Help us shape the future of Go! Take the 2026 Go Developer Survey

api

package
v0.1.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 18, 2026 License: Apache-2.0 Imports: 29 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// FactExpiration defines the token expiration time.
	// Contains: biscuit.Date(expirationTime)
	// Example Datalog: check if time($time), expiration($exp), $time <= $exp
	FactExpiration = "expiration"

	// FactNode defines the PeerID of the node that this token belongs to.
	// Contains: biscuit.String(nodePeerID)
	// Example Datalog: allow if node("12D3KooWP2G8nJCLASp1Kb4TmQS4wCpMH2vpSUz8ug8DYEJiuf1i")
	FactNode = "node"

	// FactClientPeerID defines the client PeerID performing the request, used for replay defense.
	// Contains: biscuit.String(clientPeerID)
	// Example Datalog: check if client_peer_id($id), connection_peer_id($id)
	FactClientPeerID = "client_peer_id"

	// FactActorNode names the origin agentmesh-node PeerID that exchanged a delegated
	// subject credential at POST /token/exchange, for audit logs, for act.sub in
	// border JWTs, and for ext_proc attributes["mesh"].actor_node. It grants
	// nothing: no baseline rule and no policy binding reads it.
	FactActorNode = "actor_node"

	// FactGroup defines the group claim extracted from the OIDC token.
	// Contains: biscuit.String(groupName)
	// Example Datalog: allow if group("data-science")
	FactGroup = "group"

	// FactRole defines a custom Agent Mesh role assigned to the user or node.
	// Contains: biscuit.String(roleName)
	// Example Datalog: allow if role("mesh-member")
	//
	// Only the control plane mints it, from mesh policy bindings. It must
	// never be derived from an OIDC claim: role("mesh:role:router") is what
	// makes a router, and an issuer's "roles" claim is the issuer's word, not
	// the mesh operator's. See FactIdpRole.
	FactRole = "role"

	// FactIdpRole carries the OIDC "roles" claim as the issuer emitted it.
	// Contains: biscuit.String(roleName)
	// Example Datalog: allow if idp_role("platform-team")
	// Bind it to a mesh role in policy (member "idp_role:platform-team"),
	// or target it ("idp_role:platform-team"); it grants nothing by itself.
	FactIdpRole = "idp_role"

	// FactRight defines the cryptographically signed capability/right.
	// Contains: biscuit.String(rightName)
	// Example Datalog: allow if right("relay")
	FactRight = "right"

	// RightRelay defines the transport relaying/bridging right.
	RightRelay = "relay"

	// RightServiceInvoke defines the edge service invocation right.
	RightServiceInvoke = "service:invoke"

	// Standard role values
	RoleRouter = "mesh:role:router"
	RoleNode   = "mesh:role:node"
	// RoleControlPlane is the role the control plane's own peer presents to
	// routers when it connects to publish events.
	RoleControlPlane = "mesh:role:control-plane"

	// FactUser defines the subject (username/userID) claim extracted from the OIDC token.
	// Contains: biscuit.String(username)
	// Example Datalog: allow if user("alice")
	FactUser = "user"

	// FactEmail defines the email claim extracted from the OIDC token.
	// Contains: biscuit.String(emailAddress)
	// Example Datalog: allow if email("bob@example.com")
	FactEmail = "email"

	// FactGrantedServiceAllTypes allows access to all service types (e.g., mcp, inference) and all targets.
	// Contains: biscuit.Bool(true) (marker fact)
	// Example Datalog: allow if granted_service_all_types(true)
	FactGrantedServiceAllTypes = "granted_service_all_types"

	// FactGrantedServiceAll allows access to all targets under a specific service type.
	// Contains: biscuit.String(serviceType) (e.g., "mcp")
	// Example Datalog: allow if service("mcp", $target), granted_service_all("mcp")
	FactGrantedServiceAll = "granted_service_all"

	// FactGrantedServiceSuffix allows access to services matching a suffix pattern (e.g. *.service.local).
	// Contains: biscuit.String(serviceType), biscuit.String(suffixPattern)
	FactGrantedServiceSuffix = "granted_service_suffix"

	// FactGrantedServicePrefix allows access to services matching a prefix pattern (e.g. calculator.*).
	// Contains: biscuit.String(serviceType), biscuit.String(prefixPattern)
	FactGrantedServicePrefix = "granted_service_prefix"

	// FactGrantedServiceExact allows access to a specific service type and target.
	// Contains: biscuit.String(serviceType), biscuit.String(targetName)
	// Example Datalog: allow if service("mcp", "calculator"), granted_service_exact("mcp", "calculator")
	FactGrantedServiceExact = "granted_service_exact"

	// FactGrantedServiceSet allows access to a Set of exact service names under a specific service
	// type. This lets many exact grants for the same type be carried as a single Datalog fact instead
	// of one fact per entry, which keeps token/world fact counts flat regardless of list length.
	// Contains: biscuit.String(serviceType), biscuit.Set of biscuit.String(serviceName)
	// Example Datalog: allow if service("mcp", "calculator"), granted_service_set("mcp", $set), $set.contains("calculator")
	FactGrantedServiceSet = "granted_service_set"

	// The granted_publish_* facts are the granted_service_* facts for the
	// other direction: what a member may serve, as a role's allowed_publish
	// grants it. A router verifies them before it keeps a member's record and
	// a caller before it sends a request to a provider it found by name, with
	// PublishPolicies over a publish($type, $name) fact. They carry the same
	// terms as their granted_service_* counterpart.
	FactGrantedPublishAllTypes = "granted_publish_all_types"
	FactGrantedPublishAll      = "granted_publish_all"
	FactGrantedPublishSuffix   = "granted_publish_suffix"
	FactGrantedPublishPrefix   = "granted_publish_prefix"
	FactGrantedPublishExact    = "granted_publish_exact"
	FactGrantedPublishSet      = "granted_publish_set"

	// FactPublish is the service a verifier asks about: publish("mcp", "calc").
	// Added by the verifier, never carried in a token.
	FactPublish = "publish"

	// FactGrantedTargetAllTypes allows target access to all network targets (unrestricted).
	// Contains: biscuit.Bool(true) (marker fact)
	FactGrantedTargetAllTypes = "granted_target_all_types"

	// FactGrantedTargetAll allows target access to all values of a specific fact.
	// Contains: biscuit.String(factName) (e.g., "group")
	FactGrantedTargetAll = "granted_target_all"

	// FactGrantedTargetSuffix allows target access to values matching a suffix pattern.
	// Contains: biscuit.String(factName), biscuit.String(suffixPattern)
	FactGrantedTargetSuffix = "granted_target_suffix"

	// FactGrantedTargetPrefix allows target access to values matching a prefix pattern.
	// Contains: biscuit.String(factName), biscuit.String(prefixPattern)
	FactGrantedTargetPrefix = "granted_target_prefix"

	// FactGrantedTargetExact allows target access to a specific fact name and value combination.
	// Contains: biscuit.String(factName), biscuit.String(factValue)
	// Example Datalog: allow_network_target("group", "backend") <- target_fact("group", "backend"), granted_target_exact("group", "backend")
	FactGrantedTargetExact = "granted_target_exact"

	// FactGrantedTargetAllFacts allows target access to any fact name and value combination.
	// Contains: biscuit.Bool(true) (marker fact)
	FactGrantedTargetAllFacts = "granted_target_all_facts"

	// FactGrantedTargetSet allows target access to a Set of exact values for a specific fact name.
	// This lets many exact target grants for the same fact name be carried as a single Datalog fact
	// instead of one fact per entry, which keeps token/world fact counts flat regardless of list length.
	// Contains: biscuit.String(factName), biscuit.Set of biscuit.String(factValue)
	FactGrantedTargetSet = "granted_target_set"

	// FactConnectionPeerID defines the actual PeerID of the remote peer making the connection.
	// Contains: biscuit.String(connectionPeerID)
	// Example Datalog: check if client_peer_id($id), connection_peer_id($id)
	FactConnectionPeerID = "connection_peer_id"

	// FactTargetFact normalizes identity assertions (claims, node, user) to a standardized target.
	// Contains: biscuit.String(factName), biscuit.String(factValue)
	// Example Datalog: target_fact("group", $val) <- group($val)
	FactTargetFact = "target_fact"

	// FactAllowNetworkTarget evaluates whether a target assertion meets the token access grants.
	// Contains: biscuit.String(factName), biscuit.String(factValue)
	// Example Datalog: allow_network_target("group", "backend")
	FactAllowNetworkTarget = "allow_network_target"

	// FactTargetUnrestricted indicates that target authorization checks are bypassed.
	// Contains: biscuit.Bool(true) (marker fact)
	// Example Datalog: check if allow_network_target($fact, $val) or target_unrestricted(true)
	FactTargetUnrestricted = "target_unrestricted"

	// FactTargetRestricted indicates that target authorization checks must be enforced.
	// Contains: biscuit.Bool(true) (marker fact)
	FactTargetRestricted = "target_restricted"

	// FactService represents the service target that a node is requesting access to.
	// Contains: biscuit.String(serviceType), biscuit.String(serviceName)
	// Example Datalog: service("mcp", "calculator")
	FactService = "service"

	// FactMethod is the HTTP method of the request as received, or "CONNECT"
	// for a tunnel the node opens without terminating HTTP.
	// Contains: biscuit.String(method)
	// Example Datalog: deny if method($m), !($m == "GET")
	FactMethod = "method"

	// FactPath is the request path as the backend sees it: leading slash, no
	// query, with the mesh routing prefix removed. A tunnel carries path("").
	// Contains: biscuit.String(path)
	// Example Datalog: deny if path($p), !$p.starts_with("/v2/public/")
	FactPath = "path"

	// FactHost is the destination hostname of an egress request, lowercase,
	// as authorized: the same string as the service name.
	// Contains: biscuit.String(host)
	// Example Datalog: deny if host("payroll.internal.example.com")
	FactHost = "host"

	// FactPort is the destination port of an egress request.
	// Contains: biscuit.Integer(port)
	// Example Datalog: deny if port($p), !($p == 443)
	FactPort = "port"

	// FactHTTPGrantedServiceExact is granted_service_exact, narrowed.
	// Contains: biscuit.String(serviceType), biscuit.String(serviceName)
	FactHTTPGrantedServiceExact = "http_granted_service_exact"

	// FactHTTPGrantedServiceSuffix is granted_service_suffix, narrowed.
	// Contains: biscuit.String(serviceType), biscuit.String(suffixPattern)
	FactHTTPGrantedServiceSuffix = "http_granted_service_suffix"

	// FactHTTPGrantedServicePrefix is granted_service_prefix, narrowed.
	// Contains: biscuit.String(serviceType), biscuit.String(prefixPattern)
	FactHTTPGrantedServicePrefix = "http_granted_service_prefix"

	// FactHTTPGrantedServiceAll is granted_service_all, narrowed. Its key is "*".
	// Contains: biscuit.String(serviceType)
	FactHTTPGrantedServiceAll = "http_granted_service_all"

	// FactHTTPGrantedServiceAllTypes is granted_service_all_types, narrowed.
	// Its type and key are both "*".
	// Contains: biscuit.Bool(true) (marker fact)
	FactHTTPGrantedServiceAllTypes = "http_granted_service_all_types"

	// FactGrantedMethod lists the methods a narrowed grant permits.
	// Contains: biscuit.String(serviceType), biscuit.String(key), biscuit.Set of biscuit.String(method)
	FactGrantedMethod = "granted_method"

	// FactGrantedMethodAny marks a narrowed grant that permits every method.
	// Contains: biscuit.String(serviceType), biscuit.String(key)
	FactGrantedMethodAny = "granted_method_any"

	// FactGrantedPathExact lists the exact paths a narrowed grant permits.
	// Contains: biscuit.String(serviceType), biscuit.String(key), biscuit.Set of biscuit.String(path)
	FactGrantedPathExact = "granted_path_exact"

	// FactGrantedPathPrefix permits every path under one prefix, one fact per prefix.
	// Contains: biscuit.String(serviceType), biscuit.String(key), biscuit.String(prefix)
	FactGrantedPathPrefix = "granted_path_prefix"

	// FactGrantedPathAny marks a narrowed grant that permits every path.
	// Contains: biscuit.String(serviceType), biscuit.String(key)
	FactGrantedPathAny = "granted_path_any"

	// FactHTTPMethodOK is derived when the request method satisfies a narrowed grant.
	// Contains: biscuit.String(serviceType), biscuit.String(key)
	FactHTTPMethodOK = "http_method_ok"

	// FactHTTPPathOK is derived when the request path satisfies a narrowed grant.
	// Contains: biscuit.String(serviceType), biscuit.String(key)
	FactHTTPPathOK = "http_path_ok"

	// FactLabel is a control-plane-attested key=value label on the token's
	// node (see api/labels.go). The control plane mints one fact per
	// declared label, so a requirement is a single exact match: a node
	// attested with region="us-east-1" carries label("region", "us-east-1"),
	// satisfying `check if label("region", "us-east-1")` only — composition
	// across values is left entirely to the operator (attest as many labels
	// as needed).
	// Contains: biscuit.String(key), biscuit.String(value)
	// Example Datalog: check if label("region", "us-east-1")
	FactLabel = "label"

	// FactTime defines the current system time injected during evaluation.
	// Contains: biscuit.Date(currentTime)
	// Example Datalog: check if time($time)
	FactTime = "time"

	// FactTARBlock is the sole Datalog predicate allowed in a holder-appended
	// Biscuit attenuation block (block index >= 1). Its single string term is
	// the unpadded base64url-encoded protobuf serialization of an
	// api.TaskAuthorizationRule.
	// Contains: biscuit.String(base64urlProto)
	// Example Datalog: tar_block("ChB0YXNrLWJxLXJlYWQtMTIz...")
	FactTARBlock = "tar_block"
)

Biscuit fact names represent the Datalog predicates used in auth tokens and policy evaluation.

View Source 
const (
	DefaultDHTReplication    = 3
	DefaultReprovideInterval = 5 * time.Minute
)

The directory parameters a mesh runs on when its control plane sets none (ControlPlaneInfoResponse.directory): three routers per key, a re-announcement every five minutes, and records that outlive three of them. Every member and router derives its settings from these three numbers, so a member started against no control plane at all behaves as one of a default mesh.

View Source 
const (
	// EnrollURIScheme is the URI scheme of a device enrollment payload.
	EnrollURIScheme = "mesh"
	// EnrollURIHost is the fixed host component; it names the action.
	EnrollURIHost = "enroll"
)
View Source 
const (
	// EnrollProtocolID is the libp2p protocol identifier for node enrollment.
	EnrollProtocolID protocol.ID = "/mesh/enroll/1.0.0"

	// MCPProtocolID is the libp2p protocol identifier for Model Context Protocol streams.
	MCPProtocolID protocol.ID = "/mesh/mcp/1.0.0"

	// AuthProtocolID is the libp2p protocol identifier for the zero-trust auth handshake.
	AuthProtocolID protocol.ID = "/mesh/auth/1.0.0"

	// GoAwayProtocolID is the libp2p protocol on which a router tells a member
	// it will no longer hold it; the stream carries one RouterGoAway.
	GoAwayProtocolID protocol.ID = "/mesh/goaway/1.0.0"

	// DHTProtocolPrefix namespaces the mesh's Kademlia DHT away from the
	// public IPFS one; the protocol every member and router registers for
	// it is DHTProtocolID.
	DHTProtocolPrefix protocol.ID = "/mesh"
	DHTProtocolID     protocol.ID = DHTProtocolPrefix + "/kad/1.0.0"

	// GossipEvents is the GossipSub topic used to broadcast mesh event updates (e.g., node bans).
	GossipEvents = "/mesh/events/v1"

	// GossipControlPlaneSync is the GossipSub topic used by the control plane to sync cluster state.
	GossipControlPlaneSync = "/mesh/control-plane/sync/v1"

	// DefaultAudience is the default audience string used in OIDC token validation.
	DefaultAudience = "agentmesh-audience"
)
View Source 
const (
	// BiscuitTokenTTL is the strict cryptographically enforced lifespan
	// of a minted Biscuit token (24 hours).
	// This is verified locally by each peer on every connection.
	BiscuitTokenTTL = 24 * time.Hour

	// OIDCSessionTTL is the default database-enforced lifespan of a node's OIDC
	// interactive enrollment session (90 days). After this period, the node
	// must re-authenticate with the OIDC provider to establish a new session.
	// Operators tune the cadence with the control plane's --oidc-session-ttl.
	OIDCSessionTTL = 90 * 24 * time.Hour

	// TokenRefreshCheckInterval is the frequency at which the node daemon and router check
	// if their current Biscuit token is close to expiration and needs to be proactively refreshed.
	TokenRefreshCheckInterval = 10 * time.Minute
)
View Source 
const (
	// GrantTypeTokenExchange is the RFC 8693 OAuth 2.0 Token Exchange grant type URI.
	GrantTypeTokenExchange = "urn:ietf:params:oauth:grant-type:token-exchange"

	// GrantTypeAuthorizationCode is the standard OAuth 2.1 authorization_code grant type.
	GrantTypeAuthorizationCode = "authorization_code"

	// GrantTypeClientCredentials is the RFC 6749 client_credentials grant type.
	GrantTypeClientCredentials = "client_credentials"

	// GrantTypeJWTBearer is the RFC 7523 section 2.1 JWT authorization grant type URI.
	GrantTypeJWTBearer = "urn:ietf:params:oauth:grant-type:jwt-bearer"

	// ClientAssertionTypeJWTBearer is the RFC 7523 section 2.2 client assertion type URI.
	ClientAssertionTypeJWTBearer = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"

	// ClientAssertionTypeJWTSPIFFE is the client assertion type URI for a SPIFFE
	// JWT-SVID (draft-ietf-oauth-spiffe-client-auth).
	ClientAssertionTypeJWTSPIFFE = "urn:ietf:params:oauth:client-assertion-type:jwt-spiffe"

	// TokenTypeBiscuit is the token type URI identifying a Agent Mesh Biscuit token in RFC 8693 exchanges.
	TokenTypeBiscuit = "urn:agentmesh:params:oauth:token-type:biscuit"

	// TokenTypeJWT is the RFC 8693 JWT token type URI.
	TokenTypeJWT = "urn:ietf:params:oauth:token-type:jwt"

	// TokenTypeIDToken is the RFC 8693 OIDC ID token type URI.
	TokenTypeIDToken = "urn:ietf:params:oauth:token-type:id_token"

	// TokenTypeAccessToken is the RFC 8693 OAuth access token type URI.
	TokenTypeAccessToken = "urn:ietf:params:oauth:token-type:access_token"
)
View Source 
const (
	// HeaderMeshBiscuit is the custom HTTP header used to carry the base64-encoded
	// Biscuit token containing the node's identity credentials when forwarding requests
	// over libp2p HTTP between nodes in the mesh.
	//
	// This header is internal to the Agent Mesh datapath and is stripped before requests
	// are forwarded to backend services.
	HeaderMeshBiscuit = "X-Mesh-Biscuit"

	// HeaderChallengeTimestamp and HeaderChallengeSignature carry the signed
	// freshness challenge on GET /enroll/status, GET /policies, GET /egress,
	// GET /revocations, and POST /nodes/catalog: unix milliseconds and an
	// unpadded base64url signature over the endpoint's challenge payload.
	// Headers rather than query parameters, so the signature never lands in
	// access logs, where it would be replayable for its freshness window.
	HeaderChallengeTimestamp = "X-Mesh-Challenge-Ts"
	HeaderChallengeSignature = "X-Mesh-Challenge-Sig"

	// HeaderPeerID carries the authenticated libp2p peer ID of the caller.
	// The mesh ingress handler stamps it after authorization succeeds,
	// overwriting any inbound value, so backend services get verified caller
	// attribution without parsing biscuits. The inference facade sets it the
	// same way for locally served requests.
	HeaderPeerID = "X-Peer-Id"

	// HeaderMeshAuthentication is the custom HTTP header used to authenticate a local
	// process to this node's sidecar API (the shared secret configured via
	// "--api-token-path" or the AGENTMESH_API_TOKEN environment variable). Using a
	// Agent Mesh-specific header name — instead of the standard
	// "Authorization" header — leaves "Authorization" free to always mean what
	// every HTTP client expects: the credential for the destination being called.
	// The sidecar strips this header before forwarding any request off-node, so
	// it never leaks to a remote peer or backend service.
	//
	// For compatibility with MCP clients that only support a plain "Authorization"
	// header, purely-local endpoints (that never forward it anywhere) also accept
	// "Authorization" as an alias. The egress/inference proxy does NOT: there,
	// "Authorization" is reserved exclusively for the destination's credential.
	HeaderMeshAuthentication = "X-Mesh-Authentication"

	// HeaderMeshNoTrailingSlash is the custom HTTP header set by the ingress handler
	// to indicate that the original request had no trailing slash.
	//
	// This helps backward-compatibility with services that strictly distinguish
	// between a root path "/" and an empty path "".
	HeaderMeshNoTrailingSlash = "X-Mesh-No-Trailing-Slash"

	// HeaderMeshRequiredLabels constrains an inference request on the sidecar's
	// OpenAI-compatible endpoints (/v1/*) to providers attested with every
	// pair of a comma-separated list of "key=value" label requirements (see
	// api/labels.go and LabelCheck); invalid entries are rejected with HTTP
	// 400. It can only narrow what mesh policy allows, never widen it. Absent
	// means any provider permitted by policy.
	//
	// Reserved as part of the sidecar contract; enforced by the provider
	// scorer. Label declarations are routing hints until attested via the
	// node's Biscuit (see api/labels.go).
	HeaderMeshRequiredLabels = "X-Mesh-Required-Labels"

	// HeaderMeshPrincipal, HeaderMeshRoles, HeaderMeshTask, and HeaderMeshTaskID carry
	// verified caller attribution injected by ext_authz or forwarded to an
	// operator inspection chain when forward_context is enabled.
	HeaderMeshPrincipal     = "X-Mesh-Principal"
	HeaderMeshRoles         = "X-Mesh-Roles"
	HeaderMeshTask          = "X-Mesh-Task"
	HeaderMeshTaskID        = "X-Mesh-Task-Id"
	HeaderMeshTargetService = "X-Mesh-Target-Service"
)
View Source 
const (
	// SystemNamespace is the namespace reserved for built-in mesh services and protocols.
	SystemNamespace = "mesh:system"

	// CatalogTarget is the special system service name used to retrieve tool catalogs.
	// In policy rules, it must be referred to explicitly as: system://mesh.catalog
	CatalogTarget = "mesh.catalog"

	// MCPServicePrefix is the scheme prefix for Model Context Protocol services.
	// Fully qualified MCP services use the URI format: mcp://<service-name>
	MCPServicePrefix = "mcp://"

	// InferenceServicePrefix is the scheme prefix for LLM Inference services.
	// Fully qualified inference services use the URI format: inference://<service-name>
	InferenceServicePrefix = "inference://"

	// EgressServicePrefix is the scheme prefix for destinations outside the
	// mesh, served by a node that enforces policy on them. The name is the
	// destination hostname: egress://api.github.com
	EgressServicePrefix = "egress://"
)
View Source 
const (
	// ServiceTypeStringMCP is the string identifier for MCP services.
	ServiceTypeStringMCP = "mcp"

	// ServiceTypeStringInference is the string identifier for Inference services.
	ServiceTypeStringInference = "inference"

	// ServiceTypeStringA2A is the string identifier for A2A (Agent2Agent) services.
	ServiceTypeStringA2A = "a2a"

	// ServiceTypeStringEgress is the string identifier for egress destinations.
	ServiceTypeStringEgress = "egress"
)
View Source 
const (
	// MaxAttenuationBlocks is the maximum number of appended Biscuit blocks
	// (block index 1..MaxAttenuationBlocks) allowed on an inbound token.
	MaxAttenuationBlocks = 8

	// MaxTARBytes is the maximum serialized protobuf byte size of a single
	// TaskAuthorizationRule before base64url encoding.
	MaxTARBytes = 4096

	// MaxRulesPerTAR is the maximum number of TaskRule entries in one
	// TaskAuthorizationRule.
	MaxRulesPerTAR = 16

	// MaxEntriesPerTARList is the maximum number of strings in any repeated
	// field of TaskRule or TaskOperation.
	MaxEntriesPerTARList = 64

	// MaxTARNameLength is the maximum byte length of task_id, name, service
	// patterns, tool names, HTTP paths, and cloud permissions in a TAR.
	MaxTARNameLength = 128

	// MaxTARDescriptionLength is the maximum byte length of human-readable
	// description fields in TaskAuthorizationRule and TaskRule.
	MaxTARDescriptionLength = 256

	// MaxTARResourceLength is the maximum byte length of an allowed_resources
	// entry (e.g. a cloud resource manager path).
	MaxTARResourceLength = 256

	// TARBlockSourcePattern is the exact regular expression that every
	// appended block's Datalog source text must match across Go, TypeScript,
	// and Python verifiers. It permits only a single tar_block("<base64url>")
	// fact with zero rules and zero checks.
	TARBlockSourcePattern = `^tar_block\("([A-Za-z0-9_-]+)"\);?\s*$`
)

Structural bounds for holder-appended TaskAuthorizationRule (tar_block) attenuation blocks. Enforced identically by the Go, TypeScript, and Python verifiers before evaluating a request.

View Source 
const DirectoryKeyBytes = 34

DirectoryKeyBytes is the length of a directory key: a sha256 multihash.

View Source 
const DirectoryMaxAddrs = 32

DirectoryMaxAddrs bounds the addresses one record carries.

View Source 
const DirectoryProtocolID protocol.ID = "/mesh/directory/1.0.0"

DirectoryProtocolID is the libp2p protocol on which a member asks a router it is attached to for the directory: one DirectoryRequest per stream, one DirectoryResponse back. Routers place records on each other over it as well.

View Source 
const ErrStaleChallengeTimestampMessage = "stale or invalid challenge timestamp"

ErrStaleChallengeTimestampMessage is the stable substring returned in a 401 response body when a signed challenge timestamp is outside the control plane's freshness window. Clients match this message to recompute challenge_unix_ms from the response's Date header and retry once.

View Source 
const KeysResponseFreshness = 5 * time.Minute

KeysResponseFreshness bounds how far a signed /keys response's timestamp may be from the receiver's clock: a captured response must not be able to keep a retired key trusted after its grace period.

View Source 
const MaxNodeLabels = 64

MaxNodeLabels bounds the number of labels a single node may declare at enrollment so label facts cannot exhaust the Biscuit authorizer fact budget.

View Source 
const NodeConfigVersionV1Alpha1 = "v1alpha1"

NodeConfigVersionV1Alpha1 is the only node config schema this build understands. A file omitting the version is read as this one, since it predates the check.

View Source 
const (
	// SystemAuthenticated is a special member string representing any authenticated user.
	SystemAuthenticated = "mesh:system:authenticated"
)

Variables

View Source 
var (
	EnrollmentStatus_name = map[int32]string{
		0: "ENROLLMENT_STATUS_UNSPECIFIED",
		1: "ENROLLMENT_STATUS_PENDING",
		2: "ENROLLMENT_STATUS_APPROVED",
		3: "ENROLLMENT_STATUS_REJECTED",
	}
	EnrollmentStatus_value = map[string]int32{
		"ENROLLMENT_STATUS_UNSPECIFIED": 0,
		"ENROLLMENT_STATUS_PENDING":     1,
		"ENROLLMENT_STATUS_APPROVED":    2,
		"ENROLLMENT_STATUS_REJECTED":    3,
	}
)

Enum value maps for EnrollmentStatus.

