From e6afb040e6ce7fe9d0e0de1adfaba88d614541fd Mon Sep 17 00:00:00 2001 From: Gael <338191059+gael-obin@users.noreply.github.com> Date: Fri, 30 Oct 2026 12:41:06 -0400 Subject: [PATCH] feat(accounts): exchange installation setup authority --- .../code/pkg/adapters/host_interface.go | 6 + .../accounts/code/pkg/adapters/host_offers.go | 3 + .../code/pkg/adapters/host_offers_test.go | 17 + .../pkg/business/authority_core_delivery.go | 6 +- .../authority_core_delivery_setup_test.go | 19 + .../pkg/gen/host/authority/v1/authority.pb.go | 400 +++++++++++------- .../gen/host/composition/v1/composition.pb.go | 226 +++++++--- .../host/installation/v1/installation.pb.go | 250 +++++++---- .../canonical_declaration_encoding_test.go | 5 +- .../code/pkg/infra/postgres_authority_core.go | 26 +- .../generated/openapi-raw/api.swagger.json | 18 + .../proto/host/authority/v1/authority.proto | 12 + .../host/composition/v1/composition.proto | 15 + .../host/installation/v1/installation.proto | 14 + .../src/gen/host/authority/v1/authority_pb.ts | 92 ++-- .../gen/host/composition/v1/composition_pb.ts | 70 ++- .../host/installation/v1/installation_pb.ts | 69 ++- 17 files changed, 882 insertions(+), 366 deletions(-) create mode 100644 module/services/accounts/code/pkg/business/authority_core_delivery_setup_test.go diff --git a/module/services/accounts/code/pkg/adapters/host_interface.go b/module/services/accounts/code/pkg/adapters/host_interface.go index 3c98c7442..da38f229e 100644 --- a/module/services/accounts/code/pkg/adapters/host_interface.go +++ b/module/services/accounts/code/pkg/adapters/host_interface.go @@ -224,6 +224,12 @@ func (s *HostAuthorityServer) Issue(ctx context.Context, req *authorityv1.IssueR return nil, werr } out, err = core.IssueForInstallation(ctx, w, as.Installation.GetInstallationId(), r) + case *authorityv1.IssueRequest_Setup: + w, werr := workload(ctx, req.GetActor().GetCredential(), "actor") + if werr != nil { + return nil, werr + } + out, err = core.IssueForInstallationSetup(ctx, w, as.Setup.GetStepToken(), as.Setup.GetMethod(), r) case *authorityv1.IssueRequest_ParentToken: w, werr := workload(ctx, req.GetActor().GetCredential(), "actor") if werr != nil { diff --git a/module/services/accounts/code/pkg/adapters/host_offers.go b/module/services/accounts/code/pkg/adapters/host_offers.go index 0b3adc5bd..b7772c5ca 100644 --- a/module/services/accounts/code/pkg/adapters/host_offers.go +++ b/module/services/accounts/code/pkg/adapters/host_offers.go @@ -114,6 +114,9 @@ func reviewedOffer(offer authority.ReviewedOffer, bindings map[string]*runnablev return nil, coreStatus(err) } out := &installationv1.ReviewedOffer{Target: projected.Target, ToolsComposed: projected.ToolsComposed, InstallationRole: projected.InstallationRole} + for _, setup := range projected.Setup { + out.Setup = append(out.Setup, &installationv1.OfferSetup{Binding: setup.Binding, Module: setup.Module, Methods: setup.Methods, Scopes: offerScopesToWire(setup.Scopes)}) + } for _, edge := range projected.EdgeDependencies { out.EdgeDependencies = append(out.EdgeDependencies, &installationv1.OfferDependency{Module: edge.Module, Presence: edge.Presence}) } diff --git a/module/services/accounts/code/pkg/adapters/host_offers_test.go b/module/services/accounts/code/pkg/adapters/host_offers_test.go index 577dc7644..3569e4db5 100644 --- a/module/services/accounts/code/pkg/adapters/host_offers_test.go +++ b/module/services/accounts/code/pkg/adapters/host_offers_test.go @@ -6,6 +6,7 @@ import ( "github.com/codefly-dev/authority/libraries/authority-core/go/authority" "github.com/codefly-dev/authority/libraries/authority-core/go/domain" + modulecontract "github.com/codefly-dev/core/contracts/module" basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0" runnablev0 "github.com/codefly-dev/core/generated/go/codefly/runnable/v0" "github.com/codefly-dev/core/resources" @@ -143,3 +144,19 @@ func TestAReviewedOfferPreservesTheSharedProjectionRefusal(t *testing.T) { require.Equal(t, codes.FailedPrecondition, status.Code(err)) require.Contains(t, status.Convert(err).Message(), "the composed binding BROKEN is not a valid tool") } + +// Setup grants shown for review retain their binding, target, methods and scope. +func TestReviewedOfferProjectsSetup(t *testing.T) { + offer := proposalsOffer(domain.ConsentApproval{}) + offer.Module.Setup = []modulecontract.ResolvedSetup{{Binding: "documents", Methods: []string{"/records.v1.Schema/Define"}, Scopes: []string{"records.types:define"}}} + review, err := reviewedOffer(offer, nil) + require.NoError(t, err) + require.Len(t, review.GetSetup(), 1) + setup := review.GetSetup()[0] + require.Equal(t, "documents", setup.GetBinding()) + require.Equal(t, "documents", setup.GetModule()) + require.Equal(t, []string{"/records.v1.Schema/Define"}, setup.GetMethods()) + require.Len(t, setup.GetScopes(), 1) + require.Equal(t, "records.types", setup.GetScopes()[0].GetResourceKind()) + require.Equal(t, []string{"define"}, setup.GetScopes()[0].GetActions()) +} diff --git a/module/services/accounts/code/pkg/business/authority_core_delivery.go b/module/services/accounts/code/pkg/business/authority_core_delivery.go index 8c1d1e14d..157850437 100644 --- a/module/services/accounts/code/pkg/business/authority_core_delivery.go +++ b/module/services/accounts/code/pkg/business/authority_core_delivery.go @@ -14,6 +14,7 @@ import ( "github.com/codefly-dev/authority/libraries/authority-core/go/decide" coredelivered "github.com/codefly-dev/authority/libraries/authority-core/go/delivered" "github.com/codefly-dev/authority/libraries/authority-core/go/domain" + modulecontract "github.com/codefly-dev/core/contracts/module" basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0" "github.com/codefly-dev/core/solutionhost" "github.com/codefly-dev/core/wool" @@ -43,7 +44,10 @@ func coreModuleOf(manifest *solutionhost.ModuleManifest, carrierDocument []byte, // documentOf reads this host's binding of the authority's document as the core's. func documentOf(in *compositionv1.AuthorityManifestV1) *coredelivered.Document { doc := &coredelivered.Document{Module: in.GetModule(), Generation: in.GetGeneration(), CoreManifestDigest: in.GetCoreManifestDigest(), - ScopeCeilings: wireScopes(in.GetScopeCeilings()), OwnerAware: in.GetOwnerAware(), InstallationRole: in.GetInstallationRole()} + ScopeCeilings: wireScopes(in.GetScopeCeilings()), OwnerAware: in.GetOwnerAware(), OwnerAwareResourceKinds: in.GetOwnerAwareResourceKinds(), InstallationRole: in.GetInstallationRole()} + for _, setup := range in.GetSetup() { + doc.Setup = append(doc.Setup, modulecontract.ResolvedSetup{Binding: setup.GetBinding(), Methods: setup.GetMethods(), Scopes: setup.GetScopes()}) + } for _, edge := range in.GetEdgeDependencies() { doc.EdgeDependencies = append(doc.EdgeDependencies, domain.EdgeDependency{Module: edge.GetModule(), Presence: edge.GetPresence()}) } diff --git a/module/services/accounts/code/pkg/business/authority_core_delivery_setup_test.go b/module/services/accounts/code/pkg/business/authority_core_delivery_setup_test.go new file mode 100644 index 000000000..ff6cc65a0 --- /dev/null +++ b/module/services/accounts/code/pkg/business/authority_core_delivery_setup_test.go @@ -0,0 +1,19 @@ +package business + +import ( + "testing" + + compositionv1 "accounts/pkg/gen/host/composition/v1" + modulecontract "github.com/codefly-dev/core/contracts/module" + "github.com/stretchr/testify/require" +) + +func TestDocumentOfRetainsSetupAndOwnerAwareKinds(t *testing.T) { + in := &compositionv1.AuthorityManifestV1{ + OwnerAwareResourceKinds: []string{"example.items"}, + Setup: []*compositionv1.SetupGrantV1{{Binding: "records", Methods: []string{"/records.v1.Schema/Define"}, Scopes: []string{"records.types:define"}}}, + } + got := documentOf(in) + require.Equal(t, in.OwnerAwareResourceKinds, got.OwnerAwareResourceKinds) + require.Equal(t, []modulecontract.ResolvedSetup{{Binding: "records", Methods: []string{"/records.v1.Schema/Define"}, Scopes: []string{"records.types:define"}}}, got.Setup) +} diff --git a/module/services/accounts/code/pkg/gen/host/authority/v1/authority.pb.go b/module/services/accounts/code/pkg/gen/host/authority/v1/authority.pb.go index 6d27e23f1..aa72dfa40 100644 --- a/module/services/accounts/code/pkg/gen/host/authority/v1/authority.pb.go +++ b/module/services/accounts/code/pkg/gen/host/authority/v1/authority.pb.go @@ -41,6 +41,7 @@ type IssueRequest struct { // *IssueRequest_Installation // *IssueRequest_ParentToken // *IssueRequest_Delegation + // *IssueRequest_Setup As isIssueRequest_As `protobuf_oneof:"as"` // The module principal that may consume the capability. Audience string `protobuf:"bytes,5,opt,name=audience,proto3" json:"audience,omitempty"` @@ -150,6 +151,15 @@ func (x *IssueRequest) GetDelegation() *DelegationRef { return nil } +func (x *IssueRequest) GetSetup() *InstallationSetupRef { + if x != nil { + if x, ok := x.As.(*IssueRequest_Setup); ok { + return x.Setup + } + } + return nil +} + func (x *IssueRequest) GetAudience() string { if x != nil { return x.Audience @@ -234,6 +244,12 @@ type IssueRequest_Delegation struct { Delegation *DelegationRef `protobuf:"bytes,11,opt,name=delegation,proto3,oneof"` } +type IssueRequest_Setup struct { + // Current authenticated install callback evidence for one declared setup + // method. Independent of standing roles; requires the solution's actor. + Setup *InstallationSetupRef `protobuf:"bytes,13,opt,name=setup,proto3,oneof"` +} + func (*IssueRequest_Person) isIssueRequest_As() {} func (*IssueRequest_Workload) isIssueRequest_As() {} @@ -244,6 +260,64 @@ func (*IssueRequest_ParentToken) isIssueRequest_As() {} func (*IssueRequest_Delegation) isIssueRequest_As() {} +func (*IssueRequest_Setup) isIssueRequest_As() {} + +// InstallationSetupRef selects one exact method from the reviewed setup grant. +// The callback token proves the current attempt; it is not data authority. +type InstallationSetupRef struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The unexpired standard installation callback credential. + StepToken string `protobuf:"bytes,1,opt,name=step_token,json=stepToken,proto3" json:"step_token,omitempty"` + // The exact destination method selected by the setup declaration. + Method string `protobuf:"bytes,2,opt,name=method,proto3" json:"method,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *InstallationSetupRef) Reset() { + *x = InstallationSetupRef{} + mi := &file_host_authority_v1_authority_proto_msgTypes[1] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *InstallationSetupRef) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*InstallationSetupRef) ProtoMessage() {} + +func (x *InstallationSetupRef) ProtoReflect() protoreflect.Message { + mi := &file_host_authority_v1_authority_proto_msgTypes[1] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use InstallationSetupRef.ProtoReflect.Descriptor instead. +func (*InstallationSetupRef) Descriptor() ([]byte, []int) { + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{1} +} + +func (x *InstallationSetupRef) GetStepToken() string { + if x != nil { + return x.StepToken + } + return "" +} + +func (x *InstallationSetupRef) GetMethod() string { + if x != nil { + return x.Method + } + return "" +} + // DelegationRef names one delegation. type DelegationRef struct { state protoimpl.MessageState `protogen:"open.v1"` @@ -255,7 +329,7 @@ type DelegationRef struct { func (x *DelegationRef) Reset() { *x = DelegationRef{} - mi := &file_host_authority_v1_authority_proto_msgTypes[1] + mi := &file_host_authority_v1_authority_proto_msgTypes[2] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -267,7 +341,7 @@ func (x *DelegationRef) String() string { func (*DelegationRef) ProtoMessage() {} func (x *DelegationRef) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[1] + mi := &file_host_authority_v1_authority_proto_msgTypes[2] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -280,7 +354,7 @@ func (x *DelegationRef) ProtoReflect() protoreflect.Message { // Deprecated: Use DelegationRef.ProtoReflect.Descriptor instead. func (*DelegationRef) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{1} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{2} } func (x *DelegationRef) GetDelegationId() string { @@ -310,7 +384,7 @@ type DelegateRequest struct { func (x *DelegateRequest) Reset() { *x = DelegateRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[2] + mi := &file_host_authority_v1_authority_proto_msgTypes[3] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -322,7 +396,7 @@ func (x *DelegateRequest) String() string { func (*DelegateRequest) ProtoMessage() {} func (x *DelegateRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[2] + mi := &file_host_authority_v1_authority_proto_msgTypes[3] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -335,7 +409,7 @@ func (x *DelegateRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DelegateRequest.ProtoReflect.Descriptor instead. func (*DelegateRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{2} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{3} } func (x *DelegateRequest) GetModule() string { @@ -387,7 +461,7 @@ type Delegation struct { func (x *Delegation) Reset() { *x = Delegation{} - mi := &file_host_authority_v1_authority_proto_msgTypes[3] + mi := &file_host_authority_v1_authority_proto_msgTypes[4] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -399,7 +473,7 @@ func (x *Delegation) String() string { func (*Delegation) ProtoMessage() {} func (x *Delegation) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[3] + mi := &file_host_authority_v1_authority_proto_msgTypes[4] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -412,7 +486,7 @@ func (x *Delegation) ProtoReflect() protoreflect.Message { // Deprecated: Use Delegation.ProtoReflect.Descriptor instead. func (*Delegation) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{3} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{4} } func (x *Delegation) GetDelegationId() string { @@ -484,7 +558,7 @@ type GetDelegationRequest struct { func (x *GetDelegationRequest) Reset() { *x = GetDelegationRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[4] + mi := &file_host_authority_v1_authority_proto_msgTypes[5] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -496,7 +570,7 @@ func (x *GetDelegationRequest) String() string { func (*GetDelegationRequest) ProtoMessage() {} func (x *GetDelegationRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[4] + mi := &file_host_authority_v1_authority_proto_msgTypes[5] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -509,7 +583,7 @@ func (x *GetDelegationRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetDelegationRequest.ProtoReflect.Descriptor instead. func (*GetDelegationRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{4} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{5} } func (x *GetDelegationRequest) GetDelegationId() string { @@ -537,7 +611,7 @@ type RevokeDelegationRequest struct { func (x *RevokeDelegationRequest) Reset() { *x = RevokeDelegationRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[5] + mi := &file_host_authority_v1_authority_proto_msgTypes[6] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -549,7 +623,7 @@ func (x *RevokeDelegationRequest) String() string { func (*RevokeDelegationRequest) ProtoMessage() {} func (x *RevokeDelegationRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[5] + mi := &file_host_authority_v1_authority_proto_msgTypes[6] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -562,7 +636,7 @@ func (x *RevokeDelegationRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RevokeDelegationRequest.ProtoReflect.Descriptor instead. func (*RevokeDelegationRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{5} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{6} } func (x *RevokeDelegationRequest) GetDelegationId() string { @@ -582,7 +656,7 @@ type RevokeDelegationResponse struct { func (x *RevokeDelegationResponse) Reset() { *x = RevokeDelegationResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[6] + mi := &file_host_authority_v1_authority_proto_msgTypes[7] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -594,7 +668,7 @@ func (x *RevokeDelegationResponse) String() string { func (*RevokeDelegationResponse) ProtoMessage() {} func (x *RevokeDelegationResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[6] + mi := &file_host_authority_v1_authority_proto_msgTypes[7] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -607,7 +681,7 @@ func (x *RevokeDelegationResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RevokeDelegationResponse.ProtoReflect.Descriptor instead. func (*RevokeDelegationResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{6} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{7} } func (x *RevokeDelegationResponse) GetDelegation() *Delegation { @@ -628,7 +702,7 @@ type PersonSession struct { func (x *PersonSession) Reset() { *x = PersonSession{} - mi := &file_host_authority_v1_authority_proto_msgTypes[7] + mi := &file_host_authority_v1_authority_proto_msgTypes[8] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -640,7 +714,7 @@ func (x *PersonSession) String() string { func (*PersonSession) ProtoMessage() {} func (x *PersonSession) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[7] + mi := &file_host_authority_v1_authority_proto_msgTypes[8] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -653,7 +727,7 @@ func (x *PersonSession) ProtoReflect() protoreflect.Message { // Deprecated: Use PersonSession.ProtoReflect.Descriptor instead. func (*PersonSession) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{7} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{8} } // WorkloadCredential proves which module a running process is: the native @@ -669,7 +743,7 @@ type WorkloadCredential struct { func (x *WorkloadCredential) Reset() { *x = WorkloadCredential{} - mi := &file_host_authority_v1_authority_proto_msgTypes[8] + mi := &file_host_authority_v1_authority_proto_msgTypes[9] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -681,7 +755,7 @@ func (x *WorkloadCredential) String() string { func (*WorkloadCredential) ProtoMessage() {} func (x *WorkloadCredential) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[8] + mi := &file_host_authority_v1_authority_proto_msgTypes[9] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -694,7 +768,7 @@ func (x *WorkloadCredential) ProtoReflect() protoreflect.Message { // Deprecated: Use WorkloadCredential.ProtoReflect.Descriptor instead. func (*WorkloadCredential) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{8} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{9} } func (x *WorkloadCredential) GetCredential() string { @@ -715,7 +789,7 @@ type InstallationRef struct { func (x *InstallationRef) Reset() { *x = InstallationRef{} - mi := &file_host_authority_v1_authority_proto_msgTypes[9] + mi := &file_host_authority_v1_authority_proto_msgTypes[10] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -727,7 +801,7 @@ func (x *InstallationRef) String() string { func (*InstallationRef) ProtoMessage() {} func (x *InstallationRef) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[9] + mi := &file_host_authority_v1_authority_proto_msgTypes[10] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -740,7 +814,7 @@ func (x *InstallationRef) ProtoReflect() protoreflect.Message { // Deprecated: Use InstallationRef.ProtoReflect.Descriptor instead. func (*InstallationRef) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{9} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{10} } func (x *InstallationRef) GetInstallationId() string { @@ -765,7 +839,7 @@ type IssueResponse struct { func (x *IssueResponse) Reset() { *x = IssueResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[10] + mi := &file_host_authority_v1_authority_proto_msgTypes[11] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -777,7 +851,7 @@ func (x *IssueResponse) String() string { func (*IssueResponse) ProtoMessage() {} func (x *IssueResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[10] + mi := &file_host_authority_v1_authority_proto_msgTypes[11] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -790,7 +864,7 @@ func (x *IssueResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use IssueResponse.ProtoReflect.Descriptor instead. func (*IssueResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{10} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{11} } func (x *IssueResponse) GetToken() string { @@ -852,7 +926,7 @@ type CheckRequest struct { func (x *CheckRequest) Reset() { *x = CheckRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[11] + mi := &file_host_authority_v1_authority_proto_msgTypes[12] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -864,7 +938,7 @@ func (x *CheckRequest) String() string { func (*CheckRequest) ProtoMessage() {} func (x *CheckRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[11] + mi := &file_host_authority_v1_authority_proto_msgTypes[12] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -877,7 +951,7 @@ func (x *CheckRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CheckRequest.ProtoReflect.Descriptor instead. func (*CheckRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{11} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{12} } func (x *CheckRequest) GetToken() string { @@ -924,7 +998,7 @@ type CheckResponse struct { func (x *CheckResponse) Reset() { *x = CheckResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[12] + mi := &file_host_authority_v1_authority_proto_msgTypes[13] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -936,7 +1010,7 @@ func (x *CheckResponse) String() string { func (*CheckResponse) ProtoMessage() {} func (x *CheckResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[12] + mi := &file_host_authority_v1_authority_proto_msgTypes[13] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -949,7 +1023,7 @@ func (x *CheckResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use CheckResponse.ProtoReflect.Descriptor instead. func (*CheckResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{12} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{13} } func (x *CheckResponse) GetContext() *WorkContextV1 { @@ -982,7 +1056,7 @@ type KeysRequest struct { func (x *KeysRequest) Reset() { *x = KeysRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[13] + mi := &file_host_authority_v1_authority_proto_msgTypes[14] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -994,7 +1068,7 @@ func (x *KeysRequest) String() string { func (*KeysRequest) ProtoMessage() {} func (x *KeysRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[13] + mi := &file_host_authority_v1_authority_proto_msgTypes[14] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1007,7 +1081,7 @@ func (x *KeysRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use KeysRequest.ProtoReflect.Descriptor instead. func (*KeysRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{13} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{14} } // KeysResponse is the issuer and its keys. @@ -1032,7 +1106,7 @@ type KeysResponse struct { func (x *KeysResponse) Reset() { *x = KeysResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[14] + mi := &file_host_authority_v1_authority_proto_msgTypes[15] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1044,7 +1118,7 @@ func (x *KeysResponse) String() string { func (*KeysResponse) ProtoMessage() {} func (x *KeysResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[14] + mi := &file_host_authority_v1_authority_proto_msgTypes[15] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1057,7 +1131,7 @@ func (x *KeysResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use KeysResponse.ProtoReflect.Descriptor instead. func (*KeysResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{14} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{15} } func (x *KeysResponse) GetIssuer() string { @@ -1100,7 +1174,7 @@ type PublicKey struct { func (x *PublicKey) Reset() { *x = PublicKey{} - mi := &file_host_authority_v1_authority_proto_msgTypes[15] + mi := &file_host_authority_v1_authority_proto_msgTypes[16] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1112,7 +1186,7 @@ func (x *PublicKey) String() string { func (*PublicKey) ProtoMessage() {} func (x *PublicKey) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[15] + mi := &file_host_authority_v1_authority_proto_msgTypes[16] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1125,7 +1199,7 @@ func (x *PublicKey) ProtoReflect() protoreflect.Message { // Deprecated: Use PublicKey.ProtoReflect.Descriptor instead. func (*PublicKey) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{15} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{16} } func (x *PublicKey) GetKeyId() string { @@ -1180,7 +1254,7 @@ type RegisterAdmissionKeyRequest struct { func (x *RegisterAdmissionKeyRequest) Reset() { *x = RegisterAdmissionKeyRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[16] + mi := &file_host_authority_v1_authority_proto_msgTypes[17] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1192,7 +1266,7 @@ func (x *RegisterAdmissionKeyRequest) String() string { func (*RegisterAdmissionKeyRequest) ProtoMessage() {} func (x *RegisterAdmissionKeyRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[16] + mi := &file_host_authority_v1_authority_proto_msgTypes[17] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1205,7 +1279,7 @@ func (x *RegisterAdmissionKeyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RegisterAdmissionKeyRequest.ProtoReflect.Descriptor instead. func (*RegisterAdmissionKeyRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{16} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{17} } func (x *RegisterAdmissionKeyRequest) GetActor() *WorkloadCredential { @@ -1242,7 +1316,7 @@ type RegisterAdmissionKeyResponse struct { func (x *RegisterAdmissionKeyResponse) Reset() { *x = RegisterAdmissionKeyResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[17] + mi := &file_host_authority_v1_authority_proto_msgTypes[18] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1254,7 +1328,7 @@ func (x *RegisterAdmissionKeyResponse) String() string { func (*RegisterAdmissionKeyResponse) ProtoMessage() {} func (x *RegisterAdmissionKeyResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[17] + mi := &file_host_authority_v1_authority_proto_msgTypes[18] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1267,7 +1341,7 @@ func (x *RegisterAdmissionKeyResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RegisterAdmissionKeyResponse.ProtoReflect.Descriptor instead. func (*RegisterAdmissionKeyResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{17} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{18} } func (x *RegisterAdmissionKeyResponse) GetKey() *PublicKey { @@ -1301,7 +1375,7 @@ type ListResourcesRequest struct { func (x *ListResourcesRequest) Reset() { *x = ListResourcesRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[18] + mi := &file_host_authority_v1_authority_proto_msgTypes[19] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1313,7 +1387,7 @@ func (x *ListResourcesRequest) String() string { func (*ListResourcesRequest) ProtoMessage() {} func (x *ListResourcesRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[18] + mi := &file_host_authority_v1_authority_proto_msgTypes[19] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1326,7 +1400,7 @@ func (x *ListResourcesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListResourcesRequest.ProtoReflect.Descriptor instead. func (*ListResourcesRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{18} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{19} } func (x *ListResourcesRequest) GetToken() string { @@ -1369,7 +1443,7 @@ type ListResourcesResponse struct { func (x *ListResourcesResponse) Reset() { *x = ListResourcesResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[19] + mi := &file_host_authority_v1_authority_proto_msgTypes[20] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1381,7 +1455,7 @@ func (x *ListResourcesResponse) String() string { func (*ListResourcesResponse) ProtoMessage() {} func (x *ListResourcesResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[19] + mi := &file_host_authority_v1_authority_proto_msgTypes[20] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1394,7 +1468,7 @@ func (x *ListResourcesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListResourcesResponse.ProtoReflect.Descriptor instead. func (*ListResourcesResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{19} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{20} } func (x *ListResourcesResponse) GetGrants() []*ResourceGrant { @@ -1421,7 +1495,7 @@ type AttachResourceRequest struct { func (x *AttachResourceRequest) Reset() { *x = AttachResourceRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[20] + mi := &file_host_authority_v1_authority_proto_msgTypes[21] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1433,7 +1507,7 @@ func (x *AttachResourceRequest) String() string { func (*AttachResourceRequest) ProtoMessage() {} func (x *AttachResourceRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[20] + mi := &file_host_authority_v1_authority_proto_msgTypes[21] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1446,7 +1520,7 @@ func (x *AttachResourceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use AttachResourceRequest.ProtoReflect.Descriptor instead. func (*AttachResourceRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{20} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{21} } func (x *AttachResourceRequest) GetToken() string { @@ -1488,7 +1562,7 @@ type AttachResourceResponse struct { func (x *AttachResourceResponse) Reset() { *x = AttachResourceResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[21] + mi := &file_host_authority_v1_authority_proto_msgTypes[22] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1500,7 +1574,7 @@ func (x *AttachResourceResponse) String() string { func (*AttachResourceResponse) ProtoMessage() {} func (x *AttachResourceResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[21] + mi := &file_host_authority_v1_authority_proto_msgTypes[22] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1513,7 +1587,7 @@ func (x *AttachResourceResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use AttachResourceResponse.ProtoReflect.Descriptor instead. func (*AttachResourceResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{21} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{22} } func (x *AttachResourceResponse) GetInstallationId() string { @@ -1540,7 +1614,7 @@ type DetachResourceRequest struct { func (x *DetachResourceRequest) Reset() { *x = DetachResourceRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[22] + mi := &file_host_authority_v1_authority_proto_msgTypes[23] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1552,7 +1626,7 @@ func (x *DetachResourceRequest) String() string { func (*DetachResourceRequest) ProtoMessage() {} func (x *DetachResourceRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[22] + mi := &file_host_authority_v1_authority_proto_msgTypes[23] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1565,7 +1639,7 @@ func (x *DetachResourceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DetachResourceRequest.ProtoReflect.Descriptor instead. func (*DetachResourceRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{22} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{23} } func (x *DetachResourceRequest) GetActor() *WorkloadCredential { @@ -1607,7 +1681,7 @@ type DetachResourceResponse struct { func (x *DetachResourceResponse) Reset() { *x = DetachResourceResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[23] + mi := &file_host_authority_v1_authority_proto_msgTypes[24] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1619,7 +1693,7 @@ func (x *DetachResourceResponse) String() string { func (*DetachResourceResponse) ProtoMessage() {} func (x *DetachResourceResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[23] + mi := &file_host_authority_v1_authority_proto_msgTypes[24] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1632,7 +1706,7 @@ func (x *DetachResourceResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DetachResourceResponse.ProtoReflect.Descriptor instead. func (*DetachResourceResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{23} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{24} } func (x *DetachResourceResponse) GetInstallationId() string { @@ -1664,7 +1738,7 @@ type AuthorizeTransferRequest struct { func (x *AuthorizeTransferRequest) Reset() { *x = AuthorizeTransferRequest{} - mi := &file_host_authority_v1_authority_proto_msgTypes[24] + mi := &file_host_authority_v1_authority_proto_msgTypes[25] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1676,7 +1750,7 @@ func (x *AuthorizeTransferRequest) String() string { func (*AuthorizeTransferRequest) ProtoMessage() {} func (x *AuthorizeTransferRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[24] + mi := &file_host_authority_v1_authority_proto_msgTypes[25] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1689,7 +1763,7 @@ func (x *AuthorizeTransferRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use AuthorizeTransferRequest.ProtoReflect.Descriptor instead. func (*AuthorizeTransferRequest) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{24} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{25} } func (x *AuthorizeTransferRequest) GetToken() string { @@ -1747,7 +1821,7 @@ type AuthorizeTransferResponse struct { func (x *AuthorizeTransferResponse) Reset() { *x = AuthorizeTransferResponse{} - mi := &file_host_authority_v1_authority_proto_msgTypes[25] + mi := &file_host_authority_v1_authority_proto_msgTypes[26] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1759,7 +1833,7 @@ func (x *AuthorizeTransferResponse) String() string { func (*AuthorizeTransferResponse) ProtoMessage() {} func (x *AuthorizeTransferResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[25] + mi := &file_host_authority_v1_authority_proto_msgTypes[26] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1772,7 +1846,7 @@ func (x *AuthorizeTransferResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use AuthorizeTransferResponse.ProtoReflect.Descriptor instead. func (*AuthorizeTransferResponse) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{25} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{26} } func (x *AuthorizeTransferResponse) GetPrincipalId() string { @@ -1809,7 +1883,7 @@ type ResourceGrant struct { func (x *ResourceGrant) Reset() { *x = ResourceGrant{} - mi := &file_host_authority_v1_authority_proto_msgTypes[26] + mi := &file_host_authority_v1_authority_proto_msgTypes[27] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1821,7 +1895,7 @@ func (x *ResourceGrant) String() string { func (*ResourceGrant) ProtoMessage() {} func (x *ResourceGrant) ProtoReflect() protoreflect.Message { - mi := &file_host_authority_v1_authority_proto_msgTypes[26] + mi := &file_host_authority_v1_authority_proto_msgTypes[27] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1834,7 +1908,7 @@ func (x *ResourceGrant) ProtoReflect() protoreflect.Message { // Deprecated: Use ResourceGrant.ProtoReflect.Descriptor instead. func (*ResourceGrant) Descriptor() ([]byte, []int) { - return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{26} + return file_host_authority_v1_authority_proto_rawDescGZIP(), []int{27} } func (x *ResourceGrant) GetMatch() isResourceGrant_Match { @@ -1924,7 +1998,7 @@ var File_host_authority_v1_authority_proto protoreflect.FileDescriptor const file_host_authority_v1_authority_proto_rawDesc = "" + "\n" + - "!host/authority/v1/authority.proto\x12\x11host.authority.v1\x1a\x1cgoogle/api/annotations.proto\x1a$host/authority/v1/work_context.proto\"\xf3\x04\n" + + "!host/authority/v1/authority.proto\x12\x11host.authority.v1\x1a\x1cgoogle/api/annotations.proto\x1a$host/authority/v1/work_context.proto\"\xb4\x05\n" + "\fIssueRequest\x12:\n" + "\x06person\x18\x01 \x01(\v2 .host.authority.v1.PersonSessionH\x00R\x06person\x12C\n" + "\bworkload\x18\x02 \x01(\v2%.host.authority.v1.WorkloadCredentialH\x00R\bworkload\x12H\n" + @@ -1932,7 +2006,8 @@ const file_host_authority_v1_authority_proto_rawDesc = "" + "\fparent_token\x18\x04 \x01(\tH\x00R\vparentToken\x12B\n" + "\n" + "delegation\x18\v \x01(\v2 .host.authority.v1.DelegationRefH\x00R\n" + - "delegation\x12\x1a\n" + + "delegation\x12?\n" + + "\x05setup\x18\r \x01(\v2'.host.authority.v1.InstallationSetupRefH\x00R\x05setup\x12\x1a\n" + "\baudience\x18\x05 \x01(\tR\baudience\x126\n" + "\x06scopes\x18\x06 \x03(\v2\x1e.host.authority.v1.WorkScopeV1R\x06scopes\x12\x1f\n" + "\vttl_seconds\x18\a \x01(\x03R\n" + @@ -1942,7 +2017,11 @@ const file_host_authority_v1_authority_proto_rawDesc = "" + "\x05actor\x18\n" + " \x01(\v2%.host.authority.v1.WorkloadCredentialR\x05actor\x12\x1c\n" + "\toperation\x18\f \x01(\tR\toperationB\x04\n" + - "\x02as\"4\n" + + "\x02as\"M\n" + + "\x14InstallationSetupRef\x12\x1d\n" + + "\n" + + "step_token\x18\x01 \x01(\tR\tstepToken\x12\x16\n" + + "\x06method\x18\x02 \x01(\tR\x06method\"4\n" + "\rDelegationRef\x12#\n" + "\rdelegation_id\x18\x01 \x01(\tR\fdelegationId\"\x9c\x01\n" + "\x0fDelegateRequest\x12\x16\n" + @@ -2077,86 +2156,88 @@ func file_host_authority_v1_authority_proto_rawDescGZIP() []byte { return file_host_authority_v1_authority_proto_rawDescData } -var file_host_authority_v1_authority_proto_msgTypes = make([]protoimpl.MessageInfo, 27) +var file_host_authority_v1_authority_proto_msgTypes = make([]protoimpl.MessageInfo, 28) var file_host_authority_v1_authority_proto_goTypes = []any{ (*IssueRequest)(nil), // 0: host.authority.v1.IssueRequest - (*DelegationRef)(nil), // 1: host.authority.v1.DelegationRef - (*DelegateRequest)(nil), // 2: host.authority.v1.DelegateRequest - (*Delegation)(nil), // 3: host.authority.v1.Delegation - (*GetDelegationRequest)(nil), // 4: host.authority.v1.GetDelegationRequest - (*RevokeDelegationRequest)(nil), // 5: host.authority.v1.RevokeDelegationRequest - (*RevokeDelegationResponse)(nil), // 6: host.authority.v1.RevokeDelegationResponse - (*PersonSession)(nil), // 7: host.authority.v1.PersonSession - (*WorkloadCredential)(nil), // 8: host.authority.v1.WorkloadCredential - (*InstallationRef)(nil), // 9: host.authority.v1.InstallationRef - (*IssueResponse)(nil), // 10: host.authority.v1.IssueResponse - (*CheckRequest)(nil), // 11: host.authority.v1.CheckRequest - (*CheckResponse)(nil), // 12: host.authority.v1.CheckResponse - (*KeysRequest)(nil), // 13: host.authority.v1.KeysRequest - (*KeysResponse)(nil), // 14: host.authority.v1.KeysResponse - (*PublicKey)(nil), // 15: host.authority.v1.PublicKey - (*RegisterAdmissionKeyRequest)(nil), // 16: host.authority.v1.RegisterAdmissionKeyRequest - (*RegisterAdmissionKeyResponse)(nil), // 17: host.authority.v1.RegisterAdmissionKeyResponse - (*ListResourcesRequest)(nil), // 18: host.authority.v1.ListResourcesRequest - (*ListResourcesResponse)(nil), // 19: host.authority.v1.ListResourcesResponse - (*AttachResourceRequest)(nil), // 20: host.authority.v1.AttachResourceRequest - (*AttachResourceResponse)(nil), // 21: host.authority.v1.AttachResourceResponse - (*DetachResourceRequest)(nil), // 22: host.authority.v1.DetachResourceRequest - (*DetachResourceResponse)(nil), // 23: host.authority.v1.DetachResourceResponse - (*AuthorizeTransferRequest)(nil), // 24: host.authority.v1.AuthorizeTransferRequest - (*AuthorizeTransferResponse)(nil), // 25: host.authority.v1.AuthorizeTransferResponse - (*ResourceGrant)(nil), // 26: host.authority.v1.ResourceGrant - (*WorkScopeV1)(nil), // 27: host.authority.v1.WorkScopeV1 - (*WorkContextV1)(nil), // 28: host.authority.v1.WorkContextV1 + (*InstallationSetupRef)(nil), // 1: host.authority.v1.InstallationSetupRef + (*DelegationRef)(nil), // 2: host.authority.v1.DelegationRef + (*DelegateRequest)(nil), // 3: host.authority.v1.DelegateRequest + (*Delegation)(nil), // 4: host.authority.v1.Delegation + (*GetDelegationRequest)(nil), // 5: host.authority.v1.GetDelegationRequest + (*RevokeDelegationRequest)(nil), // 6: host.authority.v1.RevokeDelegationRequest + (*RevokeDelegationResponse)(nil), // 7: host.authority.v1.RevokeDelegationResponse + (*PersonSession)(nil), // 8: host.authority.v1.PersonSession + (*WorkloadCredential)(nil), // 9: host.authority.v1.WorkloadCredential + (*InstallationRef)(nil), // 10: host.authority.v1.InstallationRef + (*IssueResponse)(nil), // 11: host.authority.v1.IssueResponse + (*CheckRequest)(nil), // 12: host.authority.v1.CheckRequest + (*CheckResponse)(nil), // 13: host.authority.v1.CheckResponse + (*KeysRequest)(nil), // 14: host.authority.v1.KeysRequest + (*KeysResponse)(nil), // 15: host.authority.v1.KeysResponse + (*PublicKey)(nil), // 16: host.authority.v1.PublicKey + (*RegisterAdmissionKeyRequest)(nil), // 17: host.authority.v1.RegisterAdmissionKeyRequest + (*RegisterAdmissionKeyResponse)(nil), // 18: host.authority.v1.RegisterAdmissionKeyResponse + (*ListResourcesRequest)(nil), // 19: host.authority.v1.ListResourcesRequest + (*ListResourcesResponse)(nil), // 20: host.authority.v1.ListResourcesResponse + (*AttachResourceRequest)(nil), // 21: host.authority.v1.AttachResourceRequest + (*AttachResourceResponse)(nil), // 22: host.authority.v1.AttachResourceResponse + (*DetachResourceRequest)(nil), // 23: host.authority.v1.DetachResourceRequest + (*DetachResourceResponse)(nil), // 24: host.authority.v1.DetachResourceResponse + (*AuthorizeTransferRequest)(nil), // 25: host.authority.v1.AuthorizeTransferRequest + (*AuthorizeTransferResponse)(nil), // 26: host.authority.v1.AuthorizeTransferResponse + (*ResourceGrant)(nil), // 27: host.authority.v1.ResourceGrant + (*WorkScopeV1)(nil), // 28: host.authority.v1.WorkScopeV1 + (*WorkContextV1)(nil), // 29: host.authority.v1.WorkContextV1 } var file_host_authority_v1_authority_proto_depIdxs = []int32{ - 7, // 0: host.authority.v1.IssueRequest.person:type_name -> host.authority.v1.PersonSession - 8, // 1: host.authority.v1.IssueRequest.workload:type_name -> host.authority.v1.WorkloadCredential - 9, // 2: host.authority.v1.IssueRequest.installation:type_name -> host.authority.v1.InstallationRef - 1, // 3: host.authority.v1.IssueRequest.delegation:type_name -> host.authority.v1.DelegationRef - 27, // 4: host.authority.v1.IssueRequest.scopes:type_name -> host.authority.v1.WorkScopeV1 - 8, // 5: host.authority.v1.IssueRequest.actor:type_name -> host.authority.v1.WorkloadCredential - 27, // 6: host.authority.v1.DelegateRequest.scopes:type_name -> host.authority.v1.WorkScopeV1 - 27, // 7: host.authority.v1.Delegation.scopes:type_name -> host.authority.v1.WorkScopeV1 - 8, // 8: host.authority.v1.GetDelegationRequest.actor:type_name -> host.authority.v1.WorkloadCredential - 3, // 9: host.authority.v1.RevokeDelegationResponse.delegation:type_name -> host.authority.v1.Delegation - 28, // 10: host.authority.v1.IssueResponse.context:type_name -> host.authority.v1.WorkContextV1 - 28, // 11: host.authority.v1.CheckResponse.context:type_name -> host.authority.v1.WorkContextV1 - 15, // 12: host.authority.v1.KeysResponse.keys:type_name -> host.authority.v1.PublicKey - 15, // 13: host.authority.v1.KeysResponse.admission_keys:type_name -> host.authority.v1.PublicKey - 8, // 14: host.authority.v1.RegisterAdmissionKeyRequest.actor:type_name -> host.authority.v1.WorkloadCredential - 15, // 15: host.authority.v1.RegisterAdmissionKeyResponse.key:type_name -> host.authority.v1.PublicKey - 26, // 16: host.authority.v1.ListResourcesResponse.grants:type_name -> host.authority.v1.ResourceGrant - 8, // 17: host.authority.v1.AttachResourceRequest.actor:type_name -> host.authority.v1.WorkloadCredential - 8, // 18: host.authority.v1.DetachResourceRequest.actor:type_name -> host.authority.v1.WorkloadCredential - 8, // 19: host.authority.v1.AuthorizeTransferRequest.actor:type_name -> host.authority.v1.WorkloadCredential - 0, // 20: host.authority.v1.AuthorityService.Issue:input_type -> host.authority.v1.IssueRequest - 11, // 21: host.authority.v1.AuthorityService.Check:input_type -> host.authority.v1.CheckRequest - 13, // 22: host.authority.v1.AuthorityService.Keys:input_type -> host.authority.v1.KeysRequest - 16, // 23: host.authority.v1.AuthorityService.RegisterAdmissionKey:input_type -> host.authority.v1.RegisterAdmissionKeyRequest - 18, // 24: host.authority.v1.AuthorityService.ListResources:input_type -> host.authority.v1.ListResourcesRequest - 20, // 25: host.authority.v1.AuthorityService.AttachResource:input_type -> host.authority.v1.AttachResourceRequest - 22, // 26: host.authority.v1.AuthorityService.DetachResource:input_type -> host.authority.v1.DetachResourceRequest - 24, // 27: host.authority.v1.AuthorityService.AuthorizeTransfer:input_type -> host.authority.v1.AuthorizeTransferRequest - 2, // 28: host.authority.v1.AuthorityService.Delegate:input_type -> host.authority.v1.DelegateRequest - 5, // 29: host.authority.v1.AuthorityService.RevokeDelegation:input_type -> host.authority.v1.RevokeDelegationRequest - 4, // 30: host.authority.v1.AuthorityService.GetDelegation:input_type -> host.authority.v1.GetDelegationRequest - 10, // 31: host.authority.v1.AuthorityService.Issue:output_type -> host.authority.v1.IssueResponse - 12, // 32: host.authority.v1.AuthorityService.Check:output_type -> host.authority.v1.CheckResponse - 14, // 33: host.authority.v1.AuthorityService.Keys:output_type -> host.authority.v1.KeysResponse - 17, // 34: host.authority.v1.AuthorityService.RegisterAdmissionKey:output_type -> host.authority.v1.RegisterAdmissionKeyResponse - 19, // 35: host.authority.v1.AuthorityService.ListResources:output_type -> host.authority.v1.ListResourcesResponse - 21, // 36: host.authority.v1.AuthorityService.AttachResource:output_type -> host.authority.v1.AttachResourceResponse - 23, // 37: host.authority.v1.AuthorityService.DetachResource:output_type -> host.authority.v1.DetachResourceResponse - 25, // 38: host.authority.v1.AuthorityService.AuthorizeTransfer:output_type -> host.authority.v1.AuthorizeTransferResponse - 3, // 39: host.authority.v1.AuthorityService.Delegate:output_type -> host.authority.v1.Delegation - 6, // 40: host.authority.v1.AuthorityService.RevokeDelegation:output_type -> host.authority.v1.RevokeDelegationResponse - 3, // 41: host.authority.v1.AuthorityService.GetDelegation:output_type -> host.authority.v1.Delegation - 31, // [31:42] is the sub-list for method output_type - 20, // [20:31] is the sub-list for method input_type - 20, // [20:20] is the sub-list for extension type_name - 20, // [20:20] is the sub-list for extension extendee - 0, // [0:20] is the sub-list for field type_name + 8, // 0: host.authority.v1.IssueRequest.person:type_name -> host.authority.v1.PersonSession + 9, // 1: host.authority.v1.IssueRequest.workload:type_name -> host.authority.v1.WorkloadCredential + 10, // 2: host.authority.v1.IssueRequest.installation:type_name -> host.authority.v1.InstallationRef + 2, // 3: host.authority.v1.IssueRequest.delegation:type_name -> host.authority.v1.DelegationRef + 1, // 4: host.authority.v1.IssueRequest.setup:type_name -> host.authority.v1.InstallationSetupRef + 28, // 5: host.authority.v1.IssueRequest.scopes:type_name -> host.authority.v1.WorkScopeV1 + 9, // 6: host.authority.v1.IssueRequest.actor:type_name -> host.authority.v1.WorkloadCredential + 28, // 7: host.authority.v1.DelegateRequest.scopes:type_name -> host.authority.v1.WorkScopeV1 + 28, // 8: host.authority.v1.Delegation.scopes:type_name -> host.authority.v1.WorkScopeV1 + 9, // 9: host.authority.v1.GetDelegationRequest.actor:type_name -> host.authority.v1.WorkloadCredential + 4, // 10: host.authority.v1.RevokeDelegationResponse.delegation:type_name -> host.authority.v1.Delegation + 29, // 11: host.authority.v1.IssueResponse.context:type_name -> host.authority.v1.WorkContextV1 + 29, // 12: host.authority.v1.CheckResponse.context:type_name -> host.authority.v1.WorkContextV1 + 16, // 13: host.authority.v1.KeysResponse.keys:type_name -> host.authority.v1.PublicKey + 16, // 14: host.authority.v1.KeysResponse.admission_keys:type_name -> host.authority.v1.PublicKey + 9, // 15: host.authority.v1.RegisterAdmissionKeyRequest.actor:type_name -> host.authority.v1.WorkloadCredential + 16, // 16: host.authority.v1.RegisterAdmissionKeyResponse.key:type_name -> host.authority.v1.PublicKey + 27, // 17: host.authority.v1.ListResourcesResponse.grants:type_name -> host.authority.v1.ResourceGrant + 9, // 18: host.authority.v1.AttachResourceRequest.actor:type_name -> host.authority.v1.WorkloadCredential + 9, // 19: host.authority.v1.DetachResourceRequest.actor:type_name -> host.authority.v1.WorkloadCredential + 9, // 20: host.authority.v1.AuthorizeTransferRequest.actor:type_name -> host.authority.v1.WorkloadCredential + 0, // 21: host.authority.v1.AuthorityService.Issue:input_type -> host.authority.v1.IssueRequest + 12, // 22: host.authority.v1.AuthorityService.Check:input_type -> host.authority.v1.CheckRequest + 14, // 23: host.authority.v1.AuthorityService.Keys:input_type -> host.authority.v1.KeysRequest + 17, // 24: host.authority.v1.AuthorityService.RegisterAdmissionKey:input_type -> host.authority.v1.RegisterAdmissionKeyRequest + 19, // 25: host.authority.v1.AuthorityService.ListResources:input_type -> host.authority.v1.ListResourcesRequest + 21, // 26: host.authority.v1.AuthorityService.AttachResource:input_type -> host.authority.v1.AttachResourceRequest + 23, // 27: host.authority.v1.AuthorityService.DetachResource:input_type -> host.authority.v1.DetachResourceRequest + 25, // 28: host.authority.v1.AuthorityService.AuthorizeTransfer:input_type -> host.authority.v1.AuthorizeTransferRequest + 3, // 29: host.authority.v1.AuthorityService.Delegate:input_type -> host.authority.v1.DelegateRequest + 6, // 30: host.authority.v1.AuthorityService.RevokeDelegation:input_type -> host.authority.v1.RevokeDelegationRequest + 5, // 31: host.authority.v1.AuthorityService.GetDelegation:input_type -> host.authority.v1.GetDelegationRequest + 11, // 32: host.authority.v1.AuthorityService.Issue:output_type -> host.authority.v1.IssueResponse + 13, // 33: host.authority.v1.AuthorityService.Check:output_type -> host.authority.v1.CheckResponse + 15, // 34: host.authority.v1.AuthorityService.Keys:output_type -> host.authority.v1.KeysResponse + 18, // 35: host.authority.v1.AuthorityService.RegisterAdmissionKey:output_type -> host.authority.v1.RegisterAdmissionKeyResponse + 20, // 36: host.authority.v1.AuthorityService.ListResources:output_type -> host.authority.v1.ListResourcesResponse + 22, // 37: host.authority.v1.AuthorityService.AttachResource:output_type -> host.authority.v1.AttachResourceResponse + 24, // 38: host.authority.v1.AuthorityService.DetachResource:output_type -> host.authority.v1.DetachResourceResponse + 26, // 39: host.authority.v1.AuthorityService.AuthorizeTransfer:output_type -> host.authority.v1.AuthorizeTransferResponse + 4, // 40: host.authority.v1.AuthorityService.Delegate:output_type -> host.authority.v1.Delegation + 7, // 41: host.authority.v1.AuthorityService.RevokeDelegation:output_type -> host.authority.v1.RevokeDelegationResponse + 4, // 42: host.authority.v1.AuthorityService.GetDelegation:output_type -> host.authority.v1.Delegation + 32, // [32:43] is the sub-list for method output_type + 21, // [21:32] is the sub-list for method input_type + 21, // [21:21] is the sub-list for extension type_name + 21, // [21:21] is the sub-list for extension extendee + 0, // [0:21] is the sub-list for field type_name } func init() { file_host_authority_v1_authority_proto_init() } @@ -2171,8 +2252,9 @@ func file_host_authority_v1_authority_proto_init() { (*IssueRequest_Installation)(nil), (*IssueRequest_ParentToken)(nil), (*IssueRequest_Delegation)(nil), + (*IssueRequest_Setup)(nil), } - file_host_authority_v1_authority_proto_msgTypes[26].OneofWrappers = []any{ + file_host_authority_v1_authority_proto_msgTypes[27].OneofWrappers = []any{ (*ResourceGrant_All)(nil), (*ResourceGrant_Id)(nil), (*ResourceGrant_Prefix)(nil), @@ -2184,7 +2266,7 @@ func file_host_authority_v1_authority_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_host_authority_v1_authority_proto_rawDesc), len(file_host_authority_v1_authority_proto_rawDesc)), NumEnums: 0, - NumMessages: 27, + NumMessages: 28, NumExtensions: 0, NumServices: 1, }, diff --git a/module/services/accounts/code/pkg/gen/host/composition/v1/composition.pb.go b/module/services/accounts/code/pkg/gen/host/composition/v1/composition.pb.go index 88fc0e441..d2a050865 100644 --- a/module/services/accounts/code/pkg/gen/host/composition/v1/composition.pb.go +++ b/module/services/accounts/code/pkg/gen/host/composition/v1/composition.pb.go @@ -147,8 +147,13 @@ type AuthorityManifestV1 struct { InstallationRole string `protobuf:"bytes,8,opt,name=installation_role,json=installationRole,proto3" json:"installation_role,omitempty"` // Viewer-edge presence only; grants no authority. Nil and empty are equivalent. EdgeDependencies []*EdgeDependencyV1 `protobuf:"bytes,9,rep,name=edge_dependencies,json=edgeDependencies,proto3" json:"edge_dependencies,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + // Resolved installation-only grants; separate from standing roles. + Setup []*SetupGrantV1 `protobuf:"bytes,10,rep,name=setup,proto3" json:"setup,omitempty"` + // Only these served kinds enforce resource-owner selectors. Mutually + // exclusive with owner_aware true; empty means none. + OwnerAwareResourceKinds []string `protobuf:"bytes,11,rep,name=owner_aware_resource_kinds,json=ownerAwareResourceKinds,proto3" json:"owner_aware_resource_kinds,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *AuthorityManifestV1) Reset() { @@ -244,6 +249,84 @@ func (x *AuthorityManifestV1) GetEdgeDependencies() []*EdgeDependencyV1 { return nil } +func (x *AuthorityManifestV1) GetSetup() []*SetupGrantV1 { + if x != nil { + return x.Setup + } + return nil +} + +func (x *AuthorityManifestV1) GetOwnerAwareResourceKinds() []string { + if x != nil { + return x.OwnerAwareResourceKinds + } + return nil +} + +// SetupGrantV1 retains exact methods even when two methods share requirements. +type SetupGrantV1 struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The required foreign invoke binding that reaches the destination. + Binding string `protobuf:"bytes,1,opt,name=binding,proto3" json:"binding,omitempty"` + // Exact, unique methods approved for this installation's setup only. + Methods []string `protobuf:"bytes,2,rep,name=methods,proto3" json:"methods,omitempty"` + // Callee-derived requirements as resource-kind:action, within invoke ceiling. + Scopes []string `protobuf:"bytes,3,rep,name=scopes,proto3" json:"scopes,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *SetupGrantV1) Reset() { + *x = SetupGrantV1{} + mi := &file_host_composition_v1_composition_proto_msgTypes[2] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *SetupGrantV1) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*SetupGrantV1) ProtoMessage() {} + +func (x *SetupGrantV1) ProtoReflect() protoreflect.Message { + mi := &file_host_composition_v1_composition_proto_msgTypes[2] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use SetupGrantV1.ProtoReflect.Descriptor instead. +func (*SetupGrantV1) Descriptor() ([]byte, []int) { + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{2} +} + +func (x *SetupGrantV1) GetBinding() string { + if x != nil { + return x.Binding + } + return "" +} + +func (x *SetupGrantV1) GetMethods() []string { + if x != nil { + return x.Methods + } + return nil +} + +func (x *SetupGrantV1) GetScopes() []string { + if x != nil { + return x.Scopes + } + return nil +} + // EdgeDependencyV1 names the exact signed module principal. The host resolves // it to a live catalogue target; it is not a target UUID, route alias or binding id. type EdgeDependencyV1 struct { @@ -257,7 +340,7 @@ type EdgeDependencyV1 struct { func (x *EdgeDependencyV1) Reset() { *x = EdgeDependencyV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[2] + mi := &file_host_composition_v1_composition_proto_msgTypes[3] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -269,7 +352,7 @@ func (x *EdgeDependencyV1) String() string { func (*EdgeDependencyV1) ProtoMessage() {} func (x *EdgeDependencyV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[2] + mi := &file_host_composition_v1_composition_proto_msgTypes[3] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -282,7 +365,7 @@ func (x *EdgeDependencyV1) ProtoReflect() protoreflect.Message { // Deprecated: Use EdgeDependencyV1.ProtoReflect.Descriptor instead. func (*EdgeDependencyV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{2} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{3} } func (x *EdgeDependencyV1) GetModule() string { @@ -317,7 +400,7 @@ type MethodPolicyV1 struct { func (x *MethodPolicyV1) Reset() { *x = MethodPolicyV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[3] + mi := &file_host_composition_v1_composition_proto_msgTypes[4] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -329,7 +412,7 @@ func (x *MethodPolicyV1) String() string { func (*MethodPolicyV1) ProtoMessage() {} func (x *MethodPolicyV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[3] + mi := &file_host_composition_v1_composition_proto_msgTypes[4] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -342,7 +425,7 @@ func (x *MethodPolicyV1) ProtoReflect() protoreflect.Message { // Deprecated: Use MethodPolicyV1.ProtoReflect.Descriptor instead. func (*MethodPolicyV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{3} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{4} } func (x *MethodPolicyV1) GetMethod() string { @@ -378,7 +461,7 @@ type SignedManifestV1 struct { func (x *SignedManifestV1) Reset() { *x = SignedManifestV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[4] + mi := &file_host_composition_v1_composition_proto_msgTypes[5] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -390,7 +473,7 @@ func (x *SignedManifestV1) String() string { func (*SignedManifestV1) ProtoMessage() {} func (x *SignedManifestV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[4] + mi := &file_host_composition_v1_composition_proto_msgTypes[5] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -403,7 +486,7 @@ func (x *SignedManifestV1) ProtoReflect() protoreflect.Message { // Deprecated: Use SignedManifestV1.ProtoReflect.Descriptor instead. func (*SignedManifestV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{4} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{5} } func (x *SignedManifestV1) GetDocument() []byte { @@ -435,7 +518,7 @@ type ApplyManifestResponse struct { func (x *ApplyManifestResponse) Reset() { *x = ApplyManifestResponse{} - mi := &file_host_composition_v1_composition_proto_msgTypes[5] + mi := &file_host_composition_v1_composition_proto_msgTypes[6] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -447,7 +530,7 @@ func (x *ApplyManifestResponse) String() string { func (*ApplyManifestResponse) ProtoMessage() {} func (x *ApplyManifestResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[5] + mi := &file_host_composition_v1_composition_proto_msgTypes[6] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -460,7 +543,7 @@ func (x *ApplyManifestResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ApplyManifestResponse.ProtoReflect.Descriptor instead. func (*ApplyManifestResponse) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{5} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{6} } func (x *ApplyManifestResponse) GetPrincipal() string { @@ -512,7 +595,7 @@ type ModuleManifestV1 struct { func (x *ModuleManifestV1) Reset() { *x = ModuleManifestV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[6] + mi := &file_host_composition_v1_composition_proto_msgTypes[7] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -524,7 +607,7 @@ func (x *ModuleManifestV1) String() string { func (*ModuleManifestV1) ProtoMessage() {} func (x *ModuleManifestV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[6] + mi := &file_host_composition_v1_composition_proto_msgTypes[7] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -537,7 +620,7 @@ func (x *ModuleManifestV1) ProtoReflect() protoreflect.Message { // Deprecated: Use ModuleManifestV1.ProtoReflect.Descriptor instead. func (*ModuleManifestV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{6} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{7} } func (x *ModuleManifestV1) GetModule() string { @@ -616,7 +699,7 @@ type RoleV1 struct { func (x *RoleV1) Reset() { *x = RoleV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[7] + mi := &file_host_composition_v1_composition_proto_msgTypes[8] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -628,7 +711,7 @@ func (x *RoleV1) String() string { func (*RoleV1) ProtoMessage() {} func (x *RoleV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[7] + mi := &file_host_composition_v1_composition_proto_msgTypes[8] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -641,7 +724,7 @@ func (x *RoleV1) ProtoReflect() protoreflect.Message { // Deprecated: Use RoleV1.ProtoReflect.Descriptor instead. func (*RoleV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{7} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{8} } func (x *RoleV1) GetName() string { @@ -687,7 +770,7 @@ type BindingV1 struct { func (x *BindingV1) Reset() { *x = BindingV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[8] + mi := &file_host_composition_v1_composition_proto_msgTypes[9] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -699,7 +782,7 @@ func (x *BindingV1) String() string { func (*BindingV1) ProtoMessage() {} func (x *BindingV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[8] + mi := &file_host_composition_v1_composition_proto_msgTypes[9] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -712,7 +795,7 @@ func (x *BindingV1) ProtoReflect() protoreflect.Message { // Deprecated: Use BindingV1.ProtoReflect.Descriptor instead. func (*BindingV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{8} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{9} } func (x *BindingV1) GetId() string { @@ -763,7 +846,7 @@ type ResourceKindV1 struct { func (x *ResourceKindV1) Reset() { *x = ResourceKindV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[9] + mi := &file_host_composition_v1_composition_proto_msgTypes[10] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -775,7 +858,7 @@ func (x *ResourceKindV1) String() string { func (*ResourceKindV1) ProtoMessage() {} func (x *ResourceKindV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[9] + mi := &file_host_composition_v1_composition_proto_msgTypes[10] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -788,7 +871,7 @@ func (x *ResourceKindV1) ProtoReflect() protoreflect.Message { // Deprecated: Use ResourceKindV1.ProtoReflect.Descriptor instead. func (*ResourceKindV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{9} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{10} } func (x *ResourceKindV1) GetKind() string { @@ -818,7 +901,7 @@ type PageV1 struct { func (x *PageV1) Reset() { *x = PageV1{} - mi := &file_host_composition_v1_composition_proto_msgTypes[10] + mi := &file_host_composition_v1_composition_proto_msgTypes[11] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -830,7 +913,7 @@ func (x *PageV1) String() string { func (*PageV1) ProtoMessage() {} func (x *PageV1) ProtoReflect() protoreflect.Message { - mi := &file_host_composition_v1_composition_proto_msgTypes[10] + mi := &file_host_composition_v1_composition_proto_msgTypes[11] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -843,7 +926,7 @@ func (x *PageV1) ProtoReflect() protoreflect.Message { // Deprecated: Use PageV1.ProtoReflect.Descriptor instead. func (*PageV1) Descriptor() ([]byte, []int) { - return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{10} + return file_host_composition_v1_composition_proto_rawDescGZIP(), []int{11} } func (x *PageV1) GetTitle() string { @@ -871,7 +954,7 @@ const file_host_composition_v1_composition_proto_rawDesc = "" + "\n" + "credential\x18\x03 \x01(\tR\n" + "credential\x12C\n" + - "\tauthority\x18\x04 \x01(\v2%.host.composition.v1.SignedManifestV1R\tauthority\"\xda\x03\n" + + "\tauthority\x18\x04 \x01(\v2%.host.composition.v1.SignedManifestV1R\tauthority\"\xd0\x04\n" + "\x13AuthorityManifestV1\x12\x16\n" + "\x06module\x18\x01 \x01(\tR\x06module\x12\x1e\n" + "\n" + @@ -884,7 +967,14 @@ const file_host_composition_v1_composition_proto_rawDesc = "" + "\vowner_aware\x18\a \x01(\bR\n" + "ownerAware\x12+\n" + "\x11installation_role\x18\b \x01(\tR\x10installationRole\x12R\n" + - "\x11edge_dependencies\x18\t \x03(\v2%.host.composition.v1.EdgeDependencyV1R\x10edgeDependencies\"F\n" + + "\x11edge_dependencies\x18\t \x03(\v2%.host.composition.v1.EdgeDependencyV1R\x10edgeDependencies\x127\n" + + "\x05setup\x18\n" + + " \x03(\v2!.host.composition.v1.SetupGrantV1R\x05setup\x12;\n" + + "\x1aowner_aware_resource_kinds\x18\v \x03(\tR\x17ownerAwareResourceKinds\"Z\n" + + "\fSetupGrantV1\x12\x18\n" + + "\abinding\x18\x01 \x01(\tR\abinding\x12\x18\n" + + "\amethods\x18\x02 \x03(\tR\amethods\x12\x16\n" + + "\x06scopes\x18\x03 \x03(\tR\x06scopes\"F\n" + "\x10EdgeDependencyV1\x12\x16\n" + "\x06module\x18\x01 \x01(\tR\x06module\x12\x1a\n" + "\bpresence\x18\x02 \x01(\tR\bpresence\"\x92\x01\n" + @@ -944,46 +1034,48 @@ func file_host_composition_v1_composition_proto_rawDescGZIP() []byte { return file_host_composition_v1_composition_proto_rawDescData } -var file_host_composition_v1_composition_proto_msgTypes = make([]protoimpl.MessageInfo, 11) +var file_host_composition_v1_composition_proto_msgTypes = make([]protoimpl.MessageInfo, 12) var file_host_composition_v1_composition_proto_goTypes = []any{ (*ApplyManifestRequest)(nil), // 0: host.composition.v1.ApplyManifestRequest (*AuthorityManifestV1)(nil), // 1: host.composition.v1.AuthorityManifestV1 - (*EdgeDependencyV1)(nil), // 2: host.composition.v1.EdgeDependencyV1 - (*MethodPolicyV1)(nil), // 3: host.composition.v1.MethodPolicyV1 - (*SignedManifestV1)(nil), // 4: host.composition.v1.SignedManifestV1 - (*ApplyManifestResponse)(nil), // 5: host.composition.v1.ApplyManifestResponse - (*ModuleManifestV1)(nil), // 6: host.composition.v1.ModuleManifestV1 - (*RoleV1)(nil), // 7: host.composition.v1.RoleV1 - (*BindingV1)(nil), // 8: host.composition.v1.BindingV1 - (*ResourceKindV1)(nil), // 9: host.composition.v1.ResourceKindV1 - (*PageV1)(nil), // 10: host.composition.v1.PageV1 - (*v1.WorkScopeV1)(nil), // 11: host.authority.v1.WorkScopeV1 + (*SetupGrantV1)(nil), // 2: host.composition.v1.SetupGrantV1 + (*EdgeDependencyV1)(nil), // 3: host.composition.v1.EdgeDependencyV1 + (*MethodPolicyV1)(nil), // 4: host.composition.v1.MethodPolicyV1 + (*SignedManifestV1)(nil), // 5: host.composition.v1.SignedManifestV1 + (*ApplyManifestResponse)(nil), // 6: host.composition.v1.ApplyManifestResponse + (*ModuleManifestV1)(nil), // 7: host.composition.v1.ModuleManifestV1 + (*RoleV1)(nil), // 8: host.composition.v1.RoleV1 + (*BindingV1)(nil), // 9: host.composition.v1.BindingV1 + (*ResourceKindV1)(nil), // 10: host.composition.v1.ResourceKindV1 + (*PageV1)(nil), // 11: host.composition.v1.PageV1 + (*v1.WorkScopeV1)(nil), // 12: host.authority.v1.WorkScopeV1 } var file_host_composition_v1_composition_proto_depIdxs = []int32{ - 6, // 0: host.composition.v1.ApplyManifestRequest.manifest:type_name -> host.composition.v1.ModuleManifestV1 - 4, // 1: host.composition.v1.ApplyManifestRequest.carrier:type_name -> host.composition.v1.SignedManifestV1 - 4, // 2: host.composition.v1.ApplyManifestRequest.authority:type_name -> host.composition.v1.SignedManifestV1 - 3, // 3: host.composition.v1.AuthorityManifestV1.methods:type_name -> host.composition.v1.MethodPolicyV1 - 11, // 4: host.composition.v1.AuthorityManifestV1.scope_ceilings:type_name -> host.authority.v1.WorkScopeV1 - 7, // 5: host.composition.v1.AuthorityManifestV1.roles:type_name -> host.composition.v1.RoleV1 - 2, // 6: host.composition.v1.AuthorityManifestV1.edge_dependencies:type_name -> host.composition.v1.EdgeDependencyV1 - 11, // 7: host.composition.v1.MethodPolicyV1.requires:type_name -> host.authority.v1.WorkScopeV1 - 8, // 8: host.composition.v1.ModuleManifestV1.bindings:type_name -> host.composition.v1.BindingV1 - 9, // 9: host.composition.v1.ModuleManifestV1.resource_kinds:type_name -> host.composition.v1.ResourceKindV1 - 10, // 10: host.composition.v1.ModuleManifestV1.page:type_name -> host.composition.v1.PageV1 - 7, // 11: host.composition.v1.ModuleManifestV1.roles:type_name -> host.composition.v1.RoleV1 - 11, // 12: host.composition.v1.RoleV1.scopes:type_name -> host.authority.v1.WorkScopeV1 - 11, // 13: host.composition.v1.RoleV1.installation_owned_scopes:type_name -> host.authority.v1.WorkScopeV1 - 11, // 14: host.composition.v1.BindingV1.invoke_scopes:type_name -> host.authority.v1.WorkScopeV1 - 11, // 15: host.composition.v1.BindingV1.headless_scopes:type_name -> host.authority.v1.WorkScopeV1 - 11, // 16: host.composition.v1.BindingV1.lookup_scopes:type_name -> host.authority.v1.WorkScopeV1 - 0, // 17: host.composition.v1.CompositionService.ApplyManifest:input_type -> host.composition.v1.ApplyManifestRequest - 5, // 18: host.composition.v1.CompositionService.ApplyManifest:output_type -> host.composition.v1.ApplyManifestResponse - 18, // [18:19] is the sub-list for method output_type - 17, // [17:18] is the sub-list for method input_type - 17, // [17:17] is the sub-list for extension type_name - 17, // [17:17] is the sub-list for extension extendee - 0, // [0:17] is the sub-list for field type_name + 7, // 0: host.composition.v1.ApplyManifestRequest.manifest:type_name -> host.composition.v1.ModuleManifestV1 + 5, // 1: host.composition.v1.ApplyManifestRequest.carrier:type_name -> host.composition.v1.SignedManifestV1 + 5, // 2: host.composition.v1.ApplyManifestRequest.authority:type_name -> host.composition.v1.SignedManifestV1 + 4, // 3: host.composition.v1.AuthorityManifestV1.methods:type_name -> host.composition.v1.MethodPolicyV1 + 12, // 4: host.composition.v1.AuthorityManifestV1.scope_ceilings:type_name -> host.authority.v1.WorkScopeV1 + 8, // 5: host.composition.v1.AuthorityManifestV1.roles:type_name -> host.composition.v1.RoleV1 + 3, // 6: host.composition.v1.AuthorityManifestV1.edge_dependencies:type_name -> host.composition.v1.EdgeDependencyV1 + 2, // 7: host.composition.v1.AuthorityManifestV1.setup:type_name -> host.composition.v1.SetupGrantV1 + 12, // 8: host.composition.v1.MethodPolicyV1.requires:type_name -> host.authority.v1.WorkScopeV1 + 9, // 9: host.composition.v1.ModuleManifestV1.bindings:type_name -> host.composition.v1.BindingV1 + 10, // 10: host.composition.v1.ModuleManifestV1.resource_kinds:type_name -> host.composition.v1.ResourceKindV1 + 11, // 11: host.composition.v1.ModuleManifestV1.page:type_name -> host.composition.v1.PageV1 + 8, // 12: host.composition.v1.ModuleManifestV1.roles:type_name -> host.composition.v1.RoleV1 + 12, // 13: host.composition.v1.RoleV1.scopes:type_name -> host.authority.v1.WorkScopeV1 + 12, // 14: host.composition.v1.RoleV1.installation_owned_scopes:type_name -> host.authority.v1.WorkScopeV1 + 12, // 15: host.composition.v1.BindingV1.invoke_scopes:type_name -> host.authority.v1.WorkScopeV1 + 12, // 16: host.composition.v1.BindingV1.headless_scopes:type_name -> host.authority.v1.WorkScopeV1 + 12, // 17: host.composition.v1.BindingV1.lookup_scopes:type_name -> host.authority.v1.WorkScopeV1 + 0, // 18: host.composition.v1.CompositionService.ApplyManifest:input_type -> host.composition.v1.ApplyManifestRequest + 6, // 19: host.composition.v1.CompositionService.ApplyManifest:output_type -> host.composition.v1.ApplyManifestResponse + 19, // [19:20] is the sub-list for method output_type + 18, // [18:19] is the sub-list for method input_type + 18, // [18:18] is the sub-list for extension type_name + 18, // [18:18] is the sub-list for extension extendee + 0, // [0:18] is the sub-list for field type_name } func init() { file_host_composition_v1_composition_proto_init() } @@ -997,7 +1089,7 @@ func file_host_composition_v1_composition_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_host_composition_v1_composition_proto_rawDesc), len(file_host_composition_v1_composition_proto_rawDesc)), NumEnums: 0, - NumMessages: 11, + NumMessages: 12, NumExtensions: 0, NumServices: 1, }, diff --git a/module/services/accounts/code/pkg/gen/host/installation/v1/installation.pb.go b/module/services/accounts/code/pkg/gen/host/installation/v1/installation.pb.go index 8b863b999..d9db83e06 100644 --- a/module/services/accounts/code/pkg/gen/host/installation/v1/installation.pb.go +++ b/module/services/accounts/code/pkg/gen/host/installation/v1/installation.pb.go @@ -1229,8 +1229,10 @@ type ReviewedOffer struct { // Exact declared viewer-edge presence, covered by the reviewed digest. // Required access and per-module approval are separate host review concerns. EdgeDependencies []*OfferDependency `protobuf:"bytes,8,rep,name=edge_dependencies,json=edgeDependencies,proto3" json:"edge_dependencies,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + // Temporary installation-confined grants, not standing roles. + Setup []*OfferSetup `protobuf:"bytes,9,rep,name=setup,proto3" json:"setup,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *ReviewedOffer) Reset() { @@ -1319,6 +1321,86 @@ func (x *ReviewedOffer) GetEdgeDependencies() []*OfferDependency { return nil } +func (x *ReviewedOffer) GetSetup() []*OfferSetup { + if x != nil { + return x.Setup + } + return nil +} + +// OfferSetup explains the exact authority usable only while setup is pending. +type OfferSetup struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The declared binding. + Binding string `protobuf:"bytes,1,opt,name=binding,proto3" json:"binding,omitempty"` + // The destination principal. + Module string `protobuf:"bytes,2,opt,name=module,proto3" json:"module,omitempty"` + // The exact allowed methods, even if other methods share their scopes. + Methods []string `protobuf:"bytes,3,rep,name=methods,proto3" json:"methods,omitempty"` + // Requirements, always confined to the pending installation's owner. + Scopes []*OfferScope `protobuf:"bytes,4,rep,name=scopes,proto3" json:"scopes,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *OfferSetup) Reset() { + *x = OfferSetup{} + mi := &file_host_installation_v1_installation_proto_msgTypes[19] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *OfferSetup) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*OfferSetup) ProtoMessage() {} + +func (x *OfferSetup) ProtoReflect() protoreflect.Message { + mi := &file_host_installation_v1_installation_proto_msgTypes[19] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use OfferSetup.ProtoReflect.Descriptor instead. +func (*OfferSetup) Descriptor() ([]byte, []int) { + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{19} +} + +func (x *OfferSetup) GetBinding() string { + if x != nil { + return x.Binding + } + return "" +} + +func (x *OfferSetup) GetModule() string { + if x != nil { + return x.Module + } + return "" +} + +func (x *OfferSetup) GetMethods() []string { + if x != nil { + return x.Methods + } + return nil +} + +func (x *OfferSetup) GetScopes() []*OfferScope { + if x != nil { + return x.Scopes + } + return nil +} + // OfferDependency carries presence only, never scopes or inferred binding ids. // Module is the exact signed principal, resolved by the host to its live target. type OfferDependency struct { @@ -1331,7 +1413,7 @@ type OfferDependency struct { func (x *OfferDependency) Reset() { *x = OfferDependency{} - mi := &file_host_installation_v1_installation_proto_msgTypes[19] + mi := &file_host_installation_v1_installation_proto_msgTypes[20] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1343,7 +1425,7 @@ func (x *OfferDependency) String() string { func (*OfferDependency) ProtoMessage() {} func (x *OfferDependency) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[19] + mi := &file_host_installation_v1_installation_proto_msgTypes[20] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1356,7 +1438,7 @@ func (x *OfferDependency) ProtoReflect() protoreflect.Message { // Deprecated: Use OfferDependency.ProtoReflect.Descriptor instead. func (*OfferDependency) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{19} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{20} } func (x *OfferDependency) GetModule() string { @@ -1386,7 +1468,7 @@ type OfferBinding struct { func (x *OfferBinding) Reset() { *x = OfferBinding{} - mi := &file_host_installation_v1_installation_proto_msgTypes[20] + mi := &file_host_installation_v1_installation_proto_msgTypes[21] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1398,7 +1480,7 @@ func (x *OfferBinding) String() string { func (*OfferBinding) ProtoMessage() {} func (x *OfferBinding) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[20] + mi := &file_host_installation_v1_installation_proto_msgTypes[21] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1411,7 +1493,7 @@ func (x *OfferBinding) ProtoReflect() protoreflect.Message { // Deprecated: Use OfferBinding.ProtoReflect.Descriptor instead. func (*OfferBinding) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{20} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{21} } func (x *OfferBinding) GetBinding() string { @@ -1449,7 +1531,7 @@ type OfferRole struct { func (x *OfferRole) Reset() { *x = OfferRole{} - mi := &file_host_installation_v1_installation_proto_msgTypes[21] + mi := &file_host_installation_v1_installation_proto_msgTypes[22] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1461,7 +1543,7 @@ func (x *OfferRole) String() string { func (*OfferRole) ProtoMessage() {} func (x *OfferRole) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[21] + mi := &file_host_installation_v1_installation_proto_msgTypes[22] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1474,7 +1556,7 @@ func (x *OfferRole) ProtoReflect() protoreflect.Message { // Deprecated: Use OfferRole.ProtoReflect.Descriptor instead. func (*OfferRole) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{21} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{22} } func (x *OfferRole) GetName() string { @@ -1514,7 +1596,7 @@ type OfferScope struct { func (x *OfferScope) Reset() { *x = OfferScope{} - mi := &file_host_installation_v1_installation_proto_msgTypes[22] + mi := &file_host_installation_v1_installation_proto_msgTypes[23] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1526,7 +1608,7 @@ func (x *OfferScope) String() string { func (*OfferScope) ProtoMessage() {} func (x *OfferScope) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[22] + mi := &file_host_installation_v1_installation_proto_msgTypes[23] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1539,7 +1621,7 @@ func (x *OfferScope) ProtoReflect() protoreflect.Message { // Deprecated: Use OfferScope.ProtoReflect.Descriptor instead. func (*OfferScope) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{22} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{23} } func (x *OfferScope) GetResourceKind() string { @@ -1587,7 +1669,7 @@ type OfferCapability struct { func (x *OfferCapability) Reset() { *x = OfferCapability{} - mi := &file_host_installation_v1_installation_proto_msgTypes[23] + mi := &file_host_installation_v1_installation_proto_msgTypes[24] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1599,7 +1681,7 @@ func (x *OfferCapability) String() string { func (*OfferCapability) ProtoMessage() {} func (x *OfferCapability) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[23] + mi := &file_host_installation_v1_installation_proto_msgTypes[24] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1612,7 +1694,7 @@ func (x *OfferCapability) ProtoReflect() protoreflect.Message { // Deprecated: Use OfferCapability.ProtoReflect.Descriptor instead. func (*OfferCapability) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{23} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{24} } func (x *OfferCapability) GetModule() string { @@ -1658,7 +1740,7 @@ type OfferTool struct { func (x *OfferTool) Reset() { *x = OfferTool{} - mi := &file_host_installation_v1_installation_proto_msgTypes[24] + mi := &file_host_installation_v1_installation_proto_msgTypes[25] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1670,7 +1752,7 @@ func (x *OfferTool) String() string { func (*OfferTool) ProtoMessage() {} func (x *OfferTool) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[24] + mi := &file_host_installation_v1_installation_proto_msgTypes[25] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1683,7 +1765,7 @@ func (x *OfferTool) ProtoReflect() protoreflect.Message { // Deprecated: Use