILLING PlatformRoleRequirement = 4 + PlatformRoleRequirement_PLATFORM_ROLE_REQUIREMENT_SUPER_ADMIN PlatformRoleRequirement = 5 +) + +// Enum value maps for PlatformRoleRequirement. +var ( + PlatformRoleRequirement_name = map[int32]string{ + 0: "PLATFORM_ROLE_REQUIREMENT_UNSPECIFIED", + 1: "PLATFORM_ROLE_REQUIREMENT_NONE", + 2: "PLATFORM_ROLE_REQUIREMENT_ANY", + 3: "PLATFORM_ROLE_REQUIREMENT_SUPPORT", + 4: "PLATFORM_ROLE_REQUIREMENT_BILLING", + 5: "PLATFORM_ROLE_REQUIREMENT_SUPER_ADMIN", + } + PlatformRoleRequirement_value = map[string]int32{ + "PLATFORM_ROLE_REQUIREMENT_UNSPECIFIED": 0, + "PLATFORM_ROLE_REQUIREMENT_NONE": 1, + "PLATFORM_ROLE_REQUIREMENT_ANY": 2, + "PLATFORM_ROLE_REQUIREMENT_SUPPORT": 3, + "PLATFORM_ROLE_REQUIREMENT_BILLING": 4, + "PLATFORM_ROLE_REQUIREMENT_SUPER_ADMIN": 5, + } +) + +func (x PlatformRoleRequirement) Enum() *PlatformRoleRequirement { + p := new(PlatformRoleRequirement) + *p = x + return p +} + +func (x PlatformRoleRequirement) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (PlatformRoleRequirement) Descriptor() protoreflect.EnumDescriptor { + return file_saas_policy_v1_options_proto_enumTypes[5].Descriptor() +} + +func (PlatformRoleRequirement) Type() protoreflect.EnumType { + return &file_saas_policy_v1_options_proto_enumTypes[5] +} + +func (x PlatformRoleRequirement) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use PlatformRoleRequirement.Descriptor instead. +func (PlatformRoleRequirement) EnumDescriptor() ([]byte, []int) { + return file_saas_policy_v1_options_proto_rawDescGZIP(), []int{5} +} + +// ImpersonationRequirement defines whether a procedure may be invoked while a +// platform operator is acting as another user. Impersonation is deliberately +// short-lived, so the restriction targets what outlives it or changes who may +// act later: durable credentials, role and membership grants, and account +// destruction. An unspecified requirement is ALLOWED — the restriction is the +// exception a method opts into, declared beside the RPC it governs. +type ImpersonationRequirement int32 + +const ( + ImpersonationRequirement_IMPERSONATION_REQUIREMENT_UNSPECIFIED ImpersonationRequirement = 0 + ImpersonationRequirement_IMPERSONATION_REQUIREMENT_ALLOWED ImpersonationRequirement = 1 + ImpersonationRequirement_IMPERSONATION_REQUIREMENT_FORBIDDEN ImpersonationRequirement = 2 +) + +// Enum value maps for ImpersonationRequirement. +var ( + ImpersonationRequirement_name = map[int32]string{ + 0: "IMPERSONATION_REQUIREMENT_UNSPECIFIED", + 1: "IMPERSONATION_REQUIREMENT_ALLOWED", + 2: "IMPERSONATION_REQUIREMENT_FORBIDDEN", + } + ImpersonationRequirement_value = map[string]int32{ + "IMPERSONATION_REQUIREMENT_UNSPECIFIED": 0, + "IMPERSONATION_REQUIREMENT_ALLOWED": 1, + "IMPERSONATION_REQUIREMENT_FORBIDDEN": 2, + } +) + +func (x ImpersonationRequirement) Enum() *ImpersonationRequirement { + p := new(ImpersonationRequirement) + *p = x + return p +} + +func (x ImpersonationRequirement) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ImpersonationRequirement) Descriptor() protoreflect.EnumDescriptor { + return file_saas_policy_v1_options_proto_enumTypes[6].Descriptor() +} + +func (ImpersonationRequirement) Type() protoreflect.EnumType { + return &file_saas_policy_v1_options_proto_enumTypes[6] +} + +func (x ImpersonationRequirement) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ImpersonationRequirement.Descriptor instead. +func (ImpersonationRequirement) EnumDescriptor() ([]byte, []int) { + return file_saas_policy_v1_options_proto_rawDescGZIP(), []int{6} +} + +// AuditEmission defines which outcomes produce durable audit events. +type AuditEmission int32 + +const ( + AuditEmission_AUDIT_EMISSION_UNSPECIFIED AuditEmission = 0 + AuditEmission_AUDIT_EMISSION_NONE AuditEmission = 1 + AuditEmission_AUDIT_EMISSION_SUCCESS AuditEmission = 2 + AuditEmission_AUDIT_EMISSION_FAILURE AuditEmission = 3 + AuditEmission_AUDIT_EMISSION_SUCCESS_AND_FAILURE AuditEmission = 4 +) + +// Enum value maps for AuditEmission. +var ( + AuditEmission_name = map[int32]string{ + 0: "AUDIT_EMISSION_UNSPECIFIED", + 1: "AUDIT_EMISSION_NONE", + 2: "AUDIT_EMISSION_SUCCESS", + 3: "AUDIT_EMISSION_FAILURE", + 4: "AUDIT_EMISSION_SUCCESS_AND_FAILURE", + } + AuditEmission_value = map[string]int32{ + "AUDIT_EMISSION_UNSPECIFIED": 0, + "AUDIT_EMISSION_NONE": 1, + "AUDIT_EMISSION_SUCCESS": 2, + "AUDIT_EMISSION_FAILURE": 3, + "AUDIT_EMISSION_SUCCESS_AND_FAILURE": 4, + } +) + +func (x AuditEmission) Enum() *AuditEmission { + p := new(AuditEmission) + *p = x + return p +} + +func (x AuditEmission) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (AuditEmission) Descriptor() protoreflect.EnumDescriptor { + return file_saas_policy_v1_options_proto_enumTypes[7].Descriptor() +} + +func (AuditEmission) Type() protoreflect.EnumType { + return &file_saas_policy_v1_options_proto_enumTypes[7] +} + +func (x AuditEmission) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use AuditEmission.Descriptor instead. +func (AuditEmission) EnumDescriptor() ([]byte, []int) { + return file_saas_policy_v1_options_proto_rawDescGZIP(), []int{7} +} + +// IdempotencyRequirement defines whether an idempotency key is accepted. +type IdempotencyRequirement int32 + +const ( + IdempotencyRequirement_IDEMPOTENCY_REQUIREMENT_UNSPECIFIED IdempotencyRequirement = 0 + IdempotencyRequirement_IDEMPOTENCY_REQUIREMENT_FORBIDDEN IdempotencyRequirement = 1 + IdempotencyRequirement_IDEMPOTENCY_REQUIREMENT_OPTIONAL IdempotencyRequirement = 2 + IdempotencyRequirement_IDEMPOTENCY_REQUIREMENT_REQUIRED IdempotencyRequirement = 3 +) + +// Enum value maps for IdempotencyRequirement. +var ( + IdempotencyRequirement_name = map[int32]string{ + 0: "IDEMPOTENCY_REQUIREMENT_UNSPECIFIED", + 1: "IDEMPOTENCY_REQUIREMENT_FORBIDDEN", + 2: "IDEMPOTENCY_REQUIREMENT_OPTIONAL", + 3: "IDEMPOTENCY_REQUIREMENT_REQUIRED", + } + IdempotencyRequirement_value = map[string]int32{ + "IDEMPOTENCY_REQUIREMENT_UNSPECIFIED": 0, + "IDEMPOTENCY_REQUIREMENT_FORBIDDEN": 1, + "IDEMPOTENCY_REQUIREMENT_OPTIONAL": 2, + "IDEMPOTENCY_REQUIREMENT_REQUIRED": 3, + } +) + +func (x IdempotencyRequirement) Enum() *IdempotencyRequirement { + p := new(IdempotencyRequirement) + *p = x + return p +} + +func (x IdempotencyRequirement) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (IdempotencyRequirement) Descriptor() protoreflect.EnumDescriptor { + return file_saas_policy_v1_options_proto_enumTypes[8].Descriptor() +} + +func (IdempotencyRequirement) Type() protoreflect.EnumType { + return &file_saas_policy_v1_options_proto_enumTypes[8] +} + +func (x IdempotencyRequirement) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use IdempotencyRequirement.Descriptor instead. +func (IdempotencyRequirement) EnumDescriptor() ([]byte, []int) { + return file_saas_policy_v1_options_proto_rawDescGZIP(), []int{8} +} + +// RateLimitClass selects a generated, centrally configured limiter budget. +type RateLimitClass int32 + +const ( + RateLimitClass_RATE_LIMIT_CLASS_UNSPECIFIED RateLimitClass = 0 + RateLimitClass_RATE_LIMIT_CLASS_PUBLIC RateLimitClass = 1 + RateLimitClass_RATE_LIMIT_CLASS_AUTHENTICATION RateLimitClass = 2 + RateLimitClass_RATE_LIMIT_CLASS_STANDARD_READ RateLimitClass = 3 + RateLimitClass_RATE_LIMIT_CLASS_STANDARD_WRITE RateLimitClass = 4 + RateLimitClass_RATE_LIMIT_CLASS_SENSITIVE RateLimitClass = 5 + RateLimitClass_RATE_LIMIT_CLASS_WEBHOOK RateLimitClass = 6 + RateLimitClass_RATE_LIMIT_CLASS_INTERNAL RateLimitClass = 7 + RateLimitClass_RATE_LIMIT_CLASS_MFA RateLimitClass = 8 +) + +// Enum value maps for RateLimitClass. +var ( + RateLimitClass_name = map[int32]string{ + 0: "RATE_LIMIT_CLASS_UNSPECIFIED", + 1: "RATE_LIMIT_CLASS_PUBLIC", + 2: "RATE_LIMIT_CLASS_AUTHENTICATION", + 3: "RATE_LIMIT_CLASS_STANDARD_READ", + 4: "RATE_LIMIT_CLASS_STANDARD_WRITE", + 5: "RATE_LIMIT_CLASS_SENSITIVE", + 6: "RATE_LIMIT_CLASS_WEBHOOK", + 7: "RATE_LIMIT_CLASS_INTERNAL", + 8: "RATE_LIMIT_CLASS_MFA", + } + RateLimitClass_value = map[string]int32{ + "RATE_LIMIT_CLASS_UNSPECIFIED": 0, + "RATE_LIMIT_CLASS_PUBLIC": 1, + "RATE_LIMIT_CLASS_AUTHENTICATION": 2, + "RATE_LIMIT_CLASS_STANDARD_READ": 3, + "RATE_LIMIT_CLASS_STANDARD_WRITE": 4, + "RATE_LIMIT_CLASS_SENSITIVE": 5, + "RATE_LIMIT_CLASS_WEBHOOK": 6, + "RATE_LIMIT_CLASS_INTERNAL": 7, + "RATE_LIMIT_CLASS_MFA": 8, + } +) + +func (x RateLimitClass) Enum() *RateLimitClass { + p := new(RateLimitClass) + *p = x + return p +} + +func (x RateLimitClass) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (RateLimitClass) Descriptor() protoreflect.EnumDescriptor { + return file_saas_policy_v1_options_proto_enumTypes[9].Descriptor() +} + +func (RateLimitClass) Type() protoreflect.EnumType { + return &file_saas_policy_v1_options_proto_enumTypes[9] +} + +func (x RateLimitClass) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use RateLimitClass.Descriptor instead. +func (RateLimitClass) EnumDescriptor() ([]byte, []int) { + return file_saas_policy_v1_options_proto_rawDescGZIP(), []int{9} +} + +// Sensitivity controls logging, tracing, body capture, and documentation. +type Sensitivity int32 + +const ( + Sensitivity_SENSITIVITY_UNSPECIFIED Sensitivity = 0 + Sensitivity_SENSITIVITY_PUBLIC Sensitivity = 1 + Sensitivity_SENSITIVITY_INTERNAL Sensitivity = 2 + Sensitivity_SENSITIVITY_CONFIDENTIAL Sensitivity = 3 + Sensitivity_SENSITIVITY_SECRET Sensitivity = 4 +) + +// Enum value maps for Sensitivity. +var ( + Sensitivity_name = map[int32]string{ + 0: "SENSITIVITY_UNSPECIFIED", + 1: "SENSITIVITY_PUBLIC", + 2: "SENSITIVITY_INTERNAL", + 3: "SENSITIVITY_CONFIDENTIAL", + 4: "SENSITIVITY_SECRET", + } + Sensitivity_value = map[string]int32{ + "SENSITIVITY_UNSPECIFIED": 0, + "SENSITIVITY_PUBLIC": 1, + "SENSITIVITY_INTERNAL": 2, + "SENSITIVITY_CONFIDENTIAL": 3, + "SENSITIVITY_SECRET": 4, + } +) + +func (x Sensitivity) Enum() *Sensitivity { + p := new(Sensitivity) + *p = x + return p +} + +func (x Sensitivity) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (Sensitivity) Descriptor() protoreflect.EnumDescriptor { + return file_saas_policy_v1_options_proto_enumTypes[10].Descriptor() +} + +func (Sensitivity) Type() protoreflect.EnumType { + return &file_saas_policy_v1_options_proto_enumTypes[10] +} + +func (x Sensitivity) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use Sensitivity.Descriptor instead. +func (Sensitivity) EnumDescriptor() ([]byte, []int) { + return file_saas_policy_v1_options_proto_rawDescGZIP(), []int{10} +} + +// ConditionAttribute names the closed set of record and caller facts a bounded +// attribute predicate may read. This is a fixed vocabulary evaluated in Go, not +// a general policy language: adding an attribute is a deliberate schema change, +// and an unrecognized attribute fails closed. +type ConditionAttribute int32 + +const ( + ConditionAttribute_CONDITION_ATTRIBUTE_UNSPECIFIED ConditionAttribute = 0 + // The caller belongs to the team that owns the target record. + ConditionAttribute_CONDITION_ATTRIBUTE_OWNER_TEAM ConditionAttribute = 1 + // The target record's status is one of allowed_statuses. + ConditionAttribute_CONDITION_ATTRIBUTE_STATUS ConditionAttribute = 2 + // The caller's clearance level is at least the record's classification level. + ConditionAttribute_CONDITION_ATTRIBUTE_CLASSIFICATION ConditionAttribute = 3 + // The request occurs within time_window. + ConditionAttribute_CONDITION_ATTRIBUTE_TIME_WINDOW ConditionAttribute = 4 +) + +// Enum value maps for ConditionAttribute. +var ( + ConditionAttribute_name = map[int32]string{ + 0: "CONDITION_ATTRIBUTE_UNSPECIFIED", + 1: "CONDITION_ATTRIBUTE_OWNER_TEAM", + 2: "CONDITION_ATTRIBUTE_STATUS", + 3: "CONDITION_ATTRIBUTE_CLASSIFICATION", + 4: "CONDITION_ATTRIBUTE_TIME_WINDOW", + } + ConditionAttribute_value = map[string]int32{ + "CONDITION_ATTRIBUTE_UNSPECIFIED": 0, + "CONDITION_ATTRIBUTE_OWNER_TEAM": 1, + "CONDITION_ATTRIBUTE_STATUS": 2, + "CONDITION_ATTRIBUTE_CLASSIFICATION": 3, + "CONDITION_ATTRIBUTE_TIME_WINDOW": 4, + } +) + +func (x ConditionAttribute) Enum() *ConditionAttribute { + p := new(ConditionAttribute) + *p = x + return p +} + +func (x ConditionAttribute) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (ConditionAttribute) Descriptor() protoreflect.EnumDescriptor { + return file_saas_policy_v1_options_proto_enumTypes[11].Descriptor() +} + +func (ConditionAttribute) Type() protoreflect.EnumType { + return &file_saas_policy_v1_options_proto_enumTypes[11] +} + +func (x ConditionAttribute) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use ConditionAttribute.Descriptor instead. +func (ConditionAttribute) EnumDescriptor() ([]byte, []int) { + return file_saas_policy_v1_options_proto_rawDescGZIP(), []int{11} +} + +// ResourceBinding binds a protobuf request field to an authorization target. +// request_field is a protobuf field path such as "org_id" or "webhook.id"; +// lookup controls the finite database lookup the policy adapter may perform. +type ResourceBinding struct { + state protoimpl.MessageState `protogen:"open.v1"` + RequestField string `protobuf:"bytes,1,opt,name=request_field,json=requestField,proto3" json:"request_field,omitempty"` + Target ResourceTarget `protobuf:"varint,2,opt,name=target,proto3,enum=saas.policy.v1.ResourceTarget" json:"target,omitempty"` + Lookup ResourceLookup `protobuf:"varint,3,opt,name=lookup,proto3,enum=saas.policy.v1.ResourceLookup" json:"lookup,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ResourceBinding) Reset() { + *x = ResourceBinding{} + mi := &file_saas_policy_v1_options_proto_msgTypes[0] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ResourceBinding) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ResourceBinding) ProtoMessage() {} + +func (x *ResourceBinding) ProtoReflect() protoreflect.Message { + mi := &file_saas_policy_v1_options_proto_msgTypes[0] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ResourceBinding.ProtoReflect.Descriptor instead. +func (*ResourceBinding) Descriptor() ([]byte, []int) { + return file_saas_policy_v1_options_proto_rawDescGZIP(), []int{0} +} + +func (x *ResourceBinding) GetRequestField() string { + if x != nil { + return x.RequestField + } + return "" +} + +func (x *ResourceBinding) GetTarget() ResourceTarget { + if x != nil { + return x.Target + } + return ResourceTarget_RESOURCE_TARGET_UNSPECIFIED +} + +func (x *ResourceBinding) GetLookup() ResourceLookup { + if x != nil { + return x.Lookup + } + return ResourceLookup_RESOURCE_LOOKUP_UNSPECIFIED +} + +// AuditPolicy names every stable event this method may emit and the outcomes +// that produce them. Repetition represents multi-event and outcome-dependent +// methods without hiding policy in an arbitrary expression. +type AuditPolicy struct { + state protoimpl.MessageState `protogen:"open.v1"` + Events []string `protobuf:"bytes,1,rep,name=events,proto3" json:"events,omitempty"` + Emission AuditEmission `protobuf:"varint,2,opt,name=emission,proto3,enum=saas.policy.v1.AuditEmission" json:"emission,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *AuditPolicy) Reset() { + *x = AuditPolicy{} + mi := &file_saas_policy_v1_options_proto_msgTypes[1] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *AuditPolicy) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*AuditPolicy) ProtoMessage() {} + +func (x *AuditPolicy) ProtoReflect() protoreflect.Message { + mi := &file_saas_policy_v1_options_proto_msgTypes[1] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use AuditPolicy.ProtoReflect.Descriptor instead. +func (*AuditPolicy) Descriptor() ([]byte, []int) { + return file_saas_policy_v1_options_proto_rawDescGZIP(), []int{1} +} + +func (x *AuditPolicy) GetEvents() []string { + if x != nil { + return x.Events + } + return nil +} + +func (x *AuditPolicy) GetEmission() AuditEmission { + if x != nil { + return x.Emission + } + return AuditEmission_AUDIT_EMISSION_UNSPECIFIED +} + +// TimeWindow is a daily wall-clock window, half-open [start_minute, end_minute) +// in minutes from local midnight, evaluated in the named IANA timezone. When +// start_minute is greater than end_minute the window wraps past midnight (e.g. +// an overnight maintenance window). start_minute and end_minute must differ. +type TimeWindow struct { + state protoimpl.MessageState `protogen:"open.v1"` + StartMinute uint32 `protobuf:"varint,1,opt,name=start_minute,json=startMinute,proto3" json:"start_minute,omitempty"` + EndMinute uint32 `protobuf:"varint,2,opt,name=end_minute,json=endMinute,proto3" json:"end_minute,omitempty"` + Timezone string `protobuf:"bytes,3,opt,name=timezone,proto3" json:"timezone,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *TimeWindow) Reset() { + *x = TimeWindow{} + mi := &file_saas_policy_v1_options_proto_msgTypes[2] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *TimeWindow) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*TimeWindow) ProtoMessage() {} + +func (x *TimeWindow) ProtoReflect() protoreflect.Message { + mi := &file_saas_policy_v1_options_proto_msgTypes[2] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use TimeWindow.ProtoReflect.Descriptor instead. +func (*TimeWindow) Descriptor() ([]byte, []int) { + return file_saas_policy_v1_options_proto_rawDescGZIP(), []int{2} +} + +func (x *TimeWindow) GetStartMinute() uint32 { + if x != nil { + return x.StartMinute + } + return 0 +} + +func (x *TimeWindow) GetEndMinute() uint32 { + if x != nil { + return x.EndMinute + } + return 0 +} + +func (x *TimeWindow) GetTimezone() string { + if x != nil { + return x.Timezone + } + return "" +} + +// Condition is one bounded attribute predicate declared beside an RPC. The +// attribute selects a closed evaluator and only its matching parameter field is +// read; the others must be empty. A method's conditions are combined with AND, +// and evaluation fails closed on any unrecognized or malformed condition. +type Condition struct { + state protoimpl.MessageState `protogen:"open.v1"` + Attribute ConditionAttribute `protobuf:"varint,1,opt,name=attribute,proto3,enum=saas.policy.v1.ConditionAttribute" json:"attribute,omitempty"` + // allowed_statuses applies only to CONDITION_ATTRIBUTE_STATUS. + AllowedStatuses []string `protobuf:"bytes,2,rep,name=allowed_statuses,json=allowedStatuses,proto3" json:"allowed_statuses,omitempty"` + // time_window applies only to CONDITION_ATTRIBUTE_TIME_WINDOW. + TimeWindow *TimeWindow `protobuf:"bytes,3,opt,name=time_window,json=timeWindow,proto3" json:"time_window,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Condition) Reset() { + *x = Condition{} + mi := &file_saas_policy_v1_options_proto_msgTypes[3] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Condition) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Condition) ProtoMessage() {} + +func (x *Condition) ProtoReflect() protoreflect.Message { + mi := &file_saas_policy_v1_options_proto_msgTypes[3] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Condition.ProtoReflect.Descriptor instead. +func (*Condition) Descriptor() ([]byte, []int) { + return file_saas_policy_v1_options_proto_rawDescGZIP(), []int{3} +} + +func (x *Condition) GetAttribute() ConditionAttribute { + if x != nil { + return x.Attribute + } + return ConditionAttribute_CONDITION_ATTRIBUTE_UNSPECIFIED +} + +func (x *Condition) GetAllowedStatuses() []string { + if x != nil { + return x.AllowedStatuses + } + return nil +} + +func (x *Condition) GetTimeWindow() *TimeWindow { + if x != nil { + return x.TimeWindow + } + return nil +} + +// MethodPolicy is the complete declarative input to Codefly's route and policy +// compiler. Complex, state-dependent authorization remains in domain code. +type MethodPolicy struct { + state protoimpl.MessageState `protogen:"open.v1"` + Exposure Exposure `protobuf:"varint,1,opt,name=exposure,proto3,enum=saas.policy.v1.Exposure" json:"exposure,omitempty"` + Tenant TenantRequirement `protobuf:"varint,2,opt,name=tenant,proto3,enum=saas.policy.v1.TenantRequirement" json:"tenant,omitempty"` + Permissions []string `protobuf:"bytes,3,rep,name=permissions,proto3" json:"permissions,omitempty"` + Scopes []string `protobuf:"bytes,4,rep,name=scopes,proto3" json:"scopes,omitempty"` + ResourceBindings []*ResourceBinding `protobuf:"bytes,5,rep,name=resource_bindings,json=resourceBindings,proto3" json:"resource_bindings,omitempty"` + Mfa MFARequirement `protobuf:"varint,6,opt,name=mfa,proto3,enum=saas.policy.v1.MFARequirement" json:"mfa,omitempty"` + Audit *AuditPolicy `protobuf:"bytes,7,opt,name=audit,proto3" json:"audit,omitempty"` + Idempotency IdempotencyRequirement `protobuf:"varint,8,opt,name=idempotency,proto3,enum=saas.policy.v1.IdempotencyRequirement" json:"idempotency,omitempty"` + RateLimit RateLimitClass `protobuf:"varint,9,opt,name=rate_limit,json=rateLimit,proto3,enum=saas.policy.v1.RateLimitClass" json:"rate_limit,omitempty"` + RequestSensitivity Sensitivity `protobuf:"varint,10,opt,name=request_sensitivity,json=requestSensitivity,proto3,enum=saas.policy.v1.Sensitivity" json:"request_sensitivity,omitempty"` + ResponseSensitivity Sensitivity `protobuf:"varint,11,opt,name=response_sensitivity,json=responseSensitivity,proto3,enum=saas.policy.v1.Sensitivity" json:"response_sensitivity,omitempty"` + PlatformRole PlatformRoleRequirement `protobuf:"varint,12,opt,name=platform_role,json=platformRole,proto3,enum=saas.policy.v1.PlatformRoleRequirement" json:"platform_role,omitempty"` + // authentication_factor_attempt marks a public login-factor verification + // attempt that must use the dedicated per-client-IP edge budget. It is not + // inferred from method names or HTTP paths. + AuthenticationFactorAttempt bool `protobuf:"varint,13,opt,name=authentication_factor_attempt,json=authenticationFactorAttempt,proto3" json:"authentication_factor_attempt,omitempty"` + // conditions is the closed set of bounded attribute predicates that must all + // hold, evaluated in domain code above the forced RLS floor — never replacing + // it. An empty list imposes no attribute condition. + Conditions []*Condition `protobuf:"bytes,14,rep,name=conditions,proto3" json:"conditions,omitempty"` + // impersonation governs admission while a support session acts as another + // user. It is enforced centrally on the same verified identity every other + // impersonation gate reads, so a method cannot be restricted here and remain + // reachable through a handler that forgot to ask. + Impersonation ImpersonationRequirement `protobuf:"varint,15,opt,name=impersonation,proto3,enum=saas.policy.v1.ImpersonationRequirement" json:"impersonation,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *MethodPolicy) Reset() { + *x = MethodPolicy{} + mi := &file_saas_policy_v1_options_proto_msgTypes[4] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *MethodPolicy) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*MethodPolicy) ProtoMessage() {} + +func (x *MethodPolicy) ProtoReflect() protoreflect.Message { + mi := &file_saas_policy_v1_options_proto_msgTypes[4] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use MethodPolicy.ProtoReflect.Descriptor instead. +func (*MethodPolicy) Descriptor() ([]byte, []int) { + return file_saas_policy_v1_options_proto_rawDescGZIP(), []int{4} +} + +func (x *MethodPolicy) GetExposure() Exposure { + if x != nil { + return x.Exposure + } + return Exposure_EXPOSURE_UNSPECIFIED +} + +func (x *MethodPolicy) GetTenant() TenantRequirement { + if x != nil { + return x.Tenant + } + return TenantRequirement_TENANT_REQUIREMENT_UNSPECIFIED +} + +func (x *MethodPolicy) GetPermissions() []string { + if x != nil { + return x.Permissions + } + return nil +} + +func (x *MethodPolicy) GetScopes() []string { + if x != nil { + return x.Scopes + } + return nil +} + +func (x *MethodPolicy) GetResourceBindings() []*ResourceBinding { + if x != nil { + return x.ResourceBindings + } + return nil +} + +func (x *MethodPolicy) GetMfa() MFARequirement { + if x != nil { + return x.Mfa + } + return MFARequirement_MFA_REQUIREMENT_UNSPECIFIED +} + +func (x *MethodPolicy) GetAudit() *AuditPolicy { + if x != nil { + return x.Audit + } + return nil +} + +func (x *MethodPolicy) GetIdempotency() IdempotencyRequirement { + if x != nil { + return x.Idempotency + } + return IdempotencyRequirement_IDEMPOTENCY_REQUIREMENT_UNSPECIFIED +} + +func (x *MethodPolicy) GetRateLimit() RateLimitClass { + if x != nil { + return x.RateLimit + } + return RateLimitClass_RATE_LIMIT_CLASS_UNSPECIFIED +} + +func (x *MethodPolicy) GetRequestSensitivity() Sensitivity { + if x != nil { + return x.RequestSensitivity + } + return Sensitivity_SENSITIVITY_UNSPECIFIED +} + +func (x *MethodPolicy) GetResponseSensitivity() Sensitivity { + if x != nil { + return x.ResponseSensitivity + } + return Sensitivity_SENSITIVITY_UNSPECIFIED +} + +func (x *MethodPolicy) GetPlatformRole() PlatformRoleRequirement { + if x != nil { + return x.PlatformRole + } + return PlatformRoleRequirement_PLATFORM_ROLE_REQUIREMENT_UNSPECIFIED +} + +func (x *MethodPolicy) GetAuthenticationFactorAttempt() bool { + if x != nil { + return x.AuthenticationFactorAttempt + } + return false +} + +func (x *MethodPolicy) GetConditions() []*Condition { + if x != nil { + return x.Conditions + } + return nil +} + +func (x *MethodPolicy) GetImpersonation() ImpersonationRequirement { + if x != nil { + return x.Impersonation + } + return ImpersonationRequirement_IMPERSONATION_REQUIREMENT_UNSPECIFIED +} + +var file_saas_policy_v1_options_proto_extTypes = []protoimpl.ExtensionInfo{ + { + ExtendedType: (*descriptorpb.MethodOptions)(nil), + ExtensionType: (*MethodPolicy)(nil), + Field: 51000, + Name: "saas.policy.v1.method_policy", + Tag: "bytes,51000,opt,name=method_policy", + Filename: "saas/policy/v1/options.proto", + }, +} + +// Extension fields to descriptorpb.MethodOptions. +var ( + // method_policy is the single policy source consumed by Codefly generation. + // + // optional saas.policy.v1.MethodPolicy method_policy = 51000; + E_MethodPolicy = &file_saas_policy_v1_options_proto_extTypes[0] +) + +var File_saas_policy_v1_options_proto protoreflect.FileDescriptor + +const file_saas_policy_v1_options_proto_rawDesc = "" + + "\n" + + "\x1csaas/policy/v1/options.proto\x12\x0esaas.policy.v1\x1a google/protobuf/descriptor.proto\"\xa6\x01\n" + + "\x0fResourceBinding\x12#\n" + + "\rrequest_field\x18\x01 \x01(\tR\frequestField\x126\n" + + "\x06target\x18\x02 \x01(\x0e2\x1e.saas.policy.v1.ResourceTargetR\x06target\x126\n" + + "\x06lookup\x18\x03 \x01(\x0e2\x1e.saas.policy.v1.ResourceLookupR\x06lookup\"`\n" + + "\vAuditPolicy\x12\x16\n" + + "\x06events\x18\x01 \x03(\tR\x06events\x129\n" + + "\bemission\x18\x02 \x01(\x0e2\x1d.saas.policy.v1.AuditEmissionR\bemission\"j\n" + + "\n" + + "TimeWindow\x12!\n" + + "\fstart_minute\x18\x01 \x01(\rR\vstartMinute\x12\x1d\n" + + "\n" + + "end_minute\x18\x02 \x01(\rR\tendMinute\x12\x1a\n" + + "\btimezone\x18\x03 \x01(\tR\btimezone\"\xb5\x01\n" + + "\tCondition\x12@\n" + + "\tattribute\x18\x01 \x01(\x0e2\".saas.policy.v1.ConditionAttributeR\tattribute\x12)\n" + + "\x10allowed_statuses\x18\x02 \x03(\tR\x0fallowedStatuses\x12;\n" + + "\vtime_window\x18\x03 \x01(\v2\x1a.saas.policy.v1.TimeWindowR\n" + + "timeWindow\"\xb0\a\n" + + "\fMethodPolicy\x124\n" + + "\bexposure\x18\x01 \x01(\x0e2\x18.saas.policy.v1.ExposureR\bexposure\x129\n" + + "\x06tenant\x18\x02 \x01(\x0e2!.saas.policy.v1.TenantRequirementR\x06tenant\x12 \n" + + "\vpermissions\x18\x03 \x03(\tR\vpermissions\x12\x16\n" + + "\x06scopes\x18\x04 \x03(\tR\x06scopes\x12L\n" + + "\x11resource_bindings\x18\x05 \x03(\v2\x1f.saas.policy.v1.ResourceBindingR\x10resourceBindings\x120\n" + + "\x03mfa\x18\x06 \x01(\x0e2\x1e.saas.policy.v1.MFARequirementR\x03mfa\x121\n" + + "\x05audit\x18\a \x01(\v2\x1b.saas.policy.v1.AuditPolicyR\x05audit\x12H\n" + + "\vidempotency\x18\b \x01(\x0e2&.saas.policy.v1.IdempotencyRequirementR\vidempotency\x12=\n" + + "\n" + + "rate_limit\x18\t \x01(\x0e2\x1e.saas.policy.v1.RateLimitClassR\trateLimit\x12L\n" + + "\x13request_sensitivity\x18\n" + + " \x01(\x0e2\x1b.saas.policy.v1.SensitivityR\x12requestSensitivity\x12N\n" + + "\x14response_sensitivity\x18\v \x01(\x0e2\x1b.saas.policy.v1.SensitivityR\x13responseSensitivity\x12L\n" + + "\rplatform_role\x18\f \x01(\x0e2'.saas.policy.v1.PlatformRoleRequirementR\fplatformRole\x12B\n" + + "\x1dauthentication_factor_attempt\x18\r \x01(\bR\x1bauthenticationFactorAttempt\x129\n" + + "\n" + + "conditions\x18\x0e \x03(\v2\x19.saas.policy.v1.ConditionR\n" + + "conditions\x12N\n" + + "\rimpersonation\x18\x0f \x01(\x0e2(.saas.policy.v1.ImpersonationRequirementR\rimpersonation*l\n" + + "\bExposure\x12\x18\n" + + "\x14EXPOSURE_UNSPECIFIED\x10\x00\x12\x13\n" + + "\x0fEXPOSURE_PUBLIC\x10\x01\x12\x1a\n" + + "\x16EXPOSURE_AUTHENTICATED\x10\x02\x12\x15\n" + + "\x11EXPOSURE_INTERNAL\x10\x03*\xfc\x01\n" + + "\x11TenantRequirement\x12\"\n" + + "\x1eTENANT_REQUIREMENT_UNSPECIFIED\x10\x00\x12\x1b\n" + + "\x17TENANT_REQUIREMENT_NONE\x10\x01\x12\x1b\n" + + "\x17TENANT_REQUIREMENT_USER\x10\x02\x12!\n" + + "\x1dTENANT_REQUIREMENT_ORG_MEMBER\x10\x03\x12 \n" + + "\x1cTENANT_REQUIREMENT_ORG_ADMIN\x10\x04\x12 \n" + + "\x1cTENANT_REQUIREMENT_ORG_OWNER\x10\x05\x12\"\n" + + "\x1eTENANT_REQUIREMENT_TEAM_MEMBER\x10\x06*\xb2\x01\n" + + "\x0eResourceTarget\x12\x1f\n" + + "\x1bRESOURCE_TARGET_UNSPECIFIED\x10\x00\x12\x1f\n" + + "\x1bRESOURCE_TARGET_CALLER_USER\x10\x01\x12 \n" + + "\x1cRESOURCE_TARGET_ORGANIZATION\x10\x02\x12\x18\n" + + "\x14RESOURCE_TARGET_TEAM\x10\x03\x12\"\n" + + "\x1eRESOURCE_TARGET_OWNED_RESOURCE\x10\x04*\xcf\x01\n" + + "\x0eResourceLookup\x12\x1f\n" + + "\x1bRESOURCE_LOOKUP_UNSPECIFIED\x10\x00\x12\x1d\n" + + "\x19RESOURCE_LOOKUP_DIRECT_ID\x10\x01\x12(\n" + + "$RESOURCE_LOOKUP_TEAM_TO_ORGANIZATION\x10\x02\x12,\n" + + "(RESOURCE_LOOKUP_RESOURCE_TO_ORGANIZATION\x10\x03\x12%\n" + + "!RESOURCE_LOOKUP_RESOURCE_TO_OWNER\x10\x04*\xbd\x01\n" + + "\x0eMFARequirement\x12\x1f\n" + + "\x1bMFA_REQUIREMENT_UNSPECIFIED\x10\x00\x12\x18\n" + + "\x14MFA_REQUIREMENT_NONE\x10\x01\x12\x1c\n" + + "\x18MFA_REQUIREMENT_ENROLLED\x10\x02\x12\"\n" + + "\x1eMFA_REQUIREMENT_RECENT_STEP_UP\x10\x03\x12.\n" + + "*MFA_REQUIREMENT_IF_ENROLLED_RECENT_STEP_UP\x10\x04*\x84\x02\n" + + "\x17PlatformRoleRequirement\x12)\n" + + "%PLATFORM_ROLE_REQUIREMENT_UNSPECIFIED\x10\x00\x12\"\n" + + "\x1ePLATFORM_ROLE_REQUIREMENT_NONE\x10\x01\x12!