View Source 
var (
	ServiceType_name = map[int32]string{
		0: "SERVICE_TYPE_UNSPECIFIED",
		1: "SERVICE_TYPE_MCP",
		2: "SERVICE_TYPE_INFERENCE",
		3: "SERVICE_TYPE_A2A",
		4: "SERVICE_TYPE_EGRESS",
	}
	ServiceType_value = map[string]int32{
		"SERVICE_TYPE_UNSPECIFIED": 0,
		"SERVICE_TYPE_MCP":         1,
		"SERVICE_TYPE_INFERENCE":   2,
		"SERVICE_TYPE_A2A":         3,
		"SERVICE_TYPE_EGRESS":      4,
	}
)

Enum value maps for ServiceType.

View Source 
var (
	EgressMode_name = map[int32]string{
		0: "EGRESS_MODE_HTTP",
		1: "EGRESS_MODE_TCP",
	}
	EgressMode_value = map[string]int32{
		"EGRESS_MODE_HTTP": 0,
		"EGRESS_MODE_TCP":  1,
	}
)

Enum value maps for EgressMode.

View Source 
var (
	ResponseInspection_name = map[int32]string{
		0: "RESPONSE_INSPECTION_BUFFERED",
		1: "RESPONSE_INSPECTION_REQUEST_ONLY",
	}
	ResponseInspection_value = map[string]int32{
		"RESPONSE_INSPECTION_BUFFERED":     0,
		"RESPONSE_INSPECTION_REQUEST_ONLY": 1,
	}
)

Enum value maps for ResponseInspection.

View Source 
var (
	RouterGoAway_Reason_name = map[int32]string{
		0: "REASON_UNSPECIFIED",
		1: "DRAINING",
		2: "OVERLOADED",
	}
	RouterGoAway_Reason_value = map[string]int32{
		"REASON_UNSPECIFIED": 0,
		"DRAINING":           1,
		"OVERLOADED":         2,
	}
)

Enum value maps for RouterGoAway_Reason.

View Source 
var (
	MeshEvent_Type_name = map[int32]string{
		0: "BANNED",
		1: "KEY_ROTATION",
		2: "POLICY_UPDATE",
	}
	MeshEvent_Type_value = map[string]int32{
		"BANNED":        0,
		"KEY_ROTATION":  1,
		"POLICY_UPDATE": 2,
	}
)

Enum value maps for MeshEvent_Type.

View Source 
var (
	ExtProcProcessingMode_HeaderMode_name = map[int32]string{
		0: "HEADER_MODE_DEFAULT",
		1: "SEND",
		2: "SKIP",
	}
	ExtProcProcessingMode_HeaderMode_value = map[string]int32{
		"HEADER_MODE_DEFAULT": 0,
		"SEND":                1,
		"SKIP":                2,
	}
)

Enum value maps for ExtProcProcessingMode_HeaderMode.

View Source 
var (
	ExtProcProcessingMode_BodyMode_name = map[int32]string{
		0: "NONE",
		1: "STREAMED",
		2: "BUFFERED",
		3: "BUFFERED_PARTIAL",
		4: "FULL_DUPLEX_STREAMED",
	}
	ExtProcProcessingMode_BodyMode_value = map[string]int32{
		"NONE":                 0,
		"STREAMED":             1,
		"BUFFERED":             2,
		"BUFFERED_PARTIAL":     3,
		"FULL_DUPLEX_STREAMED": 4,
	}
)

Enum value maps for ExtProcProcessingMode_BodyMode.

View Source 
var (
	// BaselinePolicies are the pre-compiled authorization policies for the node middleware.
	BaselinePolicies []biscuit.Policy

	// BaselineRules are the pre-compiled target evaluation rules for the node middleware.
	BaselineRules []biscuit.Rule

	// BaselineHTTPRules derive the plain granted_service_* facts from the
	// http_granted_service_* facts of a narrowed grant when the request's
	// method() and path() satisfy it. Added wherever BaselineRules are.
	BaselineHTTPRules []biscuit.Rule

	// BaselineReplayCheck verifies that the client peer ID matches the connection peer ID.
	BaselineReplayCheck biscuit.Check

	// BaselineTargetCheck verifies that the target matches one of the allowed network targets.
	BaselineTargetCheck biscuit.Check

	// TargetFactRules maps node and OIDC claims to target_fact datalog facts.
	TargetFactRules []biscuit.Rule

	// ControlPlaneStaticTimeCheck is the standard check for verifying a Biscuit's
	// own expiration() fact. Every path that admits a token must add it together
	// with a FactTime fact; see identity.EnforceExpiration.
	ControlPlaneStaticTimeCheck biscuit.Check

	// AllowIfTruePolicy is the static policy "allow if true" used during token verification.
	AllowIfTruePolicy biscuit.Policy

	// PublishPolicies decide whether a member may serve a service: over its
	// own credential and a publish($type, $name) fact, one allows when a
	// granted_publish_* fact covers the service, and no policy matching is a
	// refusal. The router runs them before it keeps a member's record, a
	// caller before it sends a request to a provider it found by name.
	PublishPolicies []biscuit.Policy

	// BaselineSources is the Datalog text every variable above is parsed from.
	// The SDKs embed this text (see hack/gen-sdk-datalog) so that a provider
	// written in another language evaluates the same authorizer as agentmesh-node.
	BaselineSources DatalogSources
)
View Source 
var ErrInsecureControlPlaneURL = errors.New("plaintext http:// control plane URL to a non-loopback host")

ErrInsecureControlPlaneURL marks a plaintext control-plane URL to a host that is not loopback. Whoever answers that URL becomes the trust root (/keys, enrollment, router addresses), so without TLS that is whoever sits on the path.

View Source 
var File_api_agentmesh_proto protoreflect.FileDescriptor
View Source 
var MarkerTerm biscuit.Term = biscuit.Bool(true)

MarkerTerm is the single term every marker fact carries, written `true` in Datalog text. See MarkerFact.

View Source 
var SupportedNodeConfigVersions = map[string]bool{
	"":                        true,
	NodeConfigVersionV1Alpha1: true,
}

SupportedNodeConfigVersions gates LoadNodeConfig. A node must refuse a schema it does not know rather than parse it as this one: silently reinterpreting a future config would silently reinterpret its attenuation rules. Adding a version means adding it here and decoding it into the same internal type, so the rest of the node stays version-agnostic.

View Source 
var (
	// TARBlockSourceRegex matches the Datalog source of a valid tar_block.
	TARBlockSourceRegex = regexp.MustCompile(TARBlockSourcePattern)
)

Functions

func BindingMemberPrefixes 

func BindingMemberPrefixes() []string

BindingMemberPrefixes are the fact names a policy binding member or an allowed_targets entry may name: the peer itself plus every OIDC claim the control plane mints. FactRole is deliberately absent: a binding on it would grant a mesh role from a mesh role.

func BuildHTTPGrantFacts 

func BuildHTTPGrantFacts(g *HTTPGrant) []biscuit.Fact

BuildHTTPGrantFacts compiles one narrowed grant into the facts minted into the holder's credential: the http_granted_service_* fact for the entry, then one fact per axis. Methods and exact paths travel as one Set each; each prefix is its own fact, because starts_with has no set form.

func BuildPublishDatalogFacts 

func BuildPublishDatalogFacts(services []string) []biscuit.Fact

BuildPublishDatalogFacts translates a role's allowed_publish patterns into granted_publish_* facts, the same way and with the same terms as BuildServiceDatalogFacts does for allowed_services.

func BuildServiceDatalogFact 

func BuildServiceDatalogFact(serviceStr string) biscuit.Fact

BuildServiceDatalogFact translates a service pattern string into a Datalog Fact.

func BuildServiceDatalogFacts 

func BuildServiceDatalogFacts(services []string) []biscuit.Fact

BuildServiceDatalogFacts translates a list of service patterns into a minimal set of Datalog facts. Exact-match entries are grouped by service type into a single granted_service_set fact each, so token/world fact counts stay flat regardless of how many exact services a role grants. Wildcard, prefix and suffix entries keep their existing one-fact-per-entry representation via BuildServiceDatalogFact, since those already collapse to a single fact per entry.

func BuildTargetDatalogFact 

func BuildTargetDatalogFact(targetStr string) biscuit.Fact

BuildTargetDatalogFact translates a target pattern string into a Datalog Fact.

func BuildTargetDatalogFacts 

func BuildTargetDatalogFacts(targets []string) []biscuit.Fact

BuildTargetDatalogFacts translates a list of target patterns into a minimal set of Datalog facts. Exact-match entries are grouped by fact name into a single granted_target_set fact each, so token/world fact counts stay flat regardless of how many exact targets a role grants. Wildcard, prefix and suffix entries keep their existing one-fact-per-entry representation via BuildTargetDatalogFact, since those already collapse to a single fact per entry.

func EffectiveTARExpiration 

func EffectiveTARExpiration(authorityExp time.Time, blocks []*TaskAuthorizationRule) time.Time

EffectiveTARExpiration returns the earliest expiration time across the authority block's expiration and every appended TaskAuthorizationRule's expire_time.

func EgressChallenge 

func EgressChallenge(peerID string, ts int64) []byte

EgressChallenge is the payload an enrolled peer signs with its identity key at GET /egress in the HeaderChallengeTimestamp and HeaderChallengeSignature headers.

func EgressServedBy 

func EgressServedBy(d *EgressDestination, roles []string, labels map[string]string) bool

EgressServedBy reports whether a node with these roles and labels is selected to serve d.

func EgressStaticSecret 

func EgressStaticSecret(d *EgressDestination) string

EgressStaticSecret returns the static secret file name configured on d, whether specified via broker.static_secret or the shorthand credential field.

func EgressTargetURL 

func EgressTargetURL(d *EgressDestination) string

EgressTargetURL is where the serving node forwards requests for d: target_url when set, otherwise https on the destination name.

func EncodeTARBlockFact 

func EncodeTARBlockFact(rule *TaskAuthorizationRule) (biscuit.Fact, error)

EncodeTARBlockFact validates a TaskAuthorizationRule and returns the single tar_block("<base64url>") Datalog fact to append in a Biscuit block.

func EncodeTARBlockPayload 

func EncodeTARBlockPayload(rule *TaskAuthorizationRule) (string, error)

EncodeTARBlockPayload validates and serializes a TaskAuthorizationRule into its canonical unpadded base64url string representation.

func EnrollChallenge 

func EnrollChallenge(peerID string, ts int64) []byte

EnrollChallenge is the payload a bootstrap enrollee signs to prove possession of the private half of BootstrapEnrollRequest.public_key at POST /enroll, carried in that message's timestamp/challenge_signature fields. Binding the peer ID keeps a captured signature useless for any other peer; the domain prefix keeps it useless at any other endpoint.

func EnrollStatusChallenge 

func EnrollStatusChallenge(peerID string, ts int64) []byte

EnrollStatusChallenge is the payload a bootstrap enrollee signs to prove possession of the key it submitted at /enroll when polling GET /enroll/status. ts is unix milliseconds; the signature travels in the HeaderChallengeSignature header (unpadded base64url) alongside HeaderChallengeTimestamp.

func EnrollURI 

func EnrollURI(server, token string) string

EnrollURI builds the device enrollment URI for the given control plane base URL and bootstrap token.

func EvaluateTaskRules 

func EvaluateTaskRules(blocks []*TaskAuthorizationRule, req TaskRequestContext, now time.Time) error

EvaluateTaskRules enforces the intersection of all appended TaskAuthorizationRule blocks in a Biscuit token:

  • For each block, if expire_time is set and now > expire_time, the token is rejected.
  • For each block, at least one TaskRule in block.rules must match req; if block.rules is empty or no rule matches, the request is denied.

func EvaluateTaskRulesForDestination 

func EvaluateTaskRulesForDestination(blocks []*TaskAuthorizationRule, serviceType, serviceName string, now time.Time) error

EvaluateTaskRulesForDestination verifies that every appended TaskAuthorizationRule block in blocks is unexpired at now and contains at least one TaskRule whose allowed_services matches (serviceType, serviceName). Used by control-plane destination-level checks (e.g. POST /sts/token) where per-request HTTP method and path constraints have already been enforced by the egress node PEP.

func HTTPGrantKey 

func HTTPGrantKey(service string) (factName, svcType, key string)

HTTPGrantKey returns the fact a narrowed grant is minted as and the key its method and path facts are keyed by, for one allowed_services entry. The key is the term the plain granted_service_* fact would carry, so BaselineHTTPRules can derive that fact from it.

func HTTPMethodSyntaxPattern 

func HTTPMethodSyntaxPattern() string

HTTPMethodSyntaxPattern returns the regular expression string used to validate HTTP methods in PolicyRole.http and TaskOperation.allowed_methods.

func IsSafeRequestHTTPPath 

func IsSafeRequestHTTPPath(reqPath string) bool

IsSafeRequestHTTPPath reports whether reqPath is a normalized, leading-slash HTTP path free of dot segments ("." or ".."), URL-encoded dot/slash/backslash traversal sequences, query/fragment delimiters, and ASCII control characters.

func KeysResponsePayload 

func KeysResponsePayload(resp *KeysResponse) ([]byte, error)

KeysResponsePayload is the bytes each signature in a KeysResponse covers: the key set and the signing time, deterministically encoded, signatures cleared.

func LabelCheck 

func LabelCheck(required map[string]string) (biscuit.Check, error)

LabelCheck compiles a required label set (canonical, pre-validated with ValidateLabels) into a single fail-closed check satisfied only when the token carries *every* pair: `check if label("jurisdiction", "eu"), label("compliance", "gdpr")`.

The same rule serves a caller's requirement (X-Mesh-Required-Labels, an SDK's required labels) and an operator's egress floor (Egress.RequireLabels). A map gives one value per key, so neither can spell an alternative, and listing several pairs narrows the set of acceptable peers, as it does in every label selector a reader is likely to know. A disjunction would let a peer attesting the most permissive pair stand in for the rest, and a caller who read the list as a conjunction would send data to a peer that lacks a property they required, with no error to tell them.

A requirement and a floor are combined by adding one check each to the authorizer, which ANDs them; neither needs to know about the other.

func LabelFacts 

func LabelFacts(labels map[string]string) []biscuit.Fact

LabelFacts materializes a label set as one Datalog fact per key=value pair (see FactLabel). Keys are sorted for deterministic fact ordering. An empty set returns nil.

func LabelPatternsAllow 

func LabelPatternsAllow(patterns []string, labels map[string]string) error

LabelPatternsAllow reports whether patterns permit every declared label, naming the first one they do not. Keys are visited in order so the error for a given input is stable.

func LabelsContradict 

func LabelsContradict(required, claimed map[string]string) bool

LabelsContradict reports whether claimed states a *different* value for some key required names.

Absence is not contradiction, which is the whole distinction from LabelsSatisfy. Gossiped claims are a discovery hint and may carry only part of what a peer attests, so a peer silent on one pair may still satisfy all of them in its Biscuit. Only a conflicting value is grounds to skip such a peer before the gate has seen its attested facts; treating silence as failure would drop providers that are inside the boundary.

func LabelsSatisfy 

func LabelsSatisfy(required, claimed map[string]string) bool

LabelsSatisfy reports whether claimed carries every pair of required. It is the non-attested counterpart of LabelCheck, for the one provider class that has no Biscuit to check: a service local to this node, whose labels are its own configuration and so are complete. An empty requirement is satisfied by anything, so callers may pass one unconditionally.

func MarkerFact 

func MarkerFact(name string) biscuit.Fact

MarkerFact returns the presence-only fact name(true). The Biscuit grammar requires at least one term per predicate, so a fact whose only meaning is "this grant exists" carries MarkerTerm and is matched as name(true).

func MatchBindingMemberValue 

func MatchBindingMemberValue(candidates []string, pattern string) bool

MatchBindingMemberValue reports whether any candidate claim value satisfies pattern (exact match, "<prefix>*" starts_with, or "*<suffix>" ends_with).

func MatchHTTPPath 

func MatchHTTPPath(pattern, reqPath string) bool

MatchHTTPPath reports whether a path pattern from TaskOperation.allowed_paths ("/exact" or "/prefix/*") matches reqPath using the same semantics as BuildHTTPGrantFacts and BaselineSources.HTTPRules.

func MatchServicePattern 

func MatchServicePattern(pattern, reqType, reqName string) bool

MatchServicePattern reports whether a service pattern from TaskRule.allowed_services matches the target (reqType, reqName) using the exact same dot-anchored semantics as BuildServiceDatalogFact and BaselineSources.Rules:

  • "*" matches every non-empty (reqType, reqName)
  • "<type>://*" matches every non-empty reqName of <type>
  • "<type>://*.<suffix>" matches reqName ending with ".<suffix>"
  • "<type>://<prefix>.*" matches reqName starting with "<prefix>."
  • "<type>://<exact>" matches reqName == "<exact>"

func MatchTaskRule 

func MatchTaskRule(rule *TaskRule, req TaskRequestContext) bool

MatchTaskRule reports whether a single TaskRule permits req.

Fail-closed semantics:

  • allowed_services must have at least one entry matching (ServiceType, ServiceName).
  • If operation.allowed_tools is non-empty, ServiceType must be "mcp" and MCPTool must be in allowed_tools (unless AllowMCPStreamInit is true and MCPTool is empty during stream setup).
  • If operation.allowed_methods or operation.allowed_paths is non-empty, the request must carry HTTP facts (HasHTTP && Method != "" && Method != "CONNECT" && Path != ""), and every non-empty axis must match.
  • operation.allowed_permissions and rule.allowed_resources are opaque to the wire PEP and consumed by CloudTokenExchanger at egress.

func NodesCatalogChallenge 

func NodesCatalogChallenge(peerID string, ts int64) []byte

NodesCatalogChallenge is the payload an enrolled node signs with its identity key at POST /nodes/catalog in the HeaderChallengeTimestamp and HeaderChallengeSignature headers.

func NormalizeMeshHost 

func NormalizeMeshHost(host string) string

NormalizeMeshHost canonicalizes a hostname: it drops a trailing root dot and lowercases the name.

func OIDCClaimToFact 

func OIDCClaimToFact() map[string]string

OIDCClaimToFact returns a copy of the OIDC claims to Biscuit facts map. This ensures that the global map is immutable and thread-safe for concurrent readers.

func ParseDatalogRules 

func ParseDatalogRules(texts []string) ([]biscuit.Rule, error)

ParseDatalogRules parses PolicyConfigGetResponse.datalog_rules. One unparseable entry fails the whole set: a provider that silently dropped a rule would enforce a policy the operator never wrote.

func ParseEnrollURI 

func ParseEnrollURI(raw string) (server, token string, err error)

ParseEnrollURI extracts the control plane URL and bootstrap token from a device enrollment URI. The server must be an absolute URL that a device may trust as its control plane: https, or http to a loopback host.

func ParseLabelFlags 

func ParseLabelFlags(raw []string) (map[string]string, error)

ParseLabelFlags turns repeated "key=value" flag values into a label set that passes ValidateLabels. nil for none.

func ParseServiceTarget 

func ParseServiceTarget(target string) (svcType, svcName string)

ParseServiceTarget parses a service target string into its type (scheme) and name components.

Expected formats:

  • Hierarchical service URIs: "scheme://name" (e.g., "mcp://my_service") or "scheme://name/path" (e.g., "mcp://my_service/tool").
  • Target facts: "fact:value" (e.g., "group:backend" or "user:bob").
  • Wildcards: "*" (maps type to "*" and name to "*").

If no scheme/colon is present, it returns an empty string for the type and the full target as the name. No fallback namespace is applied; callers must be explicit.

func PeerKey 

func PeerKey(p peer.ID) []byte

PeerKey is the directory key under which a member announces where it is reached: "mesh:peer:<peer_id>". A find_peer is a lookup of this key.

func PoliciesChallenge 

func PoliciesChallenge(peerID string, ts int64) []byte

PoliciesChallenge is the payload an enrolled peer signs with its identity key at GET /policies in the HeaderChallengeTimestamp and HeaderChallengeSignature headers.

func PolicyRuleTexts 

func PolicyRuleTexts(rules []PolicyRule) []string

PolicyRuleTexts is the Datalog text of rules, one entry per rule.

func PublishFact 

func PublishFact(svcType, svcName string) biscuit.Fact

PublishFact is the fact a verifier adds to ask whether a credential grants serving a service: publish("<type>", "<name>").

func RecordTTL 

func RecordTTL(reprovide time.Duration) time.Duration

RecordTTL is how long a router keeps a record after its last announcement for a mesh that re-announces every reprovide: three intervals, so a provider that stopped without unpublishing leaves within it and two missed announcements do not unlist one that did not.

func RefreshChallenge 

func RefreshChallenge(peerID string, ts int64) []byte

RefreshChallenge is the payload an enrolled peer signs to prove possession of its identity key at POST /refresh, carried in TokenRefreshRequest's timestamp/challenge_signature fields alongside the expiring biscuit. Same shape as the other enrollment challenges: peer- and endpoint-bound, so a captured signature is useless anywhere else.

func RegisterChallenge 

func RegisterChallenge(peerID string, ts int64) []byte

RegisterChallenge is the payload an OIDC enrollee signs to prove possession of EnrollRequest.public_key at POST /register, carried in that message's timestamp/challenge_signature fields. The JWT says who is asking; this says they hold the key they are binding.

func RevocationsChallenge 

func RevocationsChallenge(peerID string, ts int64) []byte

RevocationsChallenge is the payload an enrolled peer signs with its identity key at GET /revocations in the HeaderChallengeTimestamp and HeaderChallengeSignature headers.

func RouterLeaseChallenge 

func RouterLeaseChallenge(peerID string, ts int64) []byte

RouterLeaseChallenge is the payload a router signs with its enrolled key at POST /routers/lease, carried in RouterLeaseRequest's timestamp/challenge_signature fields. The router's biscuit is not proof on its own: routers send it to every peer they authenticate.

func STSTokenChallenge 

func STSTokenChallenge(peerID string, ts int64) []byte

STSTokenChallenge is the payload an enrolled egress agentmesh-node signs with its identity key at POST /sts/token when asking the control plane to mint an ES256 border JWT for an outbound destination.

func ServiceKey 

func ServiceKey(t ServiceType, name string) ([]byte, error)

ServiceKey is the directory key of a service type, or of one named service of that type: "mesh:service:<type>" or "mesh:service:<type>:<name>".

func ServiceTypeToString 

func ServiceTypeToString(t ServiceType) (string, error)

ServiceTypeToString converts a ServiceType protobuf enum back to its standard string identifier.

func SignKeysResponse 

func SignKeysResponse(resp *KeysResponse, privateKeys []ed25519.PrivateKey, now time.Time) error

SignKeysResponse sets SignTime and one signature per key pair, so a receiver that trusts any key still valid on the control plane can verify the set. Private keys must be in the same order as resp.PublicKeys.

func SplitToolName 

func SplitToolName(toolName string) (targetService, originalToolName string, err error)

SplitToolName splits a fully qualified MCP tool name into its target service URI and the original tool name.

Expected format: "scheme://service/tool" (e.g., "mcp://my-service/my-tool"). If the input is empty or invalid, it returns an error. No default fallback is applied.

func TargetFactNames 

func TargetFactNames() []string

TargetFactNames returns the fact names an allowed_targets entry can use.

It is derived from the same source as TargetFactRules, which is the point: a target naming any other fact mints a granted_target_* fact that no target_fact will ever match, so the grant silently denies instead of failing at config time. Deriving both from one place keeps them from drifting apart.

func TokenExchangeChallenge 

func TokenExchangeChallenge(peerID string, ts int64) []byte

TokenExchangeChallenge is the payload an enrolled agentmesh-node signs with its identity key at POST /token/exchange to prove possession of the channel key that will carry the minted Delegated Session Biscuit.

func ValidateBindingMember 

func ValidateBindingMember(member string, role string) error

ValidateBindingMember checks a single PolicyBinding.members entry. It permits mesh:system:authenticated, exact "<prefix>:<value>" members, and a single leading "*<suffix>" or trailing "<prefix>*" wildcard on non-node prefixes. Bare "<prefix>:*" is rejected as a disguised mesh:system:authenticated, and values containing '"', '\', or control characters are rejected to prevent Datalog rule injection.

func ValidateControlPlaneTransport 

func ValidateControlPlaneTransport(rawURL string, allowInsecure bool) error

ValidateControlPlaneTransport accepts https://, accepts http:// only to a loopback host, and otherwise refuses unless allowInsecure is set by the operator (the --insecure-control-plane flag) for a network they trust.

func ValidateDirectoryKey 

func ValidateDirectoryKey(key []byte) error

ValidateDirectoryKey rejects anything but a sha256 multihash.

func ValidateDirectoryParameters 

func ValidateDirectoryParameters(replication int, reprovide time.Duration) error

ValidateDirectoryParameters checks the two numbers an operator sets.

func ValidateEgressDestination 

func ValidateEgressDestination(d *EgressDestination, roleNames map[string]bool) error

ValidateEgressDestination checks one PolicyConfig.egress entry. roleNames are the roles the same document defines, so served_by can be checked against them; a label entry is checked for form only.

func ValidateEgressName 

func ValidateEgressName(name string) error

ValidateEgressName checks a destination name: a lowercase hostname with no wildcard, port or path. It is the service name of egress://<name>, so it must also be valid there.

func ValidateEgressServicePattern 

func ValidateEgressServicePattern(svc string) error

ValidateEgressServicePattern checks an egress entry of allowed_services, allowed_publish or http.service. The generic service validator accepts a path and any case, which for the other types name a service that may exist; an egress name is a hostname, matched against a lowercase destination name, so a path, a port, uppercase or a trailing dot would compile to a grant that matches nothing. Entries of other types pass through unchanged.

func ValidateHTTPGrant 

func ValidateHTTPGrant(g *HTTPGrant, allowedServices []string) error

ValidateHTTPGrant checks one PolicyRole.http entry against the role's allowed_services: the entry must narrow a grant the role makes, written the same way, and its methods and paths must be well-formed.

func ValidateHTTPGrants 

func ValidateHTTPGrants(grants []*HTTPGrant, allowedServices []string) error

ValidateHTTPGrants validates all PolicyRole.http entries for a single role, ensuring each entry is valid and no two entries narrow the same service (which would otherwise combine their method and path facts across grants).

func ValidateLabelKey 

func ValidateLabelKey(key string) error

ValidateLabelKey checks that a label key is well-formed: 1-63 characters from [a-zA-Z0-9_.-].

func ValidateLabelPattern 

func ValidateLabelPattern(pattern string) error

ValidateLabelPattern checks one entry of a role's allowed_labels. The forms are "*" for any label at all, "key=*" for any value of a key, and "key=value" for one exact pair.

func ValidateLabelValue 

func ValidateLabelValue(value string) error

ValidateLabelValue checks that a label value is well-formed: non-empty, bounded length, and free of characters that collide with the wire-format separators (comma-separated key=value pairs) or control characters.

func ValidateLabels 

func ValidateLabels(labels map[string]string) error

ValidateLabels checks every key and value in a label set. Keys are visited in lexicographic order, so the error returned for a given input is deterministic and stable across runs (Go's map iteration is randomized).

func ValidateRoleName 

func ValidateRoleName(name string) error

ValidateRoleName checks that a PolicyRole.name is non-empty and free of characters that could break or inject Datalog rules.

func ValidateServiceFormat 

func ValidateServiceFormat(svc string) error

ValidateServiceFormat ensures the service string follows the explicit URI format.

func ValidateTARServicePattern 

func ValidateTARServicePattern(svc string) error

ValidateTARServicePattern validates an entry in TaskRule.allowed_services using the same dot-anchored service grammar as PolicyRole.allowed_services ("*", "<type>://*", "<type>://*.<suffix>", "<type>://<prefix>.*", "<type>://<exact>").

func ValidateTargetFormat 

func ValidateTargetFormat(target string) error

ValidateTargetFormat ensures the target string follows the explicit fact:value format.

func ValidateTaskAuthorizationRule 

func ValidateTaskAuthorizationRule(rule *TaskAuthorizationRule) error

ValidateTaskAuthorizationRule validates the structural limits and field grammars of a TaskAuthorizationRule. An empty rules list is valid and represents a fail-closed rule set that denies all requests.

func VerifyKeysResponse 

func VerifyKeysResponse(resp *KeysResponse, trusted []ed25519.PublicKey, now time.Time) ([]ed25519.PublicKey, error)

VerifyKeysResponse returns the key set if it is fresh and at least one listed key is already trusted and its signature verifies. A receiver with nothing trusted yet cannot verify anything and gets an error: enrollment, not /keys, is where the first key comes from.