OfferTool.ProtoReflect.Descriptor instead. func (*OfferTool) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{24} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{25} } func (x *OfferTool) GetName() string { @@ -1719,7 +1801,7 @@ type ListHeldRequest struct { func (x *ListHeldRequest) Reset() { *x = ListHeldRequest{} - mi := &file_host_installation_v1_installation_proto_msgTypes[25] + mi := &file_host_installation_v1_installation_proto_msgTypes[26] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1731,7 +1813,7 @@ func (x *ListHeldRequest) String() string { func (*ListHeldRequest) ProtoMessage() {} func (x *ListHeldRequest) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[25] + mi := &file_host_installation_v1_installation_proto_msgTypes[26] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1744,7 +1826,7 @@ func (x *ListHeldRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListHeldRequest.ProtoReflect.Descriptor instead. func (*ListHeldRequest) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{25} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{26} } func (x *ListHeldRequest) GetOrganizationId() string { @@ -1766,7 +1848,7 @@ type ListHeldResponse struct { func (x *ListHeldResponse) Reset() { *x = ListHeldResponse{} - mi := &file_host_installation_v1_installation_proto_msgTypes[26] + mi := &file_host_installation_v1_installation_proto_msgTypes[27] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1778,7 +1860,7 @@ func (x *ListHeldResponse) String() string { func (*ListHeldResponse) ProtoMessage() {} func (x *ListHeldResponse) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[26] + mi := &file_host_installation_v1_installation_proto_msgTypes[27] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1791,7 +1873,7 @@ func (x *ListHeldResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListHeldResponse.ProtoReflect.Descriptor instead. func (*ListHeldResponse) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{26} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{27} } func (x *ListHeldResponse) GetInstallations() []*HeldInstallation { @@ -1814,7 +1896,7 @@ type HeldInstallation struct { func (x *HeldInstallation) Reset() { *x = HeldInstallation{} - mi := &file_host_installation_v1_installation_proto_msgTypes[27] + mi := &file_host_installation_v1_installation_proto_msgTypes[28] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1826,7 +1908,7 @@ func (x *HeldInstallation) String() string { func (*HeldInstallation) ProtoMessage() {} func (x *HeldInstallation) ProtoReflect() protoreflect.Message { - mi := &file_host_installation_v1_installation_proto_msgTypes[27] + mi := &file_host_installation_v1_installation_proto_msgTypes[28] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1839,7 +1921,7 @@ func (x *HeldInstallation) ProtoReflect() protoreflect.Message { // Deprecated: Use HeldInstallation.ProtoReflect.Descriptor instead. func (*HeldInstallation) Descriptor() ([]byte, []int) { - return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{27} + return file_host_installation_v1_installation_proto_rawDescGZIP(), []int{28} } func (x *HeldInstallation) GetInstallation() *Installation { @@ -1939,7 +2021,7 @@ const file_host_installation_v1_installation_proto_rawDesc = "" + "\x06target\x18\x01 \x01(\tR\x06target\x12\x1e\n" + "\n" + "generation\x18\x02 \x01(\x04R\n" + - "generation\"\xcf\x03\n" + + "generation\"\x87\x04\n" + "\rReviewedOffer\x12A\n" + "\bapproval\x18\x01 \x01(\v2%.host.installation.v1.ConsentApprovalR\bapproval\x12\x16\n" + "\x06target\x18\x02 \x01(\tR\x06target\x125\n" + @@ -1948,7 +2030,14 @@ const file_host_installation_v1_installation_proto_rawDesc = "" + "\aceiling\x18\x05 \x03(\v2\".host.installation.v1.OfferBindingR\aceiling\x12%\n" + "\x0etools_composed\x18\x06 \x01(\bR\rtoolsComposed\x12+\n" + "\x11installation_role\x18\a \x01(\tR\x10installationRole\x12R\n" + - "\x11edge_dependencies\x18\b \x03(\v2%.host.installation.v1.OfferDependencyR\x10edgeDependencies\"E\n" + + "\x11edge_dependencies\x18\b \x03(\v2%.host.installation.v1.OfferDependencyR\x10edgeDependencies\x126\n" + + "\x05setup\x18\t \x03(\v2 .host.installation.v1.OfferSetupR\x05setup\"\x92\x01\n" + + "\n" + + "OfferSetup\x12\x18\n" + + "\abinding\x18\x01 \x01(\tR\abinding\x12\x16\n" + + "\x06module\x18\x02 \x01(\tR\x06module\x12\x18\n" + + "\amethods\x18\x03 \x03(\tR\amethods\x128\n" + + "\x06scopes\x18\x04 \x03(\v2 .host.installation.v1.OfferScopeR\x06scopes\"E\n" + "\x0fOfferDependency\x12\x16\n" + "\x06module\x18\x01 \x01(\tR\x06module\x12\x1a\n" + "\bpresence\x18\x02 \x01(\tR\bpresence\"z\n" + @@ -2013,7 +2102,7 @@ func file_host_installation_v1_installation_proto_rawDescGZIP() []byte { } var file_host_installation_v1_installation_proto_enumTypes = make([]protoimpl.EnumInfo, 1) -var file_host_installation_v1_installation_proto_msgTypes = make([]protoimpl.MessageInfo, 28) +var file_host_installation_v1_installation_proto_msgTypes = make([]protoimpl.MessageInfo, 29) var file_host_installation_v1_installation_proto_goTypes = []any{ (Installation_Status)(0), // 0: host.installation.v1.Installation.Status (*CurrentInstallationRequest)(nil), // 1: host.installation.v1.CurrentInstallationRequest @@ -2035,15 +2124,16 @@ var file_host_installation_v1_installation_proto_goTypes = []any{ (*ListOffersResponse)(nil), // 17: host.installation.v1.ListOffersResponse (*Offer)(nil), // 18: host.installation.v1.Offer (*ReviewedOffer)(nil), // 19: host.installation.v1.ReviewedOffer - (*OfferDependency)(nil), // 20: host.installation.v1.OfferDependency - (*OfferBinding)(nil), // 21: host.installation.v1.OfferBinding - (*OfferRole)(nil), // 22: host.installation.v1.OfferRole - (*OfferScope)(nil), // 23: host.installation.v1.OfferScope - (*OfferCapability)(nil), // 24: host.installation.v1.OfferCapability - (*OfferTool)(nil), // 25: host.installation.v1.OfferTool - (*ListHeldRequest)(nil), // 26: host.installation.v1.ListHeldRequest - (*ListHeldResponse)(nil), // 27: host.installation.v1.ListHeldResponse - (*HeldInstallation)(nil), // 28: host.installation.v1.HeldInstallation + (*OfferSetup)(nil), // 20: host.installation.v1.OfferSetup + (*OfferDependency)(nil), // 21: host.installation.v1.OfferDependency + (*OfferBinding)(nil), // 22: host.installation.v1.OfferBinding + (*OfferRole)(nil), // 23: host.installation.v1.OfferRole + (*OfferScope)(nil), // 24: host.installation.v1.OfferScope + (*OfferCapability)(nil), // 25: host.installation.v1.OfferCapability + (*OfferTool)(nil), // 26: host.installation.v1.OfferTool + (*ListHeldRequest)(nil), // 27: host.installation.v1.ListHeldRequest + (*ListHeldResponse)(nil), // 28: host.installation.v1.ListHeldResponse + (*HeldInstallation)(nil), // 29: host.installation.v1.HeldInstallation } var file_host_installation_v1_installation_proto_depIdxs = []int32{ 5, // 0: host.installation.v1.InstallRequest.approval:type_name -> host.installation.v1.ConsentApproval @@ -2053,44 +2143,46 @@ var file_host_installation_v1_installation_proto_depIdxs = []int32{ 13, // 4: host.installation.v1.InstallationNotice.installation:type_name -> host.installation.v1.Installation 18, // 5: host.installation.v1.ListOffersResponse.offers:type_name -> host.installation.v1.Offer 5, // 6: host.installation.v1.ReviewedOffer.approval:type_name -> host.installation.v1.ConsentApproval - 22, // 7: host.installation.v1.ReviewedOffer.roles:type_name -> host.installation.v1.OfferRole + 23, // 7: host.installation.v1.ReviewedOffer.roles:type_name -> host.installation.v1.OfferRole 13, // 8: host.installation.v1.ReviewedOffer.installation:type_name -> host.installation.v1.Installation - 21, // 9: host.installation.v1.ReviewedOffer.ceiling:type_name -> host.installation.v1.OfferBinding - 20, // 10: host.installation.v1.ReviewedOffer.edge_dependencies:type_name -> host.installation.v1.OfferDependency - 23, // 11: host.installation.v1.OfferBinding.scopes:type_name -> host.installation.v1.OfferScope - 23, // 12: host.installation.v1.OfferRole.scopes:type_name -> host.installation.v1.OfferScope - 24, // 13: host.installation.v1.OfferRole.capabilities:type_name -> host.installation.v1.OfferCapability - 23, // 14: host.installation.v1.OfferCapability.requires:type_name -> host.installation.v1.OfferScope - 25, // 15: host.installation.v1.OfferCapability.tools:type_name -> host.installation.v1.OfferTool - 28, // 16: host.installation.v1.ListHeldResponse.installations:type_name -> host.installation.v1.HeldInstallation - 13, // 17: host.installation.v1.HeldInstallation.installation:type_name -> host.installation.v1.Installation - 1, // 18: host.installation.v1.InstallationService.Current:input_type -> host.installation.v1.CurrentInstallationRequest - 3, // 19: host.installation.v1.InstallationService.Install:input_type -> host.installation.v1.InstallRequest - 4, // 20: host.installation.v1.InstallationService.Review:input_type -> host.installation.v1.ReviewRequest - 6, // 21: host.installation.v1.InstallationService.GrantRole:input_type -> host.installation.v1.GrantRoleRequest - 7, // 22: host.installation.v1.InstallationService.RevokeRole:input_type -> host.installation.v1.RevokeRoleRequest - 8, // 23: host.installation.v1.InstallationService.ListRoleGrants:input_type -> host.installation.v1.ListRoleGrantsRequest - 11, // 24: host.installation.v1.InstallationService.List:input_type -> host.installation.v1.ListRequest - 26, // 25: host.installation.v1.InstallationService.ListHeld:input_type -> host.installation.v1.ListHeldRequest - 14, // 26: host.installation.v1.InstallableService.Install:input_type -> host.installation.v1.InstallationNotice - 16, // 27: host.installation.v1.OfferService.ListOffers:input_type -> host.installation.v1.ListOffersRequest - 4, // 28: host.installation.v1.OfferService.ReviewOffer:input_type -> host.installation.v1.ReviewRequest - 2, // 29: host.installation.v1.InstallationService.Current:output_type -> host.installation.v1.CurrentInstallation - 13, // 30: host.installation.v1.InstallationService.Install:output_type -> host.installation.v1.Installation - 5, // 31: host.installation.v1.InstallationService.Review:output_type -> host.installation.v1.ConsentApproval - 13, // 32: host.installation.v1.InstallationService.GrantRole:output_type -> host.installation.v1.Installation - 13, // 33: host.installation.v1.InstallationService.RevokeRole:output_type -> host.installation.v1.Installation - 9, // 34: host.installation.v1.InstallationService.ListRoleGrants:output_type -> host.installation.v1.ListRoleGrantsResponse - 12, // 35: host.installation.v1.InstallationService.List:output_type -> host.installation.v1.ListResponse - 27, // 36: host.installation.v1.InstallationService.ListHeld:output_type -> host.installation.v1.ListHeldResponse - 15, // 37: host.installation.v1.InstallableService.Install:output_type -> host.installation.v1.InstallationAck - 17, // 38: host.installation.v1.OfferService.ListOffers:output_type -> host.installation.v1.ListOffersResponse - 19, // 39: host.installation.v1.OfferService.ReviewOffer:output_type -> host.installation.v1.ReviewedOffer - 29, // [29:40] is the sub-list for method output_type - 18, // [18:29] is the sub-list for method input_type - 18, // [18:18] is the sub-list for extension type_name - 18, // [18:18] is the sub-list for extension extendee - 0, // [0:18] is the sub-list for field type_name + 22, // 9: host.installation.v1.ReviewedOffer.ceiling:type_name -> host.installation.v1.OfferBinding + 21, // 10: host.installation.v1.ReviewedOffer.edge_dependencies:type_name -> host.installation.v1.OfferDependency + 20, // 11: host.installation.v1.ReviewedOffer.setup:type_name -> host.installation.v1.OfferSetup + 24, // 12: host.installation.v1.OfferSetup.scopes:type_name -> host.installation.v1.OfferScope + 24, // 13: host.installation.v1.OfferBinding.scopes:type_name -> host.installation.v1.OfferScope + 24, // 14: host.installation.v1.OfferRole.scopes:type_name -> host.installation.v1.OfferScope + 25, // 15: host.installation.v1.OfferRole.capabilities:type_name -> host.installation.v1.OfferCapability + 24, // 16: host.installation.v1.OfferCapability.requires:type_name -> host.installation.v1.OfferScope + 26, // 17: host.installation.v1.OfferCapability.tools:type_name -> host.installation.v1.OfferTool + 29, // 18: host.installation.v1.ListHeldResponse.installations:type_name -> host.installation.v1.HeldInstallation + 13, // 19: host.installation.v1.HeldInstallation.installation:type_name -> host.installation.v1.Installation + 1, // 20: host.installation.v1.InstallationService.Current:input_type -> host.installation.v1.CurrentInstallationRequest + 3, // 21: host.installation.v1.InstallationService.Install:input_type -> host.installation.v1.InstallRequest + 4, // 22: host.installation.v1.InstallationService.Review:input_type -> host.installation.v1.ReviewRequest + 6, // 23: host.installation.v1.InstallationService.GrantRole:input_type -> host.installation.v1.GrantRoleRequest + 7, // 24: host.installation.v1.InstallationService.RevokeRole:input_type -> host.installation.v1.RevokeRoleRequest + 8, // 25: host.installation.v1.InstallationService.ListRoleGrants:input_type -> host.installation.v1.ListRoleGrantsRequest + 11, // 26: host.installation.v1.InstallationService.List:input_type -> host.installation.v1.ListRequest + 27, // 27: host.installation.v1.InstallationService.ListHeld:input_type -> host.installation.v1.ListHeldRequest + 14, // 28: host.installation.v1.InstallableService.Install:input_type -> host.installation.v1.InstallationNotice + 16, // 29: host.installation.v1.OfferService.ListOffers:input_type -> host.installation.v1.ListOffersRequest + 4, // 30: host.installation.v1.OfferService.ReviewOffer:input_type -> host.installation.v1.ReviewRequest + 2, // 31: host.installation.v1.InstallationService.Current:output_type -> host.installation.v1.CurrentInstallation + 13, // 32: host.installation.v1.InstallationService.Install:output_type -> host.installation.v1.Installation + 5, // 33: host.installation.v1.InstallationService.Review:output_type -> host.installation.v1.ConsentApproval + 13, // 34: host.installation.v1.InstallationService.GrantRole:output_type -> host.installation.v1.Installation + 13, // 35: host.installation.v1.InstallationService.RevokeRole:output_type -> host.installation.v1.Installation + 9, // 36: host.installation.v1.InstallationService.ListRoleGrants:output_type -> host.installation.v1.ListRoleGrantsResponse + 12, // 37: host.installation.v1.InstallationService.List:output_type -> host.installation.v1.ListResponse + 28, // 38: host.installation.v1.InstallationService.ListHeld:output_type -> host.installation.v1.ListHeldResponse + 15, // 39: host.installation.v1.InstallableService.Install:output_type -> host.installation.v1.InstallationAck + 17, // 40: host.installation.v1.OfferService.ListOffers:output_type -> host.installation.v1.ListOffersResponse + 19, // 41: host.installation.v1.OfferService.ReviewOffer:output_type -> host.installation.v1.ReviewedOffer + 31, // [31:42] is the sub-list for method output_type + 20, // [20:31] is the sub-list for method input_type + 20, // [20:20] is the sub-list for extension type_name + 20, // [20:20] is the sub-list for extension extendee + 0, // [0:20] is the sub-list for field type_name } func init() { file_host_installation_v1_installation_proto_init() } @@ -2104,7 +2196,7 @@ func file_host_installation_v1_installation_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_host_installation_v1_installation_proto_rawDesc), len(file_host_installation_v1_installation_proto_rawDesc)), NumEnums: 1, - NumMessages: 28, + NumMessages: 29, NumExtensions: 0, NumServices: 3, }, diff --git a/module/services/accounts/code/pkg/infra/canonical_declaration_encoding_test.go b/module/services/accounts/code/pkg/infra/canonical_declaration_encoding_test.go index 668928743..68ce83b8f 100644 --- a/module/services/accounts/code/pkg/infra/canonical_declaration_encoding_test.go +++ b/module/services/accounts/code/pkg/infra/canonical_declaration_encoding_test.go @@ -6,11 +6,12 @@ import ( "testing" "github.com/codefly-dev/authority/libraries/authority-core/go/domain" + modulecontract "github.com/codefly-dev/core/contracts/module" ) func TestCanonicalDeclarationStorageRetainsOwnerValues(t *testing.T) { for _, role := range []string{"", "none", "reader"} { - m := domain.Module{InstallationRole: role, EdgeDependencies: []domain.EdgeDependency{ + m := domain.Module{OwnerAwareResourceKinds: []string{"example.items"}, Setup: []modulecontract.ResolvedSetup{{Binding: "schemas", Methods: []string{"/store.v1.Store/Define"}, Scopes: []string{"records.types:define"}}}, InstallationRole: role, EdgeDependencies: []domain.EdgeDependency{ {Module: "acme.records", Presence: "required"}, {Module: "acme.annotations", Presence: "optional"}, }} raw, err := encodeModule(m) @@ -21,7 +22,7 @@ func TestCanonicalDeclarationStorageRetainsOwnerValues(t *testing.T) { if err := decodeModule(&got, raw); err != nil { t.Fatal(err) } - if got.InstallationRole != role || !reflect.DeepEqual(got.EdgeDependencies, m.EdgeDependencies) { + if !reflect.DeepEqual(got.Setup, m.Setup) || !reflect.DeepEqual(got.OwnerAwareResourceKinds, m.OwnerAwareResourceKinds) || got.InstallationRole != role || !reflect.DeepEqual(got.EdgeDependencies, m.EdgeDependencies) { t.Fatalf("owner declaration changed in storage: %+v", got) } var fields map[string]json.RawMessage diff --git a/module/services/accounts/code/pkg/infra/postgres_authority_core.go b/module/services/accounts/code/pkg/infra/postgres_authority_core.go index 1ffd67247..75cb9ba4b 100644 --- a/module/services/accounts/code/pkg/infra/postgres_authority_core.go +++ b/module/services/accounts/code/pkg/infra/postgres_authority_core.go @@ -33,6 +33,7 @@ import ( "github.com/codefly-dev/authority/libraries/authority-core/go/domain" "github.com/codefly-dev/authority/libraries/authority-core/go/scope" resources "github.com/codefly-dev/authority/libraries/resources/go" + modulecontract "github.com/codefly-dev/core/contracts/module" basev0 "github.com/codefly-dev/core/generated/go/codefly/base/v0" "github.com/codefly-dev/core/workcontext" "github.com/google/uuid" @@ -358,16 +359,18 @@ func (t coreTx) grantedRole(role domain.OrgRole, query string, args ...any) (dom // moduleDocument is a module's declarations as stored. type moduleDocument struct { - ResourceKinds []storedScope `json:"resource_kinds,omitempty"` - Bindings map[string]storedBinding `json:"bindings,omitempty"` - Roles map[string][]storedScope `json:"roles,omitempty"` - OwnedRoles map[string][]storedScope `json:"owned_roles,omitempty"` - OwnerAware bool `json:"owner_aware,omitempty"` - Methods map[string]storedMethod `json:"methods,omitempty"` - HasRoles bool `json:"has_roles,omitempty"` - HasMethods bool `json:"has_methods,omitempty"` - InstallationRole string `json:"installation_role,omitempty"` - EdgeDependencies []domain.EdgeDependency `json:"edge_dependencies,omitempty"` + Setup []modulecontract.ResolvedSetup `json:"setup,omitempty"` + OwnerAwareResourceKinds []string `json:"owner_aware_resource_kinds,omitempty"` + ResourceKinds []storedScope `json:"resource_kinds,omitempty"` + Bindings map[string]storedBinding `json:"bindings,omitempty"` + Roles map[string][]storedScope `json:"roles,omitempty"` + OwnedRoles map[string][]storedScope `json:"owned_roles,omitempty"` + OwnerAware bool `json:"owner_aware,omitempty"` + Methods map[string]storedMethod `json:"methods,omitempty"` + HasRoles bool `json:"has_roles,omitempty"` + HasMethods bool `json:"has_methods,omitempty"` + InstallationRole string `json:"installation_role,omitempty"` + EdgeDependencies []domain.EdgeDependency `json:"edge_dependencies,omitempty"` } type storedScope struct { @@ -409,7 +412,7 @@ func loadScopes(in []storedScope) []*basev0.WorkScopeV1 { } func encodeModule(m domain.Module) ([]byte, error) { - doc := moduleDocument{ResourceKinds: storeScopes(m.ResourceKinds), OwnerAware: m.OwnerAware, HasRoles: m.Roles != nil, HasMethods: m.Methods != nil, + doc := moduleDocument{Setup: m.Setup, OwnerAwareResourceKinds: m.OwnerAwareResourceKinds, ResourceKinds: storeScopes(m.ResourceKinds), OwnerAware: m.OwnerAware, HasRoles: m.Roles != nil, HasMethods: m.Methods != nil, InstallationRole: m.InstallationRole, EdgeDependencies: m.EdgeDependencies} if len(m.Bindings) > 0 { doc.Bindings = map[string]storedBinding{} @@ -443,6 +446,7 @@ func decodeModule(m *domain.Module, raw []byte) error { if err := json.Unmarshal(raw, &doc); err != nil { return fmt.Errorf("module %s: stored declarations do not read: %w", m.Name, err) } + m.Setup, m.OwnerAwareResourceKinds = doc.Setup, doc.OwnerAwareResourceKinds m.ResourceKinds, m.OwnerAware = loadScopes(doc.ResourceKinds), doc.OwnerAware m.InstallationRole, m.EdgeDependencies = doc.InstallationRole, doc.EdgeDependencies m.Bindings = map[string]domain.Binding{} diff --git a/module/services/accounts/generated/openapi-raw/api.swagger.json b/module/services/accounts/generated/openapi-raw/api.swagger.json index 0e8987987..7df8d6d4e 100644 --- a/module/services/accounts/generated/openapi-raw/api.swagger.json +++ b/module/services/accounts/generated/openapi-raw/api.swagger.json @@ -9421,6 +9421,20 @@ }, "description": "InstallationRef names an installation acting for itself." }, + "v1InstallationSetupRef": { + "type": "object", + "properties": { + "stepToken": { + "type": "string", + "description": "The unexpired standard installation callback credential." + }, + "method": { + "type": "string", + "description": "The exact destination method selected by the setup declaration." + } + }, + "description": "InstallationSetupRef selects one exact method from the reviewed setup grant.