\n" + + "\x1dPLATFORM_ROLE_REQUIREMENT_ANY\x10\x02\x12%\n" + + "!PLATFORM_ROLE_REQUIREMENT_SUPPORT\x10\x03\x12%\n" + + "!PLATFORM_ROLE_REQUIREMENT_BILLING\x10\x04\x12)\n" + + "%PLATFORM_ROLE_REQUIREMENT_SUPER_ADMIN\x10\x05*\x95\x01\n" + + "\x18ImpersonationRequirement\x12)\n" + + "%IMPERSONATION_REQUIREMENT_UNSPECIFIED\x10\x00\x12%\n" + + "!IMPERSONATION_REQUIREMENT_ALLOWED\x10\x01\x12'\n" + + "#IMPERSONATION_REQUIREMENT_FORBIDDEN\x10\x02*\xa8\x01\n" + + "\rAuditEmission\x12\x1e\n" + + "\x1aAUDIT_EMISSION_UNSPECIFIED\x10\x00\x12\x17\n" + + "\x13AUDIT_EMISSION_NONE\x10\x01\x12\x1a\n" + + "\x16AUDIT_EMISSION_SUCCESS\x10\x02\x12\x1a\n" + + "\x16AUDIT_EMISSION_FAILURE\x10\x03\x12&\n" + + "\"AUDIT_EMISSION_SUCCESS_AND_FAILURE\x10\x04*\xb4\x01\n" + + "\x16IdempotencyRequirement\x12'\n" + + "#IDEMPOTENCY_REQUIREMENT_UNSPECIFIED\x10\x00\x12%\n" + + "!IDEMPOTENCY_REQUIREMENT_FORBIDDEN\x10\x01\x12$\n" + + " IDEMPOTENCY_REQUIREMENT_OPTIONAL\x10\x02\x12$\n" + + " IDEMPOTENCY_REQUIREMENT_REQUIRED\x10\x03*\xb4\x02\n" + + "\x0eRateLimitClass\x12 \n" + + "\x1cRATE_LIMIT_CLASS_UNSPECIFIED\x10\x00\x12\x1b\n" + + "\x17RATE_LIMIT_CLASS_PUBLIC\x10\x01\x12#\n" + + "\x1fRATE_LIMIT_CLASS_AUTHENTICATION\x10\x02\x12\"\n" + + "\x1eRATE_LIMIT_CLASS_STANDARD_READ\x10\x03\x12#\n" + + "\x1fRATE_LIMIT_CLASS_STANDARD_WRITE\x10\x04\x12\x1e\n" + + "\x1aRATE_LIMIT_CLASS_SENSITIVE\x10\x05\x12\x1c\n" + + "\x18RATE_LIMIT_CLASS_WEBHOOK\x10\x06\x12\x1d\n" + + "\x19RATE_LIMIT_CLASS_INTERNAL\x10\a\x12\x18\n" + + "\x14RATE_LIMIT_CLASS_MFA\x10\b*\x92\x01\n" + + "\vSensitivity\x12\x1b\n" + + "\x17SENSITIVITY_UNSPECIFIED\x10\x00\x12\x16\n" + + "\x12SENSITIVITY_PUBLIC\x10\x01\x12\x18\n" + + "\x14SENSITIVITY_INTERNAL\x10\x02\x12\x1c\n" + + "\x18SENSITIVITY_CONFIDENTIAL\x10\x03\x12\x16\n" + + "\x12SENSITIVITY_SECRET\x10\x04*\xca\x01\n" + + "\x12ConditionAttribute\x12#\n" + + "\x1fCONDITION_ATTRIBUTE_UNSPECIFIED\x10\x00\x12\"\n" + + "\x1eCONDITION_ATTRIBUTE_OWNER_TEAM\x10\x01\x12\x1e\n" + + "\x1aCONDITION_ATTRIBUTE_STATUS\x10\x02\x12&\n" + + "\"CONDITION_ATTRIBUTE_CLASSIFICATION\x10\x03\x12#\n" + + "\x1fCONDITION_ATTRIBUTE_TIME_WINDOW\x10\x04:c\n" + + "\rmethod_policy\x12\x1e.google.protobuf.MethodOptions\x18\xb8\x8e\x03 \x01(\v2\x1c.saas.policy.v1.MethodPolicyR\fmethodPolicyB\xcd\x01\n" + + "\x12com.saas.policy.v1B\fOptionsProtoP\x01ZOgithub.com/codefly-dev/cli/pkg/builder/clients/accounts/saas/policy/v1;policyv1\xa2\x02\x03SPX\xaa\x02\x0eSaas.Policy.V1\xca\x02\x0eSaas\\Policy\\V1\xe2\x02\x1aSaas\\Policy\\V1\\GPBMetadata\xea\x02\x10Saas::Policy::V1b\x06proto3" + +var ( + file_saas_policy_v1_options_proto_rawDescOnce sync.Once + file_saas_policy_v1_options_proto_rawDescData []byte +) + +func file_saas_policy_v1_options_proto_rawDescGZIP() []byte { + file_saas_policy_v1_options_proto_rawDescOnce.Do(func() { + file_saas_policy_v1_options_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_saas_policy_v1_options_proto_rawDesc), len(file_saas_policy_v1_options_proto_rawDesc))) + }) + return file_saas_policy_v1_options_proto_rawDescData +} + +var file_saas_policy_v1_options_proto_enumTypes = make([]protoimpl.EnumInfo, 12) +var file_saas_policy_v1_options_proto_msgTypes = make([]protoimpl.MessageInfo, 5) +var file_saas_policy_v1_options_proto_goTypes = []any{ + (Exposure)(0), // 0: saas.policy.v1.Exposure + (TenantRequirement)(0), // 1: saas.policy.v1.TenantRequirement + (ResourceTarget)(0), // 2: saas.policy.v1.ResourceTarget + (ResourceLookup)(0), // 3: saas.policy.v1.ResourceLookup + (MFARequirement)(0), // 4: saas.policy.v1.MFARequirement + (PlatformRoleRequirement)(0), // 5: saas.policy.v1.PlatformRoleRequirement + (ImpersonationRequirement)(0), // 6: saas.policy.v1.ImpersonationRequirement + (AuditEmission)(0), // 7: saas.policy.v1.AuditEmission + (IdempotencyRequirement)(0), // 8: saas.policy.v1.IdempotencyRequirement + (RateLimitClass)(0), // 9: saas.policy.v1.RateLimitClass + (Sensitivity)(0), // 10: saas.policy.v1.Sensitivity + (ConditionAttribute)(0), // 11: saas.policy.v1.ConditionAttribute + (*ResourceBinding)(nil), // 12: saas.policy.v1.ResourceBinding + (*AuditPolicy)(nil), // 13: saas.policy.v1.AuditPolicy + (*TimeWindow)(nil), // 14: saas.policy.v1.TimeWindow + (*Condition)(nil), // 15: saas.policy.v1.Condition + (*MethodPolicy)(nil), // 16: saas.policy.v1.MethodPolicy + (*descriptorpb.MethodOptions)(nil), // 17: google.protobuf.MethodOptions +} +var file_saas_policy_v1_options_proto_depIdxs = []int32{ + 2, // 0: saas.policy.v1.ResourceBinding.target:type_name -> saas.policy.v1.ResourceTarget + 3, // 1: saas.policy.v1.ResourceBinding.lookup:type_name -> saas.policy.v1.ResourceLookup + 7, // 2: saas.policy.v1.AuditPolicy.emission:type_name -> saas.policy.v1.AuditEmission + 11, // 3: saas.policy.v1.Condition.attribute:type_name -> saas.policy.v1.ConditionAttribute + 14, // 4: saas.policy.v1.Condition.time_window:type_name -> saas.policy.v1.TimeWindow + 0, // 5: saas.policy.v1.MethodPolicy.exposure:type_name -> saas.policy.v1.Exposure + 1, // 6: saas.policy.v1.MethodPolicy.tenant:type_name -> saas.policy.v1.TenantRequirement + 12, // 7: saas.policy.v1.MethodPolicy.resource_bindings:type_name -> saas.policy.v1.ResourceBinding + 4, // 8: saas.policy.v1.MethodPolicy.mfa:type_name -> saas.policy.v1.MFARequirement + 13, // 9: saas.policy.v1.MethodPolicy.audit:type_name -> saas.policy.v1.AuditPolicy + 8, // 10: saas.policy.v1.MethodPolicy.idempotency:type_name -> saas.policy.v1.IdempotencyRequirement + 9, // 11: saas.policy.v1.MethodPolicy.rate_limit:type_name -> saas.policy.v1.RateLimitClass + 10, // 12: saas.policy.v1.MethodPolicy.request_sensitivity:type_name -> saas.policy.v1.Sensitivity + 10, // 13: saas.policy.v1.MethodPolicy.response_sensitivity:type_name -> saas.policy.v1.Sensitivity + 5, // 14: saas.policy.v1.MethodPolicy.platform_role:type_name -> saas.policy.v1.PlatformRoleRequirement + 15, // 15: saas.policy.v1.MethodPolicy.conditions:type_name -> saas.policy.v1.Condition + 6, // 16: saas.policy.v1.MethodPolicy.impersonation:type_name -> saas.policy.v1.ImpersonationRequirement + 17, // 17: saas.policy.v1.method_policy:extendee -> google.protobuf.MethodOptions + 16, // 18: saas.policy.v1.method_policy:type_name -> saas.policy.v1.MethodPolicy + 19, // [19:19] is the sub-list for method output_type + 19, // [19:19] is the sub-list for method input_type + 18, // [18:19] is the sub-list for extension type_name + 17, // [17:18] is the sub-list for extension extendee + 0, // [0:17] is the sub-list for field type_name +} + +func init() { file_saas_policy_v1_options_proto_init() } +func file_saas_policy_v1_options_proto_init() { + if File_saas_policy_v1_options_proto != nil { + return + } + type x struct{} + out := protoimpl.TypeBuilder{ + File: protoimpl.DescBuilder{ + GoPackagePath: reflect.TypeOf(x{}).PkgPath(), + RawDescriptor: unsafe.Slice(unsafe.StringData(file_saas_policy_v1_options_proto_rawDesc), len(file_saas_policy_v1_options_proto_rawDesc)), + NumEnums: 12, + NumMessages: 5, + NumExtensions: 1, + NumServices: 0, + }, + GoTypes: file_saas_policy_v1_options_proto_goTypes, + DependencyIndexes: file_saas_policy_v1_options_proto_depIdxs, + EnumInfos: file_saas_policy_v1_options_proto_enumTypes, + MessageInfos: file_saas_policy_v1_options_proto_msgTypes, + ExtensionInfos: file_saas_policy_v1_options_proto_extTypes, + }.Build() + File_saas_policy_v1_options_proto = out.File + file_saas_policy_v1_options_proto_goTypes = nil + file_saas_policy_v1_options_proto_depIdxs = nil +} diff --git a/libraries/source-read-sdk/go/go.mod b/libraries/source-read-sdk/go/go.mod index ce7dc8bb4..53190bbe5 100644 --- a/libraries/source-read-sdk/go/go.mod +++ b/libraries/source-read-sdk/go/go.mod @@ -1,16 +1,12 @@ module github.com/codefly-dev/module-saas-starter/libraries/source-read-sdk/go -go 1.27.0 +go 1.27.3 require ( buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2 connectrpc.com/connect v1.21.0 - github.com/codefly-dev/saas-sdk-go v0.0.3-0.20260903161219-eec695334b45 golang.org/x/net v0.60.0 google.golang.org/protobuf v1.36.12 ) -require ( - golang.org/x/text v0.42.0 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260911204522-f61a6ca850bd // indirect -) +require golang.org/x/text v0.42.0 // indirect diff --git a/libraries/source-read-sdk/go/go.sum b/libraries/source-read-sdk/go/go.sum index 85ffdff88..5fb0a6713 100644 --- a/libraries/source-read-sdk/go/go.sum +++ b/libraries/source-read-sdk/go/go.sum @@ -2,15 +2,11 @@ buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-202608252041 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2/go.mod h1:TCt1lluMFnctISJXvkIQ4x3ABrPuUKCWKyjKdkJNBpw= connectrpc.com/connect v1.21.0 h1:LhqSJt7jHf5NJBo9Jq/t/9FjcYAideif0mg+qe2jCUs= connectrpc.com/connect v1.21.0/go.mod h1:A2ygJrukXwWy32vkCAAHNVguZrqZ+jeZ9rGRnGR4dN4= -github.com/codefly-dev/saas-sdk-go v0.0.3-0.20260903161219-eec695334b45 h1:wSGvbzgLs5uEDeZwuz99Xw/Ta5wU7nOWpeEGTZizp/g= -github.com/codefly-dev/saas-sdk-go v0.0.3-0.20260903161219-eec695334b45/go.mod h1:/AeO1YURG+Hx7x83dbC+M6CVkyUbm8++g6JMrNQETKc= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= -google.golang.org/genproto/googleapis/api v0.0.0-20260911204522-f61a6ca850bd h1:jgCQeWccunvocKNK2RjhQHNiSjSeMMuBpQ/5pbP+2lA= -google.golang.org/genproto/googleapis/api v0.0.0-20260911204522-f61a6ca850bd/go.mod h1:r4KD2hOq82JBWpTWkJ9NZLf6EwmRvAPIFmk7hPNtd+0= google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= diff --git a/libraries/source-read-sdk/go/source_read_test.go b/libraries/source-read-sdk/go/source_read_test.go index 91d25f928..433dff0f2 100644 --- a/libraries/source-read-sdk/go/source_read_test.go +++ b/libraries/source-read-sdk/go/source_read_test.go @@ -22,7 +22,7 @@ type projection struct { } func (projection) ListReadableSourceCollections(_ context.Context, r *connect.Request[v1.ListReadableSourceCollectionsRequest]) (*connect.Response[v1.ListReadableSourceCollectionsResponse], error) { - if r.Msg.GetPageToken() != "cursor" || r.Header().Get("X-Codefly-Work-Context") != "original-viewer" || r.Header().Get("X-Codefly-Internal-Token") != "perimeter" { + if r.Msg.GetPageToken() != "cursor" || r.Header().Get("X-Codefly-Work-Context") != "original-viewer" || r.Header().Get("X-Codefly-Internal-Token") != "" { return nil, connect.NewError(connect.CodeUnauthenticated, nil) } return connect.NewResponse(&v1.ListReadableSourceCollectionsResponse{Collections: []*v1.ReadableSourceCollection{{SourceId: "source", BoundaryId: "collection", Origin: "github", Container: "acme/handbook", Paths: []string{"docs"}}}}), nil @@ -45,7 +45,6 @@ func TestGeneratedSourceProjectionUsesInternalGRPC(t *testing.T) { credentials := connect.UnaryInterceptorFunc(func(next connect.UnaryFunc) connect.UnaryFunc { return func(ctx context.Context, req connect.AnyRequest) (connect.AnyResponse, error) { req.Header().Set("X-Codefly-Work-Context", "original-viewer") - req.Header().Set("X-Codefly-Internal-Token", "perimeter") return next(ctx, req) } }) @@ -58,6 +57,60 @@ func TestGeneratedSourceProjectionUsesInternalGRPC(t *testing.T) { t.Fatalf("%v %v", result, err) } } +func (projection) ExchangeDelegatedReadAudience(_ context.Context, r *connect.Request[v1.ModuleExchangeDelegatedReadAudienceRequest]) (*connect.Response[v1.IssuedWorkContext], error) { + if r.Header().Get("X-Codefly-Work-Context") != "calling-module" || r.Header().Get("X-Codefly-Internal-Token") != "" || r.Msg.GetParentWorkContextToken() != "original-viewer" || r.Msg.GetBindingId() != "installed-read" { + return nil, connect.NewError(connect.CodeUnauthenticated, nil) + } + return connect.NewResponse(&v1.IssuedWorkContext{Token: "viewer-child"}), nil +} + +func TestPublicSDKDelegatedExchangePreservesSeparateCredentials(t *testing.T) { + _, handler := rpc.NewModuleCapabilitiesServiceHandler(projection{}) + server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.ProtoMajor != 2 || !strings.HasPrefix(r.Header.Get("Content-Type"), "application/grpc") { + http.NotFound(w, r) + return + } + handler.ServeHTTP(w, r) + })) + server.Config.Protocols = new(http.Protocols) + server.Config.Protocols.SetUnencryptedHTTP2(true) + server.Start() + defer server.Close() //nolint:staticcheck // private listener uses h2c + for _, module := range []string{"calling-module", "original-viewer", ""} { + t.Run(module, func(t *testing.T) { + credentials := connect.UnaryInterceptorFunc(func(next connect.UnaryFunc) connect.UnaryFunc { + return func(ctx context.Context, req connect.AnyRequest) (connect.AnyResponse, error) { + req.Header().Set("X-Codefly-Work-Context", module) + return next(ctx, req) + } + }) + client, err := accounts.NewInternal(server.URL, connect.WithInterceptors(credentials)) + if err != nil { + t.Fatal(err) + } + result, err := client.ModuleCapabilities().ExchangeDelegatedReadAudience(context.Background(), &v1.ModuleExchangeDelegatedReadAudienceRequest{BindingId: "installed-read", ParentWorkContextToken: "original-viewer"}) + if module == "calling-module" { + if err != nil || result.GetToken() != "viewer-child" { + t.Fatal(result, err) + } + } else if connect.CodeOf(err) != connect.CodeUnauthenticated { + t.Fatal("substituted module credential accepted", err) + } + }) + } +} + +func TestGeneratedLibraryDoesNotImportLegacySDK(t *testing.T) { + raw, err := os.ReadFile("go.mod") + if err != nil { + t.Fatal(err) + } + if strings.Contains(string(raw), "github.com/codefly-dev/saas-sdk-go") { + t.Fatal("generated client depends on retired SDK") + } +} + func TestContractContainsOnlyRequiredDescriptors(t *testing.T) { raw, err := os.ReadFile("../contract/contract.binpb") if err != nil { @@ -107,56 +160,3 @@ func TestContractContainsOnlyRequiredDescriptors(t *testing.T) { t.Fatal("unrelated service exposed") } } - -func (projection) ExchangeDelegatedReadAudience(_ context.Context, r *connect.Request[v1.ModuleExchangeDelegatedReadAudienceRequest]) (*connect.Response[v1.IssuedWorkContext], error) { - if r.Header().Get("X-Codefly-Work-Context") != "calling-module" || r.Header().Get("X-Codefly-Internal-Token") != "perimeter" || r.Msg.GetParentWorkContextToken() != "original-viewer" || r.Msg.GetBindingId() != "installed-read" { - return nil, connect.NewError(connect.CodeUnauthenticated, nil) - } - return connect.NewResponse(&v1.IssuedWorkContext{Token: "viewer-child"}), nil -} - -func TestPublicSDKDelegatedExchangePreservesSeparateCredentials(t *testing.T) { - _, handler := rpc.NewModuleCapabilitiesServiceHandler(projection{}) - server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - if r.ProtoMajor != 2 || !strings.HasPrefix(r.Header.Get("Content-Type"), "application/grpc") { - http.NotFound(w, r) - return - } - handler.ServeHTTP(w, r) - })) - server.Config.Protocols = new(http.Protocols) - server.Config.Protocols.SetUnencryptedHTTP2(true) - server.Start() - defer server.Close() //nolint:staticcheck // private listener uses h2c - for _, module := range []string{"calling-module", "original-viewer", ""} { - t.Run(module, func(t *testing.T) { - credentials := connect.UnaryInterceptorFunc(func(next connect.UnaryFunc) connect.UnaryFunc { - return func(ctx context.Context, req connect.AnyRequest) (connect.AnyResponse, error) { - req.Header().Set("X-Codefly-Work-Context", module) - req.Header().Set("X-Codefly-Internal-Token", "perimeter") - return next(ctx, req) - } - }) - client, err := accounts.NewInternal(server.URL, connect.WithInterceptors(credentials)) - if err != nil { - t.Fatal(err) - } - result, err := client.ModuleCapabilities().ExchangeDelegatedReadAudience(context.Background(), &v1.ModuleExchangeDelegatedReadAudienceRequest{BindingId: "installed-read", ParentWorkContextToken: "original-viewer"}) - if module == "calling-module" { - if err != nil || result.GetToken() != "viewer-child" { - t.Fatal(result, err) - } - } else