The guarantee is exactly "a key this receiver already trusts vouches for this set". It defends against whoever answers the URL; it cannot defend against the holder of a trusted private key, who is the trust root by definition and could equally mint biscuits or sign events.

Types

type AWSAssumeRole 

type AWSAssumeRole struct {
	RoleArn string `protobuf:"bytes,1,opt,name=role_arn,json=roleArn,proto3" json:"role_arn,omitempty"`
	// Session policy template; the adapter intersects it with the TAR.
	SessionPolicy string `protobuf:"bytes,2,opt,name=session_policy,json=sessionPolicy,proto3" json:"session_policy,omitempty"`
	// contains filtered or unexported fields
}

func (*AWSAssumeRole) Descriptor deprecated 

func (*AWSAssumeRole) Descriptor() ([]byte, []int)

Deprecated: Use AWSAssumeRole.ProtoReflect.Descriptor instead.

func (*AWSAssumeRole) GetRoleArn 

func (x *AWSAssumeRole) GetRoleArn() string

func (*AWSAssumeRole) GetSessionPolicy 

func (x *AWSAssumeRole) GetSessionPolicy() string

func (*AWSAssumeRole) ProtoMessage 

func (*AWSAssumeRole) ProtoMessage()

func (*AWSAssumeRole) ProtoReflect 

func (x *AWSAssumeRole) ProtoReflect() protoreflect.Message

func (*AWSAssumeRole) Reset 

func (x *AWSAssumeRole) Reset()

func (*AWSAssumeRole) String 

func (x *AWSAssumeRole) String() string

type AdminStatusResponse 

type AdminStatusResponse struct {
	Users              []*User              `protobuf:"bytes,1,rep,name=users,proto3" json:"users,omitempty"`
	ActiveRouters      []*RouterLease       `protobuf:"bytes,2,rep,name=active_routers,json=activeRouters,proto3" json:"active_routers,omitempty"`
	EnrolledNodes      []*EnrolledNode      `protobuf:"bytes,3,rep,name=enrolled_nodes,json=enrolledNodes,proto3" json:"enrolled_nodes,omitempty"`
	EnrollmentRequests []*EnrollmentRequest `protobuf:"bytes,4,rep,name=enrollment_requests,json=enrollmentRequests,proto3" json:"enrollment_requests,omitempty"`
	BootstrapTokens    []*BootstrapToken    `protobuf:"bytes,5,rep,name=bootstrap_tokens,json=bootstrapTokens,proto3" json:"bootstrap_tokens,omitempty"`
	Policy             *PolicyConfig        `protobuf:"bytes,6,opt,name=policy,proto3" json:"policy,omitempty"`
	// Keyed by the reporting node's peer ID; admitted nodes only.
	NodeCatalog map[string]*NodeServices `` /* 168-byte string literal not displayed */
	// contains filtered or unexported fields
}

AdminStatusResponse answers GET /admin/status: everything the console shows an administrator, except expired nodes (see GET /user/nodes).

func (*AdminStatusResponse) Descriptor deprecated 

func (*AdminStatusResponse) Descriptor() ([]byte, []int)

Deprecated: Use AdminStatusResponse.ProtoReflect.Descriptor instead.

func (*AdminStatusResponse) GetActiveRouters 

func (x *AdminStatusResponse) GetActiveRouters() []*RouterLease

func (*AdminStatusResponse) GetBootstrapTokens 

func (x *AdminStatusResponse) GetBootstrapTokens() []*BootstrapToken

func (*AdminStatusResponse) GetEnrolledNodes 

func (x *AdminStatusResponse) GetEnrolledNodes() []*EnrolledNode

func (*AdminStatusResponse) GetEnrollmentRequests 

func (x *AdminStatusResponse) GetEnrollmentRequests() []*EnrollmentRequest

func (*AdminStatusResponse) GetNodeCatalog 

func (x *AdminStatusResponse) GetNodeCatalog() map[string]*NodeServices

func (*AdminStatusResponse) GetPolicy 

func (x *AdminStatusResponse) GetPolicy() *PolicyConfig

func (*AdminStatusResponse) GetUsers 

func (x *AdminStatusResponse) GetUsers() []*User

func (*AdminStatusResponse) ProtoMessage 

func (*AdminStatusResponse) ProtoMessage()

func (*AdminStatusResponse) ProtoReflect 

func (x *AdminStatusResponse) ProtoReflect() protoreflect.Message

func (*AdminStatusResponse) Reset 

func (x *AdminStatusResponse) Reset()

func (*AdminStatusResponse) String 

func (x *AdminStatusResponse) String() string

type Attenuation 

type Attenuation struct {
	Policies []string `yaml:"policies"`
	Checks   []string `yaml:"checks"`
	Rules    []string `yaml:"rules"`
}

type AuthFrame 

type AuthFrame struct {
	Biscuit       []byte `protobuf:"bytes,1,opt,name=biscuit,proto3" json:"biscuit,omitempty"`
	TargetService string `protobuf:"bytes,2,opt,name=target_service,json=targetService,proto3" json:"target_service,omitempty"` // Optional: specific service requested
	// contains filtered or unexported fields
}

func (*AuthFrame) Descriptor deprecated 

func (*AuthFrame) Descriptor() ([]byte, []int)

Deprecated: Use AuthFrame.ProtoReflect.Descriptor instead.

func (*AuthFrame) GetBiscuit 

func (x *AuthFrame) GetBiscuit() []byte

func (*AuthFrame) GetTargetService 

func (x *AuthFrame) GetTargetService() string

func (*AuthFrame) ProtoMessage 

func (*AuthFrame) ProtoMessage()

func (*AuthFrame) ProtoReflect 

func (x *AuthFrame) ProtoReflect() protoreflect.Message

func (*AuthFrame) Reset 

func (x *AuthFrame) Reset()

func (*AuthFrame) String 

func (x *AuthFrame) String() string

type AuthResponse 

type AuthResponse struct {
	Success bool   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
	Error   string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`     // populated only if success is false
	Biscuit []byte `protobuf:"bytes,3,opt,name=biscuit,proto3" json:"biscuit,omitempty"` // The server's own Biscuit token (for mutual auth)
	// contains filtered or unexported fields
}

func (*AuthResponse) Descriptor deprecated 

func (*AuthResponse) Descriptor() ([]byte, []int)

Deprecated: Use AuthResponse.ProtoReflect.Descriptor instead.

func (*AuthResponse) GetBiscuit 

func (x *AuthResponse) GetBiscuit() []byte

func (*AuthResponse) GetError 

func (x *AuthResponse) GetError() string

func (*AuthResponse) GetSuccess 

func (x *AuthResponse) GetSuccess() bool

func (*AuthResponse) ProtoMessage 

func (*AuthResponse) ProtoMessage()

func (*AuthResponse) ProtoReflect 

func (x *AuthResponse) ProtoReflect() protoreflect.Message

func (*AuthResponse) Reset 

func (x *AuthResponse) Reset()

func (*AuthResponse) String 

func (x *AuthResponse) String() string

type BootstrapEnrollRequest 

type BootstrapEnrollRequest struct {
	BootstrapToken string `protobuf:"bytes,1,opt,name=bootstrap_token,json=bootstrapToken,proto3" json:"bootstrap_token,omitempty"`
	PeerId         string `protobuf:"bytes,2,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	PublicKey      []byte `protobuf:"bytes,3,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
	RequestedRole  string `protobuf:"bytes,4,opt,name=requested_role,json=requestedRole,proto3" json:"requested_role,omitempty"`
	// Operator-declared labels; the admin approving the enrollment attests
	// them (see EnrollRequest.labels).
	Labels map[string]string `` /* 139-byte string literal not displayed */
	// Proof of possession of public_key's private half: challenge_unix_ms is
	// the caller's clock in unix milliseconds and challenge_signature signs
	// the UTF-8 bytes of "mesh:enroll:<peer_id>:<challenge_unix_ms>". Required,
	// and peer_id must be derived from public_key: this is what entitles a
	// repeated POST /enroll to re-fetch an existing enrollment's biscuit, so
	// a bootstrap token alone must never satisfy it.
	ChallengeUnixMs    int64  `protobuf:"varint,6,opt,name=challenge_unix_ms,json=challengeUnixMs,proto3" json:"challenge_unix_ms,omitempty"`
	ChallengeSignature []byte `protobuf:"bytes,7,opt,name=challenge_signature,json=challengeSignature,proto3" json:"challenge_signature,omitempty"`
	// contains filtered or unexported fields
}

func (*BootstrapEnrollRequest) Descriptor deprecated 

func (*BootstrapEnrollRequest) Descriptor() ([]byte, []int)

Deprecated: Use BootstrapEnrollRequest.ProtoReflect.Descriptor instead.

func (*BootstrapEnrollRequest) GetBootstrapToken 

func (x *BootstrapEnrollRequest) GetBootstrapToken() string

func (*BootstrapEnrollRequest) GetChallengeSignature 

func (x *BootstrapEnrollRequest) GetChallengeSignature() []byte

func (*BootstrapEnrollRequest) GetChallengeUnixMs 

func (x *BootstrapEnrollRequest) GetChallengeUnixMs() int64

func (*BootstrapEnrollRequest) GetLabels 

func (x *BootstrapEnrollRequest) GetLabels() map[string]string

func (*BootstrapEnrollRequest) GetPeerId 

func (x *BootstrapEnrollRequest) GetPeerId() string

func (*BootstrapEnrollRequest) GetPublicKey 

func (x *BootstrapEnrollRequest) GetPublicKey() []byte

func (*BootstrapEnrollRequest) GetRequestedRole 

func (x *BootstrapEnrollRequest) GetRequestedRole() string

func (*BootstrapEnrollRequest) ProtoMessage 

func (*BootstrapEnrollRequest) ProtoMessage()

func (*BootstrapEnrollRequest) ProtoReflect 

func (x *BootstrapEnrollRequest) ProtoReflect() protoreflect.Message

func (*BootstrapEnrollRequest) Reset 

func (x *BootstrapEnrollRequest) Reset()

func (*BootstrapEnrollRequest) String 

func (x *BootstrapEnrollRequest) String() string

type BootstrapEnrollResponse 

type BootstrapEnrollResponse struct {
	Status                EnrollmentStatus `protobuf:"varint,1,opt,name=status,proto3,enum=agentmesh.v1.EnrollmentStatus" json:"status,omitempty"`
	BiscuitToken          []byte           `protobuf:"bytes,2,opt,name=biscuit_token,json=biscuitToken,proto3" json:"biscuit_token,omitempty"`                         // Populated only if APPROVED
	PollIntervalSeconds   int32            `protobuf:"varint,3,opt,name=poll_interval_seconds,json=pollIntervalSeconds,proto3" json:"poll_interval_seconds,omitempty"` // Recommended polling wait time
	ErrorMessage          string           `protobuf:"bytes,4,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"`
	ControlPlanePublicKey []byte           `` // Populated only if APPROVED
	/* 128-byte string literal not displayed */
	RouterAddresses []string               `protobuf:"bytes,6,rep,name=router_addresses,json=routerAddresses,proto3" json:"router_addresses,omitempty"` // Populated only if APPROVED
	ExpireTime      *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`                // Populated only if APPROVED
	// contains filtered or unexported fields
}

BootstrapEnrollResponse answers POST /enroll and GET /enroll/status. Polling GET /enroll/status requires proof of possession of the key submitted at /enroll: alongside the `peer_id` query parameter, the caller sends the X-Mesh-Challenge-Ts header (unix milliseconds) and the X-Mesh-Challenge-Sig header (unpadded base64url signature over the UTF-8 bytes of "mesh:enroll-status:<peer_id>:<ts>").

func (*BootstrapEnrollResponse) Descriptor deprecated 

func (*BootstrapEnrollResponse) Descriptor() ([]byte, []int)

Deprecated: Use BootstrapEnrollResponse.ProtoReflect.Descriptor instead.

func (*BootstrapEnrollResponse) GetBiscuitToken 

func (x *BootstrapEnrollResponse) GetBiscuitToken() []byte

func (*BootstrapEnrollResponse) GetControlPlanePublicKey 

func (x *BootstrapEnrollResponse) GetControlPlanePublicKey() []byte

func (*BootstrapEnrollResponse) GetErrorMessage 

func (x *BootstrapEnrollResponse) GetErrorMessage() string

func (*BootstrapEnrollResponse) GetExpireTime 

func (x *BootstrapEnrollResponse) GetExpireTime() *timestamppb.Timestamp

func (*BootstrapEnrollResponse) GetPollIntervalSeconds 

func (x *BootstrapEnrollResponse) GetPollIntervalSeconds() int32

func (*BootstrapEnrollResponse) GetRouterAddresses 

func (x *BootstrapEnrollResponse) GetRouterAddresses() []string

func (*BootstrapEnrollResponse) GetStatus 

func (x *BootstrapEnrollResponse) GetStatus() EnrollmentStatus

func (*BootstrapEnrollResponse) ProtoMessage 

func (*BootstrapEnrollResponse) ProtoMessage()

func (*BootstrapEnrollResponse) ProtoReflect 

func (x *BootstrapEnrollResponse) ProtoReflect() protoreflect.Message

func (*BootstrapEnrollResponse) Reset 

func (x *BootstrapEnrollResponse) Reset()

func (*BootstrapEnrollResponse) String 

func (x *BootstrapEnrollResponse) String() string

type BootstrapToken 

type BootstrapToken struct {
	Id          string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	Role        string                 `protobuf:"bytes,2,opt,name=role,proto3" json:"role,omitempty"`
	OwnerId     string                 `protobuf:"bytes,3,opt,name=owner_id,json=ownerId,proto3" json:"owner_id,omitempty"`
	MaxUsages   int32                  `protobuf:"varint,4,opt,name=max_usages,json=maxUsages,proto3" json:"max_usages,omitempty"`
	UsagesCount int32                  `protobuf:"varint,5,opt,name=usages_count,json=usagesCount,proto3" json:"usages_count,omitempty"`
	Description string                 `protobuf:"bytes,6,opt,name=description,proto3" json:"description,omitempty"`
	CreateTime  *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty"`
	ExpireTime  *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	// Set when an operator revoked the token, which is distinct from expiry
	// or exhausted usages. Unset means never revoked.
	RevokeTime         *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=revoke_time,json=revokeTime,proto3" json:"revoke_time,omitempty"`
	AutonomousRecovery bool                   `protobuf:"varint,10,opt,name=autonomous_recovery,json=autonomousRecovery,proto3" json:"autonomous_recovery,omitempty"`
	Ephemeral          bool                   `protobuf:"varint,11,opt,name=ephemeral,proto3" json:"ephemeral,omitempty"`
	// contains filtered or unexported fields
}

BootstrapToken is a minted token as operators list it.

func (*BootstrapToken) Descriptor deprecated 

func (*BootstrapToken) Descriptor() ([]byte, []int)

Deprecated: Use BootstrapToken.ProtoReflect.Descriptor instead.

func (*BootstrapToken) GetAutonomousRecovery 

func (x *BootstrapToken) GetAutonomousRecovery() bool

func (*BootstrapToken) GetCreateTime 

func (x *BootstrapToken) GetCreateTime() *timestamppb.Timestamp

func (*BootstrapToken) GetDescription 

func (x *BootstrapToken) GetDescription() string

func (*BootstrapToken) GetEphemeral 

func (x *BootstrapToken) GetEphemeral() bool

func (*BootstrapToken) GetExpireTime 

func (x *BootstrapToken) GetExpireTime() *timestamppb.Timestamp

func (*BootstrapToken) GetId 

func (x *BootstrapToken) GetId() string

func (*BootstrapToken) GetMaxUsages 

func (x *BootstrapToken) GetMaxUsages() int32

func (*BootstrapToken) GetOwnerId 

func (x *BootstrapToken) GetOwnerId() string

func (*BootstrapToken) GetRevokeTime 

func (x *BootstrapToken) GetRevokeTime() *timestamppb.Timestamp

func (*BootstrapToken) GetRole 

func (x *BootstrapToken) GetRole() string

func (*BootstrapToken) GetUsagesCount 

func (x *BootstrapToken) GetUsagesCount() int32

func (*BootstrapToken) ProtoMessage 

func (*BootstrapToken) ProtoMessage()

func (*BootstrapToken) ProtoReflect 

func (x *BootstrapToken) ProtoReflect() protoreflect.Message

func (*BootstrapToken) Reset 

func (x *BootstrapToken) Reset()

func (*BootstrapToken) String 

func (x *BootstrapToken) String() string

type BootstrapTokenCreateRequest 

type BootstrapTokenCreateRequest struct {

	// Role the token enrolls into, e.g. "mesh:role:node". Required on the admin
	// endpoint; the user endpoint defaults it to "mesh:role:node".
	Role string `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
	// User the token is issued on behalf of. Honored by the user endpoint
	// only, and only for admins; defaults to the caller.
	OwnerId string `protobuf:"bytes,2,opt,name=owner_id,json=ownerId,proto3" json:"owner_id,omitempty"`
	// How long the token stays valid; unset or non-positive means 24.
	TtlHours int32 `protobuf:"varint,3,opt,name=ttl_hours,json=ttlHours,proto3" json:"ttl_hours,omitempty"`
	// How many enrollments the token admits; unset or non-positive means 1.
	MaxUsages int32 `protobuf:"varint,4,opt,name=max_usages,json=maxUsages,proto3" json:"max_usages,omitempty"`
	// Free-form operator note stored with the token.
	Description string `protobuf:"bytes,5,opt,name=description,proto3" json:"description,omitempty"`
	// Copied onto every node the token enrolls: such a node may still refresh
	// its credential after the control plane's signing key rotated past its
	// grace period, on proof of possession of its own key alone. Admin-only,
	// because a node that can always recover holds a credential that never
	// expires.
	AutonomousRecovery bool `protobuf:"varint,6,opt,name=autonomous_recovery,json=autonomousRecovery,proto3" json:"autonomous_recovery,omitempty"`
	// Copied onto every node the token enrolls: such a node is forgotten
	// soon after it falls silent (the control plane's
	// --ephemeral-node-retention, an hour by default) instead of being kept
	// for --node-retention. For members that come and go: a fleet in a scale
	// test, a probe, a CI job.
	Ephemeral bool `protobuf:"varint,7,opt,name=ephemeral,proto3" json:"ephemeral,omitempty"`
	// contains filtered or unexported fields
}

BootstrapTokenCreateRequest is the body of POST /admin/bootstrap-tokens (admin bearer) and POST /user/bootstrap-tokens (mesh user).

func (*BootstrapTokenCreateRequest) Descriptor deprecated 

func (*BootstrapTokenCreateRequest) Descriptor() ([]byte, []int)

Deprecated: Use BootstrapTokenCreateRequest.ProtoReflect.Descriptor instead.

func (*BootstrapTokenCreateRequest) GetAutonomousRecovery 

func (x *BootstrapTokenCreateRequest) GetAutonomousRecovery() bool

func (*BootstrapTokenCreateRequest) GetDescription 

func (x *BootstrapTokenCreateRequest) GetDescription() string

func (*BootstrapTokenCreateRequest) GetEphemeral 

func (x *BootstrapTokenCreateRequest) GetEphemeral() bool

func (*BootstrapTokenCreateRequest) GetMaxUsages 

func (x *BootstrapTokenCreateRequest) GetMaxUsages() int32

func (*BootstrapTokenCreateRequest) GetOwnerId 

func (x *BootstrapTokenCreateRequest) GetOwnerId() string

func (*BootstrapTokenCreateRequest) GetRole 

func (x *BootstrapTokenCreateRequest) GetRole() string

func (*BootstrapTokenCreateRequest) GetTtlHours 

func (x *BootstrapTokenCreateRequest) GetTtlHours() int32

func (*BootstrapTokenCreateRequest) ProtoMessage 

func (*BootstrapTokenCreateRequest) ProtoMessage()

func (*BootstrapTokenCreateRequest) ProtoReflect 

func (x *BootstrapTokenCreateRequest) ProtoReflect() protoreflect.Message

func (*BootstrapTokenCreateRequest) Reset 

func (x *BootstrapTokenCreateRequest) Reset()

func (*BootstrapTokenCreateRequest) String 

func (x *BootstrapTokenCreateRequest) String() string

type BootstrapTokenCreateResponse 

type BootstrapTokenCreateResponse struct {
	Id         string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	Token      string                 `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
	Role       string                 `protobuf:"bytes,3,opt,name=role,proto3" json:"role,omitempty"`
	OwnerId    string                 `protobuf:"bytes,4,opt,name=owner_id,json=ownerId,proto3" json:"owner_id,omitempty"`
	ExpireTime *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	// contains filtered or unexported fields
}

BootstrapTokenCreateResponse is returned (201) when a token is minted. token is the plaintext and is shown exactly once; the control plane keeps only its hash, which is also the id.

func (*BootstrapTokenCreateResponse) Descriptor deprecated 

func (*BootstrapTokenCreateResponse) Descriptor() ([]byte, []int)

Deprecated: Use BootstrapTokenCreateResponse.ProtoReflect.Descriptor instead.

func (*BootstrapTokenCreateResponse) GetExpireTime 

func (x *BootstrapTokenCreateResponse) GetExpireTime() *timestamppb.Timestamp

func (*BootstrapTokenCreateResponse) GetId 

func (x *BootstrapTokenCreateResponse) GetId() string

func (*BootstrapTokenCreateResponse) GetOwnerId 

func (x *BootstrapTokenCreateResponse) GetOwnerId() string

func (*BootstrapTokenCreateResponse) GetRole 

func (x *BootstrapTokenCreateResponse) GetRole() string

func (*BootstrapTokenCreateResponse) GetToken 

func (x *BootstrapTokenCreateResponse) GetToken() string

func (*BootstrapTokenCreateResponse) ProtoMessage 

func (*BootstrapTokenCreateResponse) ProtoMessage()

func (*BootstrapTokenCreateResponse) ProtoReflect 

func (x *BootstrapTokenCreateResponse) ProtoReflect() protoreflect.Message

func (*BootstrapTokenCreateResponse) Reset 

func (x *BootstrapTokenCreateResponse) Reset()

func (*BootstrapTokenCreateResponse) String 

func (x *BootstrapTokenCreateResponse) String() string

type BootstrapTokenListResponse 

type BootstrapTokenListResponse struct {
	Tokens []*BootstrapToken `protobuf:"bytes,1,rep,name=tokens,proto3" json:"tokens,omitempty"`
	// contains filtered or unexported fields
}

func (*BootstrapTokenListResponse) Descriptor deprecated 

func (*BootstrapTokenListResponse) Descriptor() ([]byte, []int)

Deprecated: Use BootstrapTokenListResponse.ProtoReflect.Descriptor instead.

func (*BootstrapTokenListResponse) GetTokens 

func (x *BootstrapTokenListResponse) GetTokens() []*BootstrapToken

func (*BootstrapTokenListResponse) ProtoMessage 

func (*BootstrapTokenListResponse) ProtoMessage()

func (*BootstrapTokenListResponse) ProtoReflect 

func (x *BootstrapTokenListResponse) ProtoReflect() protoreflect.Message

func (*BootstrapTokenListResponse) Reset 

func (x *BootstrapTokenListResponse) Reset()

func (*BootstrapTokenListResponse) String 

func (x *BootstrapTokenListResponse) String() string

type CommandBackend 

type CommandBackend struct {
	Command []string          `protobuf:"bytes,1,rep,name=command,proto3" json:"command,omitempty"`
	Env     map[string]string `` /* 133-byte string literal not displayed */
	// contains filtered or unexported fields
}

func (*CommandBackend) Descriptor deprecated 

func (*CommandBackend) Descriptor() ([]byte, []int)

Deprecated: Use CommandBackend.ProtoReflect.Descriptor instead.

func (*CommandBackend) GetCommand 

func (x *CommandBackend) GetCommand() []string

func (*CommandBackend) GetEnv 

func (x *CommandBackend) GetEnv() map[string]string

func (*CommandBackend) ProtoMessage 

func (*CommandBackend) ProtoMessage()

func (*CommandBackend) ProtoReflect 

func (x *CommandBackend) ProtoReflect() protoreflect.Message

func (*CommandBackend) Reset 

func (x *CommandBackend) Reset()

func (*CommandBackend) String 

func (x *CommandBackend) String() string

type ControlPlaneInfoResponse 

type ControlPlaneInfoResponse struct {
	OidcIssuer string `protobuf:"bytes,1,opt,name=oidc_issuer,json=oidcIssuer,proto3" json:"oidc_issuer,omitempty"`
	ClientId   string `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	Audience   string `protobuf:"bytes,3,opt,name=audience,proto3" json:"audience,omitempty"`
	// The addresses of every router with a live lease, one multiaddr per
	// address, each ending in the router's peer ID. The same routers as
	// routers, flattened; kept for members that only need something to dial.
	RouterAddresses []string `protobuf:"bytes,4,rep,name=router_addresses,json=routerAddresses,proto3" json:"router_addresses,omitempty"`
	// The complete set of currently banned peer IDs. Consumers reconcile their
	// local blocklist against this list rather than merging into it, so that a
	// peer the control plane no longer bans is unbanned everywhere without
	// needing an event of its own. MeshEvent_BANNED stays the fast path for
	// sub-second eviction; this is how a node that restarted or was offline
	// when the event was published catches up.
	BannedPeerIds []string `protobuf:"bytes,5,rep,name=banned_peer_ids,json=bannedPeerIds,proto3" json:"banned_peer_ids,omitempty"`
	// Every router with a live lease, with what a member needs to choose
	// among them: its attested labels, to select or prefer routers by
	// placement, and its load as of its last lease, to prefer the ones with
	// room.
	Routers []*RouterInfo `protobuf:"bytes,6,rep,name=routers,proto3" json:"routers,omitempty"`
	// How the mesh keeps its directory. Members and routers read these here
	// and nowhere else, so they agree without configuration of their own; a
	// control plane that leaves it unset leaves them on the defaults the
	// api package names.
	Directory *DirectoryParameters `protobuf:"bytes,7,opt,name=directory,proto3" json:"directory,omitempty"`
	// contains filtered or unexported fields
}

func (*ControlPlaneInfoResponse) Descriptor deprecated 

func (*ControlPlaneInfoResponse) Descriptor() ([]byte, []int)

Deprecated: Use ControlPlaneInfoResponse.ProtoReflect.Descriptor instead.

