api

package
v0.1.0-rc.6 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 26, 2026 License: Apache-2.0 Imports: 25 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// MaxAgentIDLen bounds an agent identifier, matching the DNS name limit it
	// is shaped after.
	MaxAgentIDLen = 253

	// MaxAgentLabelLen bounds one dot-separated label of an agent identifier.
	MaxAgentLabelLen = 63
)
View Source 
const (
	// FactExpiration defines the token expiration time.
	// Contains: biscuit.Date(expirationTime)
	// Example Datalog: check if time($time), expiration($exp), $time <= $exp
	FactExpiration = "expiration"

	// FactNode defines the PeerID of the node that this token belongs to.
	// Contains: biscuit.String(nodePeerID)
	// Example Datalog: allow if node("12D3KooWP2G8nJCLASp1Kb4TmQS4wCpMH2vpSUz8ug8DYEJiuf1i")
	FactNode = "node"

	// FactAgent defines the agent on whose behalf a request is made. Unlike
	// FactNode it does not identify a host: it is appended to the token when an
	// agent is admitted, and the same identifier is asserted again wherever that
	// agent is next resumed. See api/agent.go for the identifier rules.
	// Contains: biscuit.String(agentID)
	// Example Datalog: allow if agent("reviewer-7.prod.acme.example")
	FactAgent = "agent"

	// FactClientPeerID defines the client PeerID performing the request, used for replay defense.
	// Contains: biscuit.String(clientPeerID)
	// Example Datalog: check if client_peer_id($id), connection_peer_id($id)
	FactClientPeerID = "client_peer_id"

	// FactGroup defines the group claim extracted from the OIDC token.
	// Contains: biscuit.String(groupName)
	// Example Datalog: allow if group("data-science")
	FactGroup = "group"

	// FactRole defines a custom SAM role assigned to the user or node.
	// Contains: biscuit.String(roleName)
	// Example Datalog: allow if role("mesh-member")
	//
	// Only the control plane mints it, from mesh policy bindings. It must
	// never be derived from an OIDC claim: role("sam:role:router") is what
	// makes a router, and an issuer's "roles" claim is the issuer's word, not
	// the mesh operator's. See FactIdpRole.
	FactRole = "role"

	// FactIdpRole carries the OIDC "roles" claim as the issuer emitted it.
	// Contains: biscuit.String(roleName)
	// Example Datalog: allow if idp_role("platform-team")
	// Bind it to a mesh role in policy (member "idp_role:platform-team"),
	// or target it ("idp_role:platform-team"); it grants nothing by itself.
	FactIdpRole = "idp_role"

	// FactRight defines the cryptographically signed capability/right.
	// Contains: biscuit.String(rightName)
	// Example Datalog: allow if right("relay")
	FactRight = "right"

	// RightRelay defines the transport relaying/bridging right.
	RightRelay = "relay"

	// RightServiceInvoke defines the edge service invocation right.
	RightServiceInvoke = "service:invoke"

	// Standard role values
	RoleRouter = "sam:role:router"
	RoleNode   = "sam:role:node"
	RoleSamBox = "sam:role:sambox"

	// FactUser defines the subject (username/userID) claim extracted from the OIDC token.
	// Contains: biscuit.String(username)
	// Example Datalog: allow if user("alice")
	FactUser = "user"

	// FactEmail defines the email claim extracted from the OIDC token.
	// Contains: biscuit.String(emailAddress)
	// Example Datalog: allow if email("bob@example.com")
	FactEmail = "email"

	// FactGrantedServiceAllTypes allows access to all service types (e.g., mcp, inference) and all targets.
	// Contains: biscuit.Bool(true) (marker fact)
	// Example Datalog: allow if granted_service_all_types(true)
	FactGrantedServiceAllTypes = "granted_service_all_types"

	// FactGrantedServiceAll allows access to all targets under a specific service type.
	// Contains: biscuit.String(serviceType) (e.g., "mcp")
	// Example Datalog: allow if service("mcp", $target), granted_service_all("mcp")
	FactGrantedServiceAll = "granted_service_all"

	// FactGrantedServiceSuffix allows access to services matching a suffix pattern (e.g. *.service.local).
	// Contains: biscuit.String(serviceType), biscuit.String(suffixPattern)
	FactGrantedServiceSuffix = "granted_service_suffix"

	// FactGrantedServicePrefix allows access to services matching a prefix pattern (e.g. calculator.*).
	// Contains: biscuit.String(serviceType), biscuit.String(prefixPattern)
	FactGrantedServicePrefix = "granted_service_prefix"

	// FactGrantedServiceExact allows access to a specific service type and target.
	// Contains: biscuit.String(serviceType), biscuit.String(targetName)
	// Example Datalog: allow if service("mcp", "calculator"), granted_service_exact("mcp", "calculator")
	FactGrantedServiceExact = "granted_service_exact"

	// FactGrantedServiceSet allows access to a Set of exact service names under a specific service
	// type. This lets many exact grants for the same type be carried as a single Datalog fact instead
	// of one fact per entry, which keeps token/world fact counts flat regardless of list length.
	// Contains: biscuit.String(serviceType), biscuit.Set of biscuit.String(serviceName)
	// Example Datalog: allow if service("mcp", "calculator"), granted_service_set("mcp", $set), $set.contains("calculator")
	FactGrantedServiceSet = "granted_service_set"

	// FactGrantedTargetAllTypes allows target access to all network targets (unrestricted).
	// Contains: biscuit.Bool(true) (marker fact)
	FactGrantedTargetAllTypes = "granted_target_all_types"

	// FactGrantedTargetAll allows target access to all values of a specific fact.
	// Contains: biscuit.String(factName) (e.g., "group")
	FactGrantedTargetAll = "granted_target_all"

	// FactGrantedTargetSuffix allows target access to values matching a suffix pattern.
	// Contains: biscuit.String(factName), biscuit.String(suffixPattern)
	FactGrantedTargetSuffix = "granted_target_suffix"

	// FactGrantedTargetPrefix allows target access to values matching a prefix pattern.
	// Contains: biscuit.String(factName), biscuit.String(prefixPattern)
	FactGrantedTargetPrefix = "granted_target_prefix"

	// FactGrantedTargetExact allows target access to a specific fact name and value combination.
	// Contains: biscuit.String(factName), biscuit.String(factValue)
	// Example Datalog: allow_network_target("group", "backend") <- target_fact("group", "backend"), granted_target_exact("group", "backend")
	FactGrantedTargetExact = "granted_target_exact"

	// FactGrantedTargetAllFacts allows target access to any fact name and value combination.
	// Contains: biscuit.Bool(true) (marker fact)
	FactGrantedTargetAllFacts = "granted_target_all_facts"

	// FactGrantedTargetSet allows target access to a Set of exact values for a specific fact name.
	// This lets many exact target grants for the same fact name be carried as a single Datalog fact
	// instead of one fact per entry, which keeps token/world fact counts flat regardless of list length.
	// Contains: biscuit.String(factName), biscuit.Set of biscuit.String(factValue)
	FactGrantedTargetSet = "granted_target_set"

	// FactGrantedAgentExact allows the holder to act for one exact agent id.
	// Contains: biscuit.String(agentID)
	FactGrantedAgentExact = "granted_agent_exact"

	// FactGrantedAgentSet allows the holder to act for a Set of exact agent ids,
	// so many exact grants cost one fact instead of one fact each.
	// Contains: biscuit.Set of biscuit.String(agentID)
	FactGrantedAgentSet = "granted_agent_set"

	// FactGrantedAgentPrefix allows the holder to act for any agent id starting
	// with the prefix, e.g. "reviewer.*" -> "reviewer.".
	// Contains: biscuit.String(prefix)
	FactGrantedAgentPrefix = "granted_agent_prefix"

	// FactGrantedAgentSuffix allows the holder to act for any agent id ending
	// with the suffix, e.g. "*.prod.acme.example" -> ".prod.acme.example". The
	// leading dot is kept so the wildcard lands on a label boundary and
	// "evil-acme.example" cannot match "*.acme.example".
	// Contains: biscuit.String(suffix)
	FactGrantedAgentSuffix = "granted_agent_suffix"

	// FactGrantedAgentAll allows the holder to act for any agent at all.
	// Contains: biscuit.Bool(true) (marker fact)
	FactGrantedAgentAll = "granted_agent_all"

	// FactAgentAuthorized is derived when an agent claim falls inside one of the
	// holder's granted_agent_* namespaces.
	// Contains: biscuit.Bool(true) (marker fact)
	FactAgentAuthorized = "agent_authorized"

	// FactConnectionPeerID defines the actual PeerID of the remote peer making the connection.
	// Contains: biscuit.String(connectionPeerID)
	// Example Datalog: check if client_peer_id($id), connection_peer_id($id)
	FactConnectionPeerID = "connection_peer_id"

	// FactTargetFact normalizes identity assertions (claims, node, user) to a standardized target.
	// Contains: biscuit.String(factName), biscuit.String(factValue)
	// Example Datalog: target_fact("group", $val) <- group($val)
	FactTargetFact = "target_fact"

	// FactAllowNetworkTarget evaluates whether a target assertion meets the token access grants.
	// Contains: biscuit.String(factName), biscuit.String(factValue)
	// Example Datalog: allow_network_target("group", "backend")
	FactAllowNetworkTarget = "allow_network_target"

	// FactTargetUnrestricted indicates that target authorization checks are bypassed.
	// Contains: biscuit.Bool(true) (marker fact)
	// Example Datalog: check if allow_network_target($fact, $val) or target_unrestricted(true)
	FactTargetUnrestricted = "target_unrestricted"

	// FactTargetRestricted indicates that target authorization checks must be enforced.
	// Contains: biscuit.Bool(true) (marker fact)
	FactTargetRestricted = "target_restricted"

	// FactService represents the service target that a node is requesting access to.
	// Contains: biscuit.String(serviceType), biscuit.String(serviceName)
	// Example Datalog: service("mcp", "calculator")
	FactService = "service"

	// FactMethod is the HTTP method of the request as received, or "CONNECT"
	// for a tunnel the node opens without terminating HTTP.
	// Contains: biscuit.String(method)
	// Example Datalog: deny if method($m), !($m == "GET")
	FactMethod = "method"

	// FactPath is the request path as the backend sees it: leading slash, no
	// query, with the mesh routing prefix removed. A tunnel carries path("").
	// Contains: biscuit.String(path)
	// Example Datalog: deny if path($p), !$p.starts_with("/v2/public/")
	FactPath = "path"

	// FactHost is the destination hostname of an egress request, lowercase,
	// as authorized: the same string as the service name.
	// Contains: biscuit.String(host)
	// Example Datalog: deny if host("payroll.internal.example.com")
	FactHost = "host"

	// FactPort is the destination port of an egress request.
	// Contains: biscuit.Integer(port)
	// Example Datalog: deny if port($p), !($p == 443)
	FactPort = "port"

	// FactHTTPGrantedServiceExact is granted_service_exact, narrowed.
	// Contains: biscuit.String(serviceType), biscuit.String(serviceName)
	FactHTTPGrantedServiceExact = "http_granted_service_exact"

	// FactHTTPGrantedServiceSuffix is granted_service_suffix, narrowed.
	// Contains: biscuit.String(serviceType), biscuit.String(suffixPattern)
	FactHTTPGrantedServiceSuffix = "http_granted_service_suffix"

	// FactHTTPGrantedServicePrefix is granted_service_prefix, narrowed.
	// Contains: biscuit.String(serviceType), biscuit.String(prefixPattern)
	FactHTTPGrantedServicePrefix = "http_granted_service_prefix"

	// FactHTTPGrantedServiceAll is granted_service_all, narrowed. Its key is "*".
	// Contains: biscuit.String(serviceType)
	FactHTTPGrantedServiceAll = "http_granted_service_all"

	// FactHTTPGrantedServiceAllTypes is granted_service_all_types, narrowed.
	// Its type and key are both "*".
	// Contains: biscuit.Bool(true) (marker fact)
	FactHTTPGrantedServiceAllTypes = "http_granted_service_all_types"

	// FactGrantedMethod lists the methods a narrowed grant permits.
	// Contains: biscuit.String(serviceType), biscuit.String(key), biscuit.Set of biscuit.String(method)
	FactGrantedMethod = "granted_method"

	// FactGrantedMethodAny marks a narrowed grant that permits every method.
	// Contains: biscuit.String(serviceType), biscuit.String(key)
	FactGrantedMethodAny = "granted_method_any"

	// FactGrantedPathExact lists the exact paths a narrowed grant permits.
	// Contains: biscuit.String(serviceType), biscuit.String(key), biscuit.Set of biscuit.String(path)
	FactGrantedPathExact = "granted_path_exact"

	// FactGrantedPathPrefix permits every path under one prefix, one fact per prefix.
	// Contains: biscuit.String(serviceType), biscuit.String(key), biscuit.String(prefix)
	FactGrantedPathPrefix = "granted_path_prefix"

	// FactGrantedPathAny marks a narrowed grant that permits every path.
	// Contains: biscuit.String(serviceType), biscuit.String(key)
	FactGrantedPathAny = "granted_path_any"

	// FactHTTPMethodOK is derived when the request method satisfies a narrowed grant.
	// Contains: biscuit.String(serviceType), biscuit.String(key)
	FactHTTPMethodOK = "http_method_ok"

	// FactHTTPPathOK is derived when the request path satisfies a narrowed grant.
	// Contains: biscuit.String(serviceType), biscuit.String(key)
	FactHTTPPathOK = "http_path_ok"

	// FactLabel is a control-plane-attested key=value label on the token's
	// node (see api/labels.go). The control plane mints one fact per
	// declared label, so a requirement is a single exact match: a node
	// attested with region="us-east-1" carries label("region", "us-east-1"),
	// satisfying `check if label("region", "us-east-1")` only — composition
	// across values is left entirely to the operator (attest as many labels
	// as needed). Distinct from the unauthenticated gossip routing hint
	// carried in ServiceAnnounce.labels.
	// Contains: biscuit.String(key), biscuit.String(value)
	// Example Datalog: check if label("region", "us-east-1")
	FactLabel = "label"

	// FactTime defines the current system time injected during evaluation.
	// Contains: biscuit.Date(currentTime)
	// Example Datalog: check if time($time)
	FactTime = "time"
)

Biscuit fact names represent the Datalog predicates used in auth tokens and policy evaluation.