\nThe callback token proves the current attempt; it is not data authority." + }, "v1InstallationStatus": { "type": "string", "enum": [ @@ -9634,6 +9648,10 @@ "$ref": "#/definitions/v1DelegationRef", "description": "A delegation a person granted the module acting (actor): the capability\nis owned by that person and carries the delegation on the module's hop.\nNo live capability is presented: the authority re-checks the delegation\nand what its grantor holds now, so a revoked delegation or a lost role\nstops the next issue, and renewing is issuing again." }, + "setup": { + "$ref": "#/definitions/v1InstallationSetupRef", + "description": "Current authenticated install callback evidence for one declared setup\nmethod. Independent of standing roles; requires the solution's actor." + }, "audience": { "type": "string", "description": "The module principal that may consume the capability." diff --git a/module/services/accounts/proto/host/authority/v1/authority.proto b/module/services/accounts/proto/host/authority/v1/authority.proto index 4df9e58a4..5367471ef 100644 --- a/module/services/accounts/proto/host/authority/v1/authority.proto +++ b/module/services/accounts/proto/host/authority/v1/authority.proto @@ -149,6 +149,9 @@ message IssueRequest { // and what its grantor holds now, so a revoked delegation or a lost role // stops the next issue, and renewing is issuing again. DelegationRef delegation = 11; + // Current authenticated install callback evidence for one declared setup + // method. Independent of standing roles; requires the solution's actor. + InstallationSetupRef setup = 13; } // The module principal that may consume the capability. string audience = 5; @@ -174,6 +177,15 @@ message IssueRequest { string operation = 12; } +// InstallationSetupRef selects one exact method from the reviewed setup grant. +// The callback token proves the current attempt; it is not data authority. +message InstallationSetupRef { + // The unexpired standard installation callback credential. + string step_token = 1; + // The exact destination method selected by the setup declaration. + string method = 2; +} + // DelegationRef names one delegation. message DelegationRef { // The delegation's id, as Delegate answered it. diff --git a/module/services/accounts/proto/host/composition/v1/composition.proto b/module/services/accounts/proto/host/composition/v1/composition.proto index f0f100782..ad131d7cf 100644 --- a/module/services/accounts/proto/host/composition/v1/composition.proto +++ b/module/services/accounts/proto/host/composition/v1/composition.proto @@ -72,6 +72,21 @@ message AuthorityManifestV1 { string installation_role = 8; // Viewer-edge presence only; grants no authority. Nil and empty are equivalent. repeated EdgeDependencyV1 edge_dependencies = 9; + // Resolved installation-only grants; separate from standing roles. + repeated SetupGrantV1 setup = 10; + // Only these served kinds enforce resource-owner selectors. Mutually + // exclusive with owner_aware true; empty means none. + repeated string owner_aware_resource_kinds = 11; +} + +// SetupGrantV1 retains exact methods even when two methods share requirements. +message SetupGrantV1 { + // The required foreign invoke binding that reaches the destination. + string binding = 1; + // Exact, unique methods approved for this installation's setup only. + repeated string methods = 2; + // Callee-derived requirements as resource-kind:action, within invoke ceiling. + repeated string scopes = 3; } // EdgeDependencyV1 names the exact signed module principal. The host resolves diff --git a/module/services/accounts/proto/host/installation/v1/installation.proto b/module/services/accounts/proto/host/installation/v1/installation.proto index a2edbc627..742649aaf 100644 --- a/module/services/accounts/proto/host/installation/v1/installation.proto +++ b/module/services/accounts/proto/host/installation/v1/installation.proto @@ -270,6 +270,20 @@ message ReviewedOffer { // Exact declared viewer-edge presence, covered by the reviewed digest. // Required access and per-module approval are separate host review concerns. repeated OfferDependency edge_dependencies = 8; + // Temporary installation-confined grants, not standing roles. + repeated OfferSetup setup = 9; +} + +// OfferSetup explains the exact authority usable only while setup is pending. +message OfferSetup { + // The declared binding. + string binding = 1; + // The destination principal. + string module = 2; + // The exact allowed methods, even if other methods share their scopes. + repeated string methods = 3; + // Requirements, always confined to the pending installation's owner. + repeated OfferScope scopes = 4; } // OfferDependency carries presence only, never scopes or inferred binding ids. diff --git a/module/services/frontend/code/src/gen/host/authority/v1/authority_pb.ts b/module/services/frontend/code/src/gen/host/authority/v1/authority_pb.ts index 537c218d2..e2c838918 100644 --- a/module/services/frontend/code/src/gen/host/authority/v1/authority_pb.ts +++ b/module/services/frontend/code/src/gen/host/authority/v1/authority_pb.ts @@ -19,7 +19,7 @@ import type { Message } from "@bufbuild/protobuf"; * Describes the file host/authority/v1/authority.proto. */ export const file_host_authority_v1_authority: GenFile = /*@__PURE__*/ - fileDesc("CiFob3N0L2F1dGhvcml0eS92MS9hdXRob3JpdHkucHJvdG8SEWhvc3QuYXV0aG9yaXR5LnYxIuYDCgxJc3N1ZVJlcXVlc3QSMgoGcGVyc29uGAEgASgLMiAuaG9zdC5hdXRob3JpdHkudjEuUGVyc29uU2Vzc2lvbkgAEjkKCHdvcmtsb2FkGAIgASgLMiUuaG9zdC5hdXRob3JpdHkudjEuV29ya2xvYWRDcmVkZW50aWFsSAASOgoMaW5zdGFsbGF0aW9uGAMgASgLMiIuaG9zdC5hdXRob3JpdHkudjEuSW5zdGFsbGF0aW9uUmVmSAASFgoMcGFyZW50X3Rva2VuGAQgASgJSAASNgoKZGVsZWdhdGlvbhgLIAEoCzIgLmhvc3QuYXV0aG9yaXR5LnYxLkRlbGVnYXRpb25SZWZIABIQCghhdWRpZW5jZRgFIAEoCRIuCgZzY29wZXMYBiADKAsyHi5ob3N0LmF1dGhvcml0eS52MS5Xb3JrU2NvcGVWMRITCgt0dGxfc2Vjb25kcxgHIAEoAxIcChRvcGVyYXRpb25fYmluZGluZ19pZBgIIAEoCRIXCg9vcmdhbml6YXRpb25faWQYCSABKAkSNAoFYWN0b3IYCiABKAsyJS5ob3N0LmF1dGhvcml0eS52MS5Xb3JrbG9hZENyZWRlbnRpYWwSEQoJb3BlcmF0aW9uGAwgASgJQgQKAmFzIiYKDURlbGVnYXRpb25SZWYSFQoNZGVsZWdhdGlvbl9pZBgBIAEoCSJ3Cg9EZWxlZ2F0ZVJlcXVlc3QSDgoGbW9kdWxlGAEgASgJEi4KBnNjb3BlcxgCIAMoCzIeLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtTY29wZVYxEg8KB3B1cnBvc2UYAyABKAkSEwoLdHRsX3NlY29uZHMYBCABKAMixwEKCkRlbGVnYXRpb24SFQoNZGVsZWdhdGlvbl9pZBgBIAEoCRIXCg9vcmdhbml6YXRpb25faWQYAiABKAkSDwoHZ3JhbnRvchgDIAEoCRIOCgZtb2R1bGUYBCABKAkSLgoGc2NvcGVzGAUgAygLMh4uaG9zdC5hdXRob3JpdHkudjEuV29ya1Njb3BlVjESDwoHcHVycG9zZRgGIAEoCRIOCgZhY3RpdmUYByABKAgSFwoPZXhwaXJlc19hdF91bml4GAggASgDImMKFEdldERlbGVnYXRpb25SZXF1ZXN0EhUKDWRlbGVnYXRpb25faWQYASABKAkSNAoFYWN0b3IYAiABKAsyJS5ob3N0LmF1dGhvcml0eS52MS5Xb3JrbG9hZENyZWRlbnRpYWwiMAoXUmV2b2tlRGVsZWdhdGlvblJlcXVlc3QSFQoNZGVsZWdhdGlvbl9pZBgBIAEoCSJNChhSZXZva2VEZWxlZ2F0aW9uUmVzcG9uc2USMQoKZGVsZWdhdGlvbhgBIAEoCzIdLmhvc3QuYXV0aG9yaXR5LnYxLkRlbGVnYXRpb24iIQoNUGVyc29uU2Vzc2lvbkoECAEQAlIKc2Vzc2lvbl9pZCIoChJXb3JrbG9hZENyZWRlbnRpYWwSEgoKY3JlZGVudGlhbBgBIAEoCSIqCg9JbnN0YWxsYXRpb25SZWYSFwoPaW5zdGFsbGF0aW9uX2lkGAEgASgJImoKDUlzc3VlUmVzcG9uc2USDQoFdG9rZW4YASABKAkSFwoPZXhwaXJlc19hdF91bml4GAIgASgDEjEKB2NvbnRleHQYAyABKAsyIC5ob3N0LmF1dGhvcml0eS52MS5Xb3JrQ29udGV4dFYxIlEKDENoZWNrUmVxdWVzdBINCgV0b2tlbhgBIAEoCRIQCghhdWRpZW5jZRgCIAEoCRIOCgZtZXRob2QYAyABKAkSEAoIYWR2aXNvcnkYBCABKAgicwoNQ2hlY2tSZXNwb25zZRIxCgdjb250ZXh0GAEgASgLMiAuaG9zdC5hdXRob3JpdHkudjEuV29ya0NvbnRleHRWMRIeChZhdXRob3JpemF0aW9uX3JldmlzaW9uGAIgASgEEg8KB3JlZnVzYWwYAyABKAkiDQoLS2V5c1JlcXVlc3QigAEKDEtleXNSZXNwb25zZRIOCgZpc3N1ZXIYASABKAkSKgoEa2V5cxgCIAMoCzIcLmhvc3QuYXV0aG9yaXR5LnYxLlB1YmxpY0tleRI0Cg5hZG1pc3Npb25fa2V5cxgDIAMoCzIcLmhvc3QuYXV0aG9yaXR5LnYxLlB1YmxpY0tleSJTCglQdWJsaWNLZXkSDgoGa2V5X2lkGAEgASgJEhEKCWFsZ29yaXRobRgCIAEoCRISCgpwdWJsaWNfa2V5GAMgASgMEg8KB3B1cnBvc2UYBCABKAkidgobUmVnaXN0ZXJBZG1pc3Npb25LZXlSZXF1ZXN0EjQKBWFjdG9yGAEgASgLMiUuaG9zdC5hdXRob3JpdHkudjEuV29ya2xvYWRDcmVkZW50aWFsEhIKCnB1YmxpY19rZXkYAiABKAwSDQoFcHJvb2YYAyABKAkiYgocUmVnaXN0ZXJBZG1pc3Npb25LZXlSZXNwb25zZRIpCgNrZXkYASABKAsyHC5ob3N0LmF1dGhvcml0eS52MS5QdWJsaWNLZXkSFwoPZXhwaXJlc19hdF91bml4GAIgASgDIl4KFExpc3RSZXNvdXJjZXNSZXF1ZXN0Eg0KBXRva2VuGAEgASgJEhAKCGF1ZGllbmNlGAIgASgJEhUKDXJlc291cmNlX2tpbmQYAyABKAkSDgoGYWN0aW9uGAQgASgJIkkKFUxpc3RSZXNvdXJjZXNSZXNwb25zZRIwCgZncmFudHMYASADKAsyIC5ob3N0LmF1dGhvcml0eS52MS5SZXNvdXJjZUdyYW50IogBChVBdHRhY2hSZXNvdXJjZVJlcXVlc3QSDQoFdG9rZW4YASABKAkSNAoFYWN0b3IYAiABKAsyJS5ob3N0LmF1dGhvcml0eS52MS5Xb3JrbG9hZENyZWRlbnRpYWwSFQoNcmVzb3VyY2Vfa2luZBgDIAEoCRITCgtyZXNvdXJjZV9pZBgEIAEoCSIxChZBdHRhY2hSZXNvdXJjZVJlc3BvbnNlEhcKD2luc3RhbGxhdGlvbl9pZBgBIAEoCSKSAQoVRGV0YWNoUmVzb3VyY2VSZXF1ZXN0EjQKBWFjdG9yGAEgASgLMiUuaG9zdC5hdXRob3JpdHkudjEuV29ya2xvYWRDcmVkZW50aWFsEhcKD29yZ2FuaXphdGlvbl9pZBgCIAEoCRIVCg1yZXNvdXJjZV9raW5kGAMgASgJEhMKC3Jlc291cmNlX2lkGAQgASgJIjEKFkRldGFjaFJlc291cmNlUmVzcG9uc2USFwoPaW5zdGFsbGF0aW9uX2lkGAEgASgJIrsBChhBdXRob3JpemVUcmFuc2ZlclJlcXVlc3QSDQoFdG9rZW4YASABKAkSNAoFYWN0b3IYAiABKAsyJS5ob3N0LmF1dGhvcml0eS52MS5Xb3JrbG9hZENyZWRlbnRpYWwSFQoNcmVzb3VyY2Vfa2luZBgDIAEoCRITCgtyZXNvdXJjZV9pZBgEIAEoCRIVCg1mcm9tX293bmVyX2lkGAUgASgJEhcKD3RvX3ByaW5jaXBhbF9pZBgGIAEoCSJIChlBdXRob3JpemVUcmFuc2ZlclJlc3BvbnNlEhQKDHByaW5jaXBhbF9pZBgBIAEoCRIVCg1hdXRob3JpemVkX2J5GAIgASgJInUKDVJlc291cmNlR3JhbnQSDQoDYWxsGAEgASgISAASDAoCaWQYAiABKAlIABIQCgZwcmVmaXgYAyABKAlIABIRCgdwYXR0ZXJuGAQgASgJSAASGQoRcmVzb3VyY2Vfb3duZXJfaWQYBSABKAlCBwoFbWF0Y2gy4wgKEEF1dGhvcml0eVNlcnZpY2USagoFSXNzdWUSHy5ob3N0LmF1dGhvcml0eS52MS5Jc3N1ZVJlcXVlc3QaIC5ob3N0LmF1dGhvcml0eS52MS5Jc3N1ZVJlc3BvbnNlIh6C0+STAhg6ASoiEy92MS9hdXRob3JpdHk6aXNzdWUSagoFQ2hlY2sSHy5ob3N0LmF1dGhvcml0eS52MS5DaGVja1JlcXVlc3QaIC5ob3N0LmF1dGhvcml0eS52MS5DaGVja1Jlc3BvbnNlIh6C0+STAhg6ASoiEy92MS9hdXRob3JpdHk6Y2hlY2sSRwoES2V5cxIeLmhvc3QuYXV0aG9yaXR5LnYxLktleXNSZXF1ZXN0Gh8uaG9zdC5hdXRob3JpdHkudjEuS2V5c1Jlc3BvbnNlEncKFFJlZ2lzdGVyQWRtaXNzaW9uS2V5Ei4uaG9zdC5hdXRob3JpdHkudjEuUmVnaXN0ZXJBZG1pc3Npb25LZXlSZXF1ZXN0Gi8uaG9zdC5hdXRob3JpdHkudjEuUmVnaXN0ZXJBZG1pc3Npb25LZXlSZXNwb25zZRJiCg1MaXN0UmVzb3VyY2VzEicuaG9zdC5hdXRob3JpdHkudjEuTGlzdFJlc291cmNlc1JlcXVlc3QaKC5ob3N0LmF1dGhvcml0eS52MS5MaXN0UmVzb3VyY2VzUmVzcG9uc2USZQoOQXR0YWNoUmVzb3VyY2USKC5ob3N0LmF1dGhvcml0eS52MS5BdHRhY2hSZXNvdXJjZVJlcXVlc3QaKS5ob3N0LmF1dGhvcml0eS52MS5BdHRhY2hSZXNvdXJjZVJlc3BvbnNlEmUKDkRldGFjaFJlc291cmNlEiguaG9zdC5hdXRob3JpdHkudjEuRGV0YWNoUmVzb3VyY2VSZXF1ZXN0GikuaG9zdC5hdXRob3JpdHkudjEuRGV0YWNoUmVzb3VyY2VSZXNwb25zZRJuChFBdXRob3JpemVUcmFuc2ZlchIrLmhvc3QuYXV0aG9yaXR5LnYxLkF1dGhvcml6ZVRyYW5zZmVyUmVxdWVzdBosLmhvc3QuYXV0aG9yaXR5LnYxLkF1dGhvcml6ZVRyYW5zZmVyUmVzcG9uc2USTQoIRGVsZWdhdGUSIi5ob3N0LmF1dGhvcml0eS52MS5EZWxlZ2F0ZVJlcXVlc3QaHS5ob3N0LmF1dGhvcml0eS52MS5EZWxlZ2F0aW9uEmsKEFJldm9rZURlbGVnYXRpb24SKi5ob3N0LmF1dGhvcml0eS52MS5SZXZva2VEZWxlZ2F0aW9uUmVxdWVzdBorLmhvc3QuYXV0aG9yaXR5LnYxLlJldm9rZURlbGVnYXRpb25SZXNwb25zZRJXCg1HZXREZWxlZ2F0aW9uEicuaG9zdC5hdXRob3JpdHkudjEuR2V0RGVsZWdhdGlvblJlcXVlc3QaHS5ob3N0LmF1dGhvcml0eS52MS5EZWxlZ2F0aW9uQr0BChVjb20uaG9zdC5hdXRob3JpdHkudjFCDkF1dGhvcml0eVByb3RvUAFaLmFjY291bnRzL3BrZy9nZW4vaG9zdC9hdXRob3JpdHkvdjE7YXV0aG9yaXR5djGiAgNIQViqAhFIb3N0LkF1dGhvcml0eS5WMcoCEUhvc3RcQXV0aG9yaXR5XFYx4gIdSG9zdFxBdXRob3JpdHlcVjFcR1BCTWV0YWRhdGHqAhNIb3N0OjpBdXRob3JpdHk6OlYxYgZwcm90bzM", [file_google_api_annotations, file_host_authority_v1_work_context]); + fileDesc("CiFob3N0L2F1dGhvcml0eS92MS9hdXRob3JpdHkucHJvdG8SEWhvc3QuYXV0aG9yaXR5LnYxIqAECgxJc3N1ZVJlcXVlc3QSMgoGcGVyc29uGAEgASgLMiAuaG9zdC5hdXRob3JpdHkudjEuUGVyc29uU2Vzc2lvbkgAEjkKCHdvcmtsb2FkGAIgASgLMiUuaG9zdC5hdXRob3JpdHkudjEuV29ya2xvYWRDcmVkZW50aWFsSAASOgoMaW5zdGFsbGF0aW9uGAMgASgLMiIuaG9zdC5hdXRob3JpdHkudjEuSW5zdGFsbGF0aW9uUmVmSAASFgoMcGFyZW50X3Rva2VuGAQgASgJSAASNgoKZGVsZWdhdGlvbhgLIAEoCzIgLmhvc3QuYXV0aG9yaXR5LnYxLkRlbGVnYXRpb25SZWZIABI4CgVzZXR1cBgNIAEoCzInLmhvc3QuYXV0aG9yaXR5LnYxLkluc3RhbGxhdGlvblNldHVwUmVmSAASEAoIYXVkaWVuY2UYBSABKAkSLgoGc2NvcGVzGAYgAygLMh4uaG9zdC5hdXRob3JpdHkudjEuV29ya1Njb3BlVjESEwoLdHRsX3NlY29uZHMYByABKAMSHAoUb3BlcmF0aW9uX2JpbmRpbmdfaWQYCCABKAkSFwoPb3JnYW5pemF0aW9uX2lkGAkgASgJEjQKBWFjdG9yGAogASgLMiUuaG9zdC5hdXRob3JpdHkudjEuV29ya2xvYWRDcmVkZW50aWFsEhEKCW9wZXJhdGlvbhgMIAEoCUIECgJhcyI6ChRJbnN0YWxsYXRpb25TZXR1cFJlZhISCgpzdGVwX3Rva2VuGAEgASgJEg4KBm1ldGhvZBgCIAEoCSImCg1EZWxlZ2F0aW9uUmVmEhUKDWRlbGVnYXRpb25faWQYASABKAkidwoPRGVsZWdhdGVSZXF1ZXN0Eg4KBm1vZHVsZRgBIAEoCRIuCgZzY29wZXMYAiADKAsyHi5ob3N0LmF1dGhvcml0eS52MS5Xb3JrU2NvcGVWMRIPCgdwdXJwb3NlGAMgASgJEhMKC3R0bF9zZWNvbmRzGAQgASgDIscBCgpEZWxlZ2F0aW9uEhUKDWRlbGVnYXRpb25faWQYASABKAkSFwoPb3JnYW5pemF0aW9uX2lkGAIgASgJEg8KB2dyYW50b3IYAyABKAkSDgoGbW9kdWxlGAQgASgJEi4KBnNjb3BlcxgFIAMoCzIeLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtTY29wZVYxEg8KB3B1cnBvc2UYBiABKAkSDgoGYWN0aXZlGAcgASgIEhcKD2V4cGlyZXNfYXRfdW5peBgIIAEoAyJjChRHZXREZWxlZ2F0aW9uUmVxdWVzdBIVCg1kZWxlZ2F0aW9uX2lkGAEgASgJEjQKBWFjdG9yGAIgASgLMiUuaG9zdC5hdXRob3JpdHkudjEuV29ya2xvYWRDcmVkZW50aWFsIjAKF1Jldm9rZURlbGVnYXRpb25SZXF1ZXN0EhUKDWRlbGVnYXRpb25faWQYASABKAkiTQoYUmV2b2tlRGVsZWdhdGlvblJlc3BvbnNlEjEKCmRlbGVnYXRpb24YASABKAsyHS5ob3N0LmF1dGhvcml0eS52MS5EZWxlZ2F0aW9uIiEKDVBlcnNvblNlc3Npb25KBAgBEAJSCnNlc3Npb25faWQiKAoSV29ya2xvYWRDcmVkZW50aWFsEhIKCmNyZWRlbnRpYWwYASABKAkiKgoPSW5zdGFsbGF0aW9uUmVmEhcKD2luc3RhbGxhdGlvbl9pZBgBIAEoCSJqCg1Jc3N1ZVJlc3BvbnNlEg0KBXRva2VuGAEgASgJEhcKD2V4cGlyZXNfYXRfdW5peBgCIAEoAxIxCgdjb250ZXh0GAMgASgLMiAuaG9zdC5hdXRob3JpdHkudjEuV29ya0NvbnRleHRWMSJRCgxDaGVja1JlcXVlc3QSDQoFdG9rZW4YASABKAkSEAoIYXVkaWVuY2UYAiABKAkSDgoGbWV0aG9kGAMgASgJEhAKCGFkdmlzb3J5GAQgASgIInMKDUNoZWNrUmVzcG9uc2USMQoHY29udGV4dBgBIAEoCzIgLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtDb250ZXh0VjESHgoWYXV0aG9yaXphdGlvbl9yZXZpc2lvbhgCIAEoBBIPCgdyZWZ1c2FsGAMgASgJIg0KC0tleXNSZXF1ZXN0IoABCgxLZXlzUmVzcG9uc2USDgoGaXNzdWVyGAEgASgJEioKBGtleXMYAiADKAsyHC5ob3N0LmF1dGhvcml0eS52MS5QdWJsaWNLZXkSNAoOYWRtaXNzaW9uX2tleXMYAyADKAsyHC5ob3N0LmF1dGhvcml0eS52MS5QdWJsaWNLZXkiUwoJUHVibGljS2V5Eg4KBmtleV9pZBgBIAEoCRIRCglhbGdvcml0aG0YAiABKAkSEgoKcHVibGljX2tleRgDIAEoDBIPCgdwdXJwb3NlGAQgASgJInYKG1JlZ2lzdGVyQWRtaXNzaW9uS2V5UmVxdWVzdBI0CgVhY3RvchgBIAEoCzIlLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtsb2FkQ3JlZGVudGlhbBISCgpwdWJsaWNfa2V5GAIgASgMEg0KBXByb29mGAMgASgJImIKHFJlZ2lzdGVyQWRtaXNzaW9uS2V5UmVzcG9uc2USKQoDa2V5GAEgASgLMhwuaG9zdC5hdXRob3JpdHkudjEuUHVibGljS2V5EhcKD2V4cGlyZXNfYXRfdW5peBgCIAEoAyJeChRMaXN0UmVzb3VyY2VzUmVxdWVzdBINCgV0b2tlbhgBIAEoCRIQCghhdWRpZW5jZRgCIAEoCRIVCg1yZXNvdXJjZV9raW5kGAMgASgJEg4KBmFjdGlvbhgEIAEoCSJJChVMaXN0UmVzb3VyY2VzUmVzcG9uc2USMAoGZ3JhbnRzGAEgAygLMiAuaG9zdC5hdXRob3JpdHkudjEuUmVzb3VyY2VHcmFudCKIAQoVQXR0YWNoUmVzb3VyY2VSZXF1ZXN0Eg0KBXRva2VuGAEgASgJEjQKBWFjdG9yGAIgASgLMiUuaG9zdC5hdXRob3JpdHkudjEuV29ya2xvYWRDcmVkZW50aWFsEhUKDXJlc291cmNlX2tpbmQYAyABKAkSEwoLcmVzb3VyY2VfaWQYBCABKAkiMQoWQXR0YWNoUmVzb3VyY2VSZXNwb25zZRIXCg9pbnN0YWxsYXRpb25faWQYASABKAkikgEKFURldGFjaFJlc291cmNlUmVxdWVzdBI0CgVhY3RvchgBIAEoCzIlLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtsb2FkQ3JlZGVudGlhbBIXCg9vcmdhbml6YXRpb25faWQYAiABKAkSFQoNcmVzb3VyY2Vfa2luZBgDIAEoCRITCgtyZXNvdXJjZV9pZBgEIAEoCSIxChZEZXRhY2hSZXNvdXJjZVJlc3BvbnNlEhcKD2luc3RhbGxhdGlvbl9pZBgBIAEoCSK7AQoYQXV0aG9yaXplVHJhbnNmZXJSZXF1ZXN0Eg0KBXRva2VuGAEgASgJEjQKBWFjdG9yGAIgASgLMiUuaG9zdC5hdXRob3JpdHkudjEuV29ya2xvYWRDcmVkZW50aWFsEhUKDXJlc291cmNlX2tpbmQYAyABKAkSEwoLcmVzb3VyY2VfaWQYBCABKAkSFQoNZnJvbV9vd25lcl9pZBgFIAEoCRIXCg90b19wcmluY2lwYWxfaWQYBiABKAkiSAoZQXV0aG9yaXplVHJhbnNmZXJSZXNwb25zZRIUCgxwcmluY2lwYWxfaWQYASABKAkSFQoNYXV0aG9yaXplZF9ieRgCIAEoCSJ1Cg1SZXNvdXJjZUdyYW50Eg0KA2FsbBgBIAEoCEgAEgwKAmlkGAIgASgJSAASEAoGcHJlZml4GAMgASgJSAASEQoHcGF0dGVybhgEIAEoCUgAEhkKEXJlc291cmNlX293bmVyX2lkGAUgASgJQgcKBW1hdGNoMuMIChBBdXRob3JpdHlTZXJ2aWNlEmoKBUlzc3VlEh8uaG9zdC5hdXRob3JpdHkudjEuSXNzdWVSZXF1ZXN0GiAuaG9zdC5hdXRob3JpdHkudjEuSXNzdWVSZXNwb25zZSIegtPkkwIYOgEqIhMvdjEvYXV0aG9yaXR5Omlzc3VlEmoKBUNoZWNrEh8uaG9zdC5hdXRob3JpdHkudjEuQ2hlY2tSZXF1ZXN0GiAuaG9zdC5hdXRob3JpdHkudjEuQ2hlY2tSZXNwb25zZSIegtPkkwIYOgEqIhMvdjEvYXV0aG9yaXR5OmNoZWNrEkcKBEtleXMSHi5ob3N0LmF1dGhvcml0eS52MS5LZXlzUmVxdWVzdBofLmhvc3QuYXV0aG9yaXR5LnYxLktleXNSZXNwb25zZRJ3ChRSZWdpc3RlckFkbWlzc2lvbktleRIuLmhvc3QuYXV0aG9yaXR5LnYxLlJlZ2lzdGVyQWRtaXNzaW9uS2V5UmVxdWVzdBovLmhvc3QuYXV0aG9yaXR5LnYxLlJlZ2lzdGVyQWRtaXNzaW9uS2V5UmVzcG9uc2USYgoNTGlzdFJlc291cmNlcxInLmhvc3QuYXV0aG9yaXR5LnYxLkxpc3RSZXNvdXJjZXNSZXF1ZXN0GiguaG9zdC5hdXRob3JpdHkudjEuTGlzdFJlc291cmNlc1Jlc3BvbnNlEmUKDkF0dGFjaFJlc291cmNlEiguaG9zdC5hdXRob3JpdHkudjEuQXR0YWNoUmVzb3VyY2VSZXF1ZXN0GikuaG9zdC5hdXRob3JpdHkudjEuQXR0YWNoUmVzb3VyY2VSZXNwb25zZRJlCg5EZXRhY2hSZXNvdXJjZRIoLmhvc3QuYXV0aG9yaXR5LnYxLkRldGFjaFJlc291cmNlUmVxdWVzdBopLmhvc3QuYXV0aG9yaXR5LnYxLkRldGFjaFJlc291cmNlUmVzcG9uc2USbgoRQXV0aG9yaXplVHJhbnNmZXISKy5ob3N0LmF1dGhvcml0eS52MS5BdXRob3JpemVUcmFuc2ZlclJlcXVlc3QaLC5ob3N0LmF1dGhvcml0eS52MS5BdXRob3JpemVUcmFuc2ZlclJlc3BvbnNlEk0KCERlbGVnYXRlEiIuaG9zdC5hdXRob3JpdHkudjEuRGVsZWdhdGVSZXF1ZXN0Gh0uaG9zdC5hdXRob3JpdHkudjEuRGVsZWdhdGlvbhJrChBSZXZva2VEZWxlZ2F0aW9uEiouaG9zdC5hdXRob3JpdHkudjEuUmV2b2tlRGVsZWdhdGlvblJlcXVlc3QaKy5ob3N0LmF1dGhvcml0eS52MS5SZXZva2VEZWxlZ2F0aW9uUmVzcG9uc2USVwoNR2V0RGVsZWdhdGlvbhInLmhvc3QuYXV0aG9yaXR5LnYxLkdldERlbGVnYXRpb25SZXF1ZXN0Gh0uaG9zdC5hdXRob3JpdHkudjEuRGVsZWdhdGlvbkK9AQoVY29tLmhvc3QuYXV0aG9yaXR5LnYxQg5BdXRob3JpdHlQcm90b1ABWi5hY2NvdW50cy9wa2cvZ2VuL2hvc3QvYXV0aG9yaXR5L3YxO2F1dGhvcml0eXYxogIDSEFYqgIRSG9zdC5BdXRob3JpdHkuVjHKAhFIb3N0XEF1dGhvcml0eVxWMeICHUhvc3RcQXV0aG9yaXR5XFYxXEdQQk1ldGFkYXRh6gITSG9zdDo6QXV0aG9yaXR5OjpWMWIGcHJvdG8z", [file_google_api_annotations, file_host_authority_v1_work_context]); /** * IssueRequest names on whose behalf the capability is issued. @@ -78,6 +78,15 @@ export type IssueRequest = Message<"host.authority.v1.IssueRequest"> & { */ value: DelegationRef; case: "delegation"; + } | { + /** + * Current authenticated install callback evidence for one declared setup + * method. Independent of standing roles; requires the solution's actor. + * + * @generated from field: host.authority.v1.InstallationSetupRef setup = 13; + */ + value: InstallationSetupRef; + case: "setup"; } | { case: undefined; value?: undefined }; /** @@ -145,6 +154,35 @@ export type IssueRequest = Message<"host.authority.v1.IssueRequest"> & { export const IssueRequestSchema: GenMessage = /*@__PURE__*/ messageDesc(file_host_authority_v1_authority, 0); +/** + * InstallationSetupRef selects one exact method from the reviewed setup grant. + * The callback token proves the current attempt; it is not data authority. + * + * @generated from message host.authority.v1.InstallationSetupRef + */ +export type InstallationSetupRef = Message<"host.authority.v1.InstallationSetupRef"> & { + /** + * The unexpired standard installation callback credential. + * + * @generated from field: string step_token = 1; + */ + stepToken: string; + + /** + * The exact destination method selected by the setup declaration. + * + * @generated from field: string method = 2; + */ + method: string; +}; + +/** + * Describes the message host.authority.v1.InstallationSetupRef. + * Use `create(InstallationSetupRefSchema)` to create a new message. + */ +export const InstallationSetupRefSchema: GenMessage = /*@__PURE__*/ + messageDesc(file_host_authority_v1_authority, 1); + /** * DelegationRef names one delegation. * @@ -164,7 +202,7 @@ export type DelegationRef = Message<"host.authority.v1.DelegationRef"> & { * Use `create(DelegationRefSchema)` to create a new message. */ export const DelegationRefSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 1); + messageDesc(file_host_authority_v1_authority, 2); /** * DelegateRequest is a signed-in person granting a module the right to act for @@ -209,7 +247,7 @@ export type DelegateRequest = Message<"host.authority.v1.DelegateRequest"> & { * Use `create(DelegateRequestSchema)` to create a new message. */ export const DelegateRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 2); + messageDesc(file_host_authority_v1_authority, 3); /** * Delegation is one grant from a person to a module. @@ -271,7 +309,7 @@ export type Delegation = Message<"host.authority.v1.Delegation"> & { * Use `create(DelegationSchema)` to create a new message. */ export const DelegationSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 3); + messageDesc(file_host_authority_v1_authority, 4); /** * GetDelegationRequest names the delegation read; anyone but its module or its @@ -298,7 +336,7 @@ export type GetDelegationRequest = Message<"host.authority.v1.GetDelegationReque * Use `create(GetDelegationRequestSchema)` to create a new message. */ export const GetDelegationRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 4); + messageDesc(file_host_authority_v1_authority, 5); /** * RevokeDelegationRequest ends a delegation; its grantor may, and so may an @@ -318,7 +356,7 @@ export type RevokeDelegationRequest = Message<"host.authority.v1.RevokeDelegatio * Use `create(RevokeDelegationRequestSchema)` to create a new message. */ export const RevokeDelegationRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 5); + messageDesc(file_host_authority_v1_authority, 6); /** * RevokeDelegationResponse is the delegation as it now stands. @@ -337,7 +375,7 @@ export type RevokeDelegationResponse = Message<"host.authority.v1.RevokeDelegati * Use `create(RevokeDelegationResponseSchema)` to create a new message. */ export const RevokeDelegationResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 6); + messageDesc(file_host_authority_v1_authority, 7); /** * PersonSession names the caller's own session. It carries no field: the person @@ -354,7 +392,7 @@ export type PersonSession = Message<"host.authority.v1.PersonSession"> & { * Use `create(PersonSessionSchema)` to create a new message. */ export const PersonSessionSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 7); + messageDesc(file_host_authority_v1_authority, 8); /** * WorkloadCredential proves which module a running process is: the native @@ -377,7 +415,7 @@ export type WorkloadCredential = Message<"host.authority.v1.WorkloadCredential"> * Use `create(WorkloadCredentialSchema)` to create a new message. */ export const WorkloadCredentialSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 8); + messageDesc(file_host_authority_v1_authority, 9); /** * InstallationRef names an installation acting for itself. @@ -398,7 +436,7 @@ export type InstallationRef = Message<"host.authority.v1.InstallationRef"> & { * Use `create(InstallationRefSchema)` to create a new message. */ export const InstallationRefSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 9); + messageDesc(file_host_authority_v1_authority, 10); /** * IssueResponse carries the signed capability and its decoded form. @@ -433,7 +471,7 @@ export type IssueResponse = Message<"host.authority.v1.IssueResponse"> & { * Use `create(IssueResponseSchema)` to create a new message. */ export const IssueResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 10); + messageDesc(file_host_authority_v1_authority, 11); /** * CheckRequest presents a capability for verification. @@ -496,7 +534,7 @@ export type CheckRequest = Message<"host.authority.v1.CheckRequest"> & { * Use `create(CheckRequestSchema)` to create a new message. */ export const CheckRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 11); + messageDesc(file_host_authority_v1_authority, 12); /** * CheckResponse is the verified capability. @@ -532,7 +570,7 @@ export type CheckResponse = Message<"host.authority.v1.CheckResponse"> & { * Use `create(CheckResponseSchema)` to create a new message. */ export const CheckResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 12); + messageDesc(file_host_authority_v1_authority, 13); /** * KeysRequest asks for the verification keys. @@ -547,7 +585,7 @@ export type KeysRequest = Message<"host.authority.v1.KeysRequest"> & { * Use `create(KeysRequestSchema)` to create a new message. */ export const KeysRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 13); + messageDesc(file_host_authority_v1_authority, 14); /** * KeysResponse is the issuer and its keys. @@ -589,7 +627,7 @@ export type KeysResponse = Message<"host.authority.v1.KeysResponse"> & { * Use `create(KeysResponseSchema)` to create a new message. */ export const KeysResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 14); + messageDesc(file_host_authority_v1_authority, 15); /** * PublicKey is one verification key. @@ -633,7 +671,7 @@ export type PublicKey = Message<"host.authority.v1.PublicKey"> & { * Use `create(PublicKeySchema)` to create a new message. */ export const PublicKeySchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 15); + messageDesc(file_host_authority_v1_authority, 16); /** * RegisterAdmissionKeyRequest presents one hop admission key. @@ -677,7 +715,7 @@ export type RegisterAdmissionKeyRequest = Message<"host.authority.v1.RegisterAdm * Use `create(RegisterAdmissionKeyRequestSchema)` to create a new message. */ export const RegisterAdmissionKeyRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 16); + messageDesc(file_host_authority_v1_authority, 17); /** * RegisterAdmissionKeyResponse is the key as Keys now publishes it. @@ -705,7 +743,7 @@ export type RegisterAdmissionKeyResponse = Message<"host.authority.v1.RegisterAd * Use `create(RegisterAdmissionKeyResponseSchema)` to create a new message. */ export const RegisterAdmissionKeyResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 17); + messageDesc(file_host_authority_v1_authority, 18); /** * ListResourcesRequest asks about one kind and one action. @@ -747,7 +785,7 @@ export type ListResourcesRequest = Message<"host.authority.v1.ListResourcesReque * Use `create(ListResourcesRequestSchema)` to create a new message. */ export const ListResourcesRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 18); + messageDesc(file_host_authority_v1_authority, 19); /** * ListResourcesResponse is every grant the capability holds on the kind for the @@ -768,7 +806,7 @@ export type ListResourcesResponse = Message<"host.authority.v1.ListResourcesResp * Use `create(ListResourcesResponseSchema)` to create a new message. */ export const ListResourcesResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 19); + messageDesc(file_host_authority_v1_authority, 20); /** * AttachResourceRequest names one resource and the capability it was created under. @@ -810,7 +848,7 @@ export type AttachResourceRequest = Message<"host.authority.v1.AttachResourceReq * Use `create(AttachResourceRequestSchema)` to create a new message. */ export const AttachResourceRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 20); + messageDesc(file_host_authority_v1_authority, 21); /** * AttachResourceResponse names the installation that now owns the resource. @@ -831,7 +869,7 @@ export type AttachResourceResponse = Message<"host.authority.v1.AttachResourceRe * Use `create(AttachResourceResponseSchema)` to create a new message. */ export const AttachResourceResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 21); + messageDesc(file_host_authority_v1_authority, 22); /** * DetachResourceRequest names one resource its serving module deleted. @@ -873,7 +911,7 @@ export type DetachResourceRequest = Message<"host.authority.v1.DetachResourceReq * Use `create(DetachResourceRequestSchema)` to create a new message. */ export const DetachResourceRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 22); + messageDesc(file_host_authority_v1_authority, 23); /** * DetachResourceResponse names the installation that owned the resource. @@ -894,7 +932,7 @@ export type DetachResourceResponse = Message<"host.authority.v1.DetachResourceRe * Use `create(DetachResourceResponseSchema)` to create a new message. */ export const DetachResourceResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 23); + messageDesc(file_host_authority_v1_authority, 24); /** * AuthorizeTransferRequest names one existing resource and where it moves. @@ -951,7 +989,7 @@ export type AuthorizeTransferRequest = Message<"host.authority.v1.AuthorizeTrans * Use `create(AuthorizeTransferRequestSchema)` to create a new message. */ export const AuthorizeTransferRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 24); + messageDesc(file_host_authority_v1_authority, 25); /** * AuthorizeTransferResponse is the decision the store records. @@ -979,7 +1017,7 @@ export type AuthorizeTransferResponse = Message<"host.authority.v1.AuthorizeTran * Use `create(AuthorizeTransferResponseSchema)` to create a new message. */ export const AuthorizeTransferResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 25); + messageDesc(file_host_authority_v1_authority, 26); /** * ResourceGrant is one way of naming covered resources. Exactly one match is @@ -1040,7 +1078,7 @@ export type ResourceGrant = Message<"host.authority.v1.ResourceGrant"> & { * Use `create(ResourceGrantSchema)` to create a new message. */ export const ResourceGrantSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_authority_v1_authority, 26); + messageDesc(file_host_authority_v1_authority, 27); /** * AuthorityService is implemented by the host (accounts) and by the local authority. diff --git a/module/services/frontend/code/src/gen/host/composition/v1/composition_pb.ts b/module/services/frontend/code/src/gen/host/composition/v1/composition_pb.ts index dd36c39eb..deeea3461 100644 --- a/module/services/frontend/code/src/gen/host/composition/v1/composition_pb.ts +++ b/module/services/frontend/code/src/gen/host/composition/v1/composition_pb.ts @@ -17,7 +17,7 @@ import type { Message } from "@bufbuild/protobuf"; * Describes the file host/composition/v1/composition.proto. */ export const file_host_composition_v1_composition: GenFile = /*@__PURE__*/ - fileDesc("CiVob3N0L2NvbXBvc2l0aW9uL3YxL2NvbXBvc2l0aW9uLnByb3RvEhNob3N0LmNvbXBvc2l0aW9uLnYxItUBChRBcHBseU1hbmlmZXN0UmVxdWVzdBI3CghtYW5pZmVzdBgBIAEoCzIlLmhvc3QuY29tcG9zaXRpb24udjEuTW9kdWxlTWFuaWZlc3RWMRI2CgdjYXJyaWVyGAIgASgLMiUuaG9zdC5jb21wb3NpdGlvbi52MS5TaWduZWRNYW5pZmVzdFYxEhIKCmNyZWRlbnRpYWwYAyABKAkSOAoJYXV0aG9yaXR5GAQgASgLMiUuaG9zdC5jb21wb3NpdGlvbi52MS5TaWduZWRNYW5pZmVzdFYxIuMCChNBdXRob3JpdHlNYW5pZmVzdFYxEg4KBm1vZHVsZRgBIAEoCRISCgpnZW5lcmF0aW9uGAIgASgEEhwKFGNvcmVfbWFuaWZlc3RfZGlnZXN0GAMgASgJEjQKB21ldGhvZHMYBCADKAsyIy5ob3N0LmNvbXBvc2l0aW9uLnYxLk1ldGhvZFBvbGljeVYxEjYKDnNjb3BlX2NlaWxpbmdzGAUgAygLMh4uaG9zdC5hdXRob3JpdHkudjEuV29ya1Njb3BlVjESKgoFcm9sZXMYBiADKAsyGy5ob3N0LmNvbXBvc2l0aW9uLnYxLlJvbGVWMRITCgtvd25lcl9hd2FyZRgHIAEoCBIZChFpbnN0YWxsYXRpb25fcm9sZRgIIAEoCRJAChFlZGdlX2RlcGVuZGVuY2llcxgJIAMoCzIlLmhvc3QuY29tcG9zaXRpb24udjEuRWRnZURlcGVuZGVuY3lWMSI0ChBFZGdlRGVwZW5kZW5jeVYxEg4KBm1vZHVsZRgBIAEoCRIQCghwcmVzZW5jZRgCIAEoCSJuCg5NZXRob2RQb2xpY3lWMRIOCgZtZXRob2QYASABKAkSMAoIcmVxdWlyZXMYAiADKAsyHi5ob3N0LmF1dGhvcml0eS52MS5Xb3JrU2NvcGVWMRIaChJhbnlfY2hlY2tlZF9jYWxsZXIYAyABKAgiNgoQU2lnbmVkTWFuaWZlc3RWMRIQCghkb2N1bWVudBgBIAEoDBIQCghlbnZlbG9wZRgCIAEoDCJYChVBcHBseU1hbmlmZXN0UmVzcG9uc2USEQoJcHJpbmNpcGFsGAEgASgJEhIKCmdlbmVyYXRpb24YAiABKAQSGAoQaW5zdGFsbGF0aW9uX2lkcxgDIAMoCSKdAgoQTW9kdWxlTWFuaWZlc3RWMRIOCgZtb2R1bGUYASABKAkSEQoJcHJpbmNpcGFsGAIgASgJEgwKBGtpbmQYAyABKAkSEgoKZ2VuZXJhdGlvbhgEIAEoBBIwCghiaW5kaW5ncxgFIAMoCzIeLmhvc3QuY29tcG9zaXRpb24udjEuQmluZGluZ1YxEjsKDnJlc291cmNlX2tpbmRzGAYgAygLMiMuaG9zdC5jb21wb3NpdGlvbi52MS5SZXNvdXJjZUtpbmRWMRIpCgRwYWdlGAcgASgLMhsuaG9zdC5jb21wb3NpdGlvbi52MS5QYWdlVjESKgoFcm9sZXMYCCADKAsyGy5ob3N0LmNvbXBvc2l0aW9uLnYxLlJvbGVWMSKJAQoGUm9sZVYxEgwKBG5hbWUYASABKAkSLgoGc2NvcGVzGAIgAygLMh4uaG9zdC5hdXRob3JpdHkudjEuV29ya1Njb3BlVjESQQoZaW5zdGFsbGF0aW9uX293bmVkX3Njb3BlcxgDIAMoCzIeLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtTY29wZVYxItABCglCaW5kaW5nVjESCgoCaWQYASABKAkSEAoIYXVkaWVuY2UYAiABKAkSNQoNaW52b2tlX3Njb3BlcxgDIAMoCzIeLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtTY29wZVYxEjcKD2hlYWRsZXNzX3Njb3BlcxgEIAMoCzIeLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtTY29wZVYxEjUKDWxvb2t1cF9zY29wZXMYBSADKAsyHi5ob3N0LmF1dGhvcml0eS52MS5Xb3JrU2NvcGVWMSIvCg5SZXNvdXJjZUtpbmRWMRIMCgRraW5kGAEgASgJEg8KB2FjdGlvbnMYAiADKAkiJgoGUGFnZVYxEg0KBXRpdGxlGAEgASgJEg0KBW9yZGVyGAIgASgFMnwKEkNvbXBvc2l0aW9uU2VydmljZRJmCg1BcHBseU1hbmlmZXN0EikuaG9zdC5jb21wb3NpdGlvbi52MS5BcHBseU1hbmlmZXN0UmVxdWVzdBoqLmhvc3QuY29tcG9zaXRpb24udjEuQXBwbHlNYW5pZmVzdFJlc3BvbnNlQs0BChdjb20uaG9zdC5jb21wb3NpdGlvbi52MUIQQ29tcG9zaXRpb25Qcm90b1ABWjJhY2NvdW50cy9wa2cvZ2VuL2hvc3QvY29tcG9zaXRpb24vdjE7Y29tcG9zaXRpb252MaICA0hDWKoCE0hvc3QuQ29tcG9zaXRpb24uVjHKAhNIb3N0XENvbXBvc2l0aW9uXFYx4gIfSG9zdFxDb21wb3NpdGlvblxWMVxHUEJNZXRhZGF0YeoCFUhvc3Q6OkNvbXBvc2l0aW9uOjpWMWIGcHJvdG8z", [file_host_authority_v1_work_context]); + fileDesc("CiVob3N0L2NvbXBvc2l0aW9uL3YxL2NvbXBvc2l0aW9uLnByb3RvEhNob3N0LmNvbXBvc2l0aW9uLnYxItUBChRBcHBseU1hbmlmZXN0UmVxdWVzdBI3CghtYW5pZmVzdBgBIAEoCzIlLmhvc3QuY29tcG9zaXRpb24udjEuTW9kdWxlTWFuaWZlc3RWMRI2CgdjYXJyaWVyGAIgASgLMiUuaG9zdC5jb21wb3NpdGlvbi52MS5TaWduZWRNYW5pZmVzdFYxEhIKCmNyZWRlbnRpYWwYAyABKAkSOAoJYXV0aG9yaXR5GAQgASgLMiUuaG9zdC5jb21wb3NpdGlvbi52MS5TaWduZWRNYW5pZmVzdFYxIrkDChNBdXRob3JpdHlNYW5pZmVzdFYxEg4KBm1vZHVsZRgBIAEoCRISCgpnZW5lcmF0aW9uGAIgASgEEhwKFGNvcmVfbWFuaWZlc3RfZGlnZXN0GAMgASgJEjQKB21ldGhvZHMYBCADKAsyIy5ob3N0LmNvbXBvc2l0aW9uLnYxLk1ldGhvZFBvbGljeVYxEjYKDnNjb3BlX2NlaWxpbmdzGAUgAygLMh4uaG9zdC5hdXRob3JpdHkudjEuV29ya1Njb3BlVjESKgoFcm9sZXMYBiADKAsyGy5ob3N0LmNvbXBvc2l0aW9uLnYxLlJvbGVWMRITCgtvd25lcl9hd2FyZRgHIAEoCBIZChFpbnN0YWxsYXRpb25fcm9sZRgIIAEoCRJAChFlZGdlX2RlcGVuZGVuY2llcxgJIAMoCzIlLmhvc3QuY29tcG9zaXRpb24udjEuRWRnZURlcGVuZGVuY3lWMRIwCgVzZXR1cBgKIAMoCzIhLmhvc3QuY29tcG9zaXRpb24udjEuU2V0dXBHcmFudFYxEiIKGm93bmVyX2F3YXJlX3Jlc291cmNlX2tpbmRzGAsgAygJIkAKDFNldHVwR3JhbnRWMRIPCgdiaW5kaW5nGAEgASgJEg8KB21ldGhvZHMYAiADKAkSDgoGc2NvcGVzGAMgAygJIjQKEEVkZ2VEZXBlbmRlbmN5VjESDgoGbW9kdWxlGAEgASgJEhAKCHByZXNlbmNlGAIgASgJIm4KDk1ldGhvZFBvbGljeVYxEg4KBm1ldGhvZBgBIAEoCRIwCghyZXF1aXJlcxgCIAMoCzIeLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtTY29wZVYxEhoKEmFueV9jaGVja2VkX2NhbGxlchgDIAEoCCI2ChBTaWduZWRNYW5pZmVzdFYxEhAKCGRvY3VtZW50GAEgASgMEhAKCGVudmVsb3BlGAIgASgMIlgKFUFwcGx5TWFuaWZlc3RSZXNwb25zZRIRCglwcmluY2lwYWwYASABKAkSEgoKZ2VuZXJhdGlvbhgCIAEoBBIYChBpbnN0YWxsYXRpb25faWRzGAMgAygJIp0CChBNb2R1bGVNYW5pZmVzdFYxEg4KBm1vZHVsZRgBIAEoCRIRCglwcmluY2lwYWwYAiABKAkSDAoEa2luZBgDIAEoCRISCgpnZW5lcmF0aW9uGAQgASgEEjAKCGJpbmRpbmdzGAUgAygLMh4uaG9zdC5jb21wb3NpdGlvbi52MS5CaW5kaW5nVjESOwoOcmVzb3VyY2Vfa2luZHMYBiADKAsyIy5ob3N0LmNvbXBvc2l0aW9uLnYxLlJlc291cmNlS2luZFYxEikKBHBhZ2UYByABKAsyGy5ob3N0LmNvbXBvc2l0aW9uLnYxLlBhZ2VWMRIqCgVyb2xlcxgIIAMoCzIbLmhvc3QuY29tcG9zaXRpb24udjEuUm9sZVYxIokBCgZSb2xlVjESDAoEbmFtZRgBIAEoCRIuCgZzY29wZXMYAiADKAsyHi5ob3N0LmF1dGhvcml0eS52MS5Xb3JrU2NvcGVWMRJBChlpbnN0YWxsYXRpb25fb3duZWRfc2NvcGVzGAMgAygLMh4uaG9zdC5hdXRob3JpdHkudjEuV29ya1Njb3BlVjEi0AEKCUJpbmRpbmdWMRIKCgJpZBgBIAEoCRIQCghhdWRpZW5jZRgCIAEoCRI1Cg1pbnZva2Vfc2NvcGVzGAMgAygLMh4uaG9zdC5hdXRob3JpdHkudjEuV29ya1Njb3BlVjESNwoPaGVhZGxlc3Nfc2NvcGVzGAQgAygLMh4uaG9zdC5hdXRob3JpdHkudjEuV29ya1Njb3BlVjESNQoNbG9va3VwX3Njb3BlcxgFIAMoCzIeLmhvc3QuYXV0aG9yaXR5LnYxLldvcmtTY29wZVYxIi8KDlJlc291cmNlS2luZFYxEgwKBGtpbmQYASABKAkSDwoHYWN0aW9ucxgCIAMoCSImCgZQYWdlVjESDQoFdGl0bGUYASABKAkSDQoFb3JkZXIYAiABKAUyfAoSQ29tcG9zaXRpb25TZXJ2aWNlEmYKDUFwcGx5TWFuaWZlc3QSKS5ob3N0LmNvbXBvc2l0aW9uLnYxLkFwcGx5TWFuaWZlc3RSZXF1ZXN0GiouaG9zdC5jb21wb3NpdGlvbi52MS5BcHBseU1hbmlmZXN0UmVzcG9uc2VCzQEKF2NvbS5ob3N0LmNvbXBvc2l0aW9uLnYxQhBDb21wb3NpdGlvblByb3RvUAFaMmFjY291bnRzL3BrZy9nZW4vaG9zdC9jb21wb3NpdGlvbi92MTtjb21wb3NpdGlvbnYxogIDSENYqgITSG9zdC5Db21wb3NpdGlvbi5WMcoCE0hvc3RcQ29tcG9zaXRpb25cVjHiAh9Ib3N0XENvbXBvc2l0aW9uXFYxXEdQQk1ldGFkYXRh6gIVSG9zdDo6Q29tcG9zaXRpb246OlYxYgZwcm90bzM", [file_host_authority_v1_work_context]); /** * ApplyManifestRequest carries the manifest. @@ -154,6 +154,21 @@ export type AuthorityManifestV1 = Message<"host.composition.v1.AuthorityManifest * @generated from field: repeated host.composition.v1.EdgeDependencyV1 edge_dependencies = 9; */ edgeDependencies: EdgeDependencyV1[]; + + /** + * Resolved installation-only grants; separate from standing roles. + * + * @generated from field: repeated host.composition.v1.SetupGrantV1 setup = 10; + */ + setup: SetupGrantV1[]; + + /** + * Only these served kinds enforce resource-owner selectors. Mutually + * exclusive with owner_aware true; empty means none. + * + * @generated from field: repeated string owner_aware_resource_kinds = 11; + */ + ownerAwareResourceKinds: string[]; }; /** @@ -163,6 +178,41 @@ export type AuthorityManifestV1 = Message<"host.composition.v1.AuthorityManifest export const AuthorityManifestV1Schema: GenMessage = /*@__PURE__*/ messageDesc(file_host_composition_v1_composition, 1); +/** + * SetupGrantV1 retains exact methods even when two methods share requirements. + * + * @generated from message host.composition.v1.SetupGrantV1 + */ +export type SetupGrantV1 = Message<"host.composition.v1.SetupGrantV1"> & { + /** + * The required foreign invoke binding that reaches the destination. + * + * @generated from field: string binding = 1; + */ + binding: string; + + /** + * Exact, unique methods approved for this installation's setup only. + * + * @generated from field: repeated string methods = 2; + */ + methods: string[]; + + /** + * Callee-derived requirements as resource-kind:action, within invoke ceiling. + * + * @generated from field: repeated string scopes = 3; + */ + scopes: string[]; +}; + +/** + * Describes the message host.composition.v1.SetupGrantV1. + * Use `create(SetupGrantV1Schema)` to create a new message. + */ +export const SetupGrantV1Schema: GenMessage = /*@__PURE__*/ + messageDesc(file_host_composition_v1_composition, 2); + /** * EdgeDependencyV1 names the exact signed module principal. The host resolves * it to a live catalogue target; it is not a target UUID, route alias or binding id. @@ -188,7 +238,7 @@ export type EdgeDependencyV1 = Message<"host.composition.v1.EdgeDependencyV1"> & * Use `create(EdgeDependencyV1Schema)` to create a new message. */ export const EdgeDependencyV1Schema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_composition_v1_composition, 2); + messageDesc(file_host_composition_v1_composition, 3); /** * MethodPolicyV1 is what a call to one method must hold, as the module's @@ -226,7 +276,7 @@ export type MethodPolicyV1 = Message<"host.composition.v1.MethodPolicyV1"> & { * Use `create(MethodPolicyV1Schema)` to create a new message. */ export const MethodPolicyV1Schema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_composition_v1_composition, 3); + messageDesc(file_host_composition_v1_composition, 4); /** * SignedManifestV1 is core's signed carrier: the manifest document (JSON) and @@ -251,7 +301,7 @@ export type SignedManifestV1 = Message<"host.composition.v1.SignedManifestV1"> & * Use `create(SignedManifestV1Schema)` to create a new message. */ export const SignedManifestV1Schema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_composition_v1_composition, 4); + messageDesc(file_host_composition_v1_composition, 5); /** * ApplyManifestResponse says what the host derived. @@ -286,7 +336,7 @@ export type ApplyManifestResponse = Message<"host.composition.v1.ApplyManifestRe * Use `create(ApplyManifestResponseSchema)` to create a new message. */ export const ApplyManifestResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_composition_v1_composition, 5); + messageDesc(file_host_composition_v1_composition, 6); /** * ModuleManifestV1 is one module instance at one generation. @@ -359,7 +409,7 @@ export type ModuleManifestV1 = Message<"host.composition.v1.ModuleManifestV1"> & * Use `create(ModuleManifestV1Schema)` to create a new message. */ export const