func (*ControlPlaneInfoResponse) GetAudience 

func (x *ControlPlaneInfoResponse) GetAudience() string

func (*ControlPlaneInfoResponse) GetBannedPeerIds 

func (x *ControlPlaneInfoResponse) GetBannedPeerIds() []string

func (*ControlPlaneInfoResponse) GetClientId 

func (x *ControlPlaneInfoResponse) GetClientId() string

func (*ControlPlaneInfoResponse) GetDirectory 

func (x *ControlPlaneInfoResponse) GetDirectory() *DirectoryParameters

func (*ControlPlaneInfoResponse) GetOidcIssuer 

func (x *ControlPlaneInfoResponse) GetOidcIssuer() string

func (*ControlPlaneInfoResponse) GetRouterAddresses 

func (x *ControlPlaneInfoResponse) GetRouterAddresses() []string

func (*ControlPlaneInfoResponse) GetRouters 

func (x *ControlPlaneInfoResponse) GetRouters() []*RouterInfo

func (*ControlPlaneInfoResponse) ProtoMessage 

func (*ControlPlaneInfoResponse) ProtoMessage()

func (*ControlPlaneInfoResponse) ProtoReflect 

func (x *ControlPlaneInfoResponse) ProtoReflect() protoreflect.Message

func (*ControlPlaneInfoResponse) Reset 

func (x *ControlPlaneInfoResponse) Reset()

func (*ControlPlaneInfoResponse) String 

func (x *ControlPlaneInfoResponse) String() string

type CredentialBroker 

type CredentialBroker struct {

	// Types that are valid to be assigned to Kind:
	//
	//	*CredentialBroker_StaticSecret
	//	*CredentialBroker_OidcFederation
	//	*CredentialBroker_AwsAssumeRole
	//	*CredentialBroker_PlatformIdentity
	Kind isCredentialBroker_Kind `protobuf_oneof:"kind"`
	// contains filtered or unexported fields
}

func (*CredentialBroker) Descriptor deprecated 

func (*CredentialBroker) Descriptor() ([]byte, []int)

Deprecated: Use CredentialBroker.ProtoReflect.Descriptor instead.

func (*CredentialBroker) GetAwsAssumeRole 

func (x *CredentialBroker) GetAwsAssumeRole() *AWSAssumeRole

func (*CredentialBroker) GetKind 

func (x *CredentialBroker) GetKind() isCredentialBroker_Kind

func (*CredentialBroker) GetOidcFederation 

func (x *CredentialBroker) GetOidcFederation() *OIDCFederation

func (*CredentialBroker) GetPlatformIdentity 

func (x *CredentialBroker) GetPlatformIdentity() *PlatformIdentity

func (*CredentialBroker) GetStaticSecret 

func (x *CredentialBroker) GetStaticSecret() string

func (*CredentialBroker) ProtoMessage 

func (*CredentialBroker) ProtoMessage()

func (*CredentialBroker) ProtoReflect 

func (x *CredentialBroker) ProtoReflect() protoreflect.Message

func (*CredentialBroker) Reset 

func (x *CredentialBroker) Reset()

func (*CredentialBroker) String 

func (x *CredentialBroker) String() string

type CredentialBroker_AwsAssumeRole 

type CredentialBroker_AwsAssumeRole struct {
	AwsAssumeRole *AWSAssumeRole `protobuf:"bytes,3,opt,name=aws_assume_role,json=awsAssumeRole,proto3,oneof"`
}

type CredentialBroker_OidcFederation 

type CredentialBroker_OidcFederation struct {
	OidcFederation *OIDCFederation `protobuf:"bytes,2,opt,name=oidc_federation,json=oidcFederation,proto3,oneof"`
}

type CredentialBroker_PlatformIdentity 

type CredentialBroker_PlatformIdentity struct {
	// The node's own platform identity (GKE Workload Identity, instance
	// metadata). Only for nodes that run inside the provider.
	PlatformIdentity *PlatformIdentity `protobuf:"bytes,4,opt,name=platform_identity,json=platformIdentity,proto3,oneof"`
}

type CredentialBroker_StaticSecret 

type CredentialBroker_StaticSecret struct {
	// Name of a file in the node's secrets directory ("TOKEN" or "user:pass").
	StaticSecret string `protobuf:"bytes,1,opt,name=static_secret,json=staticSecret,proto3,oneof"`
}

type DatalogSources 

type DatalogSources struct {
	// Policies are the service allow policies (BaselinePolicies).
	Policies []string `json:"policies"`
	// PublishPolicies decide whether a member may serve a service (PublishPolicies).
	PublishPolicies []string `json:"publish_policies"`
	// Rules derive allow_network_target from target grants (BaselineRules).
	Rules []string `json:"rules"`
	// HTTPRules derive service grants from narrowed grants (BaselineHTTPRules).
	HTTPRules []string `json:"http_rules"`
	// TargetFactRules map identity facts to target_fact (TargetFactRules).
	TargetFactRules []string `json:"target_fact_rules"`
	// ReplayCheck is BaselineReplayCheck.
	ReplayCheck string `json:"replay_check"`
	// TargetCheck is BaselineTargetCheck.
	TargetCheck string `json:"target_check"`
	// TimeCheck is ControlPlaneStaticTimeCheck.
	TimeCheck string `json:"time_check"`
	// AllowIfTrue is AllowIfTruePolicy.
	AllowIfTrue string `json:"allow_if_true"`
}

DatalogSources is the source text of the baseline Datalog, one string per item, in the form every Biscuit implementation parses.

type DirectoryFindPeer 

type DirectoryFindPeer struct {
	PeerId string `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	// contains filtered or unexported fields
}

DirectoryFindPeer asks where peer_id is reached.

func (*DirectoryFindPeer) Descriptor deprecated 

func (*DirectoryFindPeer) Descriptor() ([]byte, []int)

Deprecated: Use DirectoryFindPeer.ProtoReflect.Descriptor instead.

func (*DirectoryFindPeer) GetPeerId 

func (x *DirectoryFindPeer) GetPeerId() string

func (*DirectoryFindPeer) ProtoMessage 

func (*DirectoryFindPeer) ProtoMessage()

func (*DirectoryFindPeer) ProtoReflect 

func (x *DirectoryFindPeer) ProtoReflect() protoreflect.Message

func (*DirectoryFindPeer) Reset 

func (x *DirectoryFindPeer) Reset()

func (*DirectoryFindPeer) String 

func (x *DirectoryFindPeer) String() string

type DirectoryFindProviders 

type DirectoryFindProviders struct {
	Key   []byte `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
	Limit uint32 `protobuf:"varint,2,opt,name=limit,proto3" json:"limit,omitempty"`
	// contains filtered or unexported fields
}

DirectoryFindProviders asks for up to limit providers of key.

func (*DirectoryFindProviders) Descriptor deprecated 

func (*DirectoryFindProviders) Descriptor() ([]byte, []int)

Deprecated: Use DirectoryFindProviders.ProtoReflect.Descriptor instead.

func (*DirectoryFindProviders) GetKey 

func (x *DirectoryFindProviders) GetKey() []byte

func (*DirectoryFindProviders) GetLimit 

func (x *DirectoryFindProviders) GetLimit() uint32

func (*DirectoryFindProviders) ProtoMessage 

func (*DirectoryFindProviders) ProtoMessage()

func (*DirectoryFindProviders) ProtoReflect 

func (x *DirectoryFindProviders) ProtoReflect() protoreflect.Message

func (*DirectoryFindProviders) Reset 

func (x *DirectoryFindProviders) Reset()

func (*DirectoryFindProviders) String 

func (x *DirectoryFindProviders) String() string

type DirectoryParameters 

type DirectoryParameters struct {

	// How many routers each record a member announces is placed on, the
	// closest to its key, besides the router that took the announcement.
	// Routers read it; a member asks the routers it holds.
	Replication int32 `protobuf:"varint,1,opt,name=replication,proto3" json:"replication,omitempty"`
	// How often a member re-announces each service it publishes.
	ReprovideInterval *durationpb.Duration `protobuf:"bytes,2,opt,name=reprovide_interval,json=reprovideInterval,proto3" json:"reprovide_interval,omitempty"`
	// How long a router keeps a record after its last announcement: three
	// reprovide intervals, so a provider that stopped without unpublishing
	// leaves within it and two missed announcements do not unlist one that
	// did not.
	RecordTtl *durationpb.Duration `protobuf:"bytes,3,opt,name=record_ttl,json=recordTtl,proto3" json:"record_ttl,omitempty"`
	// contains filtered or unexported fields
}

DirectoryParameters are the settings of the DHT the routers serve, set once per mesh on the control plane (agentmesh-control-plane --dht-replication, --dht-reprovide-interval) and published on /info.

func NewDirectoryParameters 

func NewDirectoryParameters(replication int, reprovide time.Duration) *DirectoryParameters

NewDirectoryParameters is the message a control plane publishes for a replication factor and a reprovide interval, the TTL derived.

func (*DirectoryParameters) Descriptor deprecated 

func (*DirectoryParameters) Descriptor() ([]byte, []int)

Deprecated: Use DirectoryParameters.ProtoReflect.Descriptor instead.

func (*DirectoryParameters) GetRecordTtl 

func (x *DirectoryParameters) GetRecordTtl() *durationpb.Duration

func (*DirectoryParameters) GetReplication 

func (x *DirectoryParameters) GetReplication() int32

func (*DirectoryParameters) GetReprovideInterval 

func (x *DirectoryParameters) GetReprovideInterval() *durationpb.Duration

func (*DirectoryParameters) ProtoMessage 

func (*DirectoryParameters) ProtoMessage()

func (*DirectoryParameters) ProtoReflect 

func (x *DirectoryParameters) ProtoReflect() protoreflect.Message

func (*DirectoryParameters) Reset 

func (x *DirectoryParameters) Reset()

func (*DirectoryParameters) String 

func (x *DirectoryParameters) String() string

type DirectoryProvide 

type DirectoryProvide struct {
	Key      []byte   `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
	Addrs    []string `protobuf:"bytes,2,rep,name=addrs,proto3" json:"addrs,omitempty"`
	Provider string   `protobuf:"bytes,3,opt,name=provider,proto3" json:"provider,omitempty"`
	Service  string   `protobuf:"bytes,4,opt,name=service,proto3" json:"service,omitempty"`
	// contains filtered or unexported fields
}

DirectoryProvide announces the sender as a provider of key, reached at addrs. A key is a sha256 multihash: of "mesh:service:<type>[:<name>]" for a service, of "mesh:peer:<peer_id>" for the member itself. A record lives for the mesh's record TTL after its last announcement; announcing it again replaces its addresses. service names the service a record is about, "<type>://<name>", and the router refuses a key that is not that service's by name or by type; a record naming no service is the member's own, under its peer key. provider is set only between routers, by the router that holds the member, and refused from anyone else: a member can only announce itself.

func (*DirectoryProvide) Descriptor deprecated 

func (*DirectoryProvide) Descriptor() ([]byte, []int)

Deprecated: Use DirectoryProvide.ProtoReflect.Descriptor instead.

func (*DirectoryProvide) GetAddrs 

func (x *DirectoryProvide) GetAddrs() []string

func (*DirectoryProvide) GetKey 

func (x *DirectoryProvide) GetKey() []byte

func (*DirectoryProvide) GetProvider 

func (x *DirectoryProvide) GetProvider() string

func (*DirectoryProvide) GetService 

func (x *DirectoryProvide) GetService() string

func (*DirectoryProvide) ProtoMessage 

func (*DirectoryProvide) ProtoMessage()

func (*DirectoryProvide) ProtoReflect 

func (x *DirectoryProvide) ProtoReflect() protoreflect.Message

func (*DirectoryProvide) Reset 

func (x *DirectoryProvide) Reset()

func (*DirectoryProvide) String 

func (x *DirectoryProvide) String() string

type DirectoryRequest 

type DirectoryRequest struct {

	// Types that are valid to be assigned to Request:
	//
	//	*DirectoryRequest_Provide
	//	*DirectoryRequest_FindProviders
	//	*DirectoryRequest_FindPeer
	//	*DirectoryRequest_Withdraw
	Request isDirectoryRequest_Request `protobuf_oneof:"request"`
	// contains filtered or unexported fields
}

DirectoryRequest is what a member asks a router it is attached to over /mesh/directory/1.0.0: one request per stream, answered with one DirectoryResponse. The member keeps no DHT of its own; the router keeps its records, places them on the routers closest to each key, and answers a lookup from its own records and those routers'. A router sends the same message to another router to place a member's record, or its withdrawal, on it.

func (*DirectoryRequest) Descriptor deprecated 

func (*DirectoryRequest) Descriptor() ([]byte, []int)

Deprecated: Use DirectoryRequest.ProtoReflect.Descriptor instead.

func (*DirectoryRequest) GetFindPeer 

func (x *DirectoryRequest) GetFindPeer() *DirectoryFindPeer

func (*DirectoryRequest) GetFindProviders 

func (x *DirectoryRequest) GetFindProviders() *DirectoryFindProviders

func (*DirectoryRequest) GetProvide 

func (x *DirectoryRequest) GetProvide() *DirectoryProvide

func (*DirectoryRequest) GetRequest 

func (x *DirectoryRequest) GetRequest() isDirectoryRequest_Request

func (*DirectoryRequest) GetWithdraw 

func (x *DirectoryRequest) GetWithdraw() *DirectoryWithdraw

func (*DirectoryRequest) ProtoMessage 

func (*DirectoryRequest) ProtoMessage()

func (*DirectoryRequest) ProtoReflect 

func (x *DirectoryRequest) ProtoReflect() protoreflect.Message

func (*DirectoryRequest) Reset 

func (x *DirectoryRequest) Reset()

func (*DirectoryRequest) String 

func (x *DirectoryRequest) String() string

type DirectoryRequest_FindPeer 

type DirectoryRequest_FindPeer struct {
	FindPeer *DirectoryFindPeer `protobuf:"bytes,3,opt,name=find_peer,json=findPeer,proto3,oneof"`
}

type DirectoryRequest_FindProviders 

type DirectoryRequest_FindProviders struct {
	FindProviders *DirectoryFindProviders `protobuf:"bytes,2,opt,name=find_providers,json=findProviders,proto3,oneof"`
}

type DirectoryRequest_Provide 

type DirectoryRequest_Provide struct {
	Provide *DirectoryProvide `protobuf:"bytes,1,opt,name=provide,proto3,oneof"`
}

type DirectoryRequest_Withdraw 

type DirectoryRequest_Withdraw struct {
	Withdraw *DirectoryWithdraw `protobuf:"bytes,4,opt,name=withdraw,proto3,oneof"`
}

type DirectoryResponse 

type DirectoryResponse struct {
	Providers []*PeerRecord `protobuf:"bytes,1,rep,name=providers,proto3" json:"providers,omitempty"`
	Peer      *PeerRecord   `protobuf:"bytes,2,opt,name=peer,proto3" json:"peer,omitempty"`
	Error     string        `protobuf:"bytes,3,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

DirectoryResponse answers one DirectoryRequest. providers answers find_providers; peer answers find_peer, unset when nobody knows the peer; error is set when the router could not run the request.

func (*DirectoryResponse) Descriptor deprecated 

func (*DirectoryResponse) Descriptor() ([]byte, []int)

Deprecated: Use DirectoryResponse.ProtoReflect.Descriptor instead.

func (*DirectoryResponse) GetError 

func (x *DirectoryResponse) GetError() string

func (*DirectoryResponse) GetPeer 

func (x *DirectoryResponse) GetPeer() *PeerRecord

func (*DirectoryResponse) GetProviders 

func (x *DirectoryResponse) GetProviders() []*PeerRecord

func (*DirectoryResponse) ProtoMessage 

func (*DirectoryResponse) ProtoMessage()

func (*DirectoryResponse) ProtoReflect 

func (x *DirectoryResponse) ProtoReflect() protoreflect.Message

func (*DirectoryResponse) Reset 

func (x *DirectoryResponse) Reset()

func (*DirectoryResponse) String 

func (x *DirectoryResponse) String() string

type DirectorySettings 

type DirectorySettings struct {
	Replication int
	Reprovide   time.Duration
	RecordTTL   time.Duration
}

DirectorySettings are the directory parameters as a member or router applies them.

func DefaultDirectorySettings 

func DefaultDirectorySettings() DirectorySettings

DefaultDirectorySettings is what a member or router runs on when the control plane publishes no directory parameters.

func DirectorySettingsFrom 

func DirectorySettingsFrom(p *DirectoryParameters) DirectorySettings

DirectorySettingsFrom reads the parameters a control plane published, with the default for each it left unset or unusable, so a member or router never runs with a zero.

type DirectoryWithdraw 

type DirectoryWithdraw struct {
	Key      []byte `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
	Provider string `protobuf:"bytes,2,opt,name=provider,proto3" json:"provider,omitempty"`
	// contains filtered or unexported fields
}

DirectoryWithdraw removes the sender's record under key, from the router asked and from the routers closest to the key: what a member sends when it stops a service or leaves the mesh, so that callers do not find it until the record would have expired. provider is as in DirectoryProvide.

func (*DirectoryWithdraw) Descriptor deprecated 

func (*DirectoryWithdraw) Descriptor() ([]byte, []int)

Deprecated: Use DirectoryWithdraw.ProtoReflect.Descriptor instead.

func (*DirectoryWithdraw) GetKey 

func (x *DirectoryWithdraw) GetKey() []byte

func (*DirectoryWithdraw) GetProvider 

func (x *DirectoryWithdraw) GetProvider() string

func (*DirectoryWithdraw) ProtoMessage 

func (*DirectoryWithdraw) ProtoMessage()

func (*DirectoryWithdraw) ProtoReflect 

func (x *DirectoryWithdraw) ProtoReflect() protoreflect.Message

func (*DirectoryWithdraw) Reset 

func (x *DirectoryWithdraw) Reset()

func (*DirectoryWithdraw) String 

func (x *DirectoryWithdraw) String() string

type DiscoveredProvider 

type DiscoveredProvider struct {
	PeerId         string `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	LocalProxyUrl  string `protobuf:"bytes,2,opt,name=local_proxy_url,json=localProxyUrl,proto3" json:"local_proxy_url,omitempty"`
	SrvName        string `protobuf:"bytes,3,opt,name=srv_name,json=srvName,proto3" json:"srv_name,omitempty"`
	SrvDescription string `protobuf:"bytes,4,opt,name=srv_description,json=srvDescription,proto3" json:"srv_description,omitempty"`
	// contains filtered or unexported fields
}

func (*DiscoveredProvider) Descriptor deprecated 

func (*DiscoveredProvider) Descriptor() ([]byte, []int)

Deprecated: Use DiscoveredProvider.ProtoReflect.Descriptor instead.

func (*DiscoveredProvider) GetLocalProxyUrl 

func (x *DiscoveredProvider) GetLocalProxyUrl() string

func (*DiscoveredProvider) GetPeerId 

func (x *DiscoveredProvider) GetPeerId() string

func (*DiscoveredProvider) GetSrvDescription 

func (x *DiscoveredProvider) GetSrvDescription() string

func (*DiscoveredProvider) GetSrvName 

func (x *DiscoveredProvider) GetSrvName() string

func (*DiscoveredProvider) ProtoMessage 

func (*DiscoveredProvider) ProtoMessage()

func (*DiscoveredProvider) ProtoReflect 

func (x *DiscoveredProvider) ProtoReflect() protoreflect.Message

func (*DiscoveredProvider) Reset 

func (x *DiscoveredProvider) Reset()

func (*DiscoveredProvider) String 

func (x *DiscoveredProvider) String() string

type Egress 

type Egress struct {
	// RequireLabels is a floor every remote provider must attest before this
	// node will send it anything, whatever the caller asked for. Absent means
	// no floor, which is the historical behaviour: the requirement is then
	// whatever the caller supplied, and a caller that supplies nothing is
	// unconstrained.
	//
	// Every pair must hold, as for a caller's requirement (see LabelCheck). A
	// map gives one value per key, so a floor cannot express alternatives —
	// that is the point: a floor with alternatives would let the weakest of
	// them stand in for the rest.
	//
	// A floor naming a label no peer attests reaches nothing, which is a
	// usable egress kill switch.
	RequireLabels map[string]string `yaml:"require_labels,omitempty"`
}

Egress is the operator's outbound policy: what this node demands of the peers it talks to. Attenuation is the mirror of it — what this node demands of the peers that talk to *it* — and the two are deliberately separate blocks because they answer opposite questions.

type EgressAssignmentsRequest 

type EgressAssignmentsRequest struct {
	// contains filtered or unexported fields
}

func (*EgressAssignmentsRequest) Descriptor deprecated 

func (*EgressAssignmentsRequest) Descriptor() ([]byte, []int)

Deprecated: Use EgressAssignmentsRequest.ProtoReflect.Descriptor instead.

func (*EgressAssignmentsRequest) ProtoMessage 

func (*EgressAssignmentsRequest) ProtoMessage()

func (*EgressAssignmentsRequest) ProtoReflect 

func (x *EgressAssignmentsRequest) ProtoReflect() protoreflect.Message

func (*EgressAssignmentsRequest) Reset 

func (x *EgressAssignmentsRequest) Reset()

func (*EgressAssignmentsRequest) String 

func (x *EgressAssignmentsRequest) String() string

type EgressAssignmentsResponse 

type EgressAssignmentsResponse struct {
	Egress []*EgressDestination `protobuf:"bytes,1,rep,name=egress,proto3" json:"egress,omitempty"`
	// contains filtered or unexported fields
}

EgressAssignmentsResponse answers GET /egress for a mesh member holding a biscuit: the destinations whose served_by selects that node. It is a separate endpoint from GET /policies so that a node predating it keeps syncing rules unchanged.

func (*EgressAssignmentsResponse) Descriptor deprecated 

func (*EgressAssignmentsResponse) Descriptor() ([]byte, []int)

Deprecated: Use EgressAssignmentsResponse.ProtoReflect.Descriptor instead.

func (*EgressAssignmentsResponse) GetEgress 

func (x *EgressAssignmentsResponse) GetEgress() []*EgressDestination

func (*EgressAssignmentsResponse) ProtoMessage 

func (*EgressAssignmentsResponse) ProtoMessage()

func (*EgressAssignmentsResponse) ProtoReflect 

func (x *EgressAssignmentsResponse) ProtoReflect() protoreflect.Message

func (*EgressAssignmentsResponse) Reset 

func (x *EgressAssignmentsResponse) Reset()

func (*EgressAssignmentsResponse) String 

func (x *EgressAssignmentsResponse) String() string

type EgressDestination 

type EgressDestination struct {

	// The destination hostname, lowercase, without a port or a path. It is the
	// service name in grants (egress://<name>) and the DHT key.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Where the serving node forwards requests. Optional; https://<name> when
	// empty. Must not carry a credential.
	TargetUrl string `protobuf:"bytes,2,opt,name=target_url,json=targetUrl,proto3" json:"target_url,omitempty"`
	// Name of the credential the serving node presents upstream, resolved by
	// the node from its secrets directory. Shorthand for broker.static_secret.
	// Never a value: secret material does not travel through this API.
	Credential string `protobuf:"bytes,3,opt,name=credential,proto3" json:"credential,omitempty"`
	// Role names or key=value labels selecting the nodes that serve this
	// destination. A node matches when any entry names one of its roles or
	// labels. The control plane also grants the destination to the selected
	// nodes, so the serving node authorizes local requests with its own
	// credential; other callers need the grant on their own role.
	ServedBy []string `protobuf:"bytes,4,rep,name=served_by,json=servedBy,proto3" json:"served_by,omitempty"`
	// Pluggable credential broker for the destination.
	Broker *CredentialBroker `protobuf:"bytes,5,opt,name=broker,proto3" json:"broker,omitempty"`
	// Content inspection the egress node applies. Destination policy: a TAR
	// cannot disable it or choose another inspector.
	Inspection *Inspection `protobuf:"bytes,6,opt,name=inspection,proto3" json:"inspection,omitempty"`
	// HTTP (default): the node terminates TLS, brokers the credential and
	// inspects. TCP: a named CONNECT tunnel, L4 policy only.
	Mode EgressMode `protobuf:"varint,7,opt,name=mode,proto3,enum=agentmesh.v1.EgressMode" json:"mode,omitempty"`
	// TCP mode: destination ports a tunnel may open. Empty denies every tunnel.
	Ports []uint32 `protobuf:"varint,8,rep,packed,name=ports,proto3" json:"ports,omitempty"`
	// Keep the destination hostname in Host when target_url is an operator
	// inspection chain that forwards to the real host.
	PreserveHost bool `protobuf:"varint,9,opt,name=preserve_host,json=preserveHost,proto3" json:"preserve_host,omitempty"`
	// Forward X-Mesh-Principal, X-Mesh-Roles and X-Mesh-Task to target_url.
	// Only for an operator chain; the node strips them for a real destination.
	ForwardContext bool `protobuf:"varint,10,opt,name=forward_context,json=forwardContext,proto3" json:"forward_context,omitempty"`
	// contains filtered or unexported fields
}

EgressDestination is a destination outside the mesh that selected nodes serve as egress://<name>. It is part of the policy document the admin writes; a node receives the destinations that select it at GET /egress and serves them without configuration of its own.

func (*EgressDestination) Descriptor deprecated 

func (*EgressDestination) Descriptor() ([]byte, []int)

Deprecated: Use EgressDestination.ProtoReflect.Descriptor instead.

func (*EgressDestination) GetBroker 

func (x *EgressDestination) GetBroker() *CredentialBroker

func (*EgressDestination) GetCredential 

func (x *EgressDestination) GetCredential() string

func (*EgressDestination) GetForwardContext 

func (x *EgressDestination) GetForwardContext() bool

func (*EgressDestination) GetInspection 

func (x *EgressDestination) GetInspection() *Inspection

func (*EgressDestination) GetMode 

func (x *EgressDestination) GetMode() EgressMode

func (*EgressDestination) GetName 

func (x *EgressDestination) GetName() string

func (*EgressDestination) GetPorts 

func (x *EgressDestination) GetPorts() []uint32

func (*EgressDestination) GetPreserveHost 

func (x *EgressDestination) GetPreserveHost() bool

func (*EgressDestination) GetServedBy 

func (x *EgressDestination) GetServedBy() []string

func (*EgressDestination) GetTargetUrl 

func (x *EgressDestination) GetTargetUrl() string

func (*EgressDestination) ProtoMessage 

func (*EgressDestination) ProtoMessage()

func (*EgressDestination) ProtoReflect 

func (x *EgressDestination) ProtoReflect() protoreflect.Message

func (*EgressDestination) Reset 

func (x *EgressDestination) Reset()

func (*EgressDestination) String 

func (x *EgressDestination) String() string

type EgressMode 

type EgressMode int32
const (
	EgressMode_EGRESS_MODE_HTTP EgressMode = 0
	EgressMode_EGRESS_MODE_TCP  EgressMode = 1
)

func (EgressMode) Descriptor 

func (EgressMode) Descriptor() protoreflect.EnumDescriptor

func (EgressMode) Enum 

func (x EgressMode) Enum() *EgressMode

func (EgressMode) EnumDescriptor deprecated 

func (EgressMode) EnumDescriptor() ([]byte, []int)

Deprecated: Use EgressMode.Descriptor instead.