View Source 
const (
	// EnrollURIScheme is the URI scheme of a device enrollment payload.
	EnrollURIScheme = "sam"
	// EnrollURIHost is the fixed host component; it names the action.
	EnrollURIHost = "enroll"
)
View Source 
const (
	// MeshZone is the DNS suffix under which mesh services are addressed from
	// inside a sandbox.
	//
	// ".alt" is the pseudo-top-level domain reserved by RFC 9476 for namespaces
	// that are explicitly NOT resolved through the DNS. That is precisely this
	// case: these names are resolved by the mesh (service discovery over
	// libp2p), never by a resolver. Using it guarantees the zone can never
	// collide with a delegated gTLD, and guarantees a name that leaks out of a
	// sandbox fails closed instead of resolving to somebody else's host.
	MeshZone = "sam.alt"

	// MeshEntrypointHost is the reserved name an agent uses to reach the mesh
	// services its gateway offers it: inference and tools, with the provider
	// chosen by policy.
	//
	// It deliberately does not name the node. A sam-node's sidecar API is a
	// local, operator-facing surface — it can register services, drive the raw
	// egress proxy and read node internals — and an agent has no business
	// reaching any of it. The gateway consumes the node; the agent consumes the
	// mesh through the gateway, and the two must not be the same address.
	MeshEntrypointHost = "mesh." + MeshZone
)
View Source 
const (
	// EnrollProtocolID is the libp2p protocol identifier for node enrollment.
	EnrollProtocolID protocol.ID = "/sam/enroll/1.0.0"

	// MCPProtocolID is the libp2p protocol identifier for Model Context Protocol streams.
	MCPProtocolID protocol.ID = "/sam/mcp/1.0.0"

	// AuthProtocolID is the libp2p protocol identifier for the zero-trust auth handshake.
	AuthProtocolID protocol.ID = "/sam/auth/1.0.0"

	// GossipEvents is the GossipSub topic used to broadcast mesh event updates (e.g., node bans).
	GossipEvents = "/sam/mesh/events/v1"

	// GossipControlPlaneSync is the GossipSub topic used by the control plane to sync cluster state.
	GossipControlPlaneSync = "/sam/control-plane/sync/v1"

	// DiscoveryTopicPrefix is the GossipSub topic namespace for interest-scoped
	// service announcements (ServiceAnnounce messages). Full topics are built
	// with DiscoveryTopic; the version segment allows wire evolution.
	DiscoveryTopicPrefix = "/sam/discovery/v1"

	// DefaultAudience is the default audience string used in OIDC token validation.
	DefaultAudience = "sam-mesh-audience"
)
View Source 
const (
	// BiscuitTokenTTL is the strict cryptographically enforced lifespan
	// of a minted Biscuit token (24 hours).
	// This is verified locally by each peer on every connection.
	BiscuitTokenTTL = 24 * time.Hour

	// OIDCSessionTTL is the default database-enforced lifespan of a node's OIDC
	// interactive enrollment session (90 days). After this period, the node
	// must re-authenticate with the OIDC provider to establish a new session.
	// Operators tune the cadence with the control plane's --oidc-session-ttl.
	OIDCSessionTTL = 90 * 24 * time.Hour

	// TokenRefreshCheckInterval is the frequency at which the node daemon and router check
	// if their current Biscuit token is close to expiration and needs to be proactively refreshed.
	TokenRefreshCheckInterval = 10 * time.Minute
)
View Source 
const (
	// HeaderSamBiscuit is the custom HTTP header used to carry the base64-encoded
	// Biscuit token containing the node's identity credentials when forwarding requests
	// over libp2p HTTP between nodes in the mesh.
	//
	// This header is internal to the SAM mesh datapath and is stripped before requests
	// are forwarded to backend services.
	HeaderSamBiscuit = "X-Sam-Biscuit"

	// HeaderChallengeTimestamp and HeaderChallengeSignature carry the signed
	// freshness challenge on GET /enroll/status: unix milliseconds and an
	// unpadded base64url signature over EnrollStatusChallenge. Headers rather
	// than query parameters, so the signature never lands in access logs,
	// where it would be replayable for its freshness window.
	HeaderChallengeTimestamp = "X-Sam-Challenge-Ts"
	HeaderChallengeSignature = "X-Sam-Challenge-Sig"

	// HeaderPeerID carries the authenticated libp2p peer ID of the caller.
	// The mesh ingress handler stamps it after authorization succeeds,
	// overwriting any inbound value, so backend services get verified caller
	// attribution without parsing biscuits. The inference facade sets it the
	// same way for locally served requests.
	HeaderPeerID = "X-Peer-Id"

	// HeaderSamAgent names the agent a request is made on behalf of, as a
	// canonical agent identifier (see api/agent.go). It is set by the sandbox
	// gateway on the node's local API socket, and honoured by the node only
	// there: arriving on that socket is proof the caller is the gateway, which
	// is the only party that knows which agent a flow belongs to.
	//
	// A sandboxed agent can never set it. The gateway overwrites the header on
	// every request it forwards, so a value an agent supplies is replaced by
	// the identity the platform bound to its channel, never merged with it.
	HeaderSamAgent = "X-Sam-Agent"

	// HeaderSamAuthentication is the custom HTTP header used to authenticate a local
	// process to this node's sidecar API (the shared secret configured via
	// "--api-token-path" or the SAM_API_TOKEN environment variable). Using a
	// SAM-specific header name — instead of the standard
	// "Authorization" header — leaves "Authorization" free to always mean what
	// every HTTP client expects: the credential for the destination being called.
	// The sidecar strips this header before forwarding any request off-node, so
	// it never leaks to a remote peer or backend service.
	//
	// For compatibility with MCP clients that only support a plain "Authorization"
	// header, purely-local endpoints (that never forward it anywhere) also accept
	// "Authorization" as an alias. The egress/inference proxy does NOT: there,
	// "Authorization" is reserved exclusively for the destination's credential.
	HeaderSamAuthentication = "X-Sam-Authentication"

	// HeaderSamNoTrailingSlash is the custom HTTP header set by the ingress handler
	// to indicate that the original request had no trailing slash.
	//
	// This helps backward-compatibility with services that strictly distinguish
	// between a root path "/" and an empty path "".
	HeaderSamNoTrailingSlash = "X-Sam-No-Trailing-Slash"

	// HeaderSamRequiredLabels constrains an inference request on the sidecar's
	// OpenAI-compatible endpoints (/v1/*) to providers attested with any of a
	// comma-separated list of "key=value" label requirements (see
	// api/labels.go and LabelCheck); invalid entries are rejected with HTTP
	// 400. It can only narrow what mesh policy allows, never widen it. Absent
	// means any provider permitted by policy.
	//
	// Reserved as part of the sidecar contract; enforced by the provider
	// scorer. Label declarations are routing hints until attested via the
	// node's Biscuit (see api/labels.go).
	HeaderSamRequiredLabels = "X-Sam-Required-Labels"
)
View Source 
const (
	// SystemNamespace is the namespace reserved for built-in mesh services and protocols.
	SystemNamespace = "sam:system"

	// CatalogTarget is the special system service name used to retrieve tool catalogs.
	// In policy rules, it must be referred to explicitly as: system://sam.catalog
	CatalogTarget = "sam.catalog"

	// MCPServicePrefix is the scheme prefix for Model Context Protocol services.
	// Fully qualified MCP services use the URI format: mcp://<service-name>
	MCPServicePrefix = "mcp://"

	// InferenceServicePrefix is the scheme prefix for LLM Inference services.
	// Fully qualified inference services use the URI format: inference://<service-name>
	InferenceServicePrefix = "inference://"

	// EgressServicePrefix is the scheme prefix for destinations outside the
	// mesh, served by a node that enforces policy on them. The name is the
	// destination hostname: egress://api.github.com
	EgressServicePrefix = "egress://"
)
View Source 
const (
	// ServiceTypeStringMCP is the string identifier for MCP services.
	ServiceTypeStringMCP = "mcp"

	// ServiceTypeStringInference is the string identifier for Inference services.
	ServiceTypeStringInference = "inference"

	// ServiceTypeStringA2A is the string identifier for A2A (Agent2Agent) services.
	ServiceTypeStringA2A = "a2a"

	// ServiceTypeStringEgress is the string identifier for egress destinations.
	ServiceTypeStringEgress = "egress"
)
View Source 
const (
	MaxAnnounceKeys      = 64
	MaxAnnounceLabels    = 16
	MaxAnnounceStringLen = 256
)

Caps for ServiceAnnounce fields: announcements are unsolicited gossip, so receivers bound every dimension before processing.

View Source 
const KeysResponseFreshness = 5 * time.Minute

KeysResponseFreshness bounds how far a signed /keys response's timestamp may be from the receiver's clock: a captured response must not be able to keep a retired key trusted after its grace period.

View Source 
const NodeConfigVersionV1Alpha1 = "v1alpha1"

NodeConfigVersionV1Alpha1 is the only node config schema this build understands. A file omitting the version is read as this one, since it predates the check.

View Source 
const (
	// SystemAuthenticated is a special member string representing any authenticated user.
	SystemAuthenticated = "sam:system:authenticated"
)

Variables

View Source 
var (
	// BaselinePolicies are the pre-compiled authorization policies for the node middleware.
	BaselinePolicies []biscuit.Policy

	// BaselineRules are the pre-compiled target evaluation rules for the node middleware.
	BaselineRules []biscuit.Rule

	// BaselineHTTPRules derive the plain granted_service_* facts from the
	// http_granted_service_* facts of a narrowed grant when the request's
	// method() and path() satisfy it. Added wherever BaselineRules are.
	BaselineHTTPRules []biscuit.Rule

	// BaselineReplayCheck verifies that the client peer ID matches the connection peer ID.
	BaselineReplayCheck biscuit.Check

	// BaselineTargetCheck verifies that the target matches one of the allowed network targets.
	BaselineTargetCheck biscuit.Check

	// BaselineAgentRules derive agent_authorized from the holder's granted_agent_* facts.
	BaselineAgentRules []biscuit.Rule

	// BaselineAgentCheck verifies that the holder may speak for the agent it named.
	// Only added when a request carries an agent claim; see node.SamNode.Authorize.
	BaselineAgentCheck biscuit.Check

	// TargetFactRules maps node and OIDC claims to target_fact datalog facts.
	TargetFactRules []biscuit.Rule

	// ControlPlaneStaticTimeCheck is the standard check for verifying a Biscuit's
	// own expiration() fact. Every path that admits a token must add it together
	// with a FactTime fact; see identity.EnforceExpiration.
	ControlPlaneStaticTimeCheck biscuit.Check

	// AllowIfTruePolicy is the static policy "allow if true" used during token verification.
	AllowIfTruePolicy biscuit.Policy

	// BaselineSources is the Datalog text every variable above is parsed from.
	// The SDKs embed this text (see hack/gen-sdk-datalog) so that a provider
	// written in another language evaluates the same authorizer as sam-node.
	BaselineSources DatalogSources
)
View Source 
var (
	EnrollmentStatus_name = map[int32]string{
		0: "ENROLLMENT_STATUS_UNSPECIFIED",
		1: "ENROLLMENT_STATUS_PENDING",
		2: "ENROLLMENT_STATUS_APPROVED",
		3: "ENROLLMENT_STATUS_REJECTED",
	}
	EnrollmentStatus_value = map[string]int32{
		"ENROLLMENT_STATUS_UNSPECIFIED": 0,
		"ENROLLMENT_STATUS_PENDING":     1,
		"ENROLLMENT_STATUS_APPROVED":    2,
		"ENROLLMENT_STATUS_REJECTED":    3,
	}
)

Enum value maps for EnrollmentStatus.