if connect.CodeOf(err) != connect.CodeUnauthenticated { - t.Fatal("substituted module credential accepted", err) - } - }) - } -} - -func TestSharedDescriptorsAreNotVendored(t *testing.T) { - for _, path := range []string{"gen/saas/policy", "gen/saas/jobs", "gen/saas/accounts/v1/work_contexts.pb.go"} { - if _, err := os.Stat(path); !os.IsNotExist(err) { - t.Fatalf("shared descriptor must come from public SDK, found %s: %v", path, err) - } - } -} diff --git a/libraries/source-read-sdk/go/transport.go b/libraries/source-read-sdk/go/transport.go index 4a71dbcdf..458768506 100644 --- a/libraries/source-read-sdk/go/transport.go +++ b/libraries/source-read-sdk/go/transport.go @@ -23,6 +23,19 @@ func (g internalGateway) HTTPClient() *http.Client { return g.client } // h2c inside the mesh; HTTPS endpoints retain normal certificate verification. // Supply credentials through Connect interceptors, never through the URL. func NewInternal(baseURL string, opts ...connect.ClientOption) (*Client, error) { + gw, err := InternalGateway(baseURL) + if err != nil { + return nil, err + } + return New(gw, append(opts, connect.WithGRPC())...), nil +} + +// InternalGateway is the Gateway of Accounts' private endpoint: HTTP/2, h2c for +// http:// inside the mesh, certificate-verified TLS for https://. The facade +// skips streaming RPCs, so a caller of FetchDatasourceBlob or +// FetchDatasourceFiles builds the generated accountsv1connect client on it +// (with connect.WithGRPC()) rather than dialling the endpoint itself. +func InternalGateway(baseURL string) (Gateway, error) { endpoint, err := url.Parse(baseURL) if err != nil { return nil, err @@ -37,7 +50,7 @@ func NewInternal(baseURL string, opts ...connect.ClientOption) (*Client, error) return (&net.Dialer{}).DialContext(ctx, network, address) } } - return New(internalGateway{url: baseURL, client: &http.Client{Transport: transport}}, opts...), nil + return internalGateway{url: baseURL, client: &http.Client{Transport: transport}}, nil } type errInvalidInternalEndpoint struct{} diff --git a/libraries/source-read-sdk/library.codefly.yaml b/libraries/source-read-sdk/library.codefly.yaml index 8fdf9a3f1..0b9c97730 100644 --- a/libraries/source-read-sdk/library.codefly.yaml +++ b/libraries/source-read-sdk/library.codefly.yaml @@ -1,20 +1,21 @@ kind: library name: source-read-sdk -version: 0.1.0 +version: 0.0.0 languages: - name: go path: go/ exports: - github.com/codefly-dev/module-saas-starter/libraries/source-read-sdk/go sources: - - package: codefly/saas-starter - version: 0.1.0 + - package: local + version: 0.0.0 + module: saas-starter service: accounts - endpoint: connect - contract-digest: sha256:a0fb4ae81270a9648d4d119f5b7c87dff9ce0aaf0fc8e3de0a6213ec32aa70da + endpoint: authority + contract-digest: sha256:e8b577955a9bc1cdd7924063718b82563794917421ad4a83aecfff9629e500c6 services: - ModuleCapabilitiesService generated-by: - codefly: 0.1.181 - companion: ghcr.io/codefly-dev/proto:0.0.16 + codefly: 0.1.215 + companion: ghcr.io/codefly-dev/proto:0.0.18 facade: true diff --git a/module/AGENTS.md b/module/AGENTS.md index 0ffdb2bab..a0f7b30c1 100644 --- a/module/AGENTS.md +++ b/module/AGENTS.md @@ -105,11 +105,13 @@ Postgres 0.0.146 and Vault 0.0.42, which include their owners' outcome fixes. An empty legacy response is not evidence that tests passed; do not bypass that check or disable the service's test phase to accept it. -CI selects released CLI v0.1.197 in `scripts/ci/install-codefly.sh` for every -planner/executor job. This release includes the merged lifecycle/artifact-cache -implementation and environment-wide standard OTEL delivery from the optional -`telemetry:` declaration. The historical source candidate remains available only -for explicit development qualification; release tags refuse source candidates. +CI selects released Codefly CLI **v0.1.215** in +`scripts/ci/install-codefly.sh` for every planner/executor job. Use that release +for local runtime qualification too: the accounts service declares Codefly's +`egress` configuration producer, which older development binaries may not +resolve. The CLI exports the host interfaces alongside the owned API in one +Connect contract. The root module agent and `module/tools` retain Core +`v0.19.7-0.20261025161440-4e7f8ef01ed2` to validate that multi-package format. Accounts and auth-gateway use released SDK v0.4.1; other services retain their own released pins. @@ -150,8 +152,8 @@ Design records: [SOLUTION_REGISTRATION.md](./SOLUTION_REGISTRATION.md), consumer workspace — `legal`, `identity`, `internal-auth`, `federation`, and the rest. A consumer overrides a group only by declaring one of the same name. No group declares module authority: the module principal registry is derived -from delivered authority inside the module envelope a platform super_admin -writes ([services/accounts/AGENTS.md](./services/accounts/AGENTS.md#the-composed-module-service-principal)). +from applied signed manifests; an existing administrative envelope can narrow +them ([services/accounts/AGENTS.md](./services/accounts/AGENTS.md#the-composed-module-service-principal)). **A credential's blast radius is the set of services that DECLARE its group**, not the set that reads it: a declared group is injected whether anything reads it or diff --git a/module/CALLABLE_SOURCES.md b/module/CALLABLE_SOURCES.md index 63f208f4e..f7b934267 100644 --- a/module/CALLABLE_SOURCES.md +++ b/module/CALLABLE_SOURCES.md @@ -29,9 +29,18 @@ The result includes each declaration's schemas, effect, bound and canonical dige it grants no invocation authority and is not itself a model-facing tool projection. Consumers must freeze the admitted declaration and separately authorize execution. -Invoke takes `org_id`, `source_id`, `operation`, `input_json`, and `effect_id`. +Invoke takes `org_id`, `source_id`, `operation`, `input_json`, `effect_id`, and +optional `expected_declaration_digest`. A consumer admitting a frozen operation +supplies its canonical `sha256:` declaration digest. A different live declaration +is refused with `SOURCE_DECLARATION_CHANGED` before creating an attempt or +calling the provider, including after waiting for receipt serialization. +Omitting the precondition retains the existing current-declaration behavior. +The precondition is part of the SDK request fingerprint; adding, removing or +changing it under an existing effect cannot replay a different request. +Lookup still takes only the original effect ID and recovers retained evidence +under current source-read authority after declaration replacement or removal. `input_json` is a string containing exactly one JSON object. The complete -protojson request (proto field names, unpopulated fields included) is limited to +protojson request (proto field names, unpopulated non-optional fields included) is limited to 65,536 bytes. Declarations require a closed input-object schema; named template parameters become escaped path components, listed query fields become query parameters, and the remaining object becomes the body. GET and DELETE refuse a @@ -183,15 +192,75 @@ Teredo are refused outright rather than decoded, because a network-specific NAT64 prefix cannot be recognised and a decoded public address is still reached through a translator on the host's own network. A v4-mapped `::ffff:a.b.c.d` is judged as `a.b.c.d`. A zoned address, or one the guard cannot parse, is refused. -The one exception is a local runtime's explicit list of loopback addresses, -described in [Local egress](#local-egress); every address it does not list is -still judged by the guard. +Every guard asks one rule, `auth.AdmitsDestination`: that classifier, plus a +declared host a meshed cell resolves into its mesh egress range, described in +[Mesh egress](#mesh-egress). The one other exception is a local runtime's +explicit list of loopback addresses, described in [Local egress](#local-egress); +every address it does not list is still judged by the guard. Named refusal/receipt/audit constructors discard provider error bodies and raw transport errors. Credential reflection in a successful provider body is refused. Audit records actor, source, operation, effect, effect ID and the closed outcome vocabulary (`committed`, `refused`, `unresolved`, `rate_limited`), never input, output, tokens or URLs. Failed operation resolution uses an `UNKNOWN` effect. +## Mesh egress + +On a cell whose ambient mesh carries egress, the mesh answers DNS for each host +the deployment declares as external reach with an address it allocated itself: +Istio ambient's auto-allocated ServiceEntry addresses, `240.240.0.0/16` by +default. It routes a connection to that address through its egress waypoint to +the real host. The address is reserved space, so the public-address classifier +refuses it, and without an admission every guarded path refuses the hosts the +cell exists to reach. + +The rule every guarded path applies (`pkg/auth/mesh_egress.go`), to the +concrete address a connection is about to reach: + +- a **public** address is admitted, as before; +- an address in the **mesh egress range** is admitted only when the deployment + asserts its mesh (`internal-transport/mesh-protected=true`) **and** the client + asked for a **hostname** that is declared, on the declared port, in + `egress/HOSTS`; +- everything else is refused exactly as before: an IP literal (never a declared + host, whatever range it is in), an undeclared hostname resolving into the + range, and every loopback, link-local, metadata, private or other non-public + address whatever name produced it. + +Both conditions are needed. Any name a tenant controls can answer with a mesh +address, which the mesh then routes to whichever declared host owns it, so the +range alone would admit a tenant's name. A declared name answering with +`10.0.0.1` is not a mesh answer, so the name alone would admit it. + +It is decided on the address actually dialled. Each guarded client resolves the +requested host, then dials each answer as an IP literal, with the dial's +Control hook judging that literal against the host:port the client asked for, +so a later DNS answer cannot replace a judged one. The webhook client keeps its +own resolve-and-pin dial and asks the same rule. + +Configuration. The hosts are the environment's `egress` declaration for +`saas/accounts`, the same entry the cell renders its egress ServiceEntries +from; Codefly generates [`egress`](configurations/README.md#egress)/`HOSTS` +from it (`api.example.com:443,hooks.example.com:8443`) and delivers it to +accounts, so nothing here lists them. The mesh assertion and the range are +[`internal-transport`](configurations/README.md#internal-transport) values: + +``` +mesh-protected=true +mesh-egress-range=240.240.0.0/16 +``` + +- **Nothing declared, nothing admitted.** No host is admitted at a mesh + address until the environment declares one. +- **Inert without the mesh.** Declared hosts on a deployment without + `mesh-protected=true` start the service and admit nothing: a declared host + resolving into the range is refused there like any other reserved address. + A `mesh-egress-range` without `mesh-protected=true` refuses startup, naming + the keys, because a range is only ever set by hand for a mesh. +- **The range is bounded.** `mesh-egress-range` defaults to `240.240.0.0/16`. + A configured prefix must lie inside `240.0.0.0/4` or `2001:2::/48`, the + blocks Istio allocates from, which no pod, node, Service or metadata address + uses. + ## Local egress A composition booted locally can prove an OAuth REST source end to end against a @@ -305,10 +374,11 @@ in-memory and httptest fixtures qualify HTTP and host decisions; real business tests require Postgres and Vault booted by Codefly. Test results and any boot or Core/CLI delivery blocker are recorded in the PR; a compiled test is not a passed integration test. The callable-sources handbook decision is accepted (proposal -#269, merged in handbook PR #271). All host Go modules that depend on Core pin released v0.18.0, which carries -#755; host suites run with `GOWORK=off`. Generation and CI pin released CLI -v0.1.185 (`3558defb95c8316cd2ad078327b10c721cf187d5`), carrying #943/#947. -No development CLI or local Core override is required. The CLI preserves scope +#269, merged in handbook PR #271). Host suites run with `GOWORK=off`. Generation and CI select the exact +CLI source candidate documented in `AGENTS.md`, which exports the owned API +and implemented host interfaces together. The root and tools Core pins validate +that multi-package contract; service pins remain independent. This candidate +is not release qualification. The CLI preserves scope slots in operation documents and resolves composition selections during preparation, checking that the called endpoint serves both Invoke and Lookup. A passing generation drift check alone does not qualify the delivery path. diff --git a/module/DATABASE_AUTHORITY.md b/module/DATABASE_AUTHORITY.md index 5e3c24ba6..b0777de0d 100644 --- a/module/DATABASE_AUTHORITY.md +++ b/module/DATABASE_AUTHORITY.md @@ -526,7 +526,7 @@ executable inventory and this table in the same change. | Scope | Relations | Required database boundary | |---|---|---| | `global` | `audit_event_types`, `bootstrap_state`, `data_retention_policies`, `datasource_credential_budgets`, `email_templates`, `feature_flags`, `identity_providers`, `module_envelopes`, `plan_entitlements`, `plans`, `platform_admins`, `policy_log_commits`, `policy_log_cursor`, `solution_delivery_documents`, `solution_generation_history`, `solution_host_bindings`, `solution_registrations`, `solution_targets` | No RLS; exact grants | -| `tenant` | `actor_chain_journal`, `actor_chain_revocations`, `api_keys`, `approval_decisions`, `approval_requests`, `audit_event_idempotency`, `audit_events`, `connector_credentials`, `dashboards`, `datasource_account_links`, `datasource_domains`, `datasource_group_bindings`, `codefly_effect_receipts`, `datasource_operation_attempts`, `datasource_oauth_consumed_states`, `datasource_source_operations`, `datasource_sources`, `delegation_grants`, `domain_events`, `entitlement_overrides`, `executable_artifact_approvals`, `github_app_installations`, `github_app_setups`, `installations`, `invitations`, `membership_integrity_findings`, `org_generic_settings`, `org_identity_providers`, `org_key_bindings`, `org_settings`, `organization_activations`, `organization_authorization_revisions`, `organization_members`, `organizations`, `principal_authorization_revisions`, `principals`, `record_shares`, `role_assignments`, `role_permissions`, `roles`, `scope_grants`, `scope_nodes`, `source_delegations`, `source_read_revisions`, `subscriptions`, `team_members`, `team_membership_quarantine`, `teams`, `usage_events`, `usage_totals`, `webhook_deliveries`, `webhook_subscriptions`, `work_context_replay` | Enabled and forced RLS with at least one policy | +| `tenant` | `actor_chain_journal`, `actor_chain_revocations`, `api_keys`, `approval_decisions`, `approval_requests`, `audit_event_idempotency`, `audit_events`, `connector_credentials`, `dashboards`, `datasource_account_links`, `datasource_domains`, `datasource_group_bindings`, `codefly_effect_receipts`, `datasource_operation_attempts`, `datasource_oauth_consumed_states`, `datasource_source_operations`, `datasource_sources`, `delegation_grants`, `domain_events`, `entitlement_overrides`, `executable_artifact_approvals`, `github_app_installations`, `github_app_setups`, `installations`, `invitations`, `membership_integrity_findings`, `module_delegations`, `org_generic_settings`, `org_identity_providers`, `org_key_bindings`, `org_settings`, `organization_activations`, `organization_authorization_revisions`, `organization_members`, `organizations`, `principal_authorization_revisions`, `principals`, `record_shares`, `role_assignments`, `role_permissions`, `roles`, `scope_grants`, `scope_nodes`, `source_delegations`, `source_read_revisions`, `subscriptions`, `team_members`, `team_membership_quarantine`, `teams`, `usage_events`, `usage_totals`, `webhook_deliveries`, `webhook_subscriptions`, `work_context_replay` | Enabled and forced RLS with at least one policy | | `user` | `client_authorization_codes`, `gdpr_requests`, `mfa_backup_codes`, `mfa_devices`, `mfa_login_transactions`, `notifications`, `onboarding_progress`, `resource_follows`, `sessions`, `user_consent_events`, `user_consent_preferences`, `user_identities`, `users`, `webauthn_ceremonies`, `webauthn_credentials` | Enabled and forced RLS with at least one policy | | `pre_auth` | `magic_links`, `waitlist_entries` | Enabled and forced RLS; fail-closed request policy, accessed only by the control-plane role | | `job` | `job_messages` | Enabled and forced RLS with at least one policy; no request relation grant — function-only scoped enqueue plus exact job-worker grants | diff --git a/module/INTERNAL_TRANSPORT.md b/module/INTERNAL_TRANSPORT.md index 5048a1cc8..a51afb219 100644 --- a/module/INTERNAL_TRANSPORT.md +++ b/module/INTERNAL_TRANSPORT.md @@ -183,13 +183,13 @@ its own, and it is the internal tier **narrowed**: lists it, and `business.ValidateModuleAuthorityProcedures` — which runs in the catalog and deployment generators — holds every entry to one of two shapes: the module capability surface, which authenticates the calling module from its - verified Work Context and authorizes it against the grant its composition - declared; or one of two read-only authority oracles - (`CheckAuthorizationRevision`, `AuthorizeEvidenceRead`), which authorize on - the perimeter credential alone and answer one bit about a capability the - consumer already holds. Every other method is refused on this listener, - whatever credential it carries: the exchanges the gateway brokers (a module - never presents its own secret to accounts), the gateway's registries and + verified Work Context (or, for `MintSourceOperationContext`, its workload + credential) and authorizes it against the grant its composition declared; or one of two read-only authority oracles + (`CheckAuthorizationRevision`, `AuthorizeEvidenceRead`), which authenticate + the calling module from its own module Work Context the same way and answer + one bit about a capability the consumer already holds. Every other method is refused on this listener, + whatever credential it carries: a module's own Work Context and operation + context mints (the authority interface's Issue serves them), the gateway's registries and validators, the generic permission oracles, principal administration, and every method that authorizes on the perimeter credential alone **and mutates state** — `ConsumeUsage`, `StartInstallationTask`, and `ConsumeSingleUse`, @@ -200,9 +200,24 @@ its own, and it is the internal tier **narrowed**: `AlreadyExists` on its own valid token, or fill the replay table for tenants it has no relationship with. Each joins the endpoint once it decides on a credential bound to the consuming module. -- **Every call still carries the internal credential**, exactly as on the - private listener, and the capability surface still decides on the verified - Work Context and the module's declared grant. +- **The endpoint asks no perimeter credential.** Every method on it proves + the calling module itself — from its verified module Work Context, or for the + one workload mint (`MintSourceOperationContext`) from the pod's workload + credential, reviewed and bound to its build — and holds it to the module's + current grant; a shared token would name no module and add nothing. The two + read-only oracles do the same: a call presenting no module Work Context, or + only the internal token, is refused `Unauthenticated` with the reason named. +- **The endpoint denies by default.** Its interceptor verifies the calling + module's own Work Context (exactly one, in `x-codefly-work-context`) before + any handler runs, for every procedure except the explicit allowlist of + workload mints (`business.ModuleAuthorityAuthenticatesInRequest`), so a method + that forgot to identify its caller is still never served open. + `TestEveryModuleAuthorityProcedureRefusesAnUnidentifiedCaller` calls every + procedure with no credential and with the internal token alone and requires + a refusal with nothing written. A module asking about a viewer it serves + (`CheckWorkContextRecordAccess`, `ListReadableSourceCollections`) presents its + own Work Context in the header and the viewer's in + `viewer_work_context_token`, and the viewer must be addressed to that module. - **Transport is unchanged**: h2c, resolved rather than configured: ```go diff --git a/module/NOTIFICATIONS.md b/module/NOTIFICATIONS.md index 11e353fd6..9e39793fb 100644 --- a/module/NOTIFICATIONS.md +++ b/module/NOTIFICATIONS.md @@ -36,9 +36,11 @@ without dropping it for a module the host does not admit as a principal. also answer `FAILED_PRECONDITION` with reason `NOTIFICATION_IDEMPOTENCY_CONFLICT` when an idempotency key was already used for different content, which is the sender's own bug and must not be dropped as -a departed recipient; and with `LIVE_AUTHORITY_UNAVAILABLE` when the host cannot -re-read live module authority, which is an operator's to repair and whose work a -sender must retain. An absent or unrecognised reason is retainable too — only +a departed recipient. A host that cannot re-read live module authority answers +`UNAVAILABLE` with reason `LIVE_AUTHORITY_UNAVAILABLE`: an operator's to repair, +and work a sender must retain. A module context this host does not admit (not +registered, installed nowhere, tenant moved, another registry binding) answers +`UNAUTHENTICATED`: the module drops its context and mints again. An absent or unrecognised reason is retainable too — only `TENANT_MEMBERSHIP_MISSING` is final. **The consuming side of this distinction is not done, and this host cannot diff --git a/module/REST_SURFACE.md b/module/REST_SURFACE.md index 5d027e3bc..49d352fb5 100644 --- a/module/REST_SURFACE.md +++ b/module/REST_SURFACE.md @@ -79,6 +79,12 @@ unknown field, missing/extra service, unsupported binding kind, duplicate plugin, unsafe template, route collision, internal exposure, or ownership drift fails generation. +The plugin registers the generated `InstallationService` transcoder as well as +the principal, delegation and Work Context transcoders. Its transport regression +test exercises every installation REST route through gRPC and preserves the +selected RPC's permission refusal; catalog presence alone does not prove a +handler is mounted. + ## Runtime boundary Accounts registers only catalog-selected services and wraps grpc-gateway in a @@ -117,11 +123,24 @@ Run from `module/services/accounts`, with Docker running and a Codefly CLI at or above 0.1.160: ```sh -codefly generate proto --proto ./proto --path saas --output .. --template accounts/proto/buf.gen.yaml +codefly generate proto --proto ./proto --output .. --template accounts/proto/buf.gen.yaml cd code go generate ./pkg/business ./pkg/adapters ./pkg/cataloggen ``` +Pass no `--path`: the template's own `inputs` select both owned trees, `saas` +and the implemented host interfaces under `host`. `--path saas` alone leaves +`host` out of the merged raw OpenAPI document (`strategy: all`), so the tree no +longer regenerates to what is committed. An implemented interface's +`google.api.http` mappings are not on this service's REST surface: the gateway +route compiler gives an interface procedure Connect routes only and +`RenderPublicOpenAPI` drops its operations. + +The catalog step is the repository's own compilers run through `go generate`. +Codefly does not yet drive them through its generation lifecycle (an open +tooling gap at the Go agent and Core `Sync`); until it does, this is the +documented path, and CI's freshness checks hold its output to it. + The adapters step also emits `generated/api-contract-surfaces.json` from the complete Connect registration catalog and the authority listener's allowlist. Module `contracts.codefly.yaml` selects it with diff --git a/module/SOLUTION_REGISTRATION.md b/module/SOLUTION_REGISTRATION.md index 69e93c393..11fa4cd4f 100644 --- a/module/SOLUTION_REGISTRATION.md +++ b/module/SOLUTION_REGISTRATION.md @@ -446,15 +446,38 @@ manifest for the binding under another domain is refused (403) even while no applied manifest remains, at receipt and by the pass. `SOLUTION_HOST_OWNERSHIP_DOMAINS` bounds the domains any pin may grant: a pin naming another refuses the boot by name. -### Module authority: the manifest asks, the envelope grants +### Module authority: the manifest asks, an envelope narrows, an installation consents The module registry every capability decision reads is derived each pass from -the applied, live manifests whose stored carrier still verifies and the -administrator's module envelope. A manifest's `authority.principal` is the -module's principal; its entry is the envelope's grant for that principal -intersected with what the manifest asks for — queues, namespaces, resource kinds, -and per operation binding the `invoke`, `lookup` and `headless` scopes — never -more than either. A binding the envelope does not allow, or allows on another +the applied, live manifests whose stored carrier still verifies and, where one +is written, the administrator's module envelope. A manifest's +`authority.principal` is the module's principal. With an envelope, its entry is +the envelope's grant for that principal intersected with what the manifest asks +for — queues, namespaces, resource kinds, and per operation binding the +`invoke`, `lookup` and `headless` scopes — never more than either. With no +envelope, the verified signed manifest is the ceiling on its own. + +**What an organisation holds is bounded by what it consented to.** An +installation made with no explicit scope records the consented snapshot of the +ceiling it was installed under, and a later ceiling can only narrow it. A +module installation follows its grant as it moves only while an envelope sets +that grant — a ceiling a platform administrator, or the composition's signed +envelope, approved for every organisation. With no envelope, a later manifest +generation that **widens** the ceiling reaches no organisation that installed +an earlier one. An organization owner or admin explicitly approves the current +ceiling by calling `host.installation.v1.InstallationService/Install` again with +the same target and role, or `saas.accounts.v1.InstallationService/InstallSolution` +with the target ID. A module re-install records a fresh snapshot, retains the +installation ID, ownership and standing grants, and advances its revision when +consent changes. A non-admin cannot re-consent, even by naming an admin owner. +A fresh installation consents to the current generation. Fixture-declared +installations use this same path: the host's setup is consent at creation and, +when reseeded, re-consents its own existing module installations. A +narrowing reaches every installation at once. An installation that already +follows its grant (recorded under an envelope, or before the signed manifest +became the ceiling) holds **nothing** on a host with no envelope — its +capabilities answer `FAILED_PRECONDITION` with reason +`INSTALLATION_CONSENT_REQUIRED` — until its administrator installs again. A binding the envelope does not allow, or allows on another audience, is omitted by name. Two manifests asking for one principal, or two principals sharing a workload, are omitted. The envelope document is `{"revision": N, "principals": {"": {"grant": {…}}}}`; it names no @@ -465,9 +488,10 @@ workload and approves no build. The envelope is written two ways, through one writer: interactively by a platform super_admin (`PlatformAdminService/PutModuleEnvelope`, fresh MFA), or **delivered** from the composition, which declares each environment's envelope -and signs it at publish with the cell's release key. Without a delivered -envelope a hosted cell applies every module's signed manifest and grants none -of them. +and signs it at publish with the cell's release key. Without an envelope a +host grants each module what its verified signed manifest asks for, and each +organisation holds what it consented to at installation (above): a later +generation's widening waits for that organisation's administrator. `POST /platform/_delivery/envelope` takes one carrier of core's `codefly/module-envelope/v1` (`{document, envelope}`, the same carrier shape, @@ -522,9 +546,10 @@ host with no verifier at all still reads it. A platform super_admin reads and writes it at `/admin/platform/module-authority`: the current revision, who wrote it and when, and every principal the applied -manifests ask for that it does not allow. With no envelope every module is -denied, and each reconcile pass says so by name in the accounts log -(`ErrModuleEnvelopeMissing`). +manifests ask for that it does not allow. With no envelope, applied signed +manifests supply the ceiling directly, and installations hold their consented +snapshot of it. An existing envelope narrows that ceiling; +a failed read never removes its restrictions. ### Configuration diff --git a/module/WEBHOOKS.md b/module/WEBHOOKS.md index 3d40cc479..b18bc72fd 100644 --- a/module/WEBHOOKS.md +++ b/module/WEBHOOKS.md @@ -4,7 +4,11 @@ Webhook endpoints must be public `https://` URLs on port 443. Accounts resolves all A/AAAA records when an endpoint is registered and again immediately before each connection. If any answer is not on the public internet, the request is rejected. That judgement is `auth.IsPublicDestination`, the classifier the -host's guarded egress paths share. The paths it covers, and the OIDC clients it +host's guarded egress paths share, plus one admission they share too: on a +meshed cell, a host the environment declares as accounts' egress +(`egress/HOSTS`) may answer +with an address in the mesh egress range +([Mesh egress](./CALLABLE_SOURCES.md#mesh-egress)). The paths it covers, and the OIDC clients it does not, are listed in [CALLABLE_SOURCES.md](./CALLABLE_SOURCES.md#oauth-and-disclosure). It reads the IANA IPv4 and IPv6 special-purpose registries, with IPv6 bounded to the diff --git a/module/WORK_CONTEXTS.md b/module/WORK_CONTEXTS.md index 45886cc01..cde7fa31e 100644 --- a/module/WORK_CONTEXTS.md +++ b/module/WORK_CONTEXTS.md @@ -3,8 +3,8 @@ `ModuleCapabilitiesService.ExchangeDelegatedReadAudience` is an internal, read-only exchange for a module holding a current signed parent but no owner -bearer. The module authenticates independently with its own module Work Context -and the internal perimeter credential. Its request contains only `binding_id` +bearer. The module authenticates independently with its own module Work Context; +no perimeter credential is asked. Its request contains only `binding_id` and `parent_work_context_token`. No owner, actor, target audience or scope is caller selectable. The parent must address the authenticated module's installed prefix and tenant; the canonical current-revision and every-hop revocation @@ -187,6 +187,18 @@ The mode is the binding's, never the request's. The chain-preserving exchange, StartTask and registered-agent actors are unchanged, and a binding without a mode keeps its owner-only child. +**A parent that names its module's bindings.