func (EgressMode) Number 

func (x EgressMode) Number() protoreflect.EnumNumber

func (EgressMode) String 

func (x EgressMode) String() string

func (EgressMode) Type 

func (EgressMode) Type() protoreflect.EnumType

type EnrollRequest 

type EnrollRequest struct {
	Jwt           string `protobuf:"bytes,1,opt,name=jwt,proto3" json:"jwt,omitempty"`
	PeerId        string `protobuf:"bytes,2,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	PublicKey     []byte `protobuf:"bytes,3,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
	RequestedRole string `protobuf:"bytes,4,opt,name=requested_role,json=requestedRole,proto3" json:"requested_role,omitempty"`
	// Operator-declared labels (e.g. key "region", see api/labels.go).
	// Validated fail-closed by the control plane and, once attested by the
	// enrollment flow's gates, minted as signed label() facts in the
	// biscuit. Empty means no claims.
	Labels map[string]string `` /* 139-byte string literal not displayed */
	// Proof of possession of public_key's private half: challenge_unix_ms is
	// the caller's clock in unix milliseconds and challenge_signature signs
	// the UTF-8 bytes of "mesh:register:<peer_id>:<challenge_unix_ms>". It is
	// an int64 because it is the number in the signed text, not an instant
	// for display. Required, and peer_id must be derived from public_key.
	// The JWT proves who is asking; this proves they hold the key they are
	// asking to bind, so an identity cannot register (and overwrite) another
	// node's peer_id.
	ChallengeUnixMs    int64  `protobuf:"varint,6,opt,name=challenge_unix_ms,json=challengeUnixMs,proto3" json:"challenge_unix_ms,omitempty"`
	ChallengeSignature []byte `protobuf:"bytes,7,opt,name=challenge_signature,json=challengeSignature,proto3" json:"challenge_signature,omitempty"`
	// contains filtered or unexported fields
}

func (*EnrollRequest) Descriptor deprecated 

func (*EnrollRequest) Descriptor() ([]byte, []int)

Deprecated: Use EnrollRequest.ProtoReflect.Descriptor instead.

func (*EnrollRequest) GetChallengeSignature 

func (x *EnrollRequest) GetChallengeSignature() []byte

func (*EnrollRequest) GetChallengeUnixMs 

func (x *EnrollRequest) GetChallengeUnixMs() int64

func (*EnrollRequest) GetJwt 

func (x *EnrollRequest) GetJwt() string

func (*EnrollRequest) GetLabels 

func (x *EnrollRequest) GetLabels() map[string]string

func (*EnrollRequest) GetPeerId 

func (x *EnrollRequest) GetPeerId() string

func (*EnrollRequest) GetPublicKey 

func (x *EnrollRequest) GetPublicKey() []byte

func (*EnrollRequest) GetRequestedRole 

func (x *EnrollRequest) GetRequestedRole() string

func (*EnrollRequest) ProtoMessage 

func (*EnrollRequest) ProtoMessage()

func (*EnrollRequest) ProtoReflect 

func (x *EnrollRequest) ProtoReflect() protoreflect.Message

func (*EnrollRequest) Reset 

func (x *EnrollRequest) Reset()

func (*EnrollRequest) String 

func (x *EnrollRequest) String() string

type EnrollResponse 

type EnrollResponse struct {
	BiscuitToken          []byte                 `protobuf:"bytes,1,opt,name=biscuit_token,json=biscuitToken,proto3" json:"biscuit_token,omitempty"`
	ErrorMessage          string                 `protobuf:"bytes,2,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"`
	ControlPlanePublicKey []byte                 `` /* 128-byte string literal not displayed */
	RouterAddresses       []string               `protobuf:"bytes,4,rep,name=router_addresses,json=routerAddresses,proto3" json:"router_addresses,omitempty"`
	ExpireTime            *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	// contains filtered or unexported fields
}

func (*EnrollResponse) Descriptor deprecated 

func (*EnrollResponse) Descriptor() ([]byte, []int)

Deprecated: Use EnrollResponse.ProtoReflect.Descriptor instead.

func (*EnrollResponse) GetBiscuitToken 

func (x *EnrollResponse) GetBiscuitToken() []byte

func (*EnrollResponse) GetControlPlanePublicKey 

func (x *EnrollResponse) GetControlPlanePublicKey() []byte

func (*EnrollResponse) GetErrorMessage 

func (x *EnrollResponse) GetErrorMessage() string

func (*EnrollResponse) GetExpireTime 

func (x *EnrollResponse) GetExpireTime() *timestamppb.Timestamp

func (*EnrollResponse) GetRouterAddresses 

func (x *EnrollResponse) GetRouterAddresses() []string

func (*EnrollResponse) ProtoMessage 

func (*EnrollResponse) ProtoMessage()

func (*EnrollResponse) ProtoReflect 

func (x *EnrollResponse) ProtoReflect() protoreflect.Message

func (*EnrollResponse) Reset 

func (x *EnrollResponse) Reset()

func (*EnrollResponse) String 

func (x *EnrollResponse) String() string

type EnrolledNode 

type EnrolledNode struct {
	PeerId string `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	Role   string `protobuf:"bytes,2,opt,name=role,proto3" json:"role,omitempty"`
	// How the node enrolled, e.g. "oidc" or "bootstrap".
	EnrollmentType string `protobuf:"bytes,3,opt,name=enrollment_type,json=enrollmentType,proto3" json:"enrollment_type,omitempty"`
	// The identity provider's claims as stored at enrollment. Admin-only.
	ClaimsJson string                 `protobuf:"bytes,4,opt,name=claims_json,json=claimsJson,proto3" json:"claims_json,omitempty"`
	OwnerId    string                 `protobuf:"bytes,5,opt,name=owner_id,json=ownerId,proto3" json:"owner_id,omitempty"`
	Labels     map[string]string      `` /* 139-byte string literal not displayed */
	EnrollTime *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=enroll_time,json=enrollTime,proto3" json:"enroll_time,omitempty"`
	// When the enrollment session ends; unset means it does not expire.
	ExpireTime         *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	Banned             bool                   `protobuf:"varint,9,opt,name=banned,proto3" json:"banned,omitempty"`
	AutonomousRecovery bool                   `protobuf:"varint,10,opt,name=autonomous_recovery,json=autonomousRecovery,proto3" json:"autonomous_recovery,omitempty"`
	// The node was enrolled by an ephemeral token and is forgotten soon after
	// it falls silent.
	Ephemeral bool `protobuf:"varint,11,opt,name=ephemeral,proto3" json:"ephemeral,omitempty"`
	// contains filtered or unexported fields
}

EnrolledNode is a member's enrollment record without its credential.

func (*EnrolledNode) Descriptor deprecated 

func (*EnrolledNode) Descriptor() ([]byte, []int)

Deprecated: Use EnrolledNode.ProtoReflect.Descriptor instead.

func (*EnrolledNode) GetAutonomousRecovery 

func (x *EnrolledNode) GetAutonomousRecovery() bool

func (*EnrolledNode) GetBanned 

func (x *EnrolledNode) GetBanned() bool

func (*EnrolledNode) GetClaimsJson 

func (x *EnrolledNode) GetClaimsJson() string

func (*EnrolledNode) GetEnrollTime 

func (x *EnrolledNode) GetEnrollTime() *timestamppb.Timestamp

func (*EnrolledNode) GetEnrollmentType 

func (x *EnrolledNode) GetEnrollmentType() string

func (*EnrolledNode) GetEphemeral 

func (x *EnrolledNode) GetEphemeral() bool

func (*EnrolledNode) GetExpireTime 

func (x *EnrolledNode) GetExpireTime() *timestamppb.Timestamp

func (*EnrolledNode) GetLabels 

func (x *EnrolledNode) GetLabels() map[string]string

func (*EnrolledNode) GetOwnerId 

func (x *EnrolledNode) GetOwnerId() string

func (*EnrolledNode) GetPeerId 

func (x *EnrolledNode) GetPeerId() string

func (*EnrolledNode) GetRole 

func (x *EnrolledNode) GetRole() string

func (*EnrolledNode) ProtoMessage 

func (*EnrolledNode) ProtoMessage()

func (*EnrolledNode) ProtoReflect 

func (x *EnrolledNode) ProtoReflect() protoreflect.Message

func (*EnrolledNode) Reset 

func (x *EnrolledNode) Reset()

func (*EnrolledNode) String 

func (x *EnrolledNode) String() string

type EnrollmentRequest 

type EnrollmentRequest struct {
	Id     string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	PeerId string `protobuf:"bytes,2,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	// The bootstrap token the request was made with.
	TokenId string           `protobuf:"bytes,3,opt,name=token_id,json=tokenId,proto3" json:"token_id,omitempty"`
	Status  EnrollmentStatus `protobuf:"varint,4,opt,name=status,proto3,enum=agentmesh.v1.EnrollmentStatus" json:"status,omitempty"`
	// Labels the node declared; approval attests them into its biscuit.
	Labels     map[string]string      `` /* 139-byte string literal not displayed */
	CreateTime *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty"`
	// Unset while the request is pending.
	ResolveTime *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=resolve_time,json=resolveTime,proto3" json:"resolve_time,omitempty"`
	ResolvedBy  string                 `protobuf:"bytes,8,opt,name=resolved_by,json=resolvedBy,proto3" json:"resolved_by,omitempty"`
	// contains filtered or unexported fields
}

EnrollmentRequest is a bootstrap enrollment awaiting or past an operator decision (see BootstrapEnrollRequest).

func (*EnrollmentRequest) Descriptor deprecated 

func (*EnrollmentRequest) Descriptor() ([]byte, []int)

Deprecated: Use EnrollmentRequest.ProtoReflect.Descriptor instead.

func (*EnrollmentRequest) GetCreateTime 

func (x *EnrollmentRequest) GetCreateTime() *timestamppb.Timestamp

func (*EnrollmentRequest) GetId 

func (x *EnrollmentRequest) GetId() string

func (*EnrollmentRequest) GetLabels 

func (x *EnrollmentRequest) GetLabels() map[string]string

func (*EnrollmentRequest) GetPeerId 

func (x *EnrollmentRequest) GetPeerId() string

func (*EnrollmentRequest) GetResolveTime 

func (x *EnrollmentRequest) GetResolveTime() *timestamppb.Timestamp

func (*EnrollmentRequest) GetResolvedBy 

func (x *EnrollmentRequest) GetResolvedBy() string

func (*EnrollmentRequest) GetStatus 

func (x *EnrollmentRequest) GetStatus() EnrollmentStatus

func (*EnrollmentRequest) GetTokenId 

func (x *EnrollmentRequest) GetTokenId() string

func (*EnrollmentRequest) ProtoMessage 

func (*EnrollmentRequest) ProtoMessage()

func (*EnrollmentRequest) ProtoReflect 

func (x *EnrollmentRequest) ProtoReflect() protoreflect.Message

func (*EnrollmentRequest) Reset 

func (x *EnrollmentRequest) Reset()

func (*EnrollmentRequest) String 

func (x *EnrollmentRequest) String() string

type EnrollmentRequestListResponse 

type EnrollmentRequestListResponse struct {
	Requests []*EnrollmentRequest `protobuf:"bytes,1,rep,name=requests,proto3" json:"requests,omitempty"`
	// contains filtered or unexported fields
}

func (*EnrollmentRequestListResponse) Descriptor deprecated 

func (*EnrollmentRequestListResponse) Descriptor() ([]byte, []int)

Deprecated: Use EnrollmentRequestListResponse.ProtoReflect.Descriptor instead.

func (*EnrollmentRequestListResponse) GetRequests 

func (x *EnrollmentRequestListResponse) GetRequests() []*EnrollmentRequest

func (*EnrollmentRequestListResponse) ProtoMessage 

func (*EnrollmentRequestListResponse) ProtoMessage()

func (*EnrollmentRequestListResponse) ProtoReflect 

func (x *EnrollmentRequestListResponse) ProtoReflect() protoreflect.Message

func (*EnrollmentRequestListResponse) Reset 

func (x *EnrollmentRequestListResponse) Reset()

func (*EnrollmentRequestListResponse) String 

func (x *EnrollmentRequestListResponse) String() string

type EnrollmentStatus 

type EnrollmentStatus int32
const (
	EnrollmentStatus_ENROLLMENT_STATUS_UNSPECIFIED EnrollmentStatus = 0
	EnrollmentStatus_ENROLLMENT_STATUS_PENDING     EnrollmentStatus = 1
	EnrollmentStatus_ENROLLMENT_STATUS_APPROVED    EnrollmentStatus = 2
	EnrollmentStatus_ENROLLMENT_STATUS_REJECTED    EnrollmentStatus = 3
)

func (EnrollmentStatus) Descriptor 

func (EnrollmentStatus) Descriptor() protoreflect.EnumDescriptor

func (EnrollmentStatus) Enum 

func (x EnrollmentStatus) Enum() *EnrollmentStatus

func (EnrollmentStatus) EnumDescriptor deprecated 

func (EnrollmentStatus) EnumDescriptor() ([]byte, []int)

Deprecated: Use EnrollmentStatus.Descriptor instead.

func (EnrollmentStatus) Number 

func (x EnrollmentStatus) Number() protoreflect.EnumNumber

func (EnrollmentStatus) String 

func (x EnrollmentStatus) String() string

func (EnrollmentStatus) Type 

func (EnrollmentStatus) Type() protoreflect.EnumType

type ExtProc 

type ExtProc struct {

	// host:port, or unix:/path for a processor on the same host.
	Target string `protobuf:"bytes,1,opt,name=target,proto3" json:"target,omitempty"`
	// Names in the node's secrets directory for mTLS to the processor: the CA
	// bundle and the client certificate with its key. Never values.
	Ca                string                 `protobuf:"bytes,2,opt,name=ca,proto3" json:"ca,omitempty"`
	ClientCertificate string                 `protobuf:"bytes,3,opt,name=client_certificate,json=clientCertificate,proto3" json:"client_certificate,omitempty"`
	ProcessingMode    *ExtProcProcessingMode `protobuf:"bytes,4,opt,name=processing_mode,json=processingMode,proto3" json:"processing_mode,omitempty"`
	// Let the processor change the mode mid-request (Envoy allow_mode_override).
	AllowModeOverride bool `protobuf:"varint,5,opt,name=allow_mode_override,json=allowModeOverride,proto3" json:"allow_mode_override,omitempty"`
	// Per-message deadline; 200ms when unset, as in Envoy.
	MessageTimeout *durationpb.Duration `protobuf:"bytes,6,opt,name=message_timeout,json=messageTimeout,proto3" json:"message_timeout,omitempty"`
	// Default false: a processor error fails the request (Envoy failure_mode_allow).
	FailureModeAllow bool `protobuf:"varint,7,opt,name=failure_mode_allow,json=failureModeAllow,proto3" json:"failure_mode_allow,omitempty"`
	// Upper bound for BUFFERED and BUFFERED_PARTIAL bodies.
	MaxBufferedBytes uint32 `protobuf:"varint,8,opt,name=max_buffered_bytes,json=maxBufferedBytes,proto3" json:"max_buffered_bytes,omitempty"`
	// contains filtered or unexported fields
}

ExtProc runs an Envoy external processor (envoy.service.ext_proc.v3 ExternalProcessor) over one bidirectional gRPC stream per request. Field names follow Envoy's ext_proc filter configuration so a processor's settings carry over unchanged.

func (*ExtProc) Descriptor deprecated 

func (*ExtProc) Descriptor() ([]byte, []int)

Deprecated: Use ExtProc.ProtoReflect.Descriptor instead.

func (*ExtProc) GetAllowModeOverride 

func (x *ExtProc) GetAllowModeOverride() bool

func (*ExtProc) GetCa 

func (x *ExtProc) GetCa() string

func (*ExtProc) GetClientCertificate 

func (x *ExtProc) GetClientCertificate() string

func (*ExtProc) GetFailureModeAllow 

func (x *ExtProc) GetFailureModeAllow() bool

func (*ExtProc) GetMaxBufferedBytes 

func (x *ExtProc) GetMaxBufferedBytes() uint32

func (*ExtProc) GetMessageTimeout 

func (x *ExtProc) GetMessageTimeout() *durationpb.Duration

func (*ExtProc) GetProcessingMode 

func (x *ExtProc) GetProcessingMode() *ExtProcProcessingMode

func (*ExtProc) GetTarget 

func (x *ExtProc) GetTarget() string

func (*ExtProc) ProtoMessage 

func (*ExtProc) ProtoMessage()

func (*ExtProc) ProtoReflect 

func (x *ExtProc) ProtoReflect() protoreflect.Message

func (*ExtProc) Reset 

func (x *ExtProc) Reset()

func (*ExtProc) String 

func (x *ExtProc) String() string

type ExtProcProcessingMode 

type ExtProcProcessingMode struct {
	RequestHeaderMode   ExtProcProcessingMode_HeaderMode `` /* 166-byte string literal not displayed */
	ResponseHeaderMode  ExtProcProcessingMode_HeaderMode `` /* 169-byte string literal not displayed */
	RequestBodyMode     ExtProcProcessingMode_BodyMode   `` /* 158-byte string literal not displayed */
	ResponseBodyMode    ExtProcProcessingMode_BodyMode   `` /* 161-byte string literal not displayed */
	RequestTrailerMode  ExtProcProcessingMode_HeaderMode `` /* 169-byte string literal not displayed */
	ResponseTrailerMode ExtProcProcessingMode_HeaderMode `` /* 172-byte string literal not displayed */
	// contains filtered or unexported fields
}

func (*ExtProcProcessingMode) Descriptor deprecated 

func (*ExtProcProcessingMode) Descriptor() ([]byte, []int)

Deprecated: Use ExtProcProcessingMode.ProtoReflect.Descriptor instead.

func (*ExtProcProcessingMode) GetRequestBodyMode 

func (x *ExtProcProcessingMode) GetRequestBodyMode() ExtProcProcessingMode_BodyMode

func (*ExtProcProcessingMode) GetRequestHeaderMode 

func (x *ExtProcProcessingMode) GetRequestHeaderMode() ExtProcProcessingMode_HeaderMode

func (*ExtProcProcessingMode) GetRequestTrailerMode 

func (x *ExtProcProcessingMode) GetRequestTrailerMode() ExtProcProcessingMode_HeaderMode

func (*ExtProcProcessingMode) GetResponseBodyMode 

func (x *ExtProcProcessingMode) GetResponseBodyMode() ExtProcProcessingMode_BodyMode

func (*ExtProcProcessingMode) GetResponseHeaderMode 

func (x *ExtProcProcessingMode) GetResponseHeaderMode() ExtProcProcessingMode_HeaderMode

func (*ExtProcProcessingMode) GetResponseTrailerMode 

func (x *ExtProcProcessingMode) GetResponseTrailerMode() ExtProcProcessingMode_HeaderMode

func (*ExtProcProcessingMode) ProtoMessage 

func (*ExtProcProcessingMode) ProtoMessage()

func (*ExtProcProcessingMode) ProtoReflect 

func (x *ExtProcProcessingMode) ProtoReflect() protoreflect.Message

func (*ExtProcProcessingMode) Reset 

func (x *ExtProcProcessingMode) Reset()

func (*ExtProcProcessingMode) String 

func (x *ExtProcProcessingMode) String() string

type ExtProcProcessingMode_BodyMode 

type ExtProcProcessingMode_BodyMode int32
const (
	ExtProcProcessingMode_NONE                 ExtProcProcessingMode_BodyMode = 0
	ExtProcProcessingMode_STREAMED             ExtProcProcessingMode_BodyMode = 1
	ExtProcProcessingMode_BUFFERED             ExtProcProcessingMode_BodyMode = 2
	ExtProcProcessingMode_BUFFERED_PARTIAL     ExtProcProcessingMode_BodyMode = 3
	ExtProcProcessingMode_FULL_DUPLEX_STREAMED ExtProcProcessingMode_BodyMode = 4
)

func (ExtProcProcessingMode_BodyMode) Descriptor 

func (ExtProcProcessingMode_BodyMode) Descriptor() protoreflect.EnumDescriptor

func (ExtProcProcessingMode_BodyMode) Enum 

func (x ExtProcProcessingMode_BodyMode) Enum() *ExtProcProcessingMode_BodyMode

func (ExtProcProcessingMode_BodyMode) EnumDescriptor deprecated 

func (ExtProcProcessingMode_BodyMode) EnumDescriptor() ([]byte, []int)

Deprecated: Use ExtProcProcessingMode_BodyMode.Descriptor instead.

func (ExtProcProcessingMode_BodyMode) Number 

func (x ExtProcProcessingMode_BodyMode) Number() protoreflect.EnumNumber

func (ExtProcProcessingMode_BodyMode) String 

func (x ExtProcProcessingMode_BodyMode) String() string

func (ExtProcProcessingMode_BodyMode) Type 

func (ExtProcProcessingMode_BodyMode) Type() protoreflect.EnumType

type ExtProcProcessingMode_HeaderMode 

type ExtProcProcessingMode_HeaderMode int32
const (
	ExtProcProcessingMode_HEADER_MODE_DEFAULT ExtProcProcessingMode_HeaderMode = 0
	ExtProcProcessingMode_SEND                ExtProcProcessingMode_HeaderMode = 1
	ExtProcProcessingMode_SKIP                ExtProcProcessingMode_HeaderMode = 2
)

func (ExtProcProcessingMode_HeaderMode) Descriptor 

func (ExtProcProcessingMode_HeaderMode) Descriptor() protoreflect.EnumDescriptor

func (ExtProcProcessingMode_HeaderMode) Enum 

func (x ExtProcProcessingMode_HeaderMode) Enum() *ExtProcProcessingMode_HeaderMode

func (ExtProcProcessingMode_HeaderMode) EnumDescriptor deprecated 

func (ExtProcProcessingMode_HeaderMode) EnumDescriptor() ([]byte, []int)

Deprecated: Use ExtProcProcessingMode_HeaderMode.Descriptor instead.

func (ExtProcProcessingMode_HeaderMode) Number 

func (x ExtProcProcessingMode_HeaderMode) Number() protoreflect.EnumNumber

func (ExtProcProcessingMode_HeaderMode) String 

func (x ExtProcProcessingMode_HeaderMode) String() string

func (ExtProcProcessingMode_HeaderMode) Type 

func (ExtProcProcessingMode_HeaderMode) Type() protoreflect.EnumType

type HTTPGrant 

type HTTPGrant struct {

	// One of the role's allowed_services entries, written identically.
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// Methods the holder may use, e.g. "GET", "HEAD". Empty means any method.
	Methods []string `protobuf:"bytes,2,rep,name=methods,proto3" json:"methods,omitempty"`
	// Paths the holder may request, as the backend sees them: "/user" matches
	// that path only, "/v2/public/*" matches every path under the prefix.
	// Empty means any path. At least one of methods and paths must be set.
	Paths []string `protobuf:"bytes,3,rep,name=paths,proto3" json:"paths,omitempty"`
	// contains filtered or unexported fields
}

HTTPGrant narrows one allowed_services entry to HTTP methods and paths. The control plane compiles it into granted_method and granted_path_* facts in the holder's credential and withholds the plain service grant for that entry. The baseline rules derive the service grant only for a request whose method($m) and path($p) facts match, so a request that carries no HTTP method (a tunnel, a non-HTTP stream) does not match a narrowed entry.

func SplitHTTPGrants 

func SplitHTTPGrants(role *PolicyRole) (plain []string, narrowed []*HTTPGrant)

SplitHTTPGrants separates a role's allowed_services into the entries minted as plain grants and the entries narrowed by PolicyRole.http. A narrowed entry is withheld from the plain list: it exists only as its http_granted_service_* fact, and the request has to earn the plain fact through BaselineHTTPRules.

func (*HTTPGrant) Descriptor deprecated 

func (*HTTPGrant) Descriptor() ([]byte, []int)

Deprecated: Use HTTPGrant.ProtoReflect.Descriptor instead.

func (*HTTPGrant) GetMethods 

func (x *HTTPGrant) GetMethods() []string

func (*HTTPGrant) GetPaths 

func (x *HTTPGrant) GetPaths() []string

func (*HTTPGrant) GetService 

func (x *HTTPGrant) GetService() string

func (*HTTPGrant) ProtoMessage 

func (*HTTPGrant) ProtoMessage()

func (*HTTPGrant) ProtoReflect 

func (x *HTTPGrant) ProtoReflect() protoreflect.Message

func (*HTTPGrant) Reset 

func (x *HTTPGrant) Reset()

func (*HTTPGrant) String 

func (x *HTTPGrant) String() string

type IdentityEvidenceResponse 

type IdentityEvidenceResponse struct {
	PeerId                  string                 `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	Biscuit                 []byte                 `protobuf:"bytes,2,opt,name=biscuit,proto3" json:"biscuit,omitempty"`
	BiscuitExpireTime       *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=biscuit_expire_time,json=biscuitExpireTime,proto3" json:"biscuit_expire_time,omitempty"`
	ControlPlaneUrl         string                 `protobuf:"bytes,4,opt,name=control_plane_url,json=controlPlaneUrl,proto3" json:"control_plane_url,omitempty"`
	TrustedControlPlaneKeys [][]byte               `` // Ed25519 SPKI DER
	/* 134-byte string literal not displayed */
	CheckTime *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=check_time,json=checkTime,proto3" json:"check_time,omitempty"`
	// contains filtered or unexported fields
}

func (*IdentityEvidenceResponse) Descriptor deprecated 

func (*IdentityEvidenceResponse) Descriptor() ([]byte, []int)

Deprecated: Use IdentityEvidenceResponse.ProtoReflect.Descriptor instead.

func (*IdentityEvidenceResponse) GetBiscuit 

func (x *IdentityEvidenceResponse) GetBiscuit() []byte

func (*IdentityEvidenceResponse) GetBiscuitExpireTime 

func (x *IdentityEvidenceResponse) GetBiscuitExpireTime() *timestamppb.Timestamp

func (*IdentityEvidenceResponse) GetCheckTime 

func (x *IdentityEvidenceResponse) GetCheckTime() *timestamppb.Timestamp

func (*IdentityEvidenceResponse) GetControlPlaneUrl 

func (x *IdentityEvidenceResponse) GetControlPlaneUrl() string

func (*IdentityEvidenceResponse) GetPeerId 

func (x *IdentityEvidenceResponse) GetPeerId() string

func (*IdentityEvidenceResponse) GetTrustedControlPlaneKeys 

func (x *IdentityEvidenceResponse) GetTrustedControlPlaneKeys() [][]byte

func (*IdentityEvidenceResponse) ProtoMessage 

func (*IdentityEvidenceResponse) ProtoMessage()

func (*IdentityEvidenceResponse) ProtoReflect 

func (x *IdentityEvidenceResponse) ProtoReflect() protoreflect.Message

func (*IdentityEvidenceResponse) Reset 

func (x *IdentityEvidenceResponse) Reset()

func (*IdentityEvidenceResponse) String 

func (x *IdentityEvidenceResponse) String() string

type Inspection 

type Inspection struct {
	Inspectors []*Inspector `protobuf:"bytes,1,rep,name=inspectors,proto3" json:"inspectors,omitempty"`
	// contains filtered or unexported fields
}

Inspection lists the inspectors the egress node runs, in order; the first block wins. Inspectors run before the broker injects the destination credential, so a processor never sees it.

func (*Inspection) Descriptor deprecated 

func (*Inspection) Descriptor() ([]byte, []int)

Deprecated: Use Inspection.ProtoReflect.Descriptor instead.

func (*Inspection) GetInspectors 

func (x *Inspection) GetInspectors() []*Inspector

func (*Inspection) ProtoMessage 

func (*Inspection) ProtoMessage()

func (*Inspection) ProtoReflect 

func (x *Inspection) ProtoReflect() protoreflect.Message

func (*Inspection) Reset 

func (x *Inspection) Reset()

func (*Inspection) String 

func (x *Inspection) String() string

type Inspector 

type Inspector struct {

	// Types that are valid to be assigned to Kind:
	//
	//	*Inspector_ModelArmor
	//	*Inspector_ExtProc
	Kind isInspector_Kind `protobuf_oneof:"kind"`
	// contains filtered or unexported fields
}

func (*Inspector) Descriptor deprecated 

func (*Inspector) Descriptor() ([]byte, []int)

Deprecated: Use Inspector.ProtoReflect.Descriptor instead.