View Source 
var (
	ServiceType_name = map[int32]string{
		0: "SERVICE_TYPE_UNSPECIFIED",
		1: "SERVICE_TYPE_MCP",
		2: "SERVICE_TYPE_INFERENCE",
		3: "SERVICE_TYPE_A2A",
		4: "SERVICE_TYPE_EGRESS",
	}
	ServiceType_value = map[string]int32{
		"SERVICE_TYPE_UNSPECIFIED": 0,
		"SERVICE_TYPE_MCP":         1,
		"SERVICE_TYPE_INFERENCE":   2,
		"SERVICE_TYPE_A2A":         3,
		"SERVICE_TYPE_EGRESS":      4,
	}
)

Enum value maps for ServiceType.

View Source 
var (
	MeshEvent_Type_name = map[int32]string{
		0: "BANNED",
		1: "KEY_ROTATION",
		2: "POLICY_UPDATE",
	}
	MeshEvent_Type_value = map[string]int32{
		"BANNED":        0,
		"KEY_ROTATION":  1,
		"POLICY_UPDATE": 2,
	}
)

Enum value maps for MeshEvent_Type.

View Source 
var ErrInsecureControlPlaneURL = errors.New("plaintext http:// control plane URL to a non-loopback host")

ErrInsecureControlPlaneURL marks a plaintext control-plane URL to a host that is not loopback. Whoever answers that URL becomes the trust root (/keys, enrollment, router addresses), so without TLS that is whoever sits on the path.

View Source 
var File_api_sam_proto protoreflect.FileDescriptor
View Source 
var MarkerTerm biscuit.Term = biscuit.Bool(true)

MarkerTerm is the single term every marker fact carries, written `true` in Datalog text. See MarkerFact.

View Source 
var SupportedNodeConfigVersions = map[string]bool{
	"":                        true,
	NodeConfigVersionV1Alpha1: true,
}

SupportedNodeConfigVersions gates LoadNodeConfig. A node must refuse a schema it does not know rather than parse it as this one: silently reinterpreting a future config would silently reinterpret its attenuation rules. Adding a version means adding it here and decoding it into the same internal type, so the rest of the node stays version-agnostic.

Functions

func AgentMember 

func AgentMember(id string) (string, error)

AgentMember renders an agent identifier as a policy member or target, the form used in allowed_targets and role bindings.

func BindingMemberPrefixes 

func BindingMemberPrefixes() []string

BindingMemberPrefixes are the fact names a policy binding member or an allowed_targets entry may name: the peer itself plus every OIDC claim the control plane mints. FactRole is deliberately absent: a binding on it would grant a mesh role from a mesh role.

func BuildAgentDatalogFact 

func BuildAgentDatalogFact(pattern string) biscuit.Fact

BuildAgentDatalogFact translates one agent namespace pattern into a Datalog fact. Patterns are the agent id shapes of §8.8: "*", "*.suffix", "prefix.*" or an exact id.

func BuildAgentDatalogFacts 

func BuildAgentDatalogFacts(patterns []string) []biscuit.Fact

BuildAgentDatalogFacts translates a list of agent namespace patterns into a minimal set of facts, merging exact ids into one granted_agent_set so a role naming many agents still costs one fact.

func BuildHTTPGrantFacts 

func BuildHTTPGrantFacts(g *HTTPGrant) []biscuit.Fact

BuildHTTPGrantFacts compiles one narrowed grant into the facts minted into the holder's credential: the http_granted_service_* fact for the entry, then one fact per axis. Methods and exact paths travel as one Set each; each prefix is its own fact, because starts_with has no set form.

func BuildServiceDatalogFact 

func BuildServiceDatalogFact(serviceStr string) biscuit.Fact

BuildServiceDatalogFact translates a service pattern string into a Datalog Fact.

func BuildServiceDatalogFacts 

func BuildServiceDatalogFacts(services []string) []biscuit.Fact

BuildServiceDatalogFacts translates a list of service patterns into a minimal set of Datalog facts. Exact-match entries are grouped by service type into a single granted_service_set fact each, so token/world fact counts stay flat regardless of how many exact services a role grants. Wildcard, prefix and suffix entries keep their existing one-fact-per-entry representation via BuildServiceDatalogFact, since those already collapse to a single fact per entry.

func BuildTargetDatalogFact 

func BuildTargetDatalogFact(targetStr string) biscuit.Fact

BuildTargetDatalogFact translates a target pattern string into a Datalog Fact.

func BuildTargetDatalogFacts 

func BuildTargetDatalogFacts(targets []string) []biscuit.Fact

BuildTargetDatalogFacts translates a list of target patterns into a minimal set of Datalog facts. Exact-match entries are grouped by fact name into a single granted_target_set fact each, so token/world fact counts stay flat regardless of how many exact targets a role grants. Wildcard, prefix and suffix entries keep their existing one-fact-per-entry representation via BuildTargetDatalogFact, since those already collapse to a single fact per entry.

func DiscoveryTopic 

func DiscoveryTopic(t ServiceType, key string) (string, error)

DiscoveryTopic returns the GossipSub topic for announcements about one routing key (a model ID for inference, a tool name for MCP). Keys are hashed so topic names stay bounded; consumers match exact keys from the ServiceAnnounce payload, so hash collisions only merge announcement streams, never routing decisions.

func EgressServedBy 

func EgressServedBy(d *EgressDestination, roles []string, labels map[string]string) bool

EgressServedBy reports whether a node with these roles and labels is selected to serve d.

func EgressTargetURL 

func EgressTargetURL(d *EgressDestination) string

EgressTargetURL is where the serving node forwards requests for d: target_url when set, otherwise https on the destination name.

func EnrollChallenge 

func EnrollChallenge(peerID string, ts int64) []byte

EnrollChallenge is the payload a bootstrap enrollee signs to prove possession of the private half of BootstrapEnrollRequest.public_key at POST /enroll, carried in that message's timestamp/challenge_signature fields. Binding the peer ID keeps a captured signature useless for any other peer; the domain prefix keeps it useless at any other endpoint.

func EnrollStatusChallenge 

func EnrollStatusChallenge(peerID string, ts int64) []byte

EnrollStatusChallenge is the payload a bootstrap enrollee signs to prove possession of the key it submitted at /enroll when polling GET /enroll/status. ts is unix milliseconds; the signature travels in the HeaderChallengeSignature header (unpadded base64url) alongside HeaderChallengeTimestamp.

func EnrollURI 

func EnrollURI(server, token string) string

EnrollURI builds the device enrollment URI for the given control plane base URL and bootstrap token.

func HTTPGrantKey 

func HTTPGrantKey(service string) (factName, svcType, key string)

HTTPGrantKey returns the fact a narrowed grant is minted as and the key its method and path facts are keyed by, for one allowed_services entry. The key is the term the plain granted_service_* fact would carry, so BaselineHTTPRules can derive that fact from it.

func IsMeshEntrypointHost 

func IsMeshEntrypointHost(host string) bool

IsMeshEntrypointHost reports whether host addresses the gateway's own agent-facing surface.

func IsMeshHost 

func IsMeshHost(host string) bool

IsMeshHost reports whether host falls inside the mesh zone. It does not validate the name beyond the suffix: use ParseMeshHost for that.

func KeysResponsePayload 

func KeysResponsePayload(resp *KeysResponse) ([]byte, error)

KeysResponsePayload is the bytes each signature in a KeysResponse covers: the key set and the signing time, deterministically encoded, signatures cleared.

func LabelCheck 

func LabelCheck(required map[string]string) (biscuit.Check, error)

LabelCheck compiles a required label set (canonical, pre-validated with ValidateLabels) into a single fail-closed check satisfied when the token carries any of them: `check if label("region", "us-east-1") or label("team", "platform")`.

func LabelFacts 

func LabelFacts(labels map[string]string) []biscuit.Fact

LabelFacts materializes a label set as one Datalog fact per key=value pair (see FactLabel). Keys are sorted for deterministic fact ordering. An empty set returns nil.

func LabelFloorCheck 

func LabelFloorCheck(required map[string]string) (biscuit.Check, error)

LabelFloorCheck compiles an operator's egress floor (see Egress.RequireLabels) into a single fail-closed check satisfied only when the token carries *every* pair: `check if label("jurisdiction", "eu"), label("compliance", "gdpr")`.

The conjunction is the whole difference from LabelCheck, which is a disjunction because a caller naming several labels means "any of these will do". A floor cannot mean that: a peer attesting only the most permissive of several alternatives would satisfy the floor while sitting outside the boundary the operator drew. So a floor takes a map — one value per key, no way to spell an alternative — and requires all of it.

Both are ordinary Biscuit checks, so a caller's requirement and a floor are combined by adding each to the authorizer and letting it AND them; neither needs to know about the other.

func LabelPatternsAllow 

func LabelPatternsAllow(patterns []string, labels map[string]string) error

LabelPatternsAllow reports whether patterns permit every declared label, naming the first one they do not. Keys are visited in order so the error for a given input is stable.

func LabelsContradictFloor 

func LabelsContradictFloor(floor, claimed map[string]string) bool

LabelsContradictFloor reports whether claimed states a *different* value for some key the floor requires.

Absence is not contradiction, which is the whole distinction from LabelsSatisfyFloor. Gossiped claims are a discovery hint and may carry only part of what a peer attests, so a peer silent on one pair of the floor may still satisfy all of it in its Biscuit. Only a conflicting value is grounds to skip such a peer before the gate has seen its attested facts; treating silence as failure would drop providers that are inside the boundary.

func LabelsSatisfyFloor 

func LabelsSatisfyFloor(floor, claimed map[string]string) bool

LabelsSatisfyFloor reports whether claimed satisfies every pair of the floor. It is the non-attested counterpart of LabelFloorCheck, for the one provider class that has no Biscuit to check: a service local to this node, whose labels are its own configuration and so are complete. An empty floor is satisfied by anything, so callers may pass one unconditionally.

func MarkerFact 

func MarkerFact(name string) biscuit.Fact

MarkerFact returns the presence-only fact name(true). The Biscuit grammar requires at least one term per predicate, so a fact whose only meaning is "this grant exists" carries MarkerTerm and is matched as name(true).

func MeshHost 

func MeshHost(t ServiceType, serviceName string) (string, error)

MeshHost is the inverse of ParseMeshHost: it renders the hostname a sandboxed agent should connect to in order to reach the given service.

func NormalizeMeshHost 

func NormalizeMeshHost(host string) string

NormalizeMeshHost canonicalizes a hostname taken off the sandbox boundary: it drops a trailing root dot and lowercases the name. DNS names are case-insensitive, so a mesh name only ever addresses a lowercase service name; services registered with uppercase characters are reachable by URI but not by hostname.

func OIDCClaimToFact 

func OIDCClaimToFact() map[string]string

OIDCClaimToFact returns a copy of the OIDC claims to Biscuit facts map. This ensures that the global map is immutable and thread-safe for concurrent readers.

func ParseDatalogRules 

func ParseDatalogRules(texts []string) ([]biscuit.Rule, error)

ParseDatalogRules parses PolicyConfigGetResponse.datalog_rules. One unparseable entry fails the whole set: a provider that silently dropped a rule would enforce a policy the operator never wrote.

func ParseEnrollURI 

func ParseEnrollURI(raw string) (server, token string, err error)

ParseEnrollURI extracts the control plane URL and bootstrap token from a device enrollment URI. The server must be an absolute URL that a device may trust as its control plane: https, or http to a loopback host.

func ParseMeshHost 

func ParseMeshHost(host string) (serviceURI string, err error)

ParseMeshHost translates a mesh hostname into its canonical service URI. 

openrouter.inference.sam.alt -> inference://openrouter
code-reviewer.mcp.sam.alt    -> mcp://code-reviewer

The service type is the label immediately left of the zone; everything to its left is the service name, which may itself contain dots (service names are validated as DNS names, not as single labels). MeshEntrypointHost is not a service and is rejected here; callers must test it with IsMeshEntrypointHost first.

Names are not resolved to a provider: which peer serves the returned URI is a discovery decision, and deliberately not encoded in the name. If pinning to one provider is ever needed, the natural extension is a longer form carrying the peer — mirroring the internal libp2p://<peer>/<type>/<name> URL — but it requires settling on a DNS-safe peer encoding first, because a base58 peer ID is case-sensitive and DNS labels are not (IPFS solves the same problem in subdomain gateways by using lowercase base36 CIDs).

func ParseServiceTarget 

func ParseServiceTarget(target string) (svcType, svcName string)

ParseServiceTarget parses a service target string into its type (scheme) and name components.