** A person's parent for a module +that will exchange through its installed bindings may name those bindings +instead of their scopes: `StartTask`'s `operation_bindings` takes binding ids +of the audience module. The host resolves each one the way the exchange will +(`ModuleOperationAudience`: the binding as installed at the organization, +narrowed by that installation) and adds its invoke scopes, keeping each +resource only if the person holds it by the check every mint makes. A binding +the person holds nothing under is refused by name. So a source binding's ids +come from the organization's installation, never from the caller. Only a +direct human-owned mint takes it; an actor's mint and a resource-confined mint +refuse it. A scope the caller also names is carried once. + Resource kinds, actions and resource ids are sorted and unique; wildcards are refused. Lookup scopes are optional: a binding that declares only invoke scopes redeems no lookup, and a lookup exchange under it is refused by name. When present, @@ -309,8 +321,8 @@ rejected with the reason rather than one call failing later. Name the resource by its **stable identity**, not by a digest of its current definition. The module principal registry is derived, each reconcile pass, from -the applied module manifests and the module envelope, so re-issuing this entry is -an envelope revision. A grant that has to be re-issued whenever +applied signed manifests, narrowed by an administrative envelope when one exists, +so re-issuing this entry is an envelope revision. A grant that has to be re-issued whenever the producer's definition moves leaves the consumer without access from the moment that definition moves until the new revision and its deliveries are applied, and each accounts replica derives its own registry on its own pass, so diff --git a/module/configurations/README.md b/module/configurations/README.md index 9efda2844..0f318e789 100644 --- a/module/configurations/README.md +++ b/module/configurations/README.md @@ -3,6 +3,10 @@ Each environment declares values in `.env` and secrets in `.secret.env`. Codefly delivers these to services declaring the group; consuming workspaces override a group rather than editing module-owned files. +A document group is one YAML document, `.yaml`: `fixture-grants.yaml` +holds the roles a composing workspace's people hold at the modules it composes, +added to the selected fixture (`services/accounts/code/fixtures/workspace_grants.go`); +the default grants nothing. ## A key a group does not declare is inert @@ -54,7 +58,6 @@ the three services below, all of which need the origin. | `APP_BASE_URL` | accounts (links it mints, the OAuth issuer, the origin it compares a forwarded one with), auth-gateway (a solution's MCP protected-resource metadata and token audience), frontend (the verified public origin it presents to accounts and judges the solution proxy against) | local only: the frontend uses its loopback own endpoint and accounts trusts the forwarded origin. Outside local, accounts refuses to start and a deployed frontend refuses sign-in, naming the key | | `BOOTSTRAP_ADMIN_EMAIL` | accounts | no one-time bootstrap administrator | | `ORGANIZATION_CREATION` | accounts | `open`; `platform_admin` or `disabled` restrict it, anything else refuses the boot | -| `MODULE_AUTHORITY_ENFORCEMENT` | accounts | `enforce`; `warn` grants every module everything its envelope entry allows, widened to the kinds and actions its manifest asks for (resource ids stay the envelope's: a manifest names none), and logs, on every registry pass, what the envelope would have withheld (a cell under validation, never a production default — the token, workload, build, installation and tenant stay enforced); anything else refuses the boot | A deployed frontend never stands its own endpoint in for `APP_BASE_URL` when that endpoint is loopback, cluster-internal (`*.svc`, `*.cluster.local`, a @@ -72,6 +75,36 @@ is the shipped behaviour: | `ACCOUNTS_REVOCATION_FAIL_OPEN` | a token whose revocation status cannot be read is denied — fail **closed** | `true`, only when fronting accounts directly with no auth-gateway, to keep the direct verify path serving through a revocation-store outage at the cost of a revoked token's remaining TTL | | `RBAC_CENTRAL_ENFORCEMENT` | `shadow`: request-time central RBAC admission classifies only | `enforce` to hard-deny. Any other value fails the boot, so a typo cannot leave enforcement off | +## internal-transport + +The mesh assertion and the egress it carries. The composed modules read the +same group, so a cell asserts the mesh once. + +| Key | Empty means | Set to | +| --- | --- | --- | +| `mesh-protected` | `false`: plaintext to a routable in-cluster address is refused | `true` only when every in-cluster hop is carried by a mutually authenticated mesh. Any value other than `true` or `false` fails the boot | +| `mesh-egress-range` | `240.240.0.0/16` (Istio ambient's default) | the CIDR prefixes the mesh allocates egress addresses from, inside `240.0.0.0/4` or `2001:2::/48`. Any other range, or a value without `mesh-protected=true`, refuses the boot | + +The hosts admitted at a mesh egress address are not authored here: they are +[`egress`](#egress)/`HOSTS`, which Codefly generates from the environment's +egress declaration. A declared host is admitted only at an address inside the +range, only when it is the host the client asked for, and only when +`mesh-protected=true`; without the mesh assertion declared hosts are inert. An +IP literal, an undeclared host resolving into the range, and every private, +loopback, link-local or metadata address stay refused. See +[Mesh egress](../CALLABLE_SOURCES.md#mesh-egress). + +## egress + +Codefly-owned: the module ships no file for it, and render refuses an authored +one. Codefly generates it from the environment's `egress` declaration and +delivers it to accounts, which lists `egress` among its workspace +configuration dependencies. + +| Key | Empty means | Holds | +| --- | --- | --- | +| `HOSTS` | the environment declares no egress: no host is admitted at a mesh egress address, and every guarded egress path admits public addresses only | the hosts the environment declares as external reach, `host:port` (443 when the declaration omits the port), comma-separated and sorted. Admitted at a mesh egress address only with `internal-transport/mesh-protected=true`; inert otherwise | + ## datasource-oauth Accounts reads three JSON maps and one local-only list. This version supports diff --git a/module/configurations/local/application.env b/module/configurations/local/application.env index bb30f3dac..8e7270294 100644 --- a/module/configurations/local/application.env +++ b/module/configurations/local/application.env @@ -40,8 +40,3 @@ BOOTSTRAP_ADMIN_EMAIL= # accounts has read it from this group and no group declared it, so an operator # who set `platform_admin` or `disabled` silently kept `open`. ORGANIZATION_CREATION= -# MODULE_AUTHORITY_ENFORCEMENT: enforce (default, empty) or warn. Under warn -# accounts grants every module what its manifest asks for and logs what the -# envelope would have withheld; the token, workload, build, installation and -# tenant stay enforced. A validation-cell setting, never a production default. -MODULE_AUTHORITY_ENFORCEMENT= diff --git a/module/configurations/local/fixture-grants.yaml b/module/configurations/local/fixture-grants.yaml new file mode 100644 index 000000000..df5acd32e --- /dev/null +++ b/module/configurations/local/fixture-grants.yaml @@ -0,0 +1,9 @@ +# The roles a composing workspace's people hold at the modules it composes, +# and the installations its organisations hold of what it composes, added to +# the selected fixture: the fixture's own `roles`, `assignments` and +# `installations` shape. This module cannot name a composed module's +# permissions or a composition's targets, so its default grants and installs +# nothing; a composing workspace overrides this document. +roles: [] +assignments: [] +installations: [] diff --git a/module/configurations/local/internal-transport.env b/module/configurations/local/internal-transport.env index 97084f80c..59fd3d626 100644 --- a/module/configurations/local/internal-transport.env +++ b/module/configurations/local/internal-transport.env @@ -32,3 +32,13 @@ # The composed modules read the same group and key for their own in-cluster # hops, so a cell asserts it once. mesh-protected=false + +# The CIDR prefixes the mesh allocates egress addresses from, for a cell whose +# ambient mesh carries egress: the hosts the environment's egress declaration +# gives this service (egress/HOSTS, which Codefly generates) are admitted by +# every guarded egress path at an address in this range, and only when +# mesh-protected=true (module/CALLABLE_SOURCES.md, "Mesh egress"). Empty means +# 240.240.0.0/16. Each prefix must lie inside 240.0.0.0/4 or 2001:2::/48 +# (Istio's IPv6 block); any other range refuses startup, as does a value +# without mesh-protected=true. +mesh-egress-range= diff --git a/module/contracts/accounts/saas.events.codefly.yaml b/module/contracts/accounts/saas.events.codefly.yaml index 081da4b2e..eff2c4b43 100644 --- a/module/contracts/accounts/saas.events.codefly.yaml +++ b/module/contracts/accounts/saas.events.codefly.yaml @@ -507,6 +507,14 @@ publishes: schema: saas/events/v1/events.proto#EventEnvelope visibility: external retention: 30d + - type: saas.module_delegation.granted + schema: saas/events/v1/events.proto#EventEnvelope + visibility: external + retention: 30d + - type: saas.module_delegation.revoked + schema: saas/events/v1/events.proto#EventEnvelope + visibility: external + retention: 30d - type: saas.onboarding.step_completed schema: saas/events/v1/events.proto#EventEnvelope visibility: external diff --git a/module/contracts/api/accounts/authority/contract.binpb b/module/contracts/api/accounts/authority/contract.binpb index 8c5b0c9c6..745bef2d3 100644 Binary files a/module/contracts/api/accounts/authority/contract.binpb and b/module/contracts/api/accounts/authority/contract.binpb differ diff --git a/module/contracts/api/accounts/authority/proto/buf.gen.yaml b/module/contracts/api/accounts/authority/proto/buf.gen.yaml index 0da198281..d39d566ac 100644 --- a/module/contracts/api/accounts/authority/proto/buf.gen.yaml +++ b/module/contracts/api/accounts/authority/proto/buf.gen.yaml @@ -4,6 +4,7 @@ inputs: - directory: . paths: - saas + - host managed: enabled: true disable: diff --git a/module/contracts/api/accounts/authority/proto/host/DIGESTS.sha256 b/module/contracts/api/accounts/authority/proto/host/DIGESTS.sha256 new file mode 100644 index 000000000..a7ce1dece --- /dev/null +++ b/module/contracts/api/accounts/authority/proto/host/DIGESTS.sha256 @@ -0,0 +1,5 @@ +65841139428f9df2e44e61233cf20ddb9a5cb900002e62b0441492284a0a5456 authority/v1/authority.proto +ba51d0df01ddad406ee570b2cb2ace754cc06e0c2ef97a2f86078834d7cd0d3d authority/v1/work_context.proto +187b07dd29d4d2f082bf5cd60f6d4801c124522a5e93725d4de8004d3368050e composition/v1/composition.proto +2bfc4fa02a2ca5d77908614e31b22da5c7e6ee18a43b58ce387f82806e56fe85 installation/v1/installation.proto +5d1e2f8fb2e7c3a7b8e027d8de23e26e53fa21212831e23fac492372ac53f28b session/v1/session.proto diff --git a/module/contracts/api/accounts/authority/proto/host/authority/v1/authority.proto b/module/contracts/api/accounts/authority/proto/host/authority/v1/authority.proto new file mode 100644 index 000000000..ce8a6c753 --- /dev/null +++ b/module/contracts/api/accounts/authority/proto/host/authority/v1/authority.proto @@ -0,0 +1,260 @@ +syntax = "proto3"; +// The authority interface: what a module or solution calls on its host to be +// issued a Work Context, to have one checked, and to learn the keys it was +// signed with, and to ask which resources of a kind it covers. Every former spelling (start task, start +// installation task, exchange audience, start child, renew, the module broker's +// mints) is Issue with a different `as`. +package host.authority.v1; + +option go_package = "gateway/pkg/gen/host/authority/v1;authorityv1"; + +import "google/api/annotations.proto"; +import "host/authority/v1/work_context.proto"; + +// AuthorityService is implemented by the host (accounts) and by the local authority. +service AuthorityService { + // Issue signs a Work Context for one owner shape, one audience and the scopes + // asked for, bounded by what the owner holds and what the audience declared. + // Served over REST too (POST /v1/authority:issue), for a module with no + // generated client of its own, as a Python service: the same request and + // answer, in JSON. + rpc Issue(IssueRequest) returns (IssueResponse) { + option (google.api.http) = {post: "/v1/authority:issue" body: "*"}; + } + // Check verifies a presented Work Context for the audience the caller is, + // re-checking the authorization revision and the seal live. + rpc Check(CheckRequest) returns (CheckResponse) { + option (google.api.http) = {post: "/v1/authority:check" body: "*"}; + } + // Keys returns the issuer and the public keys a verifier pins. + rpc Keys(KeysRequest) returns (KeysResponse); + // ListResources answers which resources of one kind a checked capability may + // act on with one action, decided by the authority at the time of the call + // rather than carried in the capability. A module maps the answer onto its + // own resources; the authority knows them only by id. + rpc ListResources(ListResourcesRequest) returns (ListResourcesResponse); + // Delegate records a signed-in person's grant to a module (the caller's + // bearer is the person); Issue with a delegation acts on it. + rpc Delegate(DelegateRequest) returns (Delegation); + // RevokeDelegation ends a delegation; the next Issue from it is refused. + rpc RevokeDelegation(RevokeDelegationRequest) returns (RevokeDelegationResponse); + // GetDelegation reads one delegation for the module it is granted to (by its + // workload credential) or for its grantor (by the caller's bearer): whether it + // still stands. Work that outlives the capability that started it asks this + // between issues, so a revoke stops it even when it calls no other module. + rpc GetDelegation(GetDelegationRequest) returns (Delegation); +} + +// IssueRequest names on whose behalf the capability is issued. +message IssueRequest { + // Who the capability is for; exactly one. + oneof as { + // The signed-in person making this call, identified by the bearer the call + // carries; the host opened that session at sign-in. + PersonSession person = 1; + // A module's own