func (*Inspector) GetExtProc 

func (x *Inspector) GetExtProc() *ExtProc

func (*Inspector) GetKind 

func (x *Inspector) GetKind() isInspector_Kind

func (*Inspector) GetModelArmor 

func (x *Inspector) GetModelArmor() *ModelArmor

func (*Inspector) ProtoMessage 

func (*Inspector) ProtoMessage()

func (*Inspector) ProtoReflect 

func (x *Inspector) ProtoReflect() protoreflect.Message

func (*Inspector) Reset 

func (x *Inspector) Reset()

func (*Inspector) String 

func (x *Inspector) String() string

type Inspector_ExtProc 

type Inspector_ExtProc struct {
	ExtProc *ExtProc `protobuf:"bytes,2,opt,name=ext_proc,json=extProc,proto3,oneof"`
}

type Inspector_ModelArmor 

type Inspector_ModelArmor struct {
	ModelArmor *ModelArmor `protobuf:"bytes,1,opt,name=model_armor,json=modelArmor,proto3,oneof"`
}

type KeysResponse 

type KeysResponse struct {
	PublicKeys [][]byte `protobuf:"bytes,1,rep,name=public_keys,json=publicKeys,proto3" json:"public_keys,omitempty"`
	// When the set was signed; receivers reject responses outside a short
	// freshness window so a captured set cannot be replayed.
	SignTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=sign_time,json=signTime,proto3" json:"sign_time,omitempty"`
	// One ed25519 signature per entry of public_keys, by that key, over the
	// deterministic encoding of this message with signatures cleared. A
	// receiver trusting any key still valid on the control plane can verify
	// the whole set (see api.VerifyKeysResponse).
	Signatures [][]byte `protobuf:"bytes,3,rep,name=signatures,proto3" json:"signatures,omitempty"`
	// contains filtered or unexported fields
}

func (*KeysResponse) Descriptor deprecated 

func (*KeysResponse) Descriptor() ([]byte, []int)

Deprecated: Use KeysResponse.ProtoReflect.Descriptor instead.

func (*KeysResponse) GetPublicKeys 

func (x *KeysResponse) GetPublicKeys() [][]byte

func (*KeysResponse) GetSignTime 

func (x *KeysResponse) GetSignTime() *timestamppb.Timestamp

func (*KeysResponse) GetSignatures 

func (x *KeysResponse) GetSignatures() [][]byte

func (*KeysResponse) ProtoMessage 

func (*KeysResponse) ProtoMessage()

func (*KeysResponse) ProtoReflect 

func (x *KeysResponse) ProtoReflect() protoreflect.Message

func (*KeysResponse) Reset 

func (x *KeysResponse) Reset()

func (*KeysResponse) String 

func (x *KeysResponse) String() string

type MemberCredential 

type MemberCredential struct {

	// Base URL of the control plane that minted the biscuit.
	ControlPlaneUrl string `protobuf:"bytes,1,opt,name=control_plane_url,json=controlPlaneUrl,proto3" json:"control_plane_url,omitempty"`
	// The member's biscuit.
	Biscuit []byte `protobuf:"bytes,2,opt,name=biscuit,proto3" json:"biscuit,omitempty"`
	// When the biscuit expires.
	ExpireTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	// Control plane signing keys trusted now; a rotation keeps several valid.
	TrustedKeys []*TrustedSigningKey `protobuf:"bytes,4,rep,name=trusted_keys,json=trustedKeys,proto3" json:"trusted_keys,omitempty"`
	// The keys trusted when the biscuit was issued. A key trusted now that is
	// absent here means a rotation happened since: the biscuit is signed by a
	// retiring key and must be refreshed before that key leaves its grace
	// period.
	IssuedUnderKeys [][]byte `protobuf:"bytes,5,rep,name=issued_under_keys,json=issuedUnderKeys,proto3" json:"issued_under_keys,omitempty"`
	// Router multiaddrs, `/p2p/<peer id>` suffixed.
	RouterAddresses []string `protobuf:"bytes,6,rep,name=router_addresses,json=routerAddresses,proto3" json:"router_addresses,omitempty"`
	// The session that renews an identity enrolled through the mesh's
	// identity provider. Unset for a member enrolled with a bootstrap token.
	OidcSession *OIDCSession `protobuf:"bytes,7,opt,name=oidc_session,json=oidcSession,proto3" json:"oidc_session,omitempty"`
	// contains filtered or unexported fields
}

func (*MemberCredential) Descriptor deprecated 

func (*MemberCredential) Descriptor() ([]byte, []int)

Deprecated: Use MemberCredential.ProtoReflect.Descriptor instead.

func (*MemberCredential) GetBiscuit 

func (x *MemberCredential) GetBiscuit() []byte

func (*MemberCredential) GetControlPlaneUrl 

func (x *MemberCredential) GetControlPlaneUrl() string

func (*MemberCredential) GetExpireTime 

func (x *MemberCredential) GetExpireTime() *timestamppb.Timestamp

func (*MemberCredential) GetIssuedUnderKeys 

func (x *MemberCredential) GetIssuedUnderKeys() [][]byte

func (*MemberCredential) GetOidcSession 

func (x *MemberCredential) GetOidcSession() *OIDCSession

func (*MemberCredential) GetRouterAddresses 

func (x *MemberCredential) GetRouterAddresses() []string

func (*MemberCredential) GetTrustedKeys 

func (x *MemberCredential) GetTrustedKeys() []*TrustedSigningKey

func (*MemberCredential) ProtoMessage 

func (*MemberCredential) ProtoMessage()

func (*MemberCredential) ProtoReflect 

func (x *MemberCredential) ProtoReflect() protoreflect.Message

func (*MemberCredential) Reset 

func (x *MemberCredential) Reset()

func (*MemberCredential) String 

func (x *MemberCredential) String() string

type MeshEvent 

type MeshEvent struct {
	Type   MeshEvent_Type `protobuf:"varint,1,opt,name=type,proto3,enum=agentmesh.v1.MeshEvent_Type" json:"type,omitempty"`
	PeerId string         `protobuf:"bytes,2,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	// When the control plane recorded the event. Receivers ignore an event
	// further than a few minutes from their clock and, for bans, one older
	// than the last they applied for the peer.
	EventTime    *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=event_time,json=eventTime,proto3" json:"event_time,omitempty"`
	NewPublicKey []byte                 `protobuf:"bytes,4,opt,name=new_public_key,json=newPublicKey,proto3" json:"new_public_key,omitempty"`
	Signature    []byte                 `protobuf:"bytes,5,opt,name=signature,proto3" json:"signature,omitempty"`
	// contains filtered or unexported fields
}

func (*MeshEvent) Descriptor deprecated 

func (*MeshEvent) Descriptor() ([]byte, []int)

Deprecated: Use MeshEvent.ProtoReflect.Descriptor instead.

func (*MeshEvent) GetEventTime 

func (x *MeshEvent) GetEventTime() *timestamppb.Timestamp

func (*MeshEvent) GetNewPublicKey 

func (x *MeshEvent) GetNewPublicKey() []byte

func (*MeshEvent) GetPeerId 

func (x *MeshEvent) GetPeerId() string

func (*MeshEvent) GetSignature 

func (x *MeshEvent) GetSignature() []byte

func (*MeshEvent) GetType 

func (x *MeshEvent) GetType() MeshEvent_Type

func (*MeshEvent) ProtoMessage 

func (*MeshEvent) ProtoMessage()

func (*MeshEvent) ProtoReflect 

func (x *MeshEvent) ProtoReflect() protoreflect.Message

func (*MeshEvent) Reset 

func (x *MeshEvent) Reset()

func (*MeshEvent) String 

func (x *MeshEvent) String() string

type MeshEvent_Type 

type MeshEvent_Type int32
const (
	MeshEvent_BANNED        MeshEvent_Type = 0
	MeshEvent_KEY_ROTATION  MeshEvent_Type = 1
	MeshEvent_POLICY_UPDATE MeshEvent_Type = 2
)

func (MeshEvent_Type) Descriptor 

func (MeshEvent_Type) Descriptor() protoreflect.EnumDescriptor

func (MeshEvent_Type) Enum 

func (x MeshEvent_Type) Enum() *MeshEvent_Type

func (MeshEvent_Type) EnumDescriptor deprecated 

func (MeshEvent_Type) EnumDescriptor() ([]byte, []int)

Deprecated: Use MeshEvent_Type.Descriptor instead.

func (MeshEvent_Type) Number 

func (x MeshEvent_Type) Number() protoreflect.EnumNumber

func (MeshEvent_Type) String 

func (x MeshEvent_Type) String() string

func (MeshEvent_Type) Type 

func (MeshEvent_Type) Type() protoreflect.EnumType

type ModelArmor 

type ModelArmor struct {

	// projects/P/locations/L/templates/T. One template per destination; a
	// destination that needs another template is declared as another
	// EgressDestination.
	Template string `protobuf:"bytes,1,opt,name=template,proto3" json:"template,omitempty"`
	// BUFFERED: the whole response is inspected before release and may be
	// rewritten. REQUEST_ONLY: prompts are inspected, responses pass.
	Response ResponseInspection `protobuf:"varint,2,opt,name=response,proto3,enum=agentmesh.v1.ResponseInspection" json:"response,omitempty"`
	// Default false: an unreachable Model Armor fails the request.
	FailOpen bool                 `protobuf:"varint,3,opt,name=fail_open,json=failOpen,proto3" json:"fail_open,omitempty"`
	Timeout  *durationpb.Duration `protobuf:"bytes,4,opt,name=timeout,proto3" json:"timeout,omitempty"`
	// contains filtered or unexported fields
}

ModelArmor calls sanitizeUserPrompt / sanitizeModelResponse directly over HTTPS. Model Armor is reached as an egress destination with an oidc_federation broker, so no credential is stored for it.

func (*ModelArmor) Descriptor deprecated 

func (*ModelArmor) Descriptor() ([]byte, []int)

Deprecated: Use ModelArmor.ProtoReflect.Descriptor instead.

func (*ModelArmor) GetFailOpen 

func (x *ModelArmor) GetFailOpen() bool

func (*ModelArmor) GetResponse 

func (x *ModelArmor) GetResponse() ResponseInspection

func (*ModelArmor) GetTemplate 

func (x *ModelArmor) GetTemplate() string

func (*ModelArmor) GetTimeout 

func (x *ModelArmor) GetTimeout() *durationpb.Duration

func (*ModelArmor) ProtoMessage 

func (*ModelArmor) ProtoMessage()

func (*ModelArmor) ProtoReflect 

func (x *ModelArmor) ProtoReflect() protoreflect.Message

func (*ModelArmor) Reset 

func (x *ModelArmor) Reset()

func (*ModelArmor) String 

func (x *ModelArmor) String() string

type NodeCatalogReport 

type NodeCatalogReport struct {
	Services []*ServiceInfo `protobuf:"bytes,1,rep,name=services,proto3" json:"services,omitempty"`
	// contains filtered or unexported fields
}

NodeCatalogReport is the body of POST /nodes/catalog: a node's self-reported list of locally registered services. The reporting peer is taken from the presented biscuit, never from the body, so a node can only ever describe itself. Display-only; carries no authorization weight.

func (*NodeCatalogReport) Descriptor deprecated 

func (*NodeCatalogReport) Descriptor() ([]byte, []int)

Deprecated: Use NodeCatalogReport.ProtoReflect.Descriptor instead.

func (*NodeCatalogReport) GetServices 

func (x *NodeCatalogReport) GetServices() []*ServiceInfo

func (*NodeCatalogReport) ProtoMessage 

func (*NodeCatalogReport) ProtoMessage()

func (*NodeCatalogReport) ProtoReflect 

func (x *NodeCatalogReport) ProtoReflect() protoreflect.Message

func (*NodeCatalogReport) Reset 

func (x *NodeCatalogReport) Reset()

func (*NodeCatalogReport) String 

func (x *NodeCatalogReport) String() string

type NodeConfig 

type NodeConfig struct {
	Version     string          `yaml:"version"`
	Attenuation Attenuation     `yaml:"attenuation"`
	Services    []ServiceConfig `yaml:"services"`
	// Labels is what this node is, attested at enrollment; Egress is what it
	// demands of the peers it talks to. Adjacent because they are read
	// together and mean opposite directions.
	Labels map[string]string `yaml:"labels,omitempty"`
	Egress Egress            `yaml:"egress"`
}

NodeConfig defines the optional attenuation rules and static services for a specific Agent Mesh Node.

type NodeListResponse 

type NodeListResponse struct {
	Nodes []*EnrolledNode `protobuf:"bytes,1,rep,name=nodes,proto3" json:"nodes,omitempty"`
	// Pass as page_token for the next page; empty on the last page.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	// contains filtered or unexported fields
}

NodeListResponse answers GET /user/nodes: enrolled nodes, newest enrollment first, page_size (default 50, at most 200) at a time. state (admitted, expired or banned, repeatable) and role narrow the list. An administrator sees every owner's nodes and may pick one with owner_id; a user sees its own.

func (*NodeListResponse) Descriptor deprecated 

func (*NodeListResponse) Descriptor() ([]byte, []int)

Deprecated: Use NodeListResponse.ProtoReflect.Descriptor instead.

func (*NodeListResponse) GetNextPageToken 

func (x *NodeListResponse) GetNextPageToken() string

func (*NodeListResponse) GetNodes 

func (x *NodeListResponse) GetNodes() []*EnrolledNode

func (*NodeListResponse) ProtoMessage 

func (*NodeListResponse) ProtoMessage()

func (*NodeListResponse) ProtoReflect 

func (x *NodeListResponse) ProtoReflect() protoreflect.Message

func (*NodeListResponse) Reset 

func (x *NodeListResponse) Reset()

func (*NodeListResponse) String 

func (x *NodeListResponse) String() string

type NodeServices 

type NodeServices struct {
	Services   []*ServiceInfo         `protobuf:"bytes,1,rep,name=services,proto3" json:"services,omitempty"`
	ReportTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=report_time,json=reportTime,proto3" json:"report_time,omitempty"`
	// contains filtered or unexported fields
}

NodeServices is the services one node last reported (see NodeCatalogReport).

func (*NodeServices) Descriptor deprecated 

func (*NodeServices) Descriptor() ([]byte, []int)

Deprecated: Use NodeServices.ProtoReflect.Descriptor instead.

func (*NodeServices) GetReportTime 

func (x *NodeServices) GetReportTime() *timestamppb.Timestamp

func (*NodeServices) GetServices 

func (x *NodeServices) GetServices() []*ServiceInfo

func (*NodeServices) ProtoMessage 

func (*NodeServices) ProtoMessage()

func (*NodeServices) ProtoReflect 

func (x *NodeServices) ProtoReflect() protoreflect.Message

func (*NodeServices) Reset 

func (x *NodeServices) Reset()

func (*NodeServices) String 

func (x *NodeServices) String() string

type OAuthAuthorizationServerMetadata 

type OAuthAuthorizationServerMetadata struct {
	Issuer                                 string   `json:"issuer"`
	AuthorizationEndpoint                  string   `json:"authorization_endpoint,omitempty"`
	TokenEndpoint                          string   `json:"token_endpoint"`
	RevocationEndpoint                     string   `json:"revocation_endpoint,omitempty"`
	JWKSURI                                string   `json:"jwks_uri,omitempty"`
	ResponseTypesSupported                 []string `json:"response_types_supported"`
	GrantTypesSupported                    []string `json:"grant_types_supported,omitempty"`
	TokenEndpointAuthMethodsSupported      []string `json:"token_endpoint_auth_methods_supported,omitempty"`
	RevocationEndpointAuthMethodsSupported []string `json:"revocation_endpoint_auth_methods_supported,omitempty"`
	CodeChallengeMethodsSupported          []string `json:"code_challenge_methods_supported,omitempty"`
}

OAuthAuthorizationServerMetadata is the RFC 8414 document a token endpoint serves at /.well-known/oauth-authorization-server. Only the fields Agent Mesh populates are present; omitted RFC 8414 fields are optional there too.

type OAuthProtectedResourceMetadata 

type OAuthProtectedResourceMetadata struct {
	Resource               string   `json:"resource"`
	AuthorizationServers   []string `json:"authorization_servers,omitempty"`
	BearerMethodsSupported []string `json:"bearer_methods_supported,omitempty"`
	ScopesSupported        []string `json:"scopes_supported,omitempty"`
}

OAuthProtectedResourceMetadata is the RFC 9728 document a resource server serves at /.well-known/oauth-protected-resource.

type OIDCFederation 

type OIDCFederation struct {

	// Google: https://sts.googleapis.com/v1/token. Other providers: their RFC 8693 endpoint.
	TokenEndpoint string `protobuf:"bytes,1,opt,name=token_endpoint,json=tokenEndpoint,proto3" json:"token_endpoint,omitempty"`
	// The audience the provider expects, e.g. the Google workload or workforce
	// pool provider resource name. One per destination.
	Audience string `protobuf:"bytes,2,opt,name=audience,proto3" json:"audience,omitempty"`
	// Optional service account to impersonate when the API does not accept the
	// federated principal directly (Google iamcredentials.generateAccessToken).
	Impersonate string `protobuf:"bytes,3,opt,name=impersonate,proto3" json:"impersonate,omitempty"`
	// OAuth scopes requested for the destination credential; the TAR may narrow
	// them further, never widen them.
	Scopes []string `protobuf:"bytes,4,rep,name=scopes,proto3" json:"scopes,omitempty"`
	// contains filtered or unexported fields
}

OIDCFederation exchanges the control plane's JWT at a provider STS.

func (*OIDCFederation) Descriptor deprecated 

func (*OIDCFederation) Descriptor() ([]byte, []int)

Deprecated: Use OIDCFederation.ProtoReflect.Descriptor instead.

func (*OIDCFederation) GetAudience 

func (x *OIDCFederation) GetAudience() string

func (*OIDCFederation) GetImpersonate 

func (x *OIDCFederation) GetImpersonate() string

func (*OIDCFederation) GetScopes 

func (x *OIDCFederation) GetScopes() []string

func (*OIDCFederation) GetTokenEndpoint 

func (x *OIDCFederation) GetTokenEndpoint() string

func (*OIDCFederation) ProtoMessage 

func (*OIDCFederation) ProtoMessage()

func (*OIDCFederation) ProtoReflect 

func (x *OIDCFederation) ProtoReflect() protoreflect.Message

func (*OIDCFederation) Reset 

func (x *OIDCFederation) Reset()

func (*OIDCFederation) String 

func (x *OIDCFederation) String() string

type OIDCSession 

type OIDCSession struct {
	Issuer       string `protobuf:"bytes,1,opt,name=issuer,proto3" json:"issuer,omitempty"`
	ClientId     string `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	Audience     string `protobuf:"bytes,3,opt,name=audience,proto3" json:"audience,omitempty"`
	RefreshToken string `protobuf:"bytes,4,opt,name=refresh_token,json=refreshToken,proto3" json:"refresh_token,omitempty"`
	// contains filtered or unexported fields
}

func (*OIDCSession) Descriptor deprecated 

func (*OIDCSession) Descriptor() ([]byte, []int)

Deprecated: Use OIDCSession.ProtoReflect.Descriptor instead.

func (*OIDCSession) GetAudience 

func (x *OIDCSession) GetAudience() string

func (*OIDCSession) GetClientId 

func (x *OIDCSession) GetClientId() string

func (*OIDCSession) GetIssuer 

func (x *OIDCSession) GetIssuer() string

func (*OIDCSession) GetRefreshToken 

func (x *OIDCSession) GetRefreshToken() string

func (*OIDCSession) ProtoMessage 

func (*OIDCSession) ProtoMessage()

func (*OIDCSession) ProtoReflect 

func (x *OIDCSession) ProtoReflect() protoreflect.Message

func (*OIDCSession) Reset 

func (x *OIDCSession) Reset()

func (*OIDCSession) String 

func (x *OIDCSession) String() string

type PeerEvidenceResponse 

type PeerEvidenceResponse struct {
	PeerId        string                 `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	Biscuit       []byte                 `protobuf:"bytes,2,opt,name=biscuit,proto3" json:"biscuit,omitempty"`
	VerifyingKey  []byte                 `protobuf:"bytes,3,opt,name=verifying_key,json=verifyingKey,proto3" json:"verifying_key,omitempty"` // Ed25519 SPKI DER, member of the trusted set
	Roles         []string               `protobuf:"bytes,4,rep,name=roles,proto3" json:"roles,omitempty"`
	Labels        map[string]string      `` /* 139-byte string literal not displayed */
	ExpireTime    *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	RevocationIds []string               `protobuf:"bytes,7,rep,name=revocation_ids,json=revocationIds,proto3" json:"revocation_ids,omitempty"` // hex
	CheckTime     *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=check_time,json=checkTime,proto3" json:"check_time,omitempty"`
	// contains filtered or unexported fields
}

func (*PeerEvidenceResponse) Descriptor deprecated 

func (*PeerEvidenceResponse) Descriptor() ([]byte, []int)

Deprecated: Use PeerEvidenceResponse.ProtoReflect.Descriptor instead.

func (*PeerEvidenceResponse) GetBiscuit 

func (x *PeerEvidenceResponse) GetBiscuit() []byte

func (*PeerEvidenceResponse) GetCheckTime 

func (x *PeerEvidenceResponse) GetCheckTime() *timestamppb.Timestamp

func (*PeerEvidenceResponse) GetExpireTime 

func (x *PeerEvidenceResponse) GetExpireTime() *timestamppb.Timestamp

func (*PeerEvidenceResponse) GetLabels 

func (x *PeerEvidenceResponse) GetLabels() map[string]string

func (*PeerEvidenceResponse) GetPeerId 

func (x *PeerEvidenceResponse) GetPeerId() string

func (*PeerEvidenceResponse) GetRevocationIds 

func (x *PeerEvidenceResponse) GetRevocationIds() []string

func (*PeerEvidenceResponse) GetRoles 

func (x *PeerEvidenceResponse) GetRoles() []string

func (*PeerEvidenceResponse) GetVerifyingKey 

func (x *PeerEvidenceResponse) GetVerifyingKey() []byte

func (*PeerEvidenceResponse) ProtoMessage 

func (*PeerEvidenceResponse) ProtoMessage()

func (*PeerEvidenceResponse) ProtoReflect 

func (x *PeerEvidenceResponse) ProtoReflect() protoreflect.Message

func (*PeerEvidenceResponse) Reset 

func (x *PeerEvidenceResponse) Reset()

func (*PeerEvidenceResponse) String 

func (x *PeerEvidenceResponse) String() string

type PeerRecord 

type PeerRecord struct {
	PeerId string   `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	Addrs  []string `protobuf:"bytes,2,rep,name=addrs,proto3" json:"addrs,omitempty"`
	// contains filtered or unexported fields
}

PeerRecord is a peer and the addresses it is reached at, relayed ones included, each ending in its peer ID.

func (*PeerRecord) Descriptor deprecated 

func (*PeerRecord) Descriptor() ([]byte, []int)

Deprecated: Use PeerRecord.ProtoReflect.Descriptor instead.

func (*PeerRecord) GetAddrs 

func (x *PeerRecord) GetAddrs() []string

func (*PeerRecord) GetPeerId 

func (x *PeerRecord) GetPeerId() string

func (*PeerRecord) ProtoMessage 

func (*PeerRecord) ProtoMessage()

func (*PeerRecord) ProtoReflect 

func (x *PeerRecord) ProtoReflect() protoreflect.Message

func (*PeerRecord) Reset 

func (x *PeerRecord) Reset()

func (*PeerRecord) String 

func (x *PeerRecord) String() string

type PlatformIdentity 

type PlatformIdentity struct {
	Scopes []string `protobuf:"bytes,1,rep,name=scopes,proto3" json:"scopes,omitempty"`
	// contains filtered or unexported fields
}

func (*PlatformIdentity) Descriptor deprecated 

func (*PlatformIdentity) Descriptor() ([]byte, []int)

Deprecated: Use PlatformIdentity.ProtoReflect.Descriptor instead.

func (*PlatformIdentity) GetScopes 

func (x *PlatformIdentity) GetScopes() []string

func (*PlatformIdentity) ProtoMessage 

func (*PlatformIdentity) ProtoMessage()

func (*PlatformIdentity) ProtoReflect 

func (x *PlatformIdentity) ProtoReflect() protoreflect.Message

func (*PlatformIdentity) Reset 

func (x *PlatformIdentity) Reset()

func (*PlatformIdentity) String 

func (x *PlatformIdentity) String() string

type PolicyBinding 

type PolicyBinding struct {
	Role    string   `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
	Members []string `protobuf:"bytes,2,rep,name=members,proto3" json:"members,omitempty"`
	// contains filtered or unexported fields
}

func (*PolicyBinding) Descriptor deprecated 

func (*PolicyBinding) Descriptor() ([]byte, []int)

Deprecated: Use PolicyBinding.ProtoReflect.Descriptor instead.

func (*PolicyBinding) GetMembers 

func (x *PolicyBinding) GetMembers() []string

func (*PolicyBinding) GetRole 

func (x *PolicyBinding) GetRole() string

func (*PolicyBinding) ProtoMessage 

func (*PolicyBinding) ProtoMessage()

func (*PolicyBinding) ProtoReflect 

func (x *PolicyBinding) ProtoReflect() protoreflect.Message

func (*PolicyBinding) Reset 

func (x *PolicyBinding) Reset()

func (*PolicyBinding) String 

func (x *PolicyBinding) String() string

type PolicyConfig 

type PolicyConfig struct {
	Roles    []*PolicyRole        `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
	Bindings []*PolicyBinding     `protobuf:"bytes,2,rep,name=bindings,proto3" json:"bindings,omitempty"`
	Egress   []*EgressDestination `protobuf:"bytes,3,rep,name=egress,proto3" json:"egress,omitempty"`
	// contains filtered or unexported fields
}

PolicyConfig is the mesh policy as the operator writes it: roles and bindings. It is the body of POST /policies and the answer of GET /admin/policy, both protojson. Only the control plane reads it, to mint tokens and to render PolicyConfigGetResponse.

func (*PolicyConfig) Descriptor deprecated 

func (*PolicyConfig) Descriptor() ([]byte, []int)

Deprecated: Use PolicyConfig.ProtoReflect.Descriptor instead.

func (*PolicyConfig) GetBindings 

func (x *PolicyConfig) GetBindings() []*PolicyBinding

func (*PolicyConfig) GetEgress 

func (x *PolicyConfig) GetEgress() []*EgressDestination

func (*PolicyConfig) GetRoles 

func (x *PolicyConfig) GetRoles() []*PolicyRole

func (*PolicyConfig) ProtoMessage 

func (*PolicyConfig) ProtoMessage()

func (*PolicyConfig) ProtoReflect 

func (x *PolicyConfig) ProtoReflect() protoreflect.Message

func (*PolicyConfig) Reset 

func (x *PolicyConfig) Reset()

func (*PolicyConfig) String 

func (x *PolicyConfig) String() string

type PolicyConfigGetRequest 

type PolicyConfigGetRequest struct {
	// contains filtered or unexported fields
}

func (*PolicyConfigGetRequest) Descriptor deprecated 

func (*PolicyConfigGetRequest) Descriptor() ([]byte, []int)

Deprecated: Use PolicyConfigGetRequest.ProtoReflect.Descriptor instead.

func (*PolicyConfigGetRequest) ProtoMessage 

func (*PolicyConfigGetRequest) ProtoMessage()

func (*PolicyConfigGetRequest) ProtoReflect 

func (x *PolicyConfigGetRequest) ProtoReflect() protoreflect.Message

func (*PolicyConfigGetRequest) Reset 

func (x *PolicyConfigGetRequest) Reset()

func (*PolicyConfigGetRequest) String 

func (x *PolicyConfigGetRequest) String() string

type PolicyConfigGetResponse 

type PolicyConfigGetResponse struct {

	// One rule per entry, rendered by the control plane with api.BuildPolicyRules.
	DatalogRules []string `protobuf:"bytes,1,rep,name=datalog_rules,json=datalogRules,proto3" json:"datalog_rules,omitempty"`
	// contains filtered or unexported fields
}