Expected formats:

  • Hierarchical service URIs: "scheme://name" (e.g., "mcp://my_service") or "scheme://name/path" (e.g., "mcp://my_service/tool").
  • Target facts: "fact:value" (e.g., "group:backend" or "user:bob").
  • Wildcards: "*" (maps type to "*" and name to "*").

If no scheme/colon is present, it returns an empty string for the type and the full target as the name. No fallback namespace is applied; callers must be explicit.

func PolicyRuleTexts 

func PolicyRuleTexts(rules []PolicyRule) []string

PolicyRuleTexts is the Datalog text of rules, one entry per rule.

func RefreshChallenge 

func RefreshChallenge(peerID string, ts int64) []byte

RefreshChallenge is the payload an enrolled peer signs to prove possession of its identity key at POST /refresh, carried in TokenRefreshRequest's timestamp/challenge_signature fields alongside the expiring biscuit. Same shape as the other enrollment challenges: peer- and endpoint-bound, so a captured signature is useless anywhere else.

func RegisterChallenge 

func RegisterChallenge(peerID string, ts int64) []byte

RegisterChallenge is the payload an OIDC enrollee signs to prove possession of EnrollRequest.public_key at POST /register, carried in that message's timestamp/challenge_signature fields. The JWT says who is asking; this says they hold the key they are binding.

func RouterLeaseChallenge 

func RouterLeaseChallenge(peerID string, ts int64) []byte

RouterLeaseChallenge is the payload a router signs with its enrolled key at POST /routers/lease, carried in RouterLeaseRequest's timestamp/challenge_signature fields. The router's biscuit is not proof on its own: routers send it to every peer they authenticate.

func ServiceTypeToString 

func ServiceTypeToString(t ServiceType) (string, error)

ServiceTypeToString converts a ServiceType protobuf enum back to its standard string identifier.

func SignKeysResponse 

func SignKeysResponse(resp *KeysResponse, privateKeys []ed25519.PrivateKey, now time.Time) error

SignKeysResponse sets SignTime and one signature per key pair, so a receiver that trusts any key still valid on the control plane can verify the set. Private keys must be in the same order as resp.PublicKeys.

func SplitToolName 

func SplitToolName(toolName string) (targetService, originalToolName string, err error)

SplitToolName splits a fully qualified MCP tool name into its target service URI and the original tool name.

Expected format: "scheme://service/tool" (e.g., "mcp://my-service/my-tool"). If the input is empty or invalid, it returns an error. No default fallback is applied.

func TargetFactNames 

func TargetFactNames() []string

TargetFactNames returns the fact names an allowed_targets entry can use.

It is derived from the same source as TargetFactRules, which is the point: a target naming any other fact mints a granted_target_* fact that no target_fact will ever match, so the grant silently denies instead of failing at config time. Deriving both from one place keeps them from drifting apart.

func ValidateAgentID 

func ValidateAgentID(id string) error

ValidateAgentID checks an agent identifier: the value part of an "agent:" member or target, without the prefix.

The rules exist to keep prefix and suffix policy safe and unambiguous: lowercase because the shape is DNS-shaped and DNS is case-insensitive, so two identifiers differing only in case must not be two principals; at least two labels because the rightmost labels are the authority that keeps identifiers from colliding across tenants; and no wildcards, because a wildcard is a policy pattern and never an identity.

func ValidateAgentPattern 

func ValidateAgentPattern(pattern string) error

ValidateAgentPattern checks one entry of a role's allowed_agents: an agent namespace the holder can act for. Unlike ValidateAgentID it allows the wildcard forms, because a namespace grant is a pattern.

A bare "*" is accepted and means any agent, which lets every holder of the role name any agent in the mesh. Some meshes have a single tenant, so it stays expressible, but callers should warn when they see it.

func ValidateControlPlaneTransport 

func ValidateControlPlaneTransport(rawURL string, allowInsecure bool) error

ValidateControlPlaneTransport accepts https://, accepts http:// only to a loopback host, and otherwise refuses unless allowInsecure is set by the operator (the --insecure-control-plane flag) for a network they trust.

func ValidateEgressDestination 

func ValidateEgressDestination(d *EgressDestination, roleNames map[string]bool) error

ValidateEgressDestination checks one PolicyConfig.egress entry. roleNames are the roles the same document defines, so served_by can be checked against them; a label entry is checked for form only.

func ValidateEgressName 

func ValidateEgressName(name string) error

ValidateEgressName checks a destination name: a lowercase hostname with no wildcard, port or path. It is the service name of egress://<name>, so it must also be valid there.

func ValidateEgressServicePattern 

func ValidateEgressServicePattern(svc string) error

ValidateEgressServicePattern checks an egress entry of allowed_services or http.service. The generic service validator accepts a path and any case, which for the other types name a service that may exist; an egress name is a hostname, matched against a lowercase destination name, so a path, a port, uppercase or a trailing dot would compile to a grant that matches nothing. Entries of other types pass through unchanged.

func ValidateHTTPGrant 

func ValidateHTTPGrant(g *HTTPGrant, allowedServices []string) error

ValidateHTTPGrant checks one PolicyRole.http entry against the role's allowed_services: the entry must narrow a grant the role makes, written the same way, and its methods and paths must be well-formed.

func ValidateLabelKey 

func ValidateLabelKey(key string) error

ValidateLabelKey checks that a label key is well-formed: 1-63 characters from [a-zA-Z0-9_.-].

func ValidateLabelPattern 

func ValidateLabelPattern(pattern string) error

ValidateLabelPattern checks one entry of a role's allowed_labels. The forms are "*" for any label at all, "key=*" for any value of a key, and "key=value" for one exact pair.

func ValidateLabelValue 

func ValidateLabelValue(value string) error

ValidateLabelValue checks that a label value is well-formed: non-empty, bounded length, and free of characters that collide with the wire-format separators (comma-separated key=value pairs) or control characters.

func ValidateLabels 

func ValidateLabels(labels map[string]string) error

ValidateLabels checks every key and value in a label set. Keys are visited in lexicographic order, so the error returned for a given input is deterministic and stable across runs (Go's map iteration is randomized).

func ValidateServiceAnnounce 

func ValidateServiceAnnounce(a *ServiceAnnounce) error

ValidateServiceAnnounce bounds and sanity-checks a gossiped announcement. Origin authenticity and freshness are the receiver's responsibility.

func ValidateServiceFormat 

func ValidateServiceFormat(svc string) error

ValidateServiceFormat ensures the service string follows the explicit URI format.

func ValidateTargetFormat 

func ValidateTargetFormat(target string) error

ValidateTargetFormat ensures the target string follows the explicit fact:value format.

func VerifyKeysResponse 

func VerifyKeysResponse(resp *KeysResponse, trusted []ed25519.PublicKey, now time.Time) ([]ed25519.PublicKey, error)

VerifyKeysResponse returns the key set if it is fresh and at least one listed key is already trusted and its signature verifies. A receiver with nothing trusted yet cannot verify anything and gets an error: enrollment, not /keys, is where the first key comes from.

The guarantee is exactly "a key this receiver already trusts vouches for this set". It defends against whoever answers the URL; it cannot defend against the holder of a trusted private key, who is the trust root by definition and could equally mint biscuits or sign events.

Types

type AgentAttachRequest 

type AgentAttachRequest struct {
	Bundle *AgentBundle `protobuf:"bytes,1,opt,name=bundle,proto3" json:"bundle,omitempty"`
	// contains filtered or unexported fields
}

AgentAttachRequest admits an agent. It is idempotent on agent_id: resuming after a crash or a migration is another Attach, not a distinct operation.

func (*AgentAttachRequest) Descriptor deprecated 

func (*AgentAttachRequest) Descriptor() ([]byte, []int)

Deprecated: Use AgentAttachRequest.ProtoReflect.Descriptor instead.

func (*AgentAttachRequest) GetBundle 

func (x *AgentAttachRequest) GetBundle() *AgentBundle

func (*AgentAttachRequest) ProtoMessage 

func (*AgentAttachRequest) ProtoMessage()

func (*AgentAttachRequest) ProtoReflect 

func (x *AgentAttachRequest) ProtoReflect() protoreflect.Message

func (*AgentAttachRequest) Reset 

func (x *AgentAttachRequest) Reset()

func (*AgentAttachRequest) String 

func (x *AgentAttachRequest) String() string

type AgentAttachResponse 

type AgentAttachResponse struct {

	// Sandbox boundary endpoints to wire into the sandbox: named HTTP tunnels
	// (CONNECT, connect-udp) for guest to host, and a reverse channel for host
	// to guest that is empty when the bundle declares no ingress.
	EgressSocket  string `protobuf:"bytes,1,opt,name=egress_socket,json=egressSocket,proto3" json:"egress_socket,omitempty"`
	IngressSocket string `protobuf:"bytes,2,opt,name=ingress_socket,json=ingressSocket,proto3" json:"ingress_socket,omitempty"`
	Error         string `protobuf:"bytes,3,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

func (*AgentAttachResponse) Descriptor deprecated 

func (*AgentAttachResponse) Descriptor() ([]byte, []int)

Deprecated: Use AgentAttachResponse.ProtoReflect.Descriptor instead.

func (*AgentAttachResponse) GetEgressSocket 

func (x *AgentAttachResponse) GetEgressSocket() string

func (*AgentAttachResponse) GetError 

func (x *AgentAttachResponse) GetError() string

func (*AgentAttachResponse) GetIngressSocket 

func (x *AgentAttachResponse) GetIngressSocket() string

func (*AgentAttachResponse) ProtoMessage 

func (*AgentAttachResponse) ProtoMessage()

func (*AgentAttachResponse) ProtoReflect 

func (x *AgentAttachResponse) ProtoReflect() protoreflect.Message

func (*AgentAttachResponse) Reset 

func (x *AgentAttachResponse) Reset()

func (*AgentAttachResponse) String 

func (x *AgentAttachResponse) String() string

type AgentBundle 

type AgentBundle struct {
	Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
	// Canonical mesh identifier, without the "agent:" prefix. Dot-separated and
	// DNS-shaped; see api/agent.go for the rules and why they exist.
	AgentId string `protobuf:"bytes,2,opt,name=agent_id,json=agentId,proto3" json:"agent_id,omitempty"`
	// The platform's own identifier, verbatim, kept for audit because the
	// translation into agent_id is not always reversible.
	ExternalId string `protobuf:"bytes,3,opt,name=external_id,json=externalId,proto3" json:"external_id,omitempty"`
	// Path to the workload credential the platform already issues: a projected
	// Kubernetes service-account token, a pod certificate, or an SVID. It is
	// verified at admission against the platform's issuer and then translated
	// into agent facts, the same way OIDC claims are translated at node
	// enrollment. The scheduler needs no mesh credential of its own.
	CredentialPath string          `protobuf:"bytes,4,opt,name=credential_path,json=credentialPath,proto3" json:"credential_path,omitempty"`
	Egress         *AgentEgress    `protobuf:"bytes,5,opt,name=egress,proto3" json:"egress,omitempty"`
	Ingress        []*AgentIngress `protobuf:"bytes,6,rep,name=ingress,proto3" json:"ingress,omitempty"`
	// contains filtered or unexported fields
}

AgentBundle is everything the platform declares about one agent. Its canonical form is a YAML file in the agent's own state directory, so that a suspend/resume onto another host carries it with no extra machinery; this message is the transport mirror of that file.

func (*AgentBundle) Descriptor deprecated 

func (*AgentBundle) Descriptor() ([]byte, []int)

Deprecated: Use AgentBundle.ProtoReflect.Descriptor instead.

func (*AgentBundle) GetAgentId 

func (x *AgentBundle) GetAgentId() string

func (*AgentBundle) GetCredentialPath 

func (x *AgentBundle) GetCredentialPath() string

func (*AgentBundle) GetEgress 

func (x *AgentBundle) GetEgress() *AgentEgress

func (*AgentBundle) GetExternalId 

func (x *AgentBundle) GetExternalId() string

func (*AgentBundle) GetIngress 

func (x *AgentBundle) GetIngress() []*AgentIngress

func (*AgentBundle) GetVersion 

func (x *AgentBundle) GetVersion() string

func (*AgentBundle) ProtoMessage 

func (*AgentBundle) ProtoMessage()

func (*AgentBundle) ProtoReflect 

func (x *AgentBundle) ProtoReflect() protoreflect.Message

func (*AgentBundle) Reset 

func (x *AgentBundle) Reset()

func (*AgentBundle) String 

func (x *AgentBundle) String() string

type AgentDetachRequest 

type AgentDetachRequest struct {
	AgentId string `protobuf:"bytes,1,opt,name=agent_id,json=agentId,proto3" json:"agent_id,omitempty"`
	// contains filtered or unexported fields
}

AgentDetachRequest stops an agent: ingress is unregistered, channels are closed and credentials dropped. It must leave no residual advertisement.