workload, proving which module it is. + WorkloadCredential workload = 2; + // An installation acting for itself, with the scope the organisation consented to. + // actor must authenticate a workload of that installation's solution. + InstallationRef installation = 3; + // One more hop from an existing capability: a child, an exchange or a renewal. + string parent_token = 4; + // A delegation a person granted the module acting (actor): the capability + // is owned by that person and carries the delegation on the module's hop. + // No live capability is presented: the authority re-checks the delegation + // and what its grantor holds now, so a revoked delegation or a lost role + // stops the next issue, and renewing is issuing again. + DelegationRef delegation = 11; + } + // The module principal that may consume the capability. + string audience = 5; + // The scopes asked for; empty means everything the owner holds at the audience. + repeated WorkScopeV1 scopes = 6; + // Requested lifetime in seconds; clamped to the issuer's ceiling. + int64 ttl_seconds = 7; + // The declared binding this capability exercises, when the owner is a workload + // or a child acts through one. + string operation_binding_id = 8; + // The organisation the work runs in. A workload may leave this empty when + // exactly one organisation has an active installation of its module. + // Otherwise it must name the organisation of the work item; + // absent or ambiguous installation authority is refused with a reason. + string organization_id = 9; + // The acting workload credential; required with parent_token, delegation, + // and installation. For installation it must name the installed solution. + WorkloadCredential actor = 10; + // Which of the binding's operations the capability is for: "invoke" (the + // default for a person, a child or a delegation), "headless" (the default for + // a workload) or "lookup": the binding's lookup scopes alone, to read a + // receipt without the authority to repeat the effect. + string operation = 12; +} + +// DelegationRef names one delegation. +message DelegationRef { + // The delegation's id, as Delegate answered it. + string delegation_id = 1; +} + +// DelegateRequest is a signed-in person granting a module the right to act for +// them beyond any session: on scopes they hold, through the module's bindings. +message DelegateRequest { + // The module granted, by principal. + string module = 1; + // What the module may do for the person; within what the person holds. + repeated WorkScopeV1 scopes = 2; + // Why, as the person was told (a connected source, a scheduled job). + string purpose = 3; +} + +// Delegation is one grant from a person to a module. +message Delegation { + string delegation_id = 1; + string organization_id = 2; + // The person who granted it, and whom every capability issued from it is for. + string grantor = 3; + // The module granted. + string module = 4; + repeated WorkScopeV1 scopes = 5; + string purpose = 6; + // False once revoked; a revoked delegation issues nothing. + bool active = 7; +} + +// GetDelegationRequest names the delegation read; anyone but its module or its +// grantor is told it does not exist. +message GetDelegationRequest { + string delegation_id = 1; + // The module asking, proving which module it is; absent when the grantor asks. + WorkloadCredential actor = 2; +} + +// RevokeDelegationRequest ends a delegation; only its grantor may. +message RevokeDelegationRequest { + string delegation_id = 1; +} + +// RevokeDelegationResponse is the delegation as it now stands. +message RevokeDelegationResponse { + Delegation delegation = 1; +} + +// PersonSession names the caller's own session. It carries no field: the person +// is whoever the bearer on the call authenticates as, so a caller cannot ask for +// another person's authority by naming a session. +message PersonSession { + reserved 1; + reserved "session_id"; +} + +// WorkloadCredential proves which module a running process is: the native +// launcher credential core's workloadidentity defines, signed by the one launcher +// the host was handed an anchor for. +message WorkloadCredential { + // The launcher-signed credential, as core's native issuer writes it. + string credential = 1; +} + +// InstallationRef names an installation acting for itself. +message InstallationRef { + // The installation id. + string installation_id = 1; +} + +// IssueResponse carries the signed capability and its decoded form. +message IssueResponse { + // The signed capability, as a caller presents it. + string token = 1; + // When the capability expires. + int64 expires_at_unix = 2; + // The decoded capability, for the holder to read its own claims. + WorkContextV1 context = 3; +} + +// CheckRequest presents a capability for verification. +message CheckRequest { + // The capability presented. + string token = 1; + // The audience the caller is; a capability addressed elsewhere is refused. + string audience = 2; + // The method the capability is presented to: "/package.Service/Method" for a + // gRPC call, " " for an HTTP request (GET /v1/model/profiles), + // matched against the routes the module declares. When set, the check also + // applies what the audience module's delivery declares for that method, and + // refuses by name a call that does not hold it, a method that declares + // nothing, and a method the module does not serve. + string method = 3; + // Advisory asks for the policy decision without its refusal: the capability + // is still verified and refused when it is not sound, but what the method + // declares is only reported, in CheckResponse.refusal, and the verified + // capability is answered. A hop in a composition that runs permissive + // (hop/ENFORCEMENT=warn) asks this way and logs the refusal it did not make. + // Hosts may refuse advisory outside local development runs. + bool advisory = 4; +} + +// CheckResponse is the verified capability. +message CheckResponse { + // The verified capability. + WorkContextV1 context = 1; + // The owner's authorization revision as of this check. + uint64 authorization_revision = 2; + // Refusal is what the method's policy would have refused, verbatim, when the + // check was advisory and the policy did not hold; empty when it held. + string refusal = 3; +} + +// KeysRequest asks for the verification keys. +message KeysRequest {} + +// KeysResponse is the issuer and its keys. +message KeysResponse { + // The issuer every capability names. + string issuer = 1; + // The public keys by key id. + repeated PublicKey keys = 2; +} + +// PublicKey is one verification key. +message PublicKey { + // The key id a capability names. + string key_id = 1; + // The signature algorithm; Ed25519. + string algorithm = 2; + // The raw public key bytes. + bytes public_key = 3; +} + +// ListResourcesRequest asks about one kind and one action. +message ListResourcesRequest { + // The capability presented. + string token = 1; + // The audience the caller is; a capability addressed elsewhere is refused. + string audience = 2; + // The resource kind, as the audience module serves it. + string resource_kind = 3; + // The action, in the kind's own vocabulary. + string action = 4; +} + +// ListResourcesResponse is every grant the capability holds on the kind for the +// action. A resource is covered when any grant matches its id; no grant means +// none. A capability that does not hold the action at all is refused instead. +message ListResourcesResponse { + repeated ResourceGrant grants = 1; +} + +// ResourceGrant is one way of naming covered resources. Exactly one is set. +message ResourceGrant { + oneof match { + // Every resource of the kind. + bool all = 1; + // Exactly this resource id. + string id = 2; + // Every resource whose id starts with this. + string prefix = 3; + // Every resource whose whole id matches this RE2 expression, at most 256 + // bytes; it is matched against the entire id, as if anchored. + string pattern = 4; + } +} diff --git a/module/contracts/api/accounts/authority/proto/host/authority/v1/work_context.proto b/module/contracts/api/accounts/authority/proto/host/authority/v1/work_context.proto new file mode 100644 index 000000000..17adac734 --- /dev/null +++ b/module/contracts/api/accounts/authority/proto/host/authority/v1/work_context.proto @@ -0,0 +1,298 @@ +syntax = "proto3"; +// Moved from codefly-dev/core proto/codefly/base/v0/work_context.proto on 2026-10-21. +// Every message, field name and field number is unchanged, so the deterministic +// bytes a verifier reads are identical; only the package and the Go import path +// differ. The conformance fixtures prove it. A change in meaning is a V2 message +// beside the V1, never a field reinterpreted. +package host.authority.v1; + +option go_package = "gateway/pkg/gen/host/authority/v1;authorityv1"; + +import "buf/validate/validate.proto"; + +// WorkContextV1 is the product-neutral identity and authority capability for +// one Task/Session hop. The signed wire representation is owned by Codefly +// SDKs; applications must never serialize this message into a bearer token or +// construct the transport header themselves. +// +// Task identity is the tuple (tenant_id, owner_principal_id, task_id). +// Starting a child agent keeps that tuple and exchanges the parent capability +// for a new child session capability. It never mutates an existing capability. +message WorkContextV1 { + // typ is fixed to "codefly.work-context/v1". + string typ = 1 [(buf.validate.field).string.const = "codefly.work-context/v1"]; + // algorithm is fixed to "Ed25519". + string algorithm = 2 [(buf.validate.field).string.const = "Ed25519"]; + // key_id selects one public verification key during rotation. + string key_id = 3 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 128]; + // issuer is the authority that verified identity and minted this context. + string issuer = 4 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // audience is the exact service or trust boundary allowed to consume it. + string audience = 5 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // not_before_unix is the earliest instant a verifier may accept this + // capability. + int64 not_before_unix = 6; + // issued_at_unix is when the issuer minted it. + int64 issued_at_unix = 7; + // expires_at_unix is the instant it stops being accepted. Exchanging a + // parent capability for a child one never extends it. + int64 expires_at_unix = 8; + // nonce identifies the capability. Replay behavior is separately explicit. + string nonce = 9 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // authorization_revision is the issuer's current membership/policy revision. + uint64 authorization_revision = 10; + // replay_policy is "idempotent" or "single-use". A verifier still needs a + // durable replay store to enforce single-use consumption. + string replay_policy = 11 [(buf.validate.field).string.in = "idempotent", (buf.validate.field).string.in = "single-use"]; + + // tenant_id is the first element of the task identity tuple and is carried + // unchanged across every hop. + string tenant_id = 12 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // owner_principal_id is the principal on whose authority the task runs. It + // is the delegating owner, not necessarily the current actor. + string owner_principal_id = 13 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // task_id completes the task identity tuple and survives child agents. + string task_id = 14 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // session_id identifies this hop. Starting a child agent mints a new one + // rather than mutating this capability. + string session_id = 15 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // parent_session_id is the session this one was exchanged from; absent on + // the first session of a task. + optional string parent_session_id = 16 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + + // authority_scopes are the maximum scopes the owner delegated into this + // Work Context. Each actor hop's granted_scopes must be a subset of the + // preceding effective scopes. + repeated WorkScopeV1 authority_scopes = 17; + // actor_chain is ordered from the first delegated actor to the current actor. + // The owner is not duplicated here merely to make a direct call look uniform. + // Every hop attenuates the one before it, except the final hop of a + // capability carrying grant_hop. + repeated WorkActorV1 actor_chain = 18; + // attribution_team_ids is an immutable verified attribution snapshot. It + // explains ownership; current authorization is still evaluated separately. + repeated string attribution_team_ids = 19; + // workspace_id is the workspace the task runs against, when the task is + // scoped to one. + optional string workspace_id = 20 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // project_id narrows workspace_id to a single project, when the task is + // scoped that far. + optional string project_id = 21 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + + // owner_principal_kind distinguishes the sort of principal the owner is, so + // a verifier can present the owner without resolving it against a directory. + // Optional on the wire: a capability minted before this field existed is + // still a valid capability, and an archived receipt embedding one still + // verifies. Deriving an identity from a capability that omits it is the + // error, raised where the identity is built. + optional string owner_principal_kind = 22 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 128]; + // owner_agent_id is the owner's agent manifest identity. Required when + // owner_principal_kind is "agent" and absent otherwise. + optional string owner_agent_id = 23 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // organization_id is the organization the task runs in. It is not the + // tenant: a tenant may hold several organizations, and authorization is + // scoped per organization. An actor hop may name a different one. + optional string organization_id = 25 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // grant_hop is the approval grant this capability was minted under. It is + // the one audited exception to the attenuation rule: the final actor hop + // holds exactly granted_scope, which the preceding hop need not contain. + // Present only on a single-use child capability minted for one approved + // call; absent on every ordinary session. + optional WorkGrantHopV1 grant_hop = 24; + // seal binds this capability to one installation and one execution: the + // principal's epoch, the installation and revision it was minted for, and + // the build incarnation it was minted on. A verifier compares every field + // against the live value and refuses on any mismatch, which is what stops a + // capability outliving the installation or the build it was issued against. + // + // REQUIRED. An earlier version of this field was optional, with the stated + // reason that a schema rule would invalidate every archived capability and + // every receipt embedding one, so the requirement belonged in the verifier. + // Two independent reviews named that for what it is: a backward-compatibility + // hedge, which the rules in force forbid. It also meant every reader other + // than the verifier saw a capability's binding to its installation as + // optional, so the strongest check in the model was the easiest one for a + // consumer to not notice. + // + // Archived capabilities and receipts are historical DATA. If they must be + // read after this, they get a snapshot type of their own rather than keeping + // the live credential permanently weaker than it should be. + WorkSealV1 seal = 26 [(buf.validate.field).required = true]; + // operation_binding is the unit of authority this capability exercises, + // sealed by its id, revision and incarnation. Present on an operation + // context and absent on a session that exercises none. + // + // The id is what a verifier looks the binding up by, exactly. Nothing + // searches the bindings for one that contains the capability's scopes: a + // search is a predicate someone wrote, and a predicate one case too + // generous grants authority nobody reviewed. + optional WorkOperationBindingV1 operation_binding = 27; +} + +// WorkSealV1 binds a capability to one installation and one execution. Its +// principal_epoch is the TASK OWNER'S; an actor hop carries its own in +// WorkActorV1.principal_epoch, because an actor's authority is narrowed +// independently of the owner's. Every +// field is a value the issuer holds live and the verifier compares exactly, so +// a capability minted before an installation was revised, a principal's +// authority was reset, or a build was replaced stops verifying at that moment +// rather than at its own expiry. +message WorkSealV1 { + // principal_epoch is the principal's current epoch. Advancing it + // invalidates every capability minted for that principal, which is how a + // compromised principal is cut off without waiting for expiry. + uint64 principal_epoch = 1 [(buf.validate.field).uint64.gte = 1]; + // installation_id identifies one organization's installation of one module. + // Authority is held through an installation, so a capability that names none + // is bound to nothing. + string installation_id = 2 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // installation_revision is the installation's revision at mint time. A + // verifier holding a different revision refuses: the scope of an + // installation changes with its revision, so a capability sealed to an + // earlier one asks for authority under terms that no longer apply. + uint64 installation_revision = 3 [(buf.validate.field).uint64.gte = 1]; + // Fields 4 and 5 carried a per-capability build seal (build_incarnation, + // image_digest). Removed: a workload's build is checked where it mints, and + // a change of approved builds revokes through the principal's epoch and the + // installation's revision. + reserved 4, 5; + reserved "build_incarnation", "image_digest"; +} + +// WorkOperationBindingV1 is the unit of authority an operation context +// exercises, sealed so that a verifier resolves exactly one binding and +// compares it rather than deciding which binding the capability's scopes fit. +message WorkOperationBindingV1 { + // binding_id is the host's identifier for the binding. The verifier looks it + // up EXACTLY: nothing searches the bindings for one that fits a capability's + // scopes, because a search is a predicate somebody wrote and a predicate one + // case too generous grants authority nobody reviewed. + // + // This comment used to say the id "is never derived from the binding's + // contents, because a derived id is one a caller can compute for a binding + // it was never granted". I refuted a review finding against that sentence by + // reading it in isolation and judging it correct. The reviewer was right and + // I was wrong: solutionhost/authority.go says the opposite in the package + // that owns the id — deriving it deterministically is delivery's business + // and better than random, and "predictability costs nothing here: an id is + // neither a secret nor a capability". + // + // Predictability costs nothing because ENTITLEMENT is what refuses a binding + // a caller does not hold, not obscurity: the verifier requires the resolved + // binding to be granted to the exercising principal within the installation + // the capability is sealed to. Guessing an id gets you a refusal. Resting + // the rule on unguessability was the retracted reasoning, and leaving it + // here contradicted the package it describes. + string binding_id = 1 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // revision is the binding's revision at mint time. A verifier holding a + // different revision refuses. + uint64 revision = 2 [(buf.validate.field).uint64.gte = 1]; + // incarnation is the binding's incarnation at mint time, which changes when + // the binding is re-established rather than merely revised. + uint64 incarnation = 3 [(buf.validate.field).uint64.gte = 1]; +} + +// WorkScopeV1 is a structured, product-neutral capability scope. Empty +// resource_ids means every resource of resource_kind; a child may narrow that +// wildcard to explicit IDs but may never widen an explicit parent set. +message WorkScopeV1 { + // resource_kind is the class of resource the scope grants against. + string resource_kind = 1 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 128]; + // actions are the operations permitted on that kind. + repeated string actions = 2; + // resource_ids narrows the scope to specific resources. Empty means every + // resource of resource_kind. + repeated string resource_ids = 3; +} + +// WorkActorV1 is one verified delegated actor. granted_scopes are the actor's +// effective scopes and must monotonically attenuate the previous hop. +message WorkActorV1 { + // principal_id identifies the actor this hop delegated to. + string principal_id = 1 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // principal_kind distinguishes the sort of principal, so a human and an + // agent bearing the same id are not conflated. + string principal_kind = 2 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 128]; + // delegation_id identifies the delegation that produced this hop, so the + // chain stays auditable back to its grant. + string delegation_id = 3 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // granted_scopes are this actor's effective scopes, a subset of the + // preceding hop's. + repeated WorkScopeV1 granted_scopes = 4; + // agent_id is the actor's agent manifest identity. Required when + // principal_kind is "agent" and absent otherwise. + optional string agent_id = 5 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // organization_id is the organization this actor belongs to, when it is not + // the one the task runs in. An org-bridge agent acts in an organization the + // owner does not belong to, and authorization is scoped to the actor's own. + optional string organization_id = 6 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // principal_epoch is THIS actor's epoch, distinct from the owner's epoch in + // the seal. Advancing it invalidates every capability in which this + // principal is an actor, without touching the owner's. + // + // It exists because the seal's epoch is the task owner's, and an actor's + // authority can be narrowed independently of the owner's: a delegated + // operation context may have a person as its owner and a service principal + // as its actor, and narrowing that service principal must reach the + // capabilities it acts in. Without this field the only lever for a + // compromised actor is the tenant's authorization_revision, which cuts off + // every capability of the tenant. + // + // REQUIRED, for the reason seal gives. A hop with no epoch is a principal + // nothing can revoke, and leaving that expressible on the wire made it a + // shape a consumer could mint without noticing. + uint64 principal_epoch = 7 [(buf.validate.field).uint64.gte = 1, (buf.validate.field).required = true]; + // Fields 8 and 9 carried this hop's build seal; removed with the seal's. + reserved 8, 9; + reserved "image_digest", "build_incarnation"; +} + +// WorkGrantHopV1 records the approval that justifies a capability holding +// authority its delegating owner never held. It is minted only as a new child +// capability bound to one tool, one subject and one call, so the authority it +// adds is unusable anywhere else and expires with the grant window. +message WorkGrantHopV1 { + // grant_id identifies the approval grant, so revoking the grant and + // auditing the call both reach the same record. + string grant_id = 1 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // approvers are the principals whose decision produced the grant, every one + // of an N-of-M quorum, so the audit record is complete. + repeated WorkApproverV1 approvers = 2 [(buf.validate.field).repeated.min_items = 1, (buf.validate.field).repeated.max_items = 64]; + // granted_scope is exactly what the approval added: one resource_kind, one + // action and one resource_id. A grant never widens beyond that triple. + WorkScopeV1 granted_scope = 3 [(buf.validate.field).required = true]; + // subject is what the grant is pinned to, in the approvals engine's own + // vocabulary, so a grant approved for one subject cannot be spent on another. + string subject = 4 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // request_digest binds the grant to the exact call the approver saw. + string request_digest = 5 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; +} + +// WorkApproverV1 is one principal whose decision produced a grant. It carries +// the kind as well as the id: a policy that requires a human approver cannot +// be written against bare identifiers. +message WorkApproverV1 { + // principal_id identifies the approver. + string principal_id = 1 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // principal_kind distinguishes the sort of principal the approver is. + string principal_kind = 2 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 128]; +} + +// ApprovalRequiredV1 is the signal a policy decision point returns instead of +// a denial when the call is approvable: the authority is not held, but an +// approver may grant it. It names exactly what a WorkGrantHopV1 would have to +// carry, so a decision and the capability that satisfies it are the same shape. +// It is carried as a typed error detail on a FailedPrecondition status. +message ApprovalRequiredV1 { + // request_id identifies the approval request the engine created, which the + // caller waits on and the resulting grant refers back to. + string request_id = 1 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // requested_scope is the authority the call needs and the principal lacks. + WorkScopeV1 requested_scope = 2 [(buf.validate.field).required = true]; + // subject is what a grant would be pinned to. + string subject = 3 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // request_digest is the exact call put to the approver. + string request_digest = 4 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; + // audience is the tool a granted capability must be minted for. + string audience = 5 [(buf.validate.field).string.min_len = 1, (buf.validate.field).string.max_len = 512]; +} diff --git a/module/contracts/api/accounts/authority/proto/host/composition/v1/composition.proto b/module/contracts/api/accounts/authority/proto/host/composition/v1/composition.proto new file mode 100644 index 000000000..a50859362 --- /dev/null +++ b/module/contracts/api/accounts/authority/proto/host/composition/v1/composition.proto @@ -0,0 +1,157 @@ +syntax = "proto3"; +// The composition interface: how the host learns what is composed. One +// operation. The render produces a manifest per module instance; the host +// derives from it the module's principal, its ceilings and its bindings. There +// is no envelope: the ceiling is the manifest. +package host.composition.v1; + +option go_package = "gateway/pkg/gen/host/composition/v1;compositionv1"; + +import "host/authority/v1/work_context.proto"; + +// CompositionService is implemented by the host and by the local authority. +service CompositionService { + // ApplyManifest delivers one module instance's manifest at one generation. + rpc ApplyManifest(ApplyManifestRequest) returns (ApplyManifestResponse); +} + +// ApplyManifestRequest carries the manifest. +message ApplyManifestRequest { + // The sketch of a manifest, kept through the transition. An implementation + // that verifies deliveries ignores it when a carrier is present. + ModuleManifestV1 manifest = 1; + // The delivery as Codefly signs it: core's module manifest and the DSSE + // envelope over it. An implementation verifies the envelope against the release + // keys it pins and reads the manifest from the verified document, never from + // the request, so what composes a module is the same signed document on the + // local authority and on the host. + SignedManifestV1 carrier = 2; + // The credential of the workload delivering the manifest, as that + // implementation attests workloads: the launcher's on the local authority, the + // delivery service account's on the host. A manifest is delivered by its own + // module's delivery workload and by nothing else. + string credential = 3; + // The authority's own document for this delivery, an AuthorityManifestV1: + // what the module declares that the authority enforces and core's manifest + // does not carry. Signed in the same envelope format by the same key as + // carrier, and naming carrier's digest. Absent means the module declares no + // method policy, and every Check that names one of its methods is refused. + SignedManifestV1 authority = 4; +} + +// AuthorityManifestV1 is the authority's document for one delivery. +message AuthorityManifestV1 { + // The module, as the core manifest it travels with names it. + string module = 1; + // The generation, equal to that core manifest's. + uint64 generation = 2; + // "sha256:" of the core manifest document delivered with it. + string core_manifest_digest = 3; + // Every method the module's published contracts serve, with what each + // declares. A method that declares nothing is listed with neither field set. + repeated MethodPolicyV1 methods = 4; + // The module's own resource kinds with the actions its contract declares on + // each (its scope ceilings). Core's manifest names the kinds alone, so without + // these a kind serves any action and a person's ask for everything they hold + // there cannot be enumerated. Each names a kind core's manifest declares. + repeated host.authority.v1.WorkScopeV1 scope_ceilings = 5; + // The roles a solution declares a person may hold on an installation of it, + // as ModuleManifestV1.roles declares them through the sketch: each within + // the solution's own scope ceilings or explicit invoke/lookup binding scopes, + // one of them installer. Headless-only scopes cannot supply a role grant. + // Core's manifest carries no roles, so they travel here until it does. A + // module declares none; a module's delivery listing any is refused. + repeated RoleV1 roles = 6; +} + +// MethodPolicyV1 is what a call to one method must hold, as the module's +// contract declares it with the authority.hop.v1.policy option. +message MethodPolicyV1 { + // The method: "/package.Service/Method" for a gRPC method, or an HTTP route + // "