PolicyConfigGetResponse answers GET /policies for a mesh member holding a biscuit. It carries the policy only as Datalog text: this is the contract every member evaluates, and none derives rules from roles and bindings.

func (*PolicyConfigGetResponse) Descriptor deprecated 

func (*PolicyConfigGetResponse) Descriptor() ([]byte, []int)

Deprecated: Use PolicyConfigGetResponse.ProtoReflect.Descriptor instead.

func (*PolicyConfigGetResponse) GetDatalogRules 

func (x *PolicyConfigGetResponse) GetDatalogRules() []string

func (*PolicyConfigGetResponse) ProtoMessage 

func (*PolicyConfigGetResponse) ProtoMessage()

func (*PolicyConfigGetResponse) ProtoReflect 

func (x *PolicyConfigGetResponse) ProtoReflect() protoreflect.Message

func (*PolicyConfigGetResponse) Reset 

func (x *PolicyConfigGetResponse) Reset()

func (*PolicyConfigGetResponse) String 

func (x *PolicyConfigGetResponse) String() string

type PolicyConfigUpdateResponse 

type PolicyConfigUpdateResponse struct {
	Success bool   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
	Error   string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

func (*PolicyConfigUpdateResponse) Descriptor deprecated 

func (*PolicyConfigUpdateResponse) Descriptor() ([]byte, []int)

Deprecated: Use PolicyConfigUpdateResponse.ProtoReflect.Descriptor instead.

func (*PolicyConfigUpdateResponse) GetError 

func (x *PolicyConfigUpdateResponse) GetError() string

func (*PolicyConfigUpdateResponse) GetSuccess 

func (x *PolicyConfigUpdateResponse) GetSuccess() bool

func (*PolicyConfigUpdateResponse) ProtoMessage 

func (*PolicyConfigUpdateResponse) ProtoMessage()

func (*PolicyConfigUpdateResponse) ProtoReflect 

func (x *PolicyConfigUpdateResponse) ProtoReflect() protoreflect.Message

func (*PolicyConfigUpdateResponse) Reset 

func (x *PolicyConfigUpdateResponse) Reset()

func (*PolicyConfigUpdateResponse) String 

func (x *PolicyConfigUpdateResponse) String() string

type PolicyRole 

type PolicyRole struct {
	Name            string   `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	AllowedTargets  []string `protobuf:"bytes,2,rep,name=allowed_targets,json=allowedTargets,proto3" json:"allowed_targets,omitempty"`
	AllowedServices []string `protobuf:"bytes,3,rep,name=allowed_services,json=allowedServices,proto3" json:"allowed_services,omitempty"`
	CustomDatalog   []string `protobuf:"bytes,4,rep,name=custom_datalog,json=customDatalog,proto3" json:"custom_datalog,omitempty"`
	// Labels a node with this role may declare at enrollment, as "*", "key=*"
	// or "key=value". A node declares its own labels, so this is what turns a
	// declaration into something the control plane is willing to sign.
	AllowedLabels []string `protobuf:"bytes,5,rep,name=allowed_labels,json=allowedLabels,proto3" json:"allowed_labels,omitempty"`
	// HTTP narrowing of allowed_services entries; see HTTPGrant.
	Http []*HTTPGrant `protobuf:"bytes,6,rep,name=http,proto3" json:"http,omitempty"`
	// Services a member with this role may serve, in the syntax of
	// allowed_services ("mcp://calc", "inference://*", "*"). A role serves
	// nothing it is not granted here: a router keeps a member's record only
	// for a service its credential grants, and a caller sends a request to
	// a provider it found by name only when the provider's credential does.
	// An egress destination needs no entry: served_by grants it to the
	// nodes it selects.
	AllowedPublish []string `protobuf:"bytes,7,rep,name=allowed_publish,json=allowedPublish,proto3" json:"allowed_publish,omitempty"`
	// contains filtered or unexported fields
}

func WithEgressPublish 

func WithEgressPublish(policyRoles []*PolicyRole, egress []*EgressDestination, roles []string, labels map[string]string) []*PolicyRole

WithEgressPublish returns policyRoles with the egress destinations a node with these roles and labels serves added to what it may publish: served_by is who may serve a destination, and the record the node announces for it needs the grant like any other. The role entries are copied, never changed in place; a role the policy does not define gets an entry that grants publishing alone.

func (*PolicyRole) Descriptor deprecated 

func (*PolicyRole) Descriptor() ([]byte, []int)

Deprecated: Use PolicyRole.ProtoReflect.Descriptor instead.

func (*PolicyRole) GetAllowedLabels 

func (x *PolicyRole) GetAllowedLabels() []string

func (*PolicyRole) GetAllowedPublish 

func (x *PolicyRole) GetAllowedPublish() []string

func (*PolicyRole) GetAllowedServices 

func (x *PolicyRole) GetAllowedServices() []string

func (*PolicyRole) GetAllowedTargets 

func (x *PolicyRole) GetAllowedTargets() []string

func (*PolicyRole) GetCustomDatalog 

func (x *PolicyRole) GetCustomDatalog() []string

func (*PolicyRole) GetHttp 

func (x *PolicyRole) GetHttp() []*HTTPGrant

func (*PolicyRole) GetName 

func (x *PolicyRole) GetName() string

func (*PolicyRole) ProtoMessage 

func (*PolicyRole) ProtoMessage()

func (*PolicyRole) ProtoReflect 

func (x *PolicyRole) ProtoReflect() protoreflect.Message

func (*PolicyRole) Reset 

func (x *PolicyRole) Reset()

func (*PolicyRole) String 

func (x *PolicyRole) String() string

type PolicyRule 

type PolicyRule struct {
	Rule biscuit.Rule
	Text string
}

PolicyRule is one mesh policy rule in both the form biscuit-go evaluates and the Datalog text every other Biscuit implementation parses.

func BuildEgressServingRules 

func BuildEgressServingRules(egress []*EgressDestination) []PolicyRule

BuildEgressServingRules grants each destination to the nodes that serve it: granted_service_exact("egress", name) and granted_publish_exact("egress", name) <- role(r) or <- label(k, v) for every served_by entry. The serving node evaluates its own credential when a local client asks for the destination, and the router and the callers evaluate it when the node publishes, so both grants have to reach them; the rules travel with the mesh policy like every other grant.

func BuildPolicyRules 

func BuildPolicyRules(roles []*PolicyRole, bindings []*PolicyBinding) (rules []PolicyRule, warnings []string)

BuildPolicyRules turns the mesh policy into the Datalog rules a provider adds to its authorizer: bindings grant role() from attested identity facts, roles grant granted_* facts from role(). Warnings name entries that were skipped or that widen the mesh more than an operator may expect; the caller decides how to surface them.

type RegisterServiceRequest 

type RegisterServiceRequest struct {
	Service *ServiceInfo `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// Types that are valid to be assigned to Backend:
	//
	//	*RegisterServiceRequest_TargetUrl
	//	*RegisterServiceRequest_Command
	Backend isRegisterServiceRequest_Backend `protobuf_oneof:"backend"`
	// contains filtered or unexported fields
}

func (*RegisterServiceRequest) Descriptor deprecated 

func (*RegisterServiceRequest) Descriptor() ([]byte, []int)

Deprecated: Use RegisterServiceRequest.ProtoReflect.Descriptor instead.

func (*RegisterServiceRequest) GetBackend 

func (x *RegisterServiceRequest) GetBackend() isRegisterServiceRequest_Backend

func (*RegisterServiceRequest) GetCommand 

func (x *RegisterServiceRequest) GetCommand() *CommandBackend

func (*RegisterServiceRequest) GetService 

func (x *RegisterServiceRequest) GetService() *ServiceInfo

func (*RegisterServiceRequest) GetTargetUrl 

func (x *RegisterServiceRequest) GetTargetUrl() string

func (*RegisterServiceRequest) ProtoMessage 

func (*RegisterServiceRequest) ProtoMessage()

func (*RegisterServiceRequest) ProtoReflect 

func (x *RegisterServiceRequest) ProtoReflect() protoreflect.Message

func (*RegisterServiceRequest) Reset 

func (x *RegisterServiceRequest) Reset()

func (*RegisterServiceRequest) String 

func (x *RegisterServiceRequest) String() string

type RegisterServiceRequest_Command 

type RegisterServiceRequest_Command struct {
	Command *CommandBackend `protobuf:"bytes,3,opt,name=command,proto3,oneof"`
}

type RegisterServiceRequest_TargetUrl 

type RegisterServiceRequest_TargetUrl struct {
	TargetUrl string `protobuf:"bytes,2,opt,name=target_url,json=targetUrl,proto3,oneof"`
}

type ResponseInspection 

type ResponseInspection int32
const (
	ResponseInspection_RESPONSE_INSPECTION_BUFFERED     ResponseInspection = 0
	ResponseInspection_RESPONSE_INSPECTION_REQUEST_ONLY ResponseInspection = 1
)

func (ResponseInspection) Descriptor 

func (ResponseInspection) Descriptor() protoreflect.EnumDescriptor

func (ResponseInspection) Enum 

func (x ResponseInspection) Enum() *ResponseInspection

func (ResponseInspection) EnumDescriptor deprecated 

func (ResponseInspection) EnumDescriptor() ([]byte, []int)

Deprecated: Use ResponseInspection.Descriptor instead.

func (ResponseInspection) Number 

func (x ResponseInspection) Number() protoreflect.EnumNumber

func (ResponseInspection) String 

func (x ResponseInspection) String() string

func (ResponseInspection) Type 

func (ResponseInspection) Type() protoreflect.EnumType

type RevocationsResponse 

type RevocationsResponse struct {
	RevocationIds []string `protobuf:"bytes,1,rep,name=revocation_ids,json=revocationIds,proto3" json:"revocation_ids,omitempty"`
	BannedPeerIds []string `protobuf:"bytes,2,rep,name=banned_peer_ids,json=bannedPeerIds,proto3" json:"banned_peer_ids,omitempty"`
	// contains filtered or unexported fields
}

RevocationsResponse answers GET /revocations on the control plane: the set of revoked Biscuit authority revocation IDs (hex-encoded RevocationIds()[0]) and banned peer IDs.

func (*RevocationsResponse) Descriptor deprecated 

func (*RevocationsResponse) Descriptor() ([]byte, []int)

Deprecated: Use RevocationsResponse.ProtoReflect.Descriptor instead.

func (*RevocationsResponse) GetBannedPeerIds 

func (x *RevocationsResponse) GetBannedPeerIds() []string

func (*RevocationsResponse) GetRevocationIds 

func (x *RevocationsResponse) GetRevocationIds() []string

func (*RevocationsResponse) ProtoMessage 

func (*RevocationsResponse) ProtoMessage()

func (*RevocationsResponse) ProtoReflect 

func (x *RevocationsResponse) ProtoReflect() protoreflect.Message

func (*RevocationsResponse) Reset 

func (x *RevocationsResponse) Reset()

func (*RevocationsResponse) String 

func (x *RevocationsResponse) String() string

type RouterGoAway 

type RouterGoAway struct {
	Reason     RouterGoAway_Reason  `protobuf:"varint,1,opt,name=reason,proto3,enum=agentmesh.v1.RouterGoAway_Reason" json:"reason,omitempty"`
	RetryAfter *durationpb.Duration `protobuf:"bytes,2,opt,name=retry_after,json=retryAfter,proto3" json:"retry_after,omitempty"`
	// contains filtered or unexported fields
}

RouterGoAway is what a router sends, on GoAwayProtocolID, to a member it will no longer hold: it is stopping, or it holds more members than it is sized for. The member attaches to another router and does not come back to this one before retry_after has passed. A member that does not speak the protocol sees its connection close instead.

func (*RouterGoAway) Descriptor deprecated 

func (*RouterGoAway) Descriptor() ([]byte, []int)

Deprecated: Use RouterGoAway.ProtoReflect.Descriptor instead.

func (*RouterGoAway) GetReason 

func (x *RouterGoAway) GetReason() RouterGoAway_Reason

func (*RouterGoAway) GetRetryAfter 

func (x *RouterGoAway) GetRetryAfter() *durationpb.Duration

func (*RouterGoAway) ProtoMessage 

func (*RouterGoAway) ProtoMessage()

func (*RouterGoAway) ProtoReflect 

func (x *RouterGoAway) ProtoReflect() protoreflect.Message

func (*RouterGoAway) Reset 

func (x *RouterGoAway) Reset()

func (*RouterGoAway) String 

func (x *RouterGoAway) String() string

type RouterGoAway_Reason 

type RouterGoAway_Reason int32
const (
	RouterGoAway_REASON_UNSPECIFIED RouterGoAway_Reason = 0
	RouterGoAway_DRAINING           RouterGoAway_Reason = 1 // the router is shutting down
	RouterGoAway_OVERLOADED         RouterGoAway_Reason = 2 // the router is above its high watermark
)

func (RouterGoAway_Reason) Descriptor 

func (RouterGoAway_Reason) Descriptor() protoreflect.EnumDescriptor

func (RouterGoAway_Reason) Enum 

func (x RouterGoAway_Reason) Enum() *RouterGoAway_Reason

func (RouterGoAway_Reason) EnumDescriptor deprecated 

func (RouterGoAway_Reason) EnumDescriptor() ([]byte, []int)

Deprecated: Use RouterGoAway_Reason.Descriptor instead.

func (RouterGoAway_Reason) Number 

func (x RouterGoAway_Reason) Number() protoreflect.EnumNumber

func (RouterGoAway_Reason) String 

func (x RouterGoAway_Reason) String() string

func (RouterGoAway_Reason) Type 

func (RouterGoAway_Reason) Type() protoreflect.EnumType

type RouterInfo 

type RouterInfo struct {
	PeerId string `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	// The router's announced addresses, each ending in its peer ID.
	Addresses []string `protobuf:"bytes,2,rep,name=addresses,proto3" json:"addresses,omitempty"`
	// The router's labels, the same labels as a node's: declared at
	// enrollment (agentmesh-router --label), signed by the control plane only
	// if the router's role allows them (PolicyRole.allowed_labels), and
	// carried as label() facts in the router's credential, where a member
	// verifies them at the handshake. A member selects routers by them
	// (--router-selector, every pair must match) or prefers routers by them
	// (--router-prefer). They place a router; they grant it nothing.
	Labels map[string]string `` /* 139-byte string literal not displayed */
	// Connections the router held when it last renewed its lease, and the
	// number it accepts (its high watermark). A member attaches to the
	// routers with the most room; connection_limit of zero means unknown.
	Connections     int32 `protobuf:"varint,4,opt,name=connections,proto3" json:"connections,omitempty"`
	ConnectionLimit int32 `protobuf:"varint,5,opt,name=connection_limit,json=connectionLimit,proto3" json:"connection_limit,omitempty"`
	// contains filtered or unexported fields
}

RouterInfo is one router as the control plane lists it on /info.

func (*RouterInfo) Descriptor deprecated 

func (*RouterInfo) Descriptor() ([]byte, []int)

Deprecated: Use RouterInfo.ProtoReflect.Descriptor instead.

func (*RouterInfo) GetAddresses 

func (x *RouterInfo) GetAddresses() []string

func (*RouterInfo) GetConnectionLimit 

func (x *RouterInfo) GetConnectionLimit() int32

func (*RouterInfo) GetConnections 

func (x *RouterInfo) GetConnections() int32

func (*RouterInfo) GetLabels 

func (x *RouterInfo) GetLabels() map[string]string

func (*RouterInfo) GetPeerId 

func (x *RouterInfo) GetPeerId() string

func (*RouterInfo) ProtoMessage 

func (*RouterInfo) ProtoMessage()

func (*RouterInfo) ProtoReflect 

func (x *RouterInfo) ProtoReflect() protoreflect.Message

func (*RouterInfo) Reset 

func (x *RouterInfo) Reset()

func (*RouterInfo) String 

func (x *RouterInfo) String() string

type RouterLease 

type RouterLease struct {
	PeerId string `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	// Multiaddrs, `/p2p/<peer id>` suffixed.
	Addresses       []string               `protobuf:"bytes,2,rep,name=addresses,proto3" json:"addresses,omitempty"`
	LastRenewalTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=last_renewal_time,json=lastRenewalTime,proto3" json:"last_renewal_time,omitempty"`
	ExpireTime      *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	ConnectedPeers  []string               `protobuf:"bytes,5,rep,name=connected_peers,json=connectedPeers,proto3" json:"connected_peers,omitempty"`
	DhtSize         int32                  `protobuf:"varint,6,opt,name=dht_size,json=dhtSize,proto3" json:"dht_size,omitempty"`
	// contains filtered or unexported fields
}

RouterLease is a router's current registration with the control plane.

func (*RouterLease) Descriptor deprecated 

func (*RouterLease) Descriptor() ([]byte, []int)

Deprecated: Use RouterLease.ProtoReflect.Descriptor instead.

func (*RouterLease) GetAddresses 

func (x *RouterLease) GetAddresses() []string

func (*RouterLease) GetConnectedPeers 

func (x *RouterLease) GetConnectedPeers() []string

func (*RouterLease) GetDhtSize 

func (x *RouterLease) GetDhtSize() int32

func (*RouterLease) GetExpireTime 

func (x *RouterLease) GetExpireTime() *timestamppb.Timestamp

func (*RouterLease) GetLastRenewalTime 

func (x *RouterLease) GetLastRenewalTime() *timestamppb.Timestamp

func (*RouterLease) GetPeerId 

func (x *RouterLease) GetPeerId() string

func (*RouterLease) ProtoMessage 

func (*RouterLease) ProtoMessage()

func (*RouterLease) ProtoReflect 

func (x *RouterLease) ProtoReflect() protoreflect.Message

func (*RouterLease) Reset 

func (x *RouterLease) Reset()

func (*RouterLease) String 

func (x *RouterLease) String() string

type RouterLeaseRequest 

type RouterLeaseRequest struct {
	PeerId         string   `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	Addresses      []string `protobuf:"bytes,2,rep,name=addresses,proto3" json:"addresses,omitempty"`
	Biscuit        []byte   `protobuf:"bytes,3,opt,name=biscuit,proto3" json:"biscuit,omitempty"`
	ConnectedPeers []string `protobuf:"bytes,4,rep,name=connected_peers,json=connectedPeers,proto3" json:"connected_peers,omitempty"`
	DhtSize        int32    `protobuf:"varint,5,opt,name=dht_size,json=dhtSize,proto3" json:"dht_size,omitempty"`
	// Proof of possession of the router's enrolled key: challenge_unix_ms is
	// the caller's clock in unix milliseconds and challenge_signature signs
	// the UTF-8 bytes of "mesh:routers-lease:<peer_id>:<challenge_unix_ms>"
	// with the key the router enrolled with. Required. The biscuit alone is
	// not proof: routers hand theirs to every peer they authenticate.
	ChallengeUnixMs    int64  `protobuf:"varint,6,opt,name=challenge_unix_ms,json=challengeUnixMs,proto3" json:"challenge_unix_ms,omitempty"`
	ChallengeSignature []byte `protobuf:"bytes,7,opt,name=challenge_signature,json=challengeSignature,proto3" json:"challenge_signature,omitempty"`
	// How long this lease stays valid. Unset means the control plane's lease
	// duration. A router may shorten its lease, never lengthen it: on its last
	// renewal before stopping it sets the time it expects to be away, zero to
	// be withdrawn at once, so a joiner is not handed a router that is gone
	// and a router back within that time is still listed.
	Ttl *durationpb.Duration `protobuf:"bytes,8,opt,name=ttl,proto3" json:"ttl,omitempty"`
	// The router's load, listed for it on /info (RouterInfo): its open
	// inbound connections and the number it accepts.
	Connections     int32 `protobuf:"varint,9,opt,name=connections,proto3" json:"connections,omitempty"`
	ConnectionLimit int32 `protobuf:"varint,10,opt,name=connection_limit,json=connectionLimit,proto3" json:"connection_limit,omitempty"`
	// contains filtered or unexported fields
}

func (*RouterLeaseRequest) Descriptor deprecated 

func (*RouterLeaseRequest) Descriptor() ([]byte, []int)

Deprecated: Use RouterLeaseRequest.ProtoReflect.Descriptor instead.

func (*RouterLeaseRequest) GetAddresses 

func (x *RouterLeaseRequest) GetAddresses() []string

func (*RouterLeaseRequest) GetBiscuit 

func (x *RouterLeaseRequest) GetBiscuit() []byte

func (*RouterLeaseRequest) GetChallengeSignature 

func (x *RouterLeaseRequest) GetChallengeSignature() []byte

func (*RouterLeaseRequest) GetChallengeUnixMs 

func (x *RouterLeaseRequest) GetChallengeUnixMs() int64

func (*RouterLeaseRequest) GetConnectedPeers 

func (x *RouterLeaseRequest) GetConnectedPeers() []string

func (*RouterLeaseRequest) GetConnectionLimit 

func (x *RouterLeaseRequest) GetConnectionLimit() int32

func (*RouterLeaseRequest) GetConnections 

func (x *RouterLeaseRequest) GetConnections() int32

func (*RouterLeaseRequest) GetDhtSize 

func (x *RouterLeaseRequest) GetDhtSize() int32

func (*RouterLeaseRequest) GetPeerId 

func (x *RouterLeaseRequest) GetPeerId() string

func (*RouterLeaseRequest) GetTtl 

func (x *RouterLeaseRequest) GetTtl() *durationpb.Duration

func (*RouterLeaseRequest) ProtoMessage 

func (*RouterLeaseRequest) ProtoMessage()

func (*RouterLeaseRequest) ProtoReflect 

func (x *RouterLeaseRequest) ProtoReflect() protoreflect.Message

func (*RouterLeaseRequest) Reset 

func (x *RouterLeaseRequest) Reset()

func (*RouterLeaseRequest) String 

func (x *RouterLeaseRequest) String() string

type RouterLeaseResponse 

type RouterLeaseResponse struct {
	Success    bool                   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
	Error      string                 `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	ExpireTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	// contains filtered or unexported fields
}

func (*RouterLeaseResponse) Descriptor deprecated 

func (*RouterLeaseResponse) Descriptor() ([]byte, []int)

Deprecated: Use RouterLeaseResponse.ProtoReflect.Descriptor instead.

func (*RouterLeaseResponse) GetError 

func (x *RouterLeaseResponse) GetError() string

func (*RouterLeaseResponse) GetExpireTime 

func (x *RouterLeaseResponse) GetExpireTime() *timestamppb.Timestamp

func (*RouterLeaseResponse) GetSuccess 

func (x *RouterLeaseResponse) GetSuccess() bool

func (*RouterLeaseResponse) ProtoMessage 

func (*RouterLeaseResponse) ProtoMessage()

func (*RouterLeaseResponse) ProtoReflect 

func (x *RouterLeaseResponse) ProtoReflect() protoreflect.Message

func (*RouterLeaseResponse) Reset 

func (x *RouterLeaseResponse) Reset()

func (*RouterLeaseResponse) String 

func (x *RouterLeaseResponse) String() string

type STSTokenRequest 

type STSTokenRequest struct {

	// The caller's Biscuit token (authority block + any tar_block chain).
	Biscuit []byte `protobuf:"bytes,1,opt,name=biscuit,proto3" json:"biscuit,omitempty"`
	// The egress destination hostname (e.g. "bigquery.googleapis.com").
	Destination string `protobuf:"bytes,2,opt,name=destination,proto3" json:"destination,omitempty"`
	// Optional explicit audience for the border JWT when not derived from the
	// destination's broker configuration.
	Audience string `protobuf:"bytes,3,opt,name=audience,proto3" json:"audience,omitempty"`
	// Proof of possession of the calling egress node's enrolled key:
	// challenge_unix_ms is the caller's clock in unix milliseconds and
	// challenge_signature signs the UTF-8 bytes of
	// "mesh:sts-token:<peer_id>:<challenge_unix_ms>".
	ChallengeUnixMs    int64  `protobuf:"varint,4,opt,name=challenge_unix_ms,json=challengeUnixMs,proto3" json:"challenge_unix_ms,omitempty"`
	ChallengeSignature []byte `protobuf:"bytes,5,opt,name=challenge_signature,json=challengeSignature,proto3" json:"challenge_signature,omitempty"`
	// contains filtered or unexported fields
}

STSTokenRequest is the body of POST /sts/token on the control plane: an enrolled egress agentmesh-node asks the control plane (acting as OIDC issuer) to verify a caller's Biscuit and TaskAuthorizationRule chain for an egress destination and mint a short-lived ES256 border JWT for cloud STS federation.

func (*STSTokenRequest) Descriptor deprecated 

func (*STSTokenRequest) Descriptor() ([]byte, []int)

Deprecated: Use STSTokenRequest.ProtoReflect.Descriptor instead.

func (*STSTokenRequest) GetAudience 

func (x *STSTokenRequest) GetAudience() string

func (*STSTokenRequest) GetBiscuit 

func (x *STSTokenRequest) GetBiscuit() []byte

func (*STSTokenRequest) GetChallengeSignature 

func (x *STSTokenRequest) GetChallengeSignature() []byte

func (*STSTokenRequest) GetChallengeUnixMs 

func (x *STSTokenRequest) GetChallengeUnixMs() int64

func (*STSTokenRequest) GetDestination 

func (x *STSTokenRequest) GetDestination() string

func (*STSTokenRequest) ProtoMessage 

func (*STSTokenRequest) ProtoMessage()

func (*STSTokenRequest) ProtoReflect 

func (x *STSTokenRequest) ProtoReflect() protoreflect.Message

func (*STSTokenRequest) Reset 

func (x *STSTokenRequest) Reset()

func (*STSTokenRequest) String 

func (x *STSTokenRequest) String() string

type STSTokenResponse 

type STSTokenResponse struct {
	Jwt        string                 `protobuf:"bytes,1,opt,name=jwt,proto3" json:"jwt,omitempty"`
	ExpireTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	Subject    string                 `protobuf:"bytes,3,opt,name=subject,proto3" json:"subject,omitempty"`
	Roles      []string               `protobuf:"bytes,4,rep,name=roles,proto3" json:"roles,omitempty"`
	TaskName   string                 `protobuf:"bytes,5,opt,name=task_name,json=taskName,proto3" json:"task_name,omitempty"`
	// contains filtered or unexported fields
}

func (*STSTokenResponse) Descriptor deprecated 

func (*STSTokenResponse) Descriptor() ([]byte, []int)

Deprecated: Use STSTokenResponse.ProtoReflect.Descriptor instead.

func (*STSTokenResponse) GetExpireTime 

func (x *STSTokenResponse) GetExpireTime() *timestamppb.Timestamp

func (*STSTokenResponse) GetJwt 

func (x *STSTokenResponse) GetJwt() string

func (*STSTokenResponse) GetRoles 

func (x *STSTokenResponse) GetRoles() []string

func (*STSTokenResponse) GetSubject 

func (x *STSTokenResponse) GetSubject() string

func (*STSTokenResponse) GetTaskName 

func (x *STSTokenResponse) GetTaskName() string

func (*STSTokenResponse) ProtoMessage 

func (*STSTokenResponse) ProtoMessage()

func (*STSTokenResponse) ProtoReflect 

func (x *STSTokenResponse) ProtoReflect() protoreflect.Message

func (*STSTokenResponse) Reset 

func (x *STSTokenResponse) Reset()

func (*STSTokenResponse) String 

func (x *STSTokenResponse) String() string

type ServiceConfig 

type ServiceConfig struct {
	Type        string `yaml:"type"` // e.g., "mcp", "inference"
	Name        string `yaml:"name"`
	Description string `yaml:"description"`
	TargetURL   string `yaml:"target_url,omitempty"`
	// TargetAuthPath names a file holding the credential the backend at
	// TargetURL requires: "TOKEN" is sent as "Authorization: Bearer TOKEN",
	// "user:pass" as HTTP Basic. A file, not a value, for the same reason
	// the CLI takes --api-token-path: config files are copied, committed and
	// rendered into ConfigMaps; a credential in one is a credential in all.
	TargetAuthPath string            `yaml:"target_auth_path,omitempty"`
	Command        []string          `yaml:"command,omitempty"`
	Env            map[string]string `yaml:"env,omitempty"`
}

type ServiceInfo 

type ServiceInfo struct {
	Type        ServiceType `protobuf:"varint,1,opt,name=type,proto3,enum=agentmesh.v1.ServiceType" json:"type,omitempty"`
	Name        string      `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	Description string      `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
	// contains filtered or unexported fields
}

func (*ServiceInfo) Descriptor deprecated 

func (*ServiceInfo) Descriptor() ([]byte, []int)