func (*AgentDetachRequest) Descriptor deprecated 

func (*AgentDetachRequest) Descriptor() ([]byte, []int)

Deprecated: Use AgentDetachRequest.ProtoReflect.Descriptor instead.

func (*AgentDetachRequest) GetAgentId 

func (x *AgentDetachRequest) GetAgentId() string

func (*AgentDetachRequest) ProtoMessage 

func (*AgentDetachRequest) ProtoMessage()

func (*AgentDetachRequest) ProtoReflect 

func (x *AgentDetachRequest) ProtoReflect() protoreflect.Message

func (*AgentDetachRequest) Reset 

func (x *AgentDetachRequest) Reset()

func (*AgentDetachRequest) String 

func (x *AgentDetachRequest) String() string

type AgentDetachResponse 

type AgentDetachResponse struct {
	Success bool   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
	Error   string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

func (*AgentDetachResponse) Descriptor deprecated 

func (*AgentDetachResponse) Descriptor() ([]byte, []int)

Deprecated: Use AgentDetachResponse.ProtoReflect.Descriptor instead.

func (*AgentDetachResponse) GetError 

func (x *AgentDetachResponse) GetError() string

func (*AgentDetachResponse) GetSuccess 

func (x *AgentDetachResponse) GetSuccess() bool

func (*AgentDetachResponse) ProtoMessage 

func (*AgentDetachResponse) ProtoMessage()

func (*AgentDetachResponse) ProtoReflect 

func (x *AgentDetachResponse) ProtoReflect() protoreflect.Message

func (*AgentDetachResponse) Reset 

func (x *AgentDetachResponse) Reset()

func (*AgentDetachResponse) String 

func (x *AgentDetachResponse) String() string

type AgentEgress 

type AgentEgress struct {
	Allow   []string       `protobuf:"bytes,1,rep,name=allow,proto3" json:"allow,omitempty"`
	Secrets []*AgentSecret `protobuf:"bytes,2,rep,name=secrets,proto3" json:"secrets,omitempty"`
	// contains filtered or unexported fields
}

AgentEgress is deny-by-default. Patterns are matched against the destination name taken from the sandbox boundary, never against a resolved address.

func (*AgentEgress) Descriptor deprecated 

func (*AgentEgress) Descriptor() ([]byte, []int)

Deprecated: Use AgentEgress.ProtoReflect.Descriptor instead.

func (*AgentEgress) GetAllow 

func (x *AgentEgress) GetAllow() []string

func (*AgentEgress) GetSecrets 

func (x *AgentEgress) GetSecrets() []*AgentSecret

func (*AgentEgress) ProtoMessage 

func (*AgentEgress) ProtoMessage()

func (*AgentEgress) ProtoReflect 

func (x *AgentEgress) ProtoReflect() protoreflect.Message

func (*AgentEgress) Reset 

func (x *AgentEgress) Reset()

func (*AgentEgress) String 

func (x *AgentEgress) String() string

type AgentIngress 

type AgentIngress struct {
	Type        ServiceType `protobuf:"varint,1,opt,name=type,proto3,enum=sam.v1.ServiceType" json:"type,omitempty"`
	Name        string      `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	Port        uint32      `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"`
	Description string      `protobuf:"bytes,4,opt,name=description,proto3" json:"description,omitempty"`
	// contains filtered or unexported fields
}

AgentIngress declares that the agent serves a mesh service. The name is the service half of the mesh host the rest of the mesh dials (see api/names.go); port is where the agent listens inside its sandbox.

func (*AgentIngress) Descriptor deprecated 

func (*AgentIngress) Descriptor() ([]byte, []int)

Deprecated: Use AgentIngress.ProtoReflect.Descriptor instead.

func (*AgentIngress) GetDescription 

func (x *AgentIngress) GetDescription() string

func (*AgentIngress) GetName 

func (x *AgentIngress) GetName() string

func (*AgentIngress) GetPort 

func (x *AgentIngress) GetPort() uint32

func (*AgentIngress) GetType 

func (x *AgentIngress) GetType() ServiceType

func (*AgentIngress) ProtoMessage 

func (*AgentIngress) ProtoMessage()

func (*AgentIngress) ProtoReflect 

func (x *AgentIngress) ProtoReflect() protoreflect.Message

func (*AgentIngress) Reset 

func (x *AgentIngress) Reset()

func (*AgentIngress) String 

func (x *AgentIngress) String() string

type AgentRefreshRequest 

type AgentRefreshRequest struct {
	AgentId        string `protobuf:"bytes,1,opt,name=agent_id,json=agentId,proto3" json:"agent_id,omitempty"`
	CredentialPath string `protobuf:"bytes,2,opt,name=credential_path,json=credentialPath,proto3" json:"credential_path,omitempty"`
	// contains filtered or unexported fields
}

AgentRefreshRequest hands in a rotated workload credential. Platforms rotate these on their own schedule, which is what bounds how long a stale admission stays usable.

func (*AgentRefreshRequest) Descriptor deprecated 

func (*AgentRefreshRequest) Descriptor() ([]byte, []int)

Deprecated: Use AgentRefreshRequest.ProtoReflect.Descriptor instead.

func (*AgentRefreshRequest) GetAgentId 

func (x *AgentRefreshRequest) GetAgentId() string

func (*AgentRefreshRequest) GetCredentialPath 

func (x *AgentRefreshRequest) GetCredentialPath() string

func (*AgentRefreshRequest) ProtoMessage 

func (*AgentRefreshRequest) ProtoMessage()

func (*AgentRefreshRequest) ProtoReflect 

func (x *AgentRefreshRequest) ProtoReflect() protoreflect.Message

func (*AgentRefreshRequest) Reset 

func (x *AgentRefreshRequest) Reset()

func (*AgentRefreshRequest) String 

func (x *AgentRefreshRequest) String() string

type AgentRefreshResponse 

type AgentRefreshResponse struct {
	Success    bool                   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
	Error      string                 `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	ExpireTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	// contains filtered or unexported fields
}

func (*AgentRefreshResponse) Descriptor deprecated 

func (*AgentRefreshResponse) Descriptor() ([]byte, []int)

Deprecated: Use AgentRefreshResponse.ProtoReflect.Descriptor instead.

func (*AgentRefreshResponse) GetError 

func (x *AgentRefreshResponse) GetError() string

func (*AgentRefreshResponse) GetExpireTime 

func (x *AgentRefreshResponse) GetExpireTime() *timestamppb.Timestamp

func (*AgentRefreshResponse) GetSuccess 

func (x *AgentRefreshResponse) GetSuccess() bool

func (*AgentRefreshResponse) ProtoMessage 

func (*AgentRefreshResponse) ProtoMessage()

func (*AgentRefreshResponse) ProtoReflect 

func (x *AgentRefreshResponse) ProtoReflect() protoreflect.Message

func (*AgentRefreshResponse) Reset 

func (x *AgentRefreshResponse) Reset()

func (*AgentRefreshResponse) String 

func (x *AgentRefreshResponse) String() string

type AgentSecret 

type AgentSecret struct {
	Host       string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
	Kind       string `protobuf:"bytes,2,opt,name=kind,proto3" json:"kind,omitempty"`                               // bearer | basicauth | customheader
	HeaderName string `protobuf:"bytes,3,opt,name=header_name,json=headerName,proto3" json:"header_name,omitempty"` // customheader only
	ValuePath  string `protobuf:"bytes,4,opt,name=value_path,json=valuePath,proto3" json:"value_path,omitempty"`
	// contains filtered or unexported fields
}

AgentSecret configures credential injection for one destination. It carries a path, never a value: secret material must not travel through this API.

func (*AgentSecret) Descriptor deprecated 

func (*AgentSecret) Descriptor() ([]byte, []int)

Deprecated: Use AgentSecret.ProtoReflect.Descriptor instead.

func (*AgentSecret) GetHeaderName 

func (x *AgentSecret) GetHeaderName() string

func (*AgentSecret) GetHost 

func (x *AgentSecret) GetHost() string

func (*AgentSecret) GetKind 

func (x *AgentSecret) GetKind() string

func (*AgentSecret) GetValuePath 

func (x *AgentSecret) GetValuePath() string

func (*AgentSecret) ProtoMessage 

func (*AgentSecret) ProtoMessage()

func (*AgentSecret) ProtoReflect 

func (x *AgentSecret) ProtoReflect() protoreflect.Message

func (*AgentSecret) Reset 

func (x *AgentSecret) Reset()

func (*AgentSecret) String 

func (x *AgentSecret) String() string

type AgentStatus 

type AgentStatus struct {
	AgentId              string                 `protobuf:"bytes,1,opt,name=agent_id,json=agentId,proto3" json:"agent_id,omitempty"`
	Attached             bool                   `protobuf:"varint,2,opt,name=attached,proto3" json:"attached,omitempty"`
	Ingress              []*AgentIngress        `protobuf:"bytes,3,rep,name=ingress,proto3" json:"ingress,omitempty"`
	CredentialExpireTime *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=credential_expire_time,json=credentialExpireTime,proto3" json:"credential_expire_time,omitempty"`
	// contains filtered or unexported fields
}

func (*AgentStatus) Descriptor deprecated 

func (*AgentStatus) Descriptor() ([]byte, []int)

Deprecated: Use AgentStatus.ProtoReflect.Descriptor instead.

func (*AgentStatus) GetAgentId 

func (x *AgentStatus) GetAgentId() string

func (*AgentStatus) GetAttached 

func (x *AgentStatus) GetAttached() bool

func (*AgentStatus) GetCredentialExpireTime 

func (x *AgentStatus) GetCredentialExpireTime() *timestamppb.Timestamp

func (*AgentStatus) GetIngress 

func (x *AgentStatus) GetIngress() []*AgentIngress

func (*AgentStatus) ProtoMessage 

func (*AgentStatus) ProtoMessage()

func (*AgentStatus) ProtoReflect 

func (x *AgentStatus) ProtoReflect() protoreflect.Message

func (*AgentStatus) Reset 

func (x *AgentStatus) Reset()

func (*AgentStatus) String 

func (x *AgentStatus) String() string

type AgentStatusRequest 

type AgentStatusRequest struct {
	AgentId string `protobuf:"bytes,1,opt,name=agent_id,json=agentId,proto3" json:"agent_id,omitempty"`
	// contains filtered or unexported fields
}

AgentStatusRequest reports on one agent, or on all of them when agent_id is empty, for a scheduler's reconcile loop.

func (*AgentStatusRequest) Descriptor deprecated 

func (*AgentStatusRequest) Descriptor() ([]byte, []int)

Deprecated: Use AgentStatusRequest.ProtoReflect.Descriptor instead.

func (*AgentStatusRequest) GetAgentId 

func (x *AgentStatusRequest) GetAgentId() string

func (*AgentStatusRequest) ProtoMessage 

func (*AgentStatusRequest) ProtoMessage()

func (*AgentStatusRequest) ProtoReflect 

func (x *AgentStatusRequest) ProtoReflect() protoreflect.Message

func (*AgentStatusRequest) Reset 

func (x *AgentStatusRequest) Reset()

func (*AgentStatusRequest) String 

func (x *AgentStatusRequest) String() string

type AgentStatusResponse 

type AgentStatusResponse struct {
	Agents []*AgentStatus `protobuf:"bytes,1,rep,name=agents,proto3" json:"agents,omitempty"`
	Error  string         `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

func (*AgentStatusResponse) Descriptor deprecated 

func (*AgentStatusResponse) Descriptor() ([]byte, []int)

Deprecated: Use AgentStatusResponse.ProtoReflect.Descriptor instead.

func (*AgentStatusResponse) GetAgents 

func (x *AgentStatusResponse) GetAgents() []*AgentStatus

func (*AgentStatusResponse) GetError 

func (x *AgentStatusResponse) GetError() string

func (*AgentStatusResponse) ProtoMessage 

func (*AgentStatusResponse) ProtoMessage()

func (*AgentStatusResponse) ProtoReflect 

func (x *AgentStatusResponse) ProtoReflect() protoreflect.Message

func (*AgentStatusResponse) Reset 

func (x *AgentStatusResponse) Reset()

func (*AgentStatusResponse) String 

func (x *AgentStatusResponse) String() string

type Attenuation 

type Attenuation struct {
	Policies []string `yaml:"policies"`
	Checks   []string `yaml:"checks"`
	Rules    []string `yaml:"rules"`
}

type AuthFrame 

type AuthFrame struct {
	Biscuit       []byte `protobuf:"bytes,1,opt,name=biscuit,proto3" json:"biscuit,omitempty"`
	TargetService string `protobuf:"bytes,2,opt,name=target_service,json=targetService,proto3" json:"target_service,omitempty"` // Optional: specific service requested
	// The agent this request is made for, as a canonical agent identifier (see
	// api/agent.go). It is the calling node's claim, carried beside the token
	// because Biscuit hides an appended block's facts from the authorizer; the
	// HTTP datapath carries the same claim in HeaderSamAgent.
	Agent string `protobuf:"bytes,3,opt,name=agent,proto3" json:"agent,omitempty"`
	// contains filtered or unexported fields
}

func (*AuthFrame) Descriptor deprecated 

func (*AuthFrame) Descriptor() ([]byte, []int)