ModuleManifestV1Schema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_composition_v1_composition, 6); + messageDesc(file_host_composition_v1_composition, 7); /** * RoleV1 is one role a solution declares. @@ -397,7 +447,7 @@ export type RoleV1 = Message<"host.composition.v1.RoleV1"> & { * Use `create(RoleV1Schema)` to create a new message. */ export const RoleV1Schema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_composition_v1_composition, 7); + messageDesc(file_host_composition_v1_composition, 8); /** * BindingV1 is one declared call towards another module. @@ -449,7 +499,7 @@ export type BindingV1 = Message<"host.composition.v1.BindingV1"> & { * Use `create(BindingV1Schema)` to create a new message. */ export const BindingV1Schema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_composition_v1_composition, 8); + messageDesc(file_host_composition_v1_composition, 9); /** * ResourceKindV1 is one kind the module governs and the actions on it. @@ -477,7 +527,7 @@ export type ResourceKindV1 = Message<"host.composition.v1.ResourceKindV1"> & { * Use `create(ResourceKindV1Schema)` to create a new message. */ export const ResourceKindV1Schema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_composition_v1_composition, 9); + messageDesc(file_host_composition_v1_composition, 10); /** * PageV1 is a module's frontend contribution. @@ -505,7 +555,7 @@ export type PageV1 = Message<"host.composition.v1.PageV1"> & { * Use `create(PageV1Schema)` to create a new message. */ export const PageV1Schema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_composition_v1_composition, 10); + messageDesc(file_host_composition_v1_composition, 11); /** * CompositionService is implemented by the host and by the local authority. diff --git a/module/services/frontend/code/src/gen/host/installation/v1/installation_pb.ts b/module/services/frontend/code/src/gen/host/installation/v1/installation_pb.ts index 90b1162f4..0e18a05e4 100644 --- a/module/services/frontend/code/src/gen/host/installation/v1/installation_pb.ts +++ b/module/services/frontend/code/src/gen/host/installation/v1/installation_pb.ts @@ -16,7 +16,7 @@ import type { Message } from "@bufbuild/protobuf"; * Describes the file host/installation/v1/installation.proto. */ export const file_host_installation_v1_installation: GenFile = /*@__PURE__*/ - fileDesc("Cidob3N0L2luc3RhbGxhdGlvbi92MS9pbnN0YWxsYXRpb24ucHJvdG8SFGhvc3QuaW5zdGFsbGF0aW9uLnYxIkwKGkN1cnJlbnRJbnN0YWxsYXRpb25SZXF1ZXN0EhQKDHBhcmVudF90b2tlbhgBIAEoCRIYChBhY3Rvcl9jcmVkZW50aWFsGAIgASgJIm8KE0N1cnJlbnRJbnN0YWxsYXRpb24SCgoCaWQYASABKAkSFwoPb3JnYW5pemF0aW9uX2lkGAIgASgJEg4KBnRhcmdldBgDIAEoCRIQCghyZXZpc2lvbhgEIAEoBBIRCgluYW1lc3BhY2UYBSABKAkimQEKDkluc3RhbGxSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCRIOCgZ0YXJnZXQYAiABKAkSDAoEcm9sZRgDIAEoCRIXCg9vd25lcl9wZXJzb25faWQYBCABKAkSNwoIYXBwcm92YWwYBSABKAsyJS5ob3N0Lmluc3RhbGxhdGlvbi52MS5Db25zZW50QXBwcm92YWwiOAoNUmV2aWV3UmVxdWVzdBIXCg9vcmdhbml6YXRpb25faWQYASABKAkSDgoGdGFyZ2V0GAIgASgJInkKD0NvbnNlbnRBcHByb3ZhbBIRCgl0YXJnZXRfaWQYASABKAkSEgoKZ2VuZXJhdGlvbhgCIAEoBBIZChFleHBlY3RlZF9yZXZpc2lvbhgDIAEoBBIUCgxvcGVyYXRpb25faWQYBCABKAkSDgoGZGlnZXN0GAUgASgJInYKEEdyYW50Um9sZVJlcXVlc3QSFwoPb3JnYW5pemF0aW9uX2lkGAEgASgJEhcKD2luc3RhbGxhdGlvbl9pZBgCIAEoCRIMCgRyb2xlGAMgASgJEhEKCXBlcnNvbl9pZBgEIAEoCRIPCgd0ZWFtX2lkGAUgASgJIncKEVJldm9rZVJvbGVSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCRIXCg9pbnN0YWxsYXRpb25faWQYAiABKAkSDAoEcm9sZRgDIAEoCRIRCglwZXJzb25faWQYBCABKAkSDwoHdGVhbV9pZBgFIAEoCSJJChVMaXN0Um9sZUdyYW50c1JlcXVlc3QSFwoPb3JnYW5pemF0aW9uX2lkGAEgASgJEhcKD2luc3RhbGxhdGlvbl9pZBgCIAEoCSJJChZMaXN0Um9sZUdyYW50c1Jlc3BvbnNlEi8KBmdyYW50cxgBIAMoCzIfLmhvc3QuaW5zdGFsbGF0aW9uLnYxLlJvbGVHcmFudCI9CglSb2xlR3JhbnQSDAoEcm9sZRgBIAEoCRIRCglwZXJzb25faWQYAiABKAkSDwoHdGVhbV9pZBgDIAEoCSImCgtMaXN0UmVxdWVzdBIXCg9vcmdhbml6YXRpb25faWQYASABKAkiSQoMTGlzdFJlc3BvbnNlEjkKDWluc3RhbGxhdGlvbnMYASADKAsyIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24i3QIKDEluc3RhbGxhdGlvbhIKCgJpZBgBIAEoCRIXCg9vcmdhbml6YXRpb25faWQYAiABKAkSDgoGdGFyZ2V0GAMgASgJEjkKBnN0YXR1cxgEIAEoDjIpLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbi5TdGF0dXMSEAoIcmV2aXNpb24YBSABKAQSDAoEcm9sZRgGIAEoCRIRCgluYW1lc3BhY2UYCSABKAkSFAoMcHJpbmNpcGFsX2lkGAogASgJEg0KBXJvbGVzGAsgAygJIlsKBlN0YXR1cxIWChJTVEFUVVNfVU5TUEVDSUZJRUQQABISCg5TVEFUVVNfUEVORElORxABEhEKDVNUQVRVU19BQ1RJVkUQAhISCg5TVEFUVVNfUkVWT0tFRBADSgQIBxAISgQICBAJUgh0ZWFtX2lkc1ISYWdlbnRfcHJpbmNpcGFsX2lkIk4KEkluc3RhbGxhdGlvbk5vdGljZRI4CgxpbnN0YWxsYXRpb24YASABKAsyIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24iEQoPSW5zdGFsbGF0aW9uQWNrIiwKEUxpc3RPZmZlcnNSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCSJBChJMaXN0T2ZmZXJzUmVzcG9uc2USKwoGb2ZmZXJzGAEgAygLMhsuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXIiKwoFT2ZmZXISDgoGdGFyZ2V0GAEgASgJEhIKCmdlbmVyYXRpb24YAiABKAQi7AIKDVJldmlld2VkT2ZmZXISNwoIYXBwcm92YWwYASABKAsyJS5ob3N0Lmluc3RhbGxhdGlvbi52MS5Db25zZW50QXBwcm92YWwSDgoGdGFyZ2V0GAIgASgJEi4KBXJvbGVzGAMgAygLMh8uaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJSb2xlEjgKDGluc3RhbGxhdGlvbhgEIAEoCzIiLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbhIzCgdjZWlsaW5nGAUgAygLMiIuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJCaW5kaW5nEhYKDnRvb2xzX2NvbXBvc2VkGAYgASgIEhkKEWluc3RhbGxhdGlvbl9yb2xlGAcgASgJEkAKEWVkZ2VfZGVwZW5kZW5jaWVzGAggAygLMiUuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJEZXBlbmRlbmN5IjMKD09mZmVyRGVwZW5kZW5jeRIOCgZtb2R1bGUYASABKAkSEAoIcHJlc2VuY2UYAiABKAkiYQoMT2ZmZXJCaW5kaW5nEg8KB2JpbmRpbmcYASABKAkSDgoGbW9kdWxlGAIgASgJEjAKBnNjb3BlcxgDIAMoCzIgLmhvc3QuaW5zdGFsbGF0aW9uLnYxLk9mZmVyU2NvcGUiiAEKCU9mZmVyUm9sZRIMCgRuYW1lGAEgASgJEjAKBnNjb3BlcxgCIAMoCzIgLmhvc3QuaW5zdGFsbGF0aW9uLnYxLk9mZmVyU2NvcGUSOwoMY2FwYWJpbGl0aWVzGAMgAygLMiUuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJDYXBhYmlsaXR5ImEKCk9mZmVyU2NvcGUSFQoNcmVzb3VyY2Vfa2luZBgBIAEoCRIPCgdhY3Rpb25zGAIgAygJEhUKDWF0dGFjaGVkX29ubHkYAyABKAgSFAoMcmVzb3VyY2VfaWRzGAQgAygJIpgBCg9PZmZlckNhcGFiaWxpdHkSDgoGbW9kdWxlGAEgASgJEhEKCW9wZXJhdGlvbhgCIAEoCRIyCghyZXF1aXJlcxgDIAMoCzIgLmhvc3QuaW5zdGFsbGF0aW9uLnYxLk9mZmVyU2NvcGUSLgoFdG9vbHMYBCADKAsyHy5ob3N0Lmluc3RhbGxhdGlvbi52MS5PZmZlclRvb2wiOQoJT2ZmZXJUb29sEgwKBG5hbWUYASABKAkSDwoHYmluZGluZxgCIAEoCRINCgV3cml0ZRgDIAEoCCIqCg9MaXN0SGVsZFJlcXVlc3QSFwoPb3JnYW5pemF0aW9uX2lkGAEgASgJIlEKEExpc3RIZWxkUmVzcG9uc2USPQoNaW5zdGFsbGF0aW9ucxgBIAMoCzImLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkhlbGRJbnN0YWxsYXRpb24iWwoQSGVsZEluc3RhbGxhdGlvbhI4CgxpbnN0YWxsYXRpb24YASABKAsyIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24SDQoFcm9sZXMYAiADKAky8wUKE0luc3RhbGxhdGlvblNlcnZpY2USZgoHQ3VycmVudBIwLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkN1cnJlbnRJbnN0YWxsYXRpb25SZXF1ZXN0GikuaG9zdC5pbnN0YWxsYXRpb24udjEuQ3VycmVudEluc3RhbGxhdGlvbhJTCgdJbnN0YWxsEiQuaG9zdC5pbnN0YWxsYXRpb24udjEuSW5zdGFsbFJlcXVlc3QaIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24SVAoGUmV2aWV3EiMuaG9zdC5pbnN0YWxsYXRpb24udjEuUmV2aWV3UmVxdWVzdBolLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkNvbnNlbnRBcHByb3ZhbBJXCglHcmFudFJvbGUSJi5ob3N0Lmluc3RhbGxhdGlvbi52MS5HcmFudFJvbGVSZXF1ZXN0GiIuaG9zdC5pbnN0YWxsYXRpb24udjEuSW5zdGFsbGF0aW9uElkKClJldm9rZVJvbGUSJy5ob3N0Lmluc3RhbGxhdGlvbi52MS5SZXZva2VSb2xlUmVxdWVzdBoiLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbhJrCg5MaXN0Um9sZUdyYW50cxIrLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkxpc3RSb2xlR3JhbnRzUmVxdWVzdBosLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkxpc3RSb2xlR3JhbnRzUmVzcG9uc2USTQoETGlzdBIhLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkxpc3RSZXF1ZXN0GiIuaG9zdC5pbnN0YWxsYXRpb24udjEuTGlzdFJlc3BvbnNlElkKCExpc3RIZWxkEiUuaG9zdC5pbnN0YWxsYXRpb24udjEuTGlzdEhlbGRSZXF1ZXN0GiYuaG9zdC5pbnN0YWxsYXRpb24udjEuTGlzdEhlbGRSZXNwb25zZTJwChJJbnN0YWxsYWJsZVNlcnZpY2USWgoHSW5zdGFsbBIoLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbk5vdGljZRolLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbkFjazLIAQoMT2ZmZXJTZXJ2aWNlEl8KCkxpc3RPZmZlcnMSJy5ob3N0Lmluc3RhbGxhdGlvbi52MS5MaXN0T2ZmZXJzUmVxdWVzdBooLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkxpc3RPZmZlcnNSZXNwb25zZRJXCgtSZXZpZXdPZmZlchIjLmhvc3QuaW5zdGFsbGF0aW9uLnYxLlJldmlld1JlcXVlc3QaIy5ob3N0Lmluc3RhbGxhdGlvbi52MS5SZXZpZXdlZE9mZmVyQtUBChhjb20uaG9zdC5pbnN0YWxsYXRpb24udjFCEUluc3RhbGxhdGlvblByb3RvUAFaNGFjY291bnRzL3BrZy9nZW4vaG9zdC9pbnN0YWxsYXRpb24vdjE7aW5zdGFsbGF0aW9udjGiAgNISViqAhRIb3N0Lkluc3RhbGxhdGlvbi5WMcoCFEhvc3RcSW5zdGFsbGF0aW9uXFYx4gIgSG9zdFxJbnN0YWxsYXRpb25cVjFcR1BCTWV0YWRhdGHqAhZIb3N0OjpJbnN0YWxsYXRpb246OlYxYgZwcm90bzM"); + fileDesc("Cidob3N0L2luc3RhbGxhdGlvbi92MS9pbnN0YWxsYXRpb24ucHJvdG8SFGhvc3QuaW5zdGFsbGF0aW9uLnYxIkwKGkN1cnJlbnRJbnN0YWxsYXRpb25SZXF1ZXN0EhQKDHBhcmVudF90b2tlbhgBIAEoCRIYChBhY3Rvcl9jcmVkZW50aWFsGAIgASgJIm8KE0N1cnJlbnRJbnN0YWxsYXRpb24SCgoCaWQYASABKAkSFwoPb3JnYW5pemF0aW9uX2lkGAIgASgJEg4KBnRhcmdldBgDIAEoCRIQCghyZXZpc2lvbhgEIAEoBBIRCgluYW1lc3BhY2UYBSABKAkimQEKDkluc3RhbGxSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCRIOCgZ0YXJnZXQYAiABKAkSDAoEcm9sZRgDIAEoCRIXCg9vd25lcl9wZXJzb25faWQYBCABKAkSNwoIYXBwcm92YWwYBSABKAsyJS5ob3N0Lmluc3RhbGxhdGlvbi52MS5Db25zZW50QXBwcm92YWwiOAoNUmV2aWV3UmVxdWVzdBIXCg9vcmdhbml6YXRpb25faWQYASABKAkSDgoGdGFyZ2V0GAIgASgJInkKD0NvbnNlbnRBcHByb3ZhbBIRCgl0YXJnZXRfaWQYASABKAkSEgoKZ2VuZXJhdGlvbhgCIAEoBBIZChFleHBlY3RlZF9yZXZpc2lvbhgDIAEoBBIUCgxvcGVyYXRpb25faWQYBCABKAkSDgoGZGlnZXN0GAUgASgJInYKEEdyYW50Um9sZVJlcXVlc3QSFwoPb3JnYW5pemF0aW9uX2lkGAEgASgJEhcKD2luc3RhbGxhdGlvbl9pZBgCIAEoCRIMCgRyb2xlGAMgASgJEhEKCXBlcnNvbl9pZBgEIAEoCRIPCgd0ZWFtX2lkGAUgASgJIncKEVJldm9rZVJvbGVSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCRIXCg9pbnN0YWxsYXRpb25faWQYAiABKAkSDAoEcm9sZRgDIAEoCRIRCglwZXJzb25faWQYBCABKAkSDwoHdGVhbV9pZBgFIAEoCSJJChVMaXN0Um9sZUdyYW50c1JlcXVlc3QSFwoPb3JnYW5pemF0aW9uX2lkGAEgASgJEhcKD2luc3RhbGxhdGlvbl9pZBgCIAEoCSJJChZMaXN0Um9sZUdyYW50c1Jlc3BvbnNlEi8KBmdyYW50cxgBIAMoCzIfLmhvc3QuaW5zdGFsbGF0aW9uLnYxLlJvbGVHcmFudCI9CglSb2xlR3JhbnQSDAoEcm9sZRgBIAEoCRIRCglwZXJzb25faWQYAiABKAkSDwoHdGVhbV9pZBgDIAEoCSImCgtMaXN0UmVxdWVzdBIXCg9vcmdhbml6YXRpb25faWQYASABKAkiSQoMTGlzdFJlc3BvbnNlEjkKDWluc3RhbGxhdGlvbnMYASADKAsyIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24i3QIKDEluc3RhbGxhdGlvbhIKCgJpZBgBIAEoCRIXCg9vcmdhbml6YXRpb25faWQYAiABKAkSDgoGdGFyZ2V0GAMgASgJEjkKBnN0YXR1cxgEIAEoDjIpLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbi5TdGF0dXMSEAoIcmV2aXNpb24YBSABKAQSDAoEcm9sZRgGIAEoCRIRCgluYW1lc3BhY2UYCSABKAkSFAoMcHJpbmNpcGFsX2lkGAogASgJEg0KBXJvbGVzGAsgAygJIlsKBlN0YXR1cxIWChJTVEFUVVNfVU5TUEVDSUZJRUQQABISCg5TVEFUVVNfUEVORElORxABEhEKDVNUQVRVU19BQ1RJVkUQAhISCg5TVEFUVVNfUkVWT0tFRBADSgQIBxAISgQICBAJUgh0ZWFtX2lkc1ISYWdlbnRfcHJpbmNpcGFsX2lkIk4KEkluc3RhbGxhdGlvbk5vdGljZRI4CgxpbnN0YWxsYXRpb24YASABKAsyIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24iEQoPSW5zdGFsbGF0aW9uQWNrIiwKEUxpc3RPZmZlcnNSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCSJBChJMaXN0T2ZmZXJzUmVzcG9uc2USKwoGb2ZmZXJzGAEgAygLMhsuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXIiKwoFT2ZmZXISDgoGdGFyZ2V0GAEgASgJEhIKCmdlbmVyYXRpb24YAiABKAQinQMKDVJldmlld2VkT2ZmZXISNwoIYXBwcm92YWwYASABKAsyJS5ob3N0Lmluc3RhbGxhdGlvbi52MS5Db25zZW50QXBwcm92YWwSDgoGdGFyZ2V0GAIgASgJEi4KBXJvbGVzGAMgAygLMh8uaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJSb2xlEjgKDGluc3RhbGxhdGlvbhgEIAEoCzIiLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbhIzCgdjZWlsaW5nGAUgAygLMiIuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJCaW5kaW5nEhYKDnRvb2xzX2NvbXBvc2VkGAYgASgIEhkKEWluc3RhbGxhdGlvbl9yb2xlGAcgASgJEkAKEWVkZ2VfZGVwZW5kZW5jaWVzGAggAygLMiUuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJEZXBlbmRlbmN5Ei8KBXNldHVwGAkgAygLMiAuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJTZXR1cCJwCgpPZmZlclNldHVwEg8KB2JpbmRpbmcYASABKAkSDgoGbW9kdWxlGAIgASgJEg8KB21ldGhvZHMYAyADKAkSMAoGc2NvcGVzGAQgAygLMiAuaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJTY29wZSIzCg9PZmZlckRlcGVuZGVuY3kSDgoGbW9kdWxlGAEgASgJEhAKCHByZXNlbmNlGAIgASgJImEKDE9mZmVyQmluZGluZxIPCgdiaW5kaW5nGAEgASgJEg4KBm1vZHVsZRgCIAEoCRIwCgZzY29wZXMYAyADKAsyIC5ob3N0Lmluc3RhbGxhdGlvbi52MS5PZmZlclNjb3BlIogBCglPZmZlclJvbGUSDAoEbmFtZRgBIAEoCRIwCgZzY29wZXMYAiADKAsyIC5ob3N0Lmluc3RhbGxhdGlvbi52MS5PZmZlclNjb3BlEjsKDGNhcGFiaWxpdGllcxgDIAMoCzIlLmhvc3QuaW5zdGFsbGF0aW9uLnYxLk9mZmVyQ2FwYWJpbGl0eSJhCgpPZmZlclNjb3BlEhUKDXJlc291cmNlX2tpbmQYASABKAkSDwoHYWN0aW9ucxgCIAMoCRIVCg1hdHRhY2hlZF9vbmx5GAMgASgIEhQKDHJlc291cmNlX2lkcxgEIAMoCSKYAQoPT2ZmZXJDYXBhYmlsaXR5Eg4KBm1vZHVsZRgBIAEoCRIRCglvcGVyYXRpb24YAiABKAkSMgoIcmVxdWlyZXMYAyADKAsyIC5ob3N0Lmluc3RhbGxhdGlvbi52MS5PZmZlclNjb3BlEi4KBXRvb2xzGAQgAygLMh8uaG9zdC5pbnN0YWxsYXRpb24udjEuT2ZmZXJUb29sIjkKCU9mZmVyVG9vbBIMCgRuYW1lGAEgASgJEg8KB2JpbmRpbmcYAiABKAkSDQoFd3JpdGUYAyABKAgiKgoPTGlzdEhlbGRSZXF1ZXN0EhcKD29yZ2FuaXphdGlvbl9pZBgBIAEoCSJRChBMaXN0SGVsZFJlc3BvbnNlEj0KDWluc3RhbGxhdGlvbnMYASADKAsyJi5ob3N0Lmluc3RhbGxhdGlvbi52MS5IZWxkSW5zdGFsbGF0aW9uIlsKEEhlbGRJbnN0YWxsYXRpb24SOAoMaW5zdGFsbGF0aW9uGAEgASgLMiIuaG9zdC5pbnN0YWxsYXRpb24udjEuSW5zdGFsbGF0aW9uEg0KBXJvbGVzGAIgAygJMvMFChNJbnN0YWxsYXRpb25TZXJ2aWNlEmYKB0N1cnJlbnQSMC5ob3N0Lmluc3RhbGxhdGlvbi52MS5DdXJyZW50SW5zdGFsbGF0aW9uUmVxdWVzdBopLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkN1cnJlbnRJbnN0YWxsYXRpb24SUwoHSW5zdGFsbBIkLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxSZXF1ZXN0GiIuaG9zdC5pbnN0YWxsYXRpb24udjEuSW5zdGFsbGF0aW9uElQKBlJldmlldxIjLmhvc3QuaW5zdGFsbGF0aW9uLnYxLlJldmlld1JlcXVlc3QaJS5ob3N0Lmluc3RhbGxhdGlvbi52MS5Db25zZW50QXBwcm92YWwSVwoJR3JhbnRSb2xlEiYuaG9zdC5pbnN0YWxsYXRpb24udjEuR3JhbnRSb2xlUmVxdWVzdBoiLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkluc3RhbGxhdGlvbhJZCgpSZXZva2VSb2xlEicuaG9zdC5pbnN0YWxsYXRpb24udjEuUmV2b2tlUm9sZVJlcXVlc3QaIi5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb24SawoOTGlzdFJvbGVHcmFudHMSKy5ob3N0Lmluc3RhbGxhdGlvbi52MS5MaXN0Um9sZUdyYW50c1JlcXVlc3QaLC5ob3N0Lmluc3RhbGxhdGlvbi52MS5MaXN0Um9sZUdyYW50c1Jlc3BvbnNlEk0KBExpc3QSIS5ob3N0Lmluc3RhbGxhdGlvbi52MS5MaXN0UmVxdWVzdBoiLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkxpc3RSZXNwb25zZRJZCghMaXN0SGVsZBIlLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkxpc3RIZWxkUmVxdWVzdBomLmhvc3QuaW5zdGFsbGF0aW9uLnYxLkxpc3RIZWxkUmVzcG9uc2UycAoSSW5zdGFsbGFibGVTZXJ2aWNlEloKB0luc3RhbGwSKC5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb25Ob3RpY2UaJS5ob3N0Lmluc3RhbGxhdGlvbi52MS5JbnN0YWxsYXRpb25BY2syyAEKDE9mZmVyU2VydmljZRJfCgpMaXN0T2ZmZXJzEicuaG9zdC5pbnN0YWxsYXRpb24udjEuTGlzdE9mZmVyc1JlcXVlc3QaKC5ob3N0Lmluc3RhbGxhdGlvbi52MS5MaXN0T2ZmZXJzUmVzcG9uc2USVwoLUmV2aWV3T2ZmZXISIy5ob3N0Lmluc3RhbGxhdGlvbi52MS5SZXZpZXdSZXF1ZXN0GiMuaG9zdC5pbnN0YWxsYXRpb24udjEuUmV2aWV3ZWRPZmZlckLVAQoYY29tLmhvc3QuaW5zdGFsbGF0aW9uLnYxQhFJbnN0YWxsYXRpb25Qcm90b1ABWjRhY2NvdW50cy9wa2cvZ2VuL2hvc3QvaW5zdGFsbGF0aW9uL3YxO2luc3RhbGxhdGlvbnYxogIDSElYqgIUSG9zdC5JbnN0YWxsYXRpb24uVjHKAhRIb3N0XEluc3RhbGxhdGlvblxWMeICIEhvc3RcSW5zdGFsbGF0aW9uXFYxXEdQQk1ldGFkYXRh6gIWSG9zdDo6SW5zdGFsbGF0aW9uOjpWMWIGcHJvdG8z"); /** * @generated from message host.installation.v1.CurrentInstallationRequest @@ -713,6 +713,13 @@ export type ReviewedOffer = Message<"host.installation.v1.ReviewedOffer"> & { * @generated from field: repeated host.installation.v1.OfferDependency edge_dependencies = 8; */ edgeDependencies: OfferDependency[]; + + /** + * Temporary installation-confined grants, not standing roles. + * + * @generated from field: repeated host.installation.v1.OfferSetup setup = 9; + */ + setup: OfferSetup[]; }; /** @@ -722,6 +729,48 @@ export type ReviewedOffer = Message<"host.installation.v1.ReviewedOffer"> & { export const ReviewedOfferSchema: GenMessage = /*@__PURE__*/ messageDesc(file_host_installation_v1_installation, 18); +/** + * OfferSetup explains the exact authority usable only while setup is pending. + * + * @generated from message host.installation.v1.OfferSetup + */ +export type OfferSetup = Message<"host.installation.v1.OfferSetup"> & { + /** + * The declared binding. + * + * @generated from field: string binding = 1; + */ + binding: string; + + /** + * The destination principal. + * + * @generated from field: string module = 2; + */ + module: string; + + /** + * The exact allowed methods, even if other methods share their scopes. + * + * @generated from field: repeated string methods = 3; + */ + methods: string[]; + + /** + * Requirements, always confined to the pending installation's owner. + * + * @generated from field: repeated host.installation.v1.OfferScope scopes = 4; + */ + scopes: OfferScope[]; +}; + +/** + * Describes the message host.installation.v1.OfferSetup. + * Use `create(OfferSetupSchema)` to create a new message. + */ +export const OfferSetupSchema: GenMessage = /*@__PURE__*/ + messageDesc(file_host_installation_v1_installation, 19); + /** * OfferDependency carries presence only, never scopes or inferred binding ids. * Module is the exact signed principal, resolved by the host to its live target. @@ -745,7 +794,7 @@ export type OfferDependency = Message<"host.installation.v1.OfferDependency"> & * Use `create(OfferDependencySchema)` to create a new message. */ export const OfferDependencySchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_installation_v1_installation, 19); + messageDesc(file_host_installation_v1_installation, 20); /** * OfferBinding is one declared call from the solution to a module. @@ -776,7 +825,7 @@ export type OfferBinding = Message<"host.installation.v1.OfferBinding"> & { * Use `create(OfferBindingSchema)` to create a new message. */ export const OfferBindingSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_installation_v1_installation, 20); + messageDesc(file_host_installation_v1_installation, 21); /** * OfferRole is one declared role and what a grant of it reaches. @@ -809,7 +858,7 @@ export type OfferRole = Message<"host.installation.v1.OfferRole"> & { * Use `create(OfferRoleSchema)` to create a new message. */ export const OfferRoleSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_installation_v1_installation, 21); + messageDesc(file_host_installation_v1_installation, 22); /** * OfferScope is one declared scope. @@ -847,7 +896,7 @@ export type OfferScope = Message<"host.installation.v1.OfferScope"> & { * Use `create(OfferScopeSchema)` to create a new message. */ export const OfferScopeSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_installation_v1_installation, 22); + messageDesc(file_host_installation_v1_installation, 23); /** * OfferCapability is one module operation a role's scopes cover. @@ -888,7 +937,7 @@ export type OfferCapability = Message<"host.installation.v1.OfferCapability"> & * Use `create(OfferCapabilitySchema)` to create a new message. */ export const OfferCapabilitySchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_installation_v1_installation, 23); + messageDesc(file_host_installation_v1_installation, 24); /** * OfferTool is one tool-exposed Runnable of an operation. @@ -923,7 +972,7 @@ export type OfferTool = Message<"host.installation.v1.OfferTool"> & { * Use `create(OfferToolSchema)` to create a new message. */ export const OfferToolSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_installation_v1_installation, 24); + messageDesc(file_host_installation_v1_installation, 25); /** * ListHeldRequest names the organisation the person reads at: the one their @@ -945,7 +994,7 @@ export type ListHeldRequest = Message<"host.installation.v1.ListHeldRequest"> & * Use `create(ListHeldRequestSchema)` to create a new message. */ export const ListHeldRequestSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_installation_v1_installation, 25); + messageDesc(file_host_installation_v1_installation, 26); /** * ListHeldResponse is every installation the person holds a role on, sorted @@ -967,7 +1016,7 @@ export type ListHeldResponse = Message<"host.installation.v1.ListHeldResponse"> * Use `create(ListHeldResponseSchema)` to create a new message. */ export const ListHeldResponseSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_installation_v1_installation, 26); + messageDesc(file_host_installation_v1_installation, 27); /** * HeldInstallation is one installation the person may use. @@ -995,7 +1044,7 @@ export type HeldInstallation = Message<"host.installation.v1.HeldInstallation"> * Use `create(HeldInstallationSchema)` to create a new message. */ export const HeldInstallationSchema: GenMessage = /*@__PURE__*/ - messageDesc(file_host_installation_v1_installation, 27); + messageDesc(file_host_installation_v1_installation, 28); /** * InstallationService is implemented by the host and by the local authority.