Deprecated: Use ServiceInfo.ProtoReflect.Descriptor instead.

func (*ServiceInfo) GetDescription 

func (x *ServiceInfo) GetDescription() string

func (*ServiceInfo) GetName 

func (x *ServiceInfo) GetName() string

func (*ServiceInfo) GetType 

func (x *ServiceInfo) GetType() ServiceType

func (*ServiceInfo) ProtoMessage 

func (*ServiceInfo) ProtoMessage()

func (*ServiceInfo) ProtoReflect 

func (x *ServiceInfo) ProtoReflect() protoreflect.Message

func (*ServiceInfo) Reset 

func (x *ServiceInfo) Reset()

func (*ServiceInfo) String 

func (x *ServiceInfo) String() string

type ServiceType 

type ServiceType int32
const (
	ServiceType_SERVICE_TYPE_UNSPECIFIED ServiceType = 0
	ServiceType_SERVICE_TYPE_MCP         ServiceType = 1
	ServiceType_SERVICE_TYPE_INFERENCE   ServiceType = 2
	ServiceType_SERVICE_TYPE_A2A         ServiceType = 3
	// A destination outside the mesh, reached through a node that enforces
	// policy on it. The service name is the destination hostname, so a grant
	// reads egress://api.github.com and the request fact
	// service("egress", "api.github.com").
	ServiceType_SERVICE_TYPE_EGRESS ServiceType = 4
)

func ParseServiceType 

func ParseServiceType(s string) (ServiceType, error)

ParseServiceType converts a string identifier (e.g. from JSON or REST) to the ServiceType protobuf enum.

func ServiceOfRecord 

func ServiceOfRecord(provider peer.ID, key []byte, service string) (ServiceType, string, error)

ServiceOfRecord parses the service a record names, "<type>://<name>", and reports whether key is one of that service's: by name or by type. A record that names no service is the provider's own, under PeerKey. This is what a router checks before it keeps a member's record, so that a member announces itself, and the services it names, and nothing else.

func (ServiceType) Descriptor 

func (ServiceType) Descriptor() protoreflect.EnumDescriptor

func (ServiceType) Enum 

func (x ServiceType) Enum() *ServiceType

func (ServiceType) EnumDescriptor deprecated 

func (ServiceType) EnumDescriptor() ([]byte, []int)

Deprecated: Use ServiceType.Descriptor instead.

func (ServiceType) Number 

func (x ServiceType) Number() protoreflect.EnumNumber

func (ServiceType) String 

func (x ServiceType) String() string

func (ServiceType) Type 

func (ServiceType) Type() protoreflect.EnumType

type TaskAuthorizationRule 

type TaskAuthorizationRule struct {
	Name        string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	DisplayName string `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
	// Positive allow-list of rules for this hop. Empty rules list denies everything.
	Rules []*TaskRule `protobuf:"bytes,3,rep,name=rules,proto3" json:"rules,omitempty"`
	// Optional shorter expiration for this task hop. Effective token expiry is
	// the minimum across the authority block's expiration() fact and every
	// appended block's expire_time.
	ExpireTime *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	// contains filtered or unexported fields
}

TaskAuthorizationRule narrows a credential's authority for a specific task or sub-agent hop. Across multiple appended blocks (1..k), semantics are strict set intersection (logical AND): a request is permitted only if it is allowed by the standing mesh policy AND is before every block's expire_time AND matches at least one TaskRule in EVERY appended TaskAuthorizationRule block.

func BuildTARFromOAuthParams 

func BuildTARFromOAuthParams(defaultName, optionsParam string, resources []string, scope string, expireTime *timestamppb.Timestamp) (*TaskAuthorizationRule, error)

BuildTARFromOAuthParams constructs and validates a TaskAuthorizationRule from OAuth 2.1 / RFC 8693 / RFC 8707 request parameters:

  • optionsParam: optional base64url-serialized TaskAuthorizationRule protobuf (or JSON object when starting with '{').
  • resources: optional RFC 8707 resource indicators (e.g. "mcp://weather").
  • scope: optional space-delimited scope tokens ("mcp://...", "tool:<name>", "method:<HTTP_METHOD>", "path:<prefix>", "perm:<permission>").

Returns (nil, nil) if none of optionsParam, resources, or scope narrow the token.

func DecodeTARBlockPayload 

func DecodeTARBlockPayload(b64 string) (*TaskAuthorizationRule, error)

DecodeTARBlockPayload decodes an unpadded base64url string into a validated TaskAuthorizationRule, rejecting oversized payloads and unknown wire fields.

func ParseTARBlockSource 

func ParseTARBlockSource(blockSource string) (*TaskAuthorizationRule, error)

ParseTARBlockSource validates that a Biscuit block's Datalog source text contains solely a single tar_block("<base64url>") fact (with optional trailing semicolon and whitespace) and decodes its TaskAuthorizationRule.

func (*TaskAuthorizationRule) Descriptor deprecated 

func (*TaskAuthorizationRule) Descriptor() ([]byte, []int)

Deprecated: Use TaskAuthorizationRule.ProtoReflect.Descriptor instead.

func (*TaskAuthorizationRule) GetDisplayName 

func (x *TaskAuthorizationRule) GetDisplayName() string

func (*TaskAuthorizationRule) GetExpireTime 

func (x *TaskAuthorizationRule) GetExpireTime() *timestamppb.Timestamp

func (*TaskAuthorizationRule) GetName 

func (x *TaskAuthorizationRule) GetName() string

func (*TaskAuthorizationRule) GetRules 

func (x *TaskAuthorizationRule) GetRules() []*TaskRule

func (*TaskAuthorizationRule) ProtoMessage 

func (*TaskAuthorizationRule) ProtoMessage()

func (*TaskAuthorizationRule) ProtoReflect 

func (x *TaskAuthorizationRule) ProtoReflect() protoreflect.Message

func (*TaskAuthorizationRule) Reset 

func (x *TaskAuthorizationRule) Reset()

func (*TaskAuthorizationRule) String 

func (x *TaskAuthorizationRule) String() string

type TaskOperation 

type TaskOperation struct {

	// Allowed MCP tool names (enforced by the PEP on mcp:// tools/call).
	AllowedTools []string `protobuf:"bytes,1,rep,name=allowed_tools,json=allowedTools,proto3" json:"allowed_tools,omitempty"`
	// Allowed HTTP methods (e.g. ["GET", "POST"]), validated with httpMethodSyntax.
	AllowedMethods []string `protobuf:"bytes,2,rep,name=allowed_methods,json=allowedMethods,proto3" json:"allowed_methods,omitempty"`
	// Allowed HTTP path patterns ("/exact" or "/prefix/*"), validated with
	// validateHTTPGrantPath.
	AllowedPaths []string `protobuf:"bytes,3,rep,name=allowed_paths,json=allowedPaths,proto3" json:"allowed_paths,omitempty"`
	// Allowed cloud IAM permissions (e.g. "bigquery.googleapis.com/datasets.get").
	// Opaque to the wire PEP; consumed by CloudTokenExchanger at egress.
	AllowedPermissions []string `protobuf:"bytes,4,rep,name=allowed_permissions,json=allowedPermissions,proto3" json:"allowed_permissions,omitempty"`
	// contains filtered or unexported fields
}

func (*TaskOperation) Descriptor deprecated 

func (*TaskOperation) Descriptor() ([]byte, []int)

Deprecated: Use TaskOperation.ProtoReflect.Descriptor instead.

func (*TaskOperation) GetAllowedMethods 

func (x *TaskOperation) GetAllowedMethods() []string

func (*TaskOperation) GetAllowedPaths 

func (x *TaskOperation) GetAllowedPaths() []string

func (*TaskOperation) GetAllowedPermissions 

func (x *TaskOperation) GetAllowedPermissions() []string

func (*TaskOperation) GetAllowedTools 

func (x *TaskOperation) GetAllowedTools() []string

func (*TaskOperation) ProtoMessage 

func (*TaskOperation) ProtoMessage()

func (*TaskOperation) ProtoReflect 

func (x *TaskOperation) ProtoReflect() protoreflect.Message

func (*TaskOperation) Reset 

func (x *TaskOperation) Reset()

func (*TaskOperation) String 

func (x *TaskOperation) String() string

type TaskRequestContext 

type TaskRequestContext struct {
	ServiceType string
	ServiceName string

	// HasHTTP is true when the verifier handles the request as HTTP with
	// Method and Path taken from the wire. A CONNECT tunnel carries
	// Method == "CONNECT" and Path == "".
	HasHTTP bool
	Method  string
	Path    string

	// MCPTool is the tool name from params.name on an MCP tools/call request.
	MCPTool string

	// AllowMCPStreamInit permits an MCP session handshake (before tools/call)
	// to satisfy a rule whose only operation restriction is allowed_tools.
	// Every subsequent tools/call on the stream is evaluated with
	// AllowMCPStreamInit false and MCPTool set to params.name.
	AllowMCPStreamInit bool
}

TaskRequestContext carries the wire attributes of a request evaluated against a chain of TaskAuthorizationRules.

type TaskRule 

type TaskRule struct {
	Description string `protobuf:"bytes,1,opt,name=description,proto3" json:"description,omitempty"`
	// Allowed mesh services (e.g., "mcp://bigquery", "inference://gemini.*",
	// "egress://bigquery.googleapis.com"). Uses the dot-anchored grammar of
	// api.ValidateServiceFormat ("*", "<type>://*", "<type>://*.<suffix>",
	// "<type>://<prefix>.*", "<type>://<exact>"). Required (non-empty).
	AllowedServices []string `protobuf:"bytes,2,rep,name=allowed_services,json=allowedServices,proto3" json:"allowed_services,omitempty"`
	// Optional operation-level allow-list. If set, the request must also match
	// the specified MCP tools, HTTP methods/paths, or cloud permissions.
	Operation *TaskOperation `protobuf:"bytes,3,opt,name=operation,proto3" json:"operation,omitempty"`
	// Optional allowed upstream resource names (e.g. CRM resource prefixes
	// "//bigquery.googleapis.com/projects/my-proj/datasets/sales_2026").
	// Opaque to the wire PEP; consumed by CloudTokenExchanger at egress.
	AllowedResources []string `protobuf:"bytes,4,rep,name=allowed_resources,json=allowedResources,proto3" json:"allowed_resources,omitempty"`
	// contains filtered or unexported fields
}

func (*TaskRule) Descriptor deprecated 

func (*TaskRule) Descriptor() ([]byte, []int)

Deprecated: Use TaskRule.ProtoReflect.Descriptor instead.

func (*TaskRule) GetAllowedResources 

func (x *TaskRule) GetAllowedResources() []string

func (*TaskRule) GetAllowedServices 

func (x *TaskRule) GetAllowedServices() []string

func (*TaskRule) GetDescription 

func (x *TaskRule) GetDescription() string

func (*TaskRule) GetOperation 

func (x *TaskRule) GetOperation() *TaskOperation

func (*TaskRule) ProtoMessage 

func (*TaskRule) ProtoMessage()

func (*TaskRule) ProtoReflect 

func (x *TaskRule) ProtoReflect() protoreflect.Message

func (*TaskRule) Reset 

func (x *TaskRule) Reset()

func (*TaskRule) String 

func (x *TaskRule) String() string

type TokenExchangeRequest 

type TokenExchangeRequest struct {

	// The subject's platform JWT to verify against the control plane's OIDC
	// providers and allowed audiences.
	SubjectToken string `protobuf:"bytes,1,opt,name=subject_token,json=subjectToken,proto3" json:"subject_token,omitempty"`
	// Optional initial task narrowing to append as block 1 on the minted
	// Biscuit.
	TaskRule *TaskAuthorizationRule `protobuf:"bytes,2,opt,name=task_rule,json=taskRule,proto3" json:"task_rule,omitempty"`
	// If true, the minted Biscuit is sealed (b.Seal()) before returning so
	// downstream holders cannot append further blocks.
	Seal bool `protobuf:"varint,3,opt,name=seal,proto3" json:"seal,omitempty"`
	// Proof of possession of the calling node's enrolled key:
	// challenge_unix_ms is the caller's clock in unix milliseconds and
	// challenge_signature signs the UTF-8 bytes of
	// "mesh:token-exchange:<peer_id>:<challenge_unix_ms>".
	ChallengeUnixMs    int64  `protobuf:"varint,4,opt,name=challenge_unix_ms,json=challengeUnixMs,proto3" json:"challenge_unix_ms,omitempty"`
	ChallengeSignature []byte `protobuf:"bytes,5,opt,name=challenge_signature,json=challengeSignature,proto3" json:"challenge_signature,omitempty"`
	// contains filtered or unexported fields
}

TokenExchangeRequest is the body of POST /token/exchange on the control plane: an enrolled agentmesh-node (authenticated via its own Biscuit in Authorization: Bearer and proof of possession below) exchanges a caller's platform JWT (OIDC ID token, K8s projected SA JWT, or SPIFFE JWT-SVID) into a short-lived Delegated Session Biscuit bound to the calling node's transport channel (client_peer_id + actor_node, without node()).

func (*TokenExchangeRequest) Descriptor deprecated 

func (*TokenExchangeRequest) Descriptor() ([]byte, []int)

Deprecated: Use TokenExchangeRequest.ProtoReflect.Descriptor instead.

func (*TokenExchangeRequest) GetChallengeSignature 

func (x *TokenExchangeRequest) GetChallengeSignature() []byte

func (*TokenExchangeRequest) GetChallengeUnixMs 

func (x *TokenExchangeRequest) GetChallengeUnixMs() int64

func (*TokenExchangeRequest) GetSeal 

func (x *TokenExchangeRequest) GetSeal() bool

func (*TokenExchangeRequest) GetSubjectToken 

func (x *TokenExchangeRequest) GetSubjectToken() string

func (*TokenExchangeRequest) GetTaskRule 

func (x *TokenExchangeRequest) GetTaskRule() *TaskAuthorizationRule

func (*TokenExchangeRequest) ProtoMessage 

func (*TokenExchangeRequest) ProtoMessage()

func (*TokenExchangeRequest) ProtoReflect 

func (x *TokenExchangeRequest) ProtoReflect() protoreflect.Message

func (*TokenExchangeRequest) Reset 

func (x *TokenExchangeRequest) Reset()

func (*TokenExchangeRequest) String 

func (x *TokenExchangeRequest) String() string

type TokenExchangeResponse 

type TokenExchangeResponse struct {
	BiscuitToken []byte                 `protobuf:"bytes,1,opt,name=biscuit_token,json=biscuitToken,proto3" json:"biscuit_token,omitempty"`
	ExpireTime   *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	Roles        []string               `protobuf:"bytes,3,rep,name=roles,proto3" json:"roles,omitempty"`
	Subject      string                 `protobuf:"bytes,4,opt,name=subject,proto3" json:"subject,omitempty"`
	// contains filtered or unexported fields
}

func (*TokenExchangeResponse) Descriptor deprecated 

func (*TokenExchangeResponse) Descriptor() ([]byte, []int)

Deprecated: Use TokenExchangeResponse.ProtoReflect.Descriptor instead.

func (*TokenExchangeResponse) GetBiscuitToken 

func (x *TokenExchangeResponse) GetBiscuitToken() []byte

func (*TokenExchangeResponse) GetExpireTime 

func (x *TokenExchangeResponse) GetExpireTime() *timestamppb.Timestamp

func (*TokenExchangeResponse) GetRoles 

func (x *TokenExchangeResponse) GetRoles() []string

func (*TokenExchangeResponse) GetSubject 

func (x *TokenExchangeResponse) GetSubject() string

func (*TokenExchangeResponse) ProtoMessage 

func (*TokenExchangeResponse) ProtoMessage()

func (*TokenExchangeResponse) ProtoReflect 

func (x *TokenExchangeResponse) ProtoReflect() protoreflect.Message

func (*TokenExchangeResponse) Reset 

func (x *TokenExchangeResponse) Reset()

func (*TokenExchangeResponse) String 

func (x *TokenExchangeResponse) String() string

type TokenRefreshRequest 

type TokenRefreshRequest struct {

	// Signature with the node key over the UTF-8 bytes of
	// "mesh:refresh:<peer_id>:<challenge_unix_ms>", where peer_id is the one
	// bound in the presented biscuit. Peer- and endpoint-bound so a captured
	// signature verifies nowhere else.
	ChallengeSignature []byte `protobuf:"bytes,1,opt,name=challenge_signature,json=challengeSignature,proto3" json:"challenge_signature,omitempty"`
	// The caller's clock in unix milliseconds, the number in the signed text.
	// Must be within the control plane's freshness window.
	ChallengeUnixMs int64 `protobuf:"varint,2,opt,name=challenge_unix_ms,json=challengeUnixMs,proto3" json:"challenge_unix_ms,omitempty"`
	// The caller's peer ID. Optional: the control plane normally reads it
	// from the verified biscuit. It is consulted only when the biscuit's
	// signing key has been retired, so the biscuit cannot be verified: the
	// control plane then looks up the enrolled node record by this ID and,
	// if the node was opted in to autonomous recovery, accepts the request
	// when the presented biscuit is byte-identical to the last one it
	// issued and the challenge verifies against the stored public key.
	PeerId string `protobuf:"bytes,3,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	// Optional fresh platform JWT for an OIDC-enrolled node. When set, the
	// control plane verifies the JWT, confirms that iss|sub matches the
	// stored enrollment's identity, and renews the stored claims and session
	// expiry in place before minting the refreshed biscuit.
	Jwt string `protobuf:"bytes,4,opt,name=jwt,proto3" json:"jwt,omitempty"`
	// contains filtered or unexported fields
}

func (*TokenRefreshRequest) Descriptor deprecated 

func (*TokenRefreshRequest) Descriptor() ([]byte, []int)

Deprecated: Use TokenRefreshRequest.ProtoReflect.Descriptor instead.

func (*TokenRefreshRequest) GetChallengeSignature 

func (x *TokenRefreshRequest) GetChallengeSignature() []byte

func (*TokenRefreshRequest) GetChallengeUnixMs 

func (x *TokenRefreshRequest) GetChallengeUnixMs() int64

func (*TokenRefreshRequest) GetJwt 

func (x *TokenRefreshRequest) GetJwt() string

func (*TokenRefreshRequest) GetPeerId 

func (x *TokenRefreshRequest) GetPeerId() string

func (*TokenRefreshRequest) ProtoMessage 

func (*TokenRefreshRequest) ProtoMessage()

func (*TokenRefreshRequest) ProtoReflect 

func (x *TokenRefreshRequest) ProtoReflect() protoreflect.Message

func (*TokenRefreshRequest) Reset 

func (x *TokenRefreshRequest) Reset()

func (*TokenRefreshRequest) String 

func (x *TokenRefreshRequest) String() string

type TokenRefreshResponse 

type TokenRefreshResponse struct {
	BiscuitToken []byte                 `protobuf:"bytes,1,opt,name=biscuit_token,json=biscuitToken,proto3" json:"biscuit_token,omitempty"`
	ExpireTime   *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	ErrorMessage string                 `protobuf:"bytes,3,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"`
	// contains filtered or unexported fields
}

func (*TokenRefreshResponse) Descriptor deprecated 

func (*TokenRefreshResponse) Descriptor() ([]byte, []int)

Deprecated: Use TokenRefreshResponse.ProtoReflect.Descriptor instead.

func (*TokenRefreshResponse) GetBiscuitToken 

func (x *TokenRefreshResponse) GetBiscuitToken() []byte

func (*TokenRefreshResponse) GetErrorMessage 

func (x *TokenRefreshResponse) GetErrorMessage() string

func (*TokenRefreshResponse) GetExpireTime 

func (x *TokenRefreshResponse) GetExpireTime() *timestamppb.Timestamp

func (*TokenRefreshResponse) ProtoMessage 

func (*TokenRefreshResponse) ProtoMessage()

func (*TokenRefreshResponse) ProtoReflect 

func (x *TokenRefreshResponse) ProtoReflect() protoreflect.Message

func (*TokenRefreshResponse) Reset 

func (x *TokenRefreshResponse) Reset()

func (*TokenRefreshResponse) String 

func (x *TokenRefreshResponse) String() string

type TokenRevokeRequest 

type TokenRevokeRequest struct {
	PeerId string `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	// contains filtered or unexported fields
}

func (*TokenRevokeRequest) Descriptor deprecated 

func (*TokenRevokeRequest) Descriptor() ([]byte, []int)

Deprecated: Use TokenRevokeRequest.ProtoReflect.Descriptor instead.

func (*TokenRevokeRequest) GetPeerId 

func (x *TokenRevokeRequest) GetPeerId() string

func (*TokenRevokeRequest) ProtoMessage 

func (*TokenRevokeRequest) ProtoMessage()

func (*TokenRevokeRequest) ProtoReflect 

func (x *TokenRevokeRequest) ProtoReflect() protoreflect.Message

func (*TokenRevokeRequest) Reset 

func (x *TokenRevokeRequest) Reset()

func (*TokenRevokeRequest) String 

func (x *TokenRevokeRequest) String() string

type TokenRevokeResponse 

type TokenRevokeResponse struct {
	Success bool   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
	Error   string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

func (*TokenRevokeResponse) Descriptor deprecated 

func (*TokenRevokeResponse) Descriptor() ([]byte, []int)

Deprecated: Use TokenRevokeResponse.ProtoReflect.Descriptor instead.

func (*TokenRevokeResponse) GetError 

func (x *TokenRevokeResponse) GetError() string

func (*TokenRevokeResponse) GetSuccess 

func (x *TokenRevokeResponse) GetSuccess() bool

func (*TokenRevokeResponse) ProtoMessage 

func (*TokenRevokeResponse) ProtoMessage()

func (*TokenRevokeResponse) ProtoReflect 

func (x *TokenRevokeResponse) ProtoReflect() protoreflect.Message

func (*TokenRevokeResponse) Reset 

func (x *TokenRevokeResponse) Reset()

func (*TokenRevokeResponse) String 

func (x *TokenRevokeResponse) String() string

type TrustedSigningKey 

type TrustedSigningKey struct {

	// Raw ed25519 public key.
	PublicKey []byte `protobuf:"bytes,1,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
	// When the member first learned the key. A key rotated out is dropped a
	// grace period after this; unset means unknown and is read as now.
	ReceiveTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=receive_time,json=receiveTime,proto3" json:"receive_time,omitempty"`
	// contains filtered or unexported fields
}

func (*TrustedSigningKey) Descriptor deprecated 

func (*TrustedSigningKey) Descriptor() ([]byte, []int)

Deprecated: Use TrustedSigningKey.ProtoReflect.Descriptor instead.

func (*TrustedSigningKey) GetPublicKey 

func (x *TrustedSigningKey) GetPublicKey() []byte

func (*TrustedSigningKey) GetReceiveTime 

func (x *TrustedSigningKey) GetReceiveTime() *timestamppb.Timestamp

func (*TrustedSigningKey) ProtoMessage 

func (*TrustedSigningKey) ProtoMessage()

func (*TrustedSigningKey) ProtoReflect 

func (x *TrustedSigningKey) ProtoReflect() protoreflect.Message

func (*TrustedSigningKey) Reset 

func (x *TrustedSigningKey) Reset()

func (*TrustedSigningKey) String 

func (x *TrustedSigningKey) String() string

type User 

type User struct {

	// The identity provider's subject.
	Id     string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	Issuer string `protobuf:"bytes,2,opt,name=issuer,proto3" json:"issuer,omitempty"`
	Email  string `protobuf:"bytes,3,opt,name=email,proto3" json:"email,omitempty"`
	// "admin" or "user".
	Role       string                 `protobuf:"bytes,4,opt,name=role,proto3" json:"role,omitempty"`
	CreateTime *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty"`
	// contains filtered or unexported fields
}

User is a human identity known to the mesh.

func (*User) Descriptor deprecated 

func (*User) Descriptor() ([]byte, []int)

Deprecated: Use User.ProtoReflect.Descriptor instead.

func (*User) GetCreateTime 

func (x *User) GetCreateTime() *timestamppb.Timestamp

func (*User) GetEmail 

func (x *User) GetEmail() string

func (*User) GetId 

func (x *User) GetId() string

func (*User) GetIssuer 

func (x *User) GetIssuer() string

func (*User) GetRole 

func (x *User) GetRole() string

func (*User) ProtoMessage 

func (*User) ProtoMessage()

func (*User) ProtoReflect 

func (x *User) ProtoReflect() protoreflect.Message

func (*User) Reset 

func (x *User) Reset()

func (*User) String 

func (x *User) String() string

type UserStatusResponse 

type UserStatusResponse struct {
	User            *User             `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
	EnrolledNodes   []*EnrolledNode   `protobuf:"bytes,2,rep,name=enrolled_nodes,json=enrolledNodes,proto3" json:"enrolled_nodes,omitempty"`
	BootstrapTokens []*BootstrapToken `protobuf:"bytes,3,rep,name=bootstrap_tokens,json=bootstrapTokens,proto3" json:"bootstrap_tokens,omitempty"`
	ActiveRouters   []*RouterLease    `protobuf:"bytes,4,rep,name=active_routers,json=activeRouters,proto3" json:"active_routers,omitempty"`
	Policy          *PolicyConfig     `protobuf:"bytes,5,opt,name=policy,proto3" json:"policy,omitempty"`
	// contains filtered or unexported fields
}

UserStatusResponse answers GET /user/status: the caller and what it owns, except expired nodes (see GET /user/nodes). The router fleet and the mesh policy describe the whole mesh and are set for an administrator only.

func (*UserStatusResponse) Descriptor deprecated 

func (*UserStatusResponse) Descriptor() ([]byte, []int)

Deprecated: Use UserStatusResponse.ProtoReflect.Descriptor instead.

func (*UserStatusResponse) GetActiveRouters 

func (x *UserStatusResponse) GetActiveRouters() []*RouterLease

func (*UserStatusResponse) GetBootstrapTokens 

func (x *UserStatusResponse) GetBootstrapTokens() []*BootstrapToken

func (*UserStatusResponse) GetEnrolledNodes 

func (x *UserStatusResponse) GetEnrolledNodes() []*EnrolledNode

func (*UserStatusResponse) GetPolicy 

func (x *UserStatusResponse) GetPolicy() *PolicyConfig

func (*UserStatusResponse) GetUser 

func (x *UserStatusResponse) GetUser() *User

func (*UserStatusResponse) ProtoMessage 

func (*UserStatusResponse) ProtoMessage()

func (*UserStatusResponse) ProtoReflect 

func (x *UserStatusResponse) ProtoReflect() protoreflect.Message

func (*UserStatusResponse) Reset 

func (x *UserStatusResponse) Reset()

func (*UserStatusResponse) String 

func (x *UserStatusResponse) String() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.