Deprecated: Use AuthFrame.ProtoReflect.Descriptor instead.

func (*AuthFrame) GetAgent 

func (x *AuthFrame) GetAgent() string

func (*AuthFrame) GetBiscuit 

func (x *AuthFrame) GetBiscuit() []byte

func (*AuthFrame) GetTargetService 

func (x *AuthFrame) GetTargetService() string

func (*AuthFrame) ProtoMessage 

func (*AuthFrame) ProtoMessage()

func (*AuthFrame) ProtoReflect 

func (x *AuthFrame) ProtoReflect() protoreflect.Message

func (*AuthFrame) Reset 

func (x *AuthFrame) Reset()

func (*AuthFrame) String 

func (x *AuthFrame) String() string

type AuthResponse 

type AuthResponse struct {
	Success bool   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
	Error   string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`     // populated only if success is false
	Biscuit []byte `protobuf:"bytes,3,opt,name=biscuit,proto3" json:"biscuit,omitempty"` // The server's own Biscuit token (for mutual auth)
	// contains filtered or unexported fields
}

func (*AuthResponse) Descriptor deprecated 

func (*AuthResponse) Descriptor() ([]byte, []int)

Deprecated: Use AuthResponse.ProtoReflect.Descriptor instead.

func (*AuthResponse) GetBiscuit 

func (x *AuthResponse) GetBiscuit() []byte

func (*AuthResponse) GetError 

func (x *AuthResponse) GetError() string

func (*AuthResponse) GetSuccess 

func (x *AuthResponse) GetSuccess() bool

func (*AuthResponse) ProtoMessage 

func (*AuthResponse) ProtoMessage()

func (*AuthResponse) ProtoReflect 

func (x *AuthResponse) ProtoReflect() protoreflect.Message

func (*AuthResponse) Reset 

func (x *AuthResponse) Reset()

func (*AuthResponse) String 

func (x *AuthResponse) String() string

type BootstrapEnrollRequest 

type BootstrapEnrollRequest struct {
	BootstrapToken string `protobuf:"bytes,1,opt,name=bootstrap_token,json=bootstrapToken,proto3" json:"bootstrap_token,omitempty"`
	PeerId         string `protobuf:"bytes,2,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	PublicKey      []byte `protobuf:"bytes,3,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
	RequestedRole  string `protobuf:"bytes,4,opt,name=requested_role,json=requestedRole,proto3" json:"requested_role,omitempty"`
	// Operator-declared labels; the admin approving the enrollment attests
	// them (see EnrollRequest.labels).
	Labels map[string]string `` /* 139-byte string literal not displayed */
	// Proof of possession of public_key's private half: challenge_unix_ms is
	// the caller's clock in unix milliseconds and challenge_signature signs
	// the UTF-8 bytes of "sam:enroll:<peer_id>:<challenge_unix_ms>". Required,
	// and peer_id must be derived from public_key: this is what entitles a
	// repeated POST /enroll to re-fetch an existing enrollment's biscuit, so
	// a bootstrap token alone must never satisfy it.
	ChallengeUnixMs    int64  `protobuf:"varint,6,opt,name=challenge_unix_ms,json=challengeUnixMs,proto3" json:"challenge_unix_ms,omitempty"`
	ChallengeSignature []byte `protobuf:"bytes,7,opt,name=challenge_signature,json=challengeSignature,proto3" json:"challenge_signature,omitempty"`
	// contains filtered or unexported fields
}

func (*BootstrapEnrollRequest) Descriptor deprecated 

func (*BootstrapEnrollRequest) Descriptor() ([]byte, []int)

Deprecated: Use BootstrapEnrollRequest.ProtoReflect.Descriptor instead.

func (*BootstrapEnrollRequest) GetBootstrapToken 

func (x *BootstrapEnrollRequest) GetBootstrapToken() string

func (*BootstrapEnrollRequest) GetChallengeSignature 

func (x *BootstrapEnrollRequest) GetChallengeSignature() []byte

func (*BootstrapEnrollRequest) GetChallengeUnixMs 

func (x *BootstrapEnrollRequest) GetChallengeUnixMs() int64

func (*BootstrapEnrollRequest) GetLabels 

func (x *BootstrapEnrollRequest) GetLabels() map[string]string

func (*BootstrapEnrollRequest) GetPeerId 

func (x *BootstrapEnrollRequest) GetPeerId() string

func (*BootstrapEnrollRequest) GetPublicKey 

func (x *BootstrapEnrollRequest) GetPublicKey() []byte

func (*BootstrapEnrollRequest) GetRequestedRole 

func (x *BootstrapEnrollRequest) GetRequestedRole() string

func (*BootstrapEnrollRequest) ProtoMessage 

func (*BootstrapEnrollRequest) ProtoMessage()

func (*BootstrapEnrollRequest) ProtoReflect 

func (x *BootstrapEnrollRequest) ProtoReflect() protoreflect.Message

func (*BootstrapEnrollRequest) Reset 

func (x *BootstrapEnrollRequest) Reset()

func (*BootstrapEnrollRequest) String 

func (x *BootstrapEnrollRequest) String() string

type BootstrapEnrollResponse 

type BootstrapEnrollResponse struct {
	Status                EnrollmentStatus `protobuf:"varint,1,opt,name=status,proto3,enum=sam.v1.EnrollmentStatus" json:"status,omitempty"`
	BiscuitToken          []byte           `protobuf:"bytes,2,opt,name=biscuit_token,json=biscuitToken,proto3" json:"biscuit_token,omitempty"`                         // Populated only if APPROVED
	PollIntervalSeconds   int32            `protobuf:"varint,3,opt,name=poll_interval_seconds,json=pollIntervalSeconds,proto3" json:"poll_interval_seconds,omitempty"` // Recommended polling wait time
	ErrorMessage          string           `protobuf:"bytes,4,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"`
	ControlPlanePublicKey []byte           `` // Populated only if APPROVED
	/* 128-byte string literal not displayed */
	RouterAddresses []string               `protobuf:"bytes,6,rep,name=router_addresses,json=routerAddresses,proto3" json:"router_addresses,omitempty"` // Populated only if APPROVED
	ExpireTime      *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`                // Populated only if APPROVED
	// contains filtered or unexported fields
}

BootstrapEnrollResponse answers POST /enroll and GET /enroll/status. Polling GET /enroll/status requires proof of possession of the key submitted at /enroll: alongside the `peer_id` query parameter, the caller sends the X-Sam-Challenge-Ts header (unix milliseconds) and the X-Sam-Challenge-Sig header (unpadded base64url signature over the UTF-8 bytes of "sam:enroll-status:<peer_id>:<ts>").

func (*BootstrapEnrollResponse) Descriptor deprecated 

func (*BootstrapEnrollResponse) Descriptor() ([]byte, []int)

Deprecated: Use BootstrapEnrollResponse.ProtoReflect.Descriptor instead.

func (*BootstrapEnrollResponse) GetBiscuitToken 

func (x *BootstrapEnrollResponse) GetBiscuitToken() []byte

func (*BootstrapEnrollResponse) GetControlPlanePublicKey 

func (x *BootstrapEnrollResponse) GetControlPlanePublicKey() []byte

func (*BootstrapEnrollResponse) GetErrorMessage 

func (x *BootstrapEnrollResponse) GetErrorMessage() string

func (*BootstrapEnrollResponse) GetExpireTime 

func (x *BootstrapEnrollResponse) GetExpireTime() *timestamppb.Timestamp

func (*BootstrapEnrollResponse) GetPollIntervalSeconds 

func (x *BootstrapEnrollResponse) GetPollIntervalSeconds() int32

func (*BootstrapEnrollResponse) GetRouterAddresses 

func (x *BootstrapEnrollResponse) GetRouterAddresses() []string

func (*BootstrapEnrollResponse) GetStatus 

func (x *BootstrapEnrollResponse) GetStatus() EnrollmentStatus

func (*BootstrapEnrollResponse) ProtoMessage 

func (*BootstrapEnrollResponse) ProtoMessage()

func (*BootstrapEnrollResponse) ProtoReflect 

func (x *BootstrapEnrollResponse) ProtoReflect() protoreflect.Message

func (*BootstrapEnrollResponse) Reset 

func (x *BootstrapEnrollResponse) Reset()

func (*BootstrapEnrollResponse) String 

func (x *BootstrapEnrollResponse) String() string

type BootstrapTokenRequest 

type BootstrapTokenRequest struct {
	// Role the token enrolls into, e.g. RoleNode. Required on the admin
	// endpoint; the user endpoint defaults it to RoleNode.
	Role string `json:"role"`
	// OwnerID is the user the token is issued on behalf of. Honored by the
	// user endpoint only, and only for admins; defaults to the caller.
	OwnerID string `json:"owner_id,omitempty"`
	// TTLHours bounds the token's validity; the control plane defaults a
	// non-positive value to 24.
	TTLHours int `json:"ttl_hours"`
	// MaxUsages is how many enrollments the token admits; the control plane
	// defaults a non-positive value to 1.
	MaxUsages int `json:"max_usages"`
	// Description is a free-form operator note stored with the token.
	Description string `json:"description,omitempty"`
	// AutonomousRecovery is copied onto every node the token enrolls: such a
	// node may still refresh its credential after the control plane's
	// signing key rotated past its grace period, on proof of possession of
	// its own key alone. Admin-only, because a node that can always recover
	// holds a credential that never expires (see
	// storage.EnrolledNode.AutonomousRecovery).
	AutonomousRecovery bool `json:"autonomous_recovery"`
}

BootstrapTokenRequest is the JSON body that mints a bootstrap token, on POST /admin/bootstrap-tokens (admin bearer) and POST /users/me/tokens (OIDC user). It is the one definition both the control plane and its clients (sam-one's CLI, the console) marshal, so a field name exists in exactly one place.

type BootstrapTokenResponse 

type BootstrapTokenResponse struct {
	ID        string `json:"id"`
	Token     string `json:"token"`
	Role      string `json:"role"`
	OwnerID   string `json:"owner_id,omitempty"`
	ExpiresAt string `json:"expires_at"`
}

BootstrapTokenResponse is returned (201) when a bootstrap token is minted. Token is the plaintext and is shown exactly once; the control plane keeps only its hash, which is also the ID.

type CommandBackend 

type CommandBackend struct {
	Command []string          `protobuf:"bytes,1,rep,name=command,proto3" json:"command,omitempty"`
	Env     map[string]string `` /* 133-byte string literal not displayed */
	// contains filtered or unexported fields
}

func (*CommandBackend) Descriptor deprecated 

func (*CommandBackend) Descriptor() ([]byte, []int)

Deprecated: Use CommandBackend.ProtoReflect.Descriptor instead.

func (*CommandBackend) GetCommand 

func (x *CommandBackend) GetCommand() []string

func (*CommandBackend) GetEnv 

func (x *CommandBackend) GetEnv() map[string]string

func (*CommandBackend) ProtoMessage 

func (*CommandBackend) ProtoMessage()

func (*CommandBackend) ProtoReflect 

func (x *CommandBackend) ProtoReflect() protoreflect.Message

func (*CommandBackend) Reset 

func (x *CommandBackend) Reset()

func (*CommandBackend) String 

func (x *CommandBackend) String() string

type ControlPlaneInfoResponse 

type ControlPlaneInfoResponse struct {
	OidcIssuer      string   `protobuf:"bytes,1,opt,name=oidc_issuer,json=oidcIssuer,proto3" json:"oidc_issuer,omitempty"`
	ClientId        string   `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	Audience        string   `protobuf:"bytes,3,opt,name=audience,proto3" json:"audience,omitempty"`
	RouterAddresses []string `protobuf:"bytes,4,rep,name=router_addresses,json=routerAddresses,proto3" json:"router_addresses,omitempty"`
	// The complete set of currently banned peer IDs. Consumers reconcile their
	// local blocklist against this list rather than merging into it, so that a
	// peer the control plane no longer bans is unbanned everywhere without
	// needing an event of its own. MeshEvent_BANNED stays the fast path for
	// sub-second eviction; this is how a node that restarted or was offline
	// when the event was published catches up.
	BannedPeerIds []string `protobuf:"bytes,5,rep,name=banned_peer_ids,json=bannedPeerIds,proto3" json:"banned_peer_ids,omitempty"`
	// contains filtered or unexported fields
}

func (*ControlPlaneInfoResponse) Descriptor deprecated 

func (*ControlPlaneInfoResponse) Descriptor() ([]byte, []int)

Deprecated: Use ControlPlaneInfoResponse.ProtoReflect.Descriptor instead.

func (*ControlPlaneInfoResponse) GetAudience 

func (x *ControlPlaneInfoResponse) GetAudience() string

func (*ControlPlaneInfoResponse) GetBannedPeerIds 

func (x *ControlPlaneInfoResponse) GetBannedPeerIds() []string

func (*ControlPlaneInfoResponse) GetClientId 

func (x *ControlPlaneInfoResponse) GetClientId() string

func (*ControlPlaneInfoResponse) GetOidcIssuer 

func (x *ControlPlaneInfoResponse) GetOidcIssuer() string

func (*ControlPlaneInfoResponse) GetRouterAddresses 

func (x *ControlPlaneInfoResponse) GetRouterAddresses() []string

func (*ControlPlaneInfoResponse) ProtoMessage 

func (*ControlPlaneInfoResponse) ProtoMessage()

func (*ControlPlaneInfoResponse) ProtoReflect 

func (x *ControlPlaneInfoResponse) ProtoReflect() protoreflect.Message

func (*ControlPlaneInfoResponse) Reset 

func (x *ControlPlaneInfoResponse) Reset()

func (*ControlPlaneInfoResponse) String 

func (x *ControlPlaneInfoResponse) String() string

type DatalogSources 

type DatalogSources struct {
	// Policies are the service allow policies (BaselinePolicies).
	Policies []string `json:"policies"`
	// Rules derive allow_network_target from target grants (BaselineRules).
	Rules []string `json:"rules"`
	// HTTPRules derive service grants from narrowed grants (BaselineHTTPRules).
	HTTPRules []string `json:"http_rules"`
	// AgentRules derive agent_authorized from agent grants (BaselineAgentRules).
	AgentRules []string `json:"agent_rules"`
	// TargetFactRules map identity facts to target_fact (TargetFactRules).
	TargetFactRules []string `json:"target_fact_rules"`
	// ReplayCheck is BaselineReplayCheck.
	ReplayCheck string `json:"replay_check"`
	// TargetCheck is BaselineTargetCheck.
	TargetCheck string `json:"target_check"`
	// AgentCheck is BaselineAgentCheck.
	AgentCheck string `json:"agent_check"`
	// TimeCheck is ControlPlaneStaticTimeCheck.
	TimeCheck string `json:"time_check"`
	// AllowIfTrue is AllowIfTruePolicy.
	AllowIfTrue string `json:"allow_if_true"`
}

DatalogSources is the source text of the baseline Datalog, one string per item, in the form every Biscuit implementation parses.

type DiscoveredProvider 

type DiscoveredProvider struct {
	PeerId         string `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	LocalProxyUrl  string `protobuf:"bytes,2,opt,name=local_proxy_url,json=localProxyUrl,proto3" json:"local_proxy_url,omitempty"`
	SrvName        string `protobuf:"bytes,3,opt,name=srv_name,json=srvName,proto3" json:"srv_name,omitempty"`
	SrvDescription string `protobuf:"bytes,4,opt,name=srv_description,json=srvDescription,proto3" json:"srv_description,omitempty"`
	// contains filtered or unexported fields
}

func (*DiscoveredProvider) Descriptor deprecated 

func (*DiscoveredProvider) Descriptor() ([]byte, []int)

Deprecated: Use DiscoveredProvider.ProtoReflect.Descriptor instead.

func (*DiscoveredProvider) GetLocalProxyUrl 

func (x *DiscoveredProvider) GetLocalProxyUrl() string

func (*DiscoveredProvider) GetPeerId 

func (x *DiscoveredProvider) GetPeerId() string

func (*DiscoveredProvider) GetSrvDescription 

func (x *DiscoveredProvider) GetSrvDescription() string

func (*DiscoveredProvider) GetSrvName 

func (x *DiscoveredProvider) GetSrvName() string

func (*DiscoveredProvider) ProtoMessage 

func (*DiscoveredProvider) ProtoMessage()

func (*DiscoveredProvider) ProtoReflect 

func (x *DiscoveredProvider) ProtoReflect() protoreflect.Message

func (*DiscoveredProvider) Reset 

func (x *DiscoveredProvider) Reset()

func (*DiscoveredProvider) String 

func (x *DiscoveredProvider) String() string

type Egress 

type Egress struct {
	// RequireLabels is a floor every remote provider must attest before this
	// node will send it anything, whatever the caller asked for. Absent means
	// no floor, which is the historical behaviour: the requirement is then
	// whatever the caller supplied, and a caller that supplies nothing is
	// unconstrained.
	//
	// Every pair must hold (AND), unlike a caller's requirement, where any one
	// pair is enough (see LabelCheck vs LabelFloorCheck). A map gives one value
	// per key, so a floor cannot express alternatives — that is the point: a
	// floor with alternatives would let the weakest of them stand in for the
	// rest.
	//
	// A floor naming a label no peer attests reaches nothing, which is a
	// usable egress kill switch.
	RequireLabels map[string]string `yaml:"require_labels,omitempty"`
}

Egress is the operator's outbound policy: what this node demands of the peers it talks to. Attenuation is the mirror of it — what this node demands of the peers that talk to *it* — and the two are deliberately separate blocks because they answer opposite questions.

type EgressAssignmentsRequest 

type EgressAssignmentsRequest struct {
	// contains filtered or unexported fields
}

func (*EgressAssignmentsRequest) Descriptor deprecated 

func (*EgressAssignmentsRequest) Descriptor() ([]byte, []int)

Deprecated: Use EgressAssignmentsRequest.ProtoReflect.Descriptor instead.

func (*EgressAssignmentsRequest) ProtoMessage 

func (*EgressAssignmentsRequest) ProtoMessage()

func (*EgressAssignmentsRequest) ProtoReflect 

func (x *EgressAssignmentsRequest) ProtoReflect() protoreflect.Message

func (*EgressAssignmentsRequest) Reset 

func (x *EgressAssignmentsRequest) Reset()

func (*EgressAssignmentsRequest) String 

func (x *EgressAssignmentsRequest) String() string

type EgressAssignmentsResponse 

type EgressAssignmentsResponse struct {
	Egress []*EgressDestination `protobuf:"bytes,1,rep,name=egress,proto3" json:"egress,omitempty"`
	// contains filtered or unexported fields
}

EgressAssignmentsResponse answers GET /egress for a mesh member holding a biscuit: the destinations whose served_by selects that node. It is a separate endpoint from GET /policies so that a node predating it keeps syncing rules unchanged.

func (*EgressAssignmentsResponse) Descriptor deprecated 

func (*EgressAssignmentsResponse) Descriptor() ([]byte, []int)

Deprecated: Use EgressAssignmentsResponse.ProtoReflect.Descriptor instead.

func (*EgressAssignmentsResponse) GetEgress 

func (x *EgressAssignmentsResponse) GetEgress() []*EgressDestination

func (*EgressAssignmentsResponse) ProtoMessage 

func (*EgressAssignmentsResponse) ProtoMessage()

func (*EgressAssignmentsResponse) ProtoReflect 

func (x *EgressAssignmentsResponse) ProtoReflect() protoreflect.Message

func (*EgressAssignmentsResponse) Reset 

func (x *EgressAssignmentsResponse) Reset()

func (*EgressAssignmentsResponse) String 

func (x *EgressAssignmentsResponse) String() string

type EgressDestination 

type EgressDestination struct {

	// The destination hostname, lowercase, without a port or a path. It is the
	// service name in grants (egress://<name>) and the DHT key.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Where the serving node forwards requests. Optional; https://<name> when
	// empty. Must not carry a credential.
	TargetUrl string `protobuf:"bytes,2,opt,name=target_url,json=targetUrl,proto3" json:"target_url,omitempty"`
	// Name of the credential the serving node presents upstream, resolved by
	// the node from its secrets directory. Never a value: secret material does
	// not travel through this API.
	Credential string `protobuf:"bytes,3,opt,name=credential,proto3" json:"credential,omitempty"`
	// Role names or key=value labels selecting the nodes that serve this
	// destination. A node matches when any entry names one of its roles or
	// labels. The control plane also grants the destination to the selected
	// nodes, so the serving node authorizes local requests with its own
	// credential; other callers need the grant on their own role.
	ServedBy []string `protobuf:"bytes,4,rep,name=served_by,json=servedBy,proto3" json:"served_by,omitempty"`
	// contains filtered or unexported fields
}

EgressDestination is a destination outside the mesh that selected nodes serve as egress://<name>. It is part of the policy document the admin writes; a node receives the destinations that select it at GET /egress and serves them without configuration of its own.

func (*EgressDestination) Descriptor deprecated 

func (*EgressDestination) Descriptor() ([]byte, []int)

Deprecated: Use EgressDestination.ProtoReflect.Descriptor instead.

func (*EgressDestination) GetCredential 

func (x *EgressDestination) GetCredential() string

func (*EgressDestination) GetName 

func (x *EgressDestination) GetName() string

func (*EgressDestination) GetServedBy 

func (x *EgressDestination) GetServedBy() []string

func (*EgressDestination) GetTargetUrl 

func (x *EgressDestination) GetTargetUrl() string

func (*EgressDestination) ProtoMessage 

func (*EgressDestination) ProtoMessage()

func (*EgressDestination) ProtoReflect 

func (x *EgressDestination) ProtoReflect() protoreflect.Message

func (*EgressDestination) Reset 

func (x *EgressDestination) Reset()

func (*EgressDestination) String 

func (x *EgressDestination) String() string

type EnrollRequest 

type EnrollRequest struct {
	Jwt           string `protobuf:"bytes,1,opt,name=jwt,proto3" json:"jwt,omitempty"`
	PeerId        string `protobuf:"bytes,2,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	PublicKey     []byte `protobuf:"bytes,3,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
	RequestedRole string `protobuf:"bytes,4,opt,name=requested_role,json=requestedRole,proto3" json:"requested_role,omitempty"`
	// Operator-declared labels (e.g. key "region", see api/labels.go).
	// Validated fail-closed by the control plane and, once attested by the
	// enrollment flow's gates, minted as signed label() facts in the
	// biscuit. Empty means no claims.
	Labels map[string]string `` /* 139-byte string literal not displayed */
	// Proof of possession of public_key's private half: challenge_unix_ms is
	// the caller's clock in unix milliseconds and challenge_signature signs
	// the UTF-8 bytes of "sam:register:<peer_id>:<challenge_unix_ms>". It is
	// an int64 because it is the number in the signed text, not an instant
	// for display. Required, and peer_id must be derived from public_key.
	// The JWT proves who is asking; this proves they hold the key they are
	// asking to bind, so an identity cannot register (and overwrite) another
	// node's peer_id.
	ChallengeUnixMs    int64  `protobuf:"varint,6,opt,name=challenge_unix_ms,json=challengeUnixMs,proto3" json:"challenge_unix_ms,omitempty"`
	ChallengeSignature []byte `protobuf:"bytes,7,opt,name=challenge_signature,json=challengeSignature,proto3" json:"challenge_signature,omitempty"`
	// contains filtered or unexported fields
}

func (*EnrollRequest) Descriptor deprecated 

func (*EnrollRequest) Descriptor() ([]byte, []int)

Deprecated: Use EnrollRequest.ProtoReflect.Descriptor instead.

func (*EnrollRequest) GetChallengeSignature 

func (x *EnrollRequest) GetChallengeSignature() []byte

func (*EnrollRequest) GetChallengeUnixMs 

func (x *EnrollRequest) GetChallengeUnixMs() int64

func (*EnrollRequest) GetJwt 

func (x *EnrollRequest) GetJwt() string

func (*EnrollRequest) GetLabels 

func (x *EnrollRequest) GetLabels() map[string]string

func (*EnrollRequest) GetPeerId 

func (x *EnrollRequest) GetPeerId() string

func (*EnrollRequest) GetPublicKey 

func (x *EnrollRequest) GetPublicKey() []byte

func (*EnrollRequest) GetRequestedRole 

func (x *EnrollRequest) GetRequestedRole() string

func (*EnrollRequest) ProtoMessage 

func (*EnrollRequest) ProtoMessage()

func (*EnrollRequest) ProtoReflect 

func (x *EnrollRequest) ProtoReflect() protoreflect.Message

func (*EnrollRequest) Reset 

func (x *EnrollRequest) Reset()

func (*EnrollRequest) String 

func (x *EnrollRequest) String() string

type EnrollResponse 

type EnrollResponse struct {
	BiscuitToken          []byte                 `protobuf:"bytes,1,opt,name=biscuit_token,json=biscuitToken,proto3" json:"biscuit_token,omitempty"`
	ErrorMessage          string                 `protobuf:"bytes,2,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"`
	ControlPlanePublicKey []byte                 `` /* 128-byte string literal not displayed */
	RouterAddresses       []string               `protobuf:"bytes,4,rep,name=router_addresses,json=routerAddresses,proto3" json:"router_addresses,omitempty"`
	ExpireTime            *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	// contains filtered or unexported fields
}

func (*EnrollResponse) Descriptor deprecated 

func (*EnrollResponse) Descriptor() ([]byte, []int)

Deprecated: Use EnrollResponse.ProtoReflect.Descriptor instead.

func (*EnrollResponse) GetBiscuitToken 

func (x *EnrollResponse) GetBiscuitToken() []byte

func (*EnrollResponse) GetControlPlanePublicKey 

func (x *EnrollResponse) GetControlPlanePublicKey() []byte

func (*EnrollResponse) GetErrorMessage 

func (x *EnrollResponse) GetErrorMessage() string

func (*EnrollResponse) GetExpireTime 

func (x *EnrollResponse) GetExpireTime() *timestamppb.Timestamp

func (*EnrollResponse) GetRouterAddresses 

func (x *EnrollResponse) GetRouterAddresses() []string

func (*EnrollResponse) ProtoMessage 

func (*EnrollResponse) ProtoMessage()

func (*EnrollResponse) ProtoReflect 

func (x *EnrollResponse) ProtoReflect() protoreflect.Message

func (*EnrollResponse) Reset 

func (x *EnrollResponse) Reset()

func (*EnrollResponse) String 

func (x *EnrollResponse) String() string

type EnrollmentStatus 

type EnrollmentStatus int32
const (
	EnrollmentStatus_ENROLLMENT_STATUS_UNSPECIFIED EnrollmentStatus = 0
	EnrollmentStatus_ENROLLMENT_STATUS_PENDING     EnrollmentStatus = 1
	EnrollmentStatus_ENROLLMENT_STATUS_APPROVED    EnrollmentStatus = 2
	EnrollmentStatus_ENROLLMENT_STATUS_REJECTED    EnrollmentStatus = 3
)

func (EnrollmentStatus) Descriptor 

func (EnrollmentStatus) Descriptor() protoreflect.EnumDescriptor

func (EnrollmentStatus) Enum 

func (x EnrollmentStatus) Enum() *EnrollmentStatus

func (EnrollmentStatus) EnumDescriptor deprecated 

func (EnrollmentStatus) EnumDescriptor() ([]byte, []int)

Deprecated: Use EnrollmentStatus.Descriptor instead.

func (EnrollmentStatus) Number 

func (x EnrollmentStatus) Number() protoreflect.EnumNumber

func (EnrollmentStatus) String 

func (x EnrollmentStatus) String() string

func (EnrollmentStatus) Type 

func (EnrollmentStatus) Type() protoreflect.EnumType

type HTTPGrant 

type HTTPGrant struct {

	// One of the role's allowed_services entries, written identically.
	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// Methods the holder may use, e.g. "GET", "HEAD". Empty means any method.
	Methods []string `protobuf:"bytes,2,rep,name=methods,proto3" json:"methods,omitempty"`
	// Paths the holder may request, as the backend sees them: "/user" matches
	// that path only, "/v2/public/*" matches every path under the prefix.
	// Empty means any path. At least one of methods and paths must be set.
	Paths []string `protobuf:"bytes,3,rep,name=paths,proto3" json:"paths,omitempty"`
	// contains filtered or unexported fields
}

HTTPGrant narrows one allowed_services entry to HTTP methods and paths. The control plane compiles it into granted_method and granted_path_* facts in the holder's credential and withholds the plain service grant for that entry. The baseline rules derive the service grant only for a request whose method($m) and path($p) facts match, so a request that carries no HTTP method (a tunnel, a non-HTTP stream) does not match a narrowed entry.

func SplitHTTPGrants 

func SplitHTTPGrants(role *PolicyRole) (plain []string, narrowed []*HTTPGrant)

SplitHTTPGrants separates a role's allowed_services into the entries minted as plain grants and the entries narrowed by PolicyRole.http. A narrowed entry is withheld from the plain list: it exists only as its http_granted_service_* fact, and the request has to earn the plain fact through BaselineHTTPRules.

func (*HTTPGrant) Descriptor deprecated 

func (*HTTPGrant) Descriptor() ([]byte, []int)

Deprecated: Use HTTPGrant.ProtoReflect.Descriptor instead.

func (*HTTPGrant) GetMethods 

func (x *HTTPGrant) GetMethods() []string

func (*HTTPGrant) GetPaths 

func (x *HTTPGrant) GetPaths() []string

func (*HTTPGrant) GetService 

func (x *HTTPGrant) GetService() string

func (*HTTPGrant) ProtoMessage 

func (*HTTPGrant) ProtoMessage()

func (*HTTPGrant) ProtoReflect 

func (x *HTTPGrant) ProtoReflect() protoreflect.Message

func (*HTTPGrant) Reset 

func (x *HTTPGrant) Reset()

func (*HTTPGrant) String 

func (x *HTTPGrant) String() string

type IdentityEvidenceResponse 

type IdentityEvidenceResponse struct {
	PeerId                  string                 `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	Biscuit                 []byte                 `protobuf:"bytes,2,opt,name=biscuit,proto3" json:"biscuit,omitempty"`
	BiscuitExpireTime       *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=biscuit_expire_time,json=biscuitExpireTime,proto3" json:"biscuit_expire_time,omitempty"`
	ControlPlaneUrl         string                 `protobuf:"bytes,4,opt,name=control_plane_url,json=controlPlaneUrl,proto3" json:"control_plane_url,omitempty"`
	TrustedControlPlaneKeys [][]byte               `` // Ed25519 SPKI DER
	/* 134-byte string literal not displayed */
	CheckTime *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=check_time,json=checkTime,proto3" json:"check_time,omitempty"`
	// contains filtered or unexported fields
}

func (*IdentityEvidenceResponse) Descriptor deprecated 

func (*IdentityEvidenceResponse) Descriptor() ([]byte, []int)

Deprecated: Use IdentityEvidenceResponse.ProtoReflect.Descriptor instead.

func (*IdentityEvidenceResponse) GetBiscuit 

func (x *IdentityEvidenceResponse) GetBiscuit() []byte

func (*IdentityEvidenceResponse) GetBiscuitExpireTime 

func (x *IdentityEvidenceResponse) GetBiscuitExpireTime() *timestamppb.Timestamp

func (*IdentityEvidenceResponse) GetCheckTime 

func (x *IdentityEvidenceResponse) GetCheckTime() *timestamppb.Timestamp

func (*IdentityEvidenceResponse) GetControlPlaneUrl 

func (x *IdentityEvidenceResponse) GetControlPlaneUrl() string

func (*IdentityEvidenceResponse) GetPeerId 

func (x *IdentityEvidenceResponse) GetPeerId() string

func (*IdentityEvidenceResponse) GetTrustedControlPlaneKeys 

func (x *IdentityEvidenceResponse) GetTrustedControlPlaneKeys() [][]byte

func (*IdentityEvidenceResponse) ProtoMessage 

func (*IdentityEvidenceResponse) ProtoMessage()

func (*IdentityEvidenceResponse) ProtoReflect 

func (x *IdentityEvidenceResponse) ProtoReflect() protoreflect.Message

func (*IdentityEvidenceResponse) Reset 

func (x *IdentityEvidenceResponse) Reset()

func (*IdentityEvidenceResponse) String 

func (x *IdentityEvidenceResponse) String() string

type KeysResponse 

type KeysResponse struct {
	PublicKeys [][]byte `protobuf:"bytes,1,rep,name=public_keys,json=publicKeys,proto3" json:"public_keys,omitempty"`
	// When the set was signed; receivers reject responses outside a short
	// freshness window so a captured set cannot be replayed.
	SignTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=sign_time,json=signTime,proto3" json:"sign_time,omitempty"`
	// One ed25519 signature per entry of public_keys, by that key, over the
	// deterministic encoding of this message with signatures cleared. A
	// receiver trusting any key still valid on the control plane can verify
	// the whole set (see api.VerifyKeysResponse).
	Signatures [][]byte `protobuf:"bytes,3,rep,name=signatures,proto3" json:"signatures,omitempty"`
	// contains filtered or unexported fields
}

func (*KeysResponse) Descriptor deprecated 

func (*KeysResponse) Descriptor() ([]byte, []int)

Deprecated: Use KeysResponse.ProtoReflect.Descriptor instead.

func (*KeysResponse) GetPublicKeys 

func (x *KeysResponse) GetPublicKeys() [][]byte

func (*KeysResponse) GetSignTime 

func (x *KeysResponse) GetSignTime() *timestamppb.Timestamp

func (*KeysResponse) GetSignatures 

func (x *KeysResponse) GetSignatures() [][]byte

func (*KeysResponse) ProtoMessage 

func (*KeysResponse) ProtoMessage()

func (*KeysResponse) ProtoReflect 

func (x *KeysResponse) ProtoReflect() protoreflect.Message

func (*KeysResponse) Reset 

func (x *KeysResponse) Reset()

func (*KeysResponse) String 

func (x *KeysResponse) String() string

type MemberCredential 

type MemberCredential struct {

	// Base URL of the control plane that minted the biscuit.
	ControlPlaneUrl string `protobuf:"bytes,1,opt,name=control_plane_url,json=controlPlaneUrl,proto3" json:"control_plane_url,omitempty"`
	// The member's biscuit.
	Biscuit []byte `protobuf:"bytes,2,opt,name=biscuit,proto3" json:"biscuit,omitempty"`
	// When the biscuit expires.
	ExpireTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	// Control plane signing keys trusted now; a rotation keeps several valid.
	TrustedKeys []*TrustedSigningKey `protobuf:"bytes,4,rep,name=trusted_keys,json=trustedKeys,proto3" json:"trusted_keys,omitempty"`
	// The keys trusted when the biscuit was issued. A key trusted now that is
	// absent here means a rotation happened since: the biscuit is signed by a
	// retiring key and must be refreshed before that key leaves its grace
	// period.
	IssuedUnderKeys [][]byte `protobuf:"bytes,5,rep,name=issued_under_keys,json=issuedUnderKeys,proto3" json:"issued_under_keys,omitempty"`
	// Router multiaddrs, `/p2p/<peer id>` suffixed.
	RouterAddresses []string `protobuf:"bytes,6,rep,name=router_addresses,json=routerAddresses,proto3" json:"router_addresses,omitempty"`
	// The session that renews an identity enrolled through the mesh's
	// identity provider. Unset for a member enrolled with a bootstrap token.
	OidcSession *OIDCSession `protobuf:"bytes,7,opt,name=oidc_session,json=oidcSession,proto3" json:"oidc_session,omitempty"`
	// contains filtered or unexported fields
}

func (*MemberCredential) Descriptor deprecated 

func (*MemberCredential) Descriptor() ([]byte, []int)

Deprecated: Use MemberCredential.ProtoReflect.Descriptor instead.

func (*MemberCredential) GetBiscuit 

func (x *MemberCredential) GetBiscuit() []byte

func (*MemberCredential) GetControlPlaneUrl 

func (x *MemberCredential) GetControlPlaneUrl() string

func (*MemberCredential) GetExpireTime 

func (x *MemberCredential) GetExpireTime() *timestamppb.Timestamp

func (*MemberCredential) GetIssuedUnderKeys 

func (x *MemberCredential) GetIssuedUnderKeys() [][]byte

func (*MemberCredential) GetOidcSession 

func (x *MemberCredential) GetOidcSession() *OIDCSession

func (*MemberCredential) GetRouterAddresses 

func (x *MemberCredential) GetRouterAddresses() []string

func (*MemberCredential) GetTrustedKeys 

func (x *MemberCredential) GetTrustedKeys() []*TrustedSigningKey

func (*MemberCredential) ProtoMessage 

func (*MemberCredential) ProtoMessage()

func (*MemberCredential) ProtoReflect 

func (x *MemberCredential) ProtoReflect() protoreflect.Message

func (*MemberCredential) Reset 

func (x *MemberCredential) Reset()

func (*MemberCredential) String 

func (x *MemberCredential) String() string

type MeshEvent 

type MeshEvent struct {
	Type   MeshEvent_Type `protobuf:"varint,1,opt,name=type,proto3,enum=sam.v1.MeshEvent_Type" json:"type,omitempty"`
	PeerId string         `protobuf:"bytes,2,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	// When the control plane recorded the event. Receivers ignore an event
	// further than a few minutes from their clock and, for bans, one older
	// than the last they applied for the peer.
	EventTime    *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=event_time,json=eventTime,proto3" json:"event_time,omitempty"`
	NewPublicKey []byte                 `protobuf:"bytes,4,opt,name=new_public_key,json=newPublicKey,proto3" json:"new_public_key,omitempty"`
	Signature    []byte                 `protobuf:"bytes,5,opt,name=signature,proto3" json:"signature,omitempty"`
	// contains filtered or unexported fields
}

func (*MeshEvent) Descriptor deprecated 

func (*MeshEvent) Descriptor() ([]byte, []int)

Deprecated: Use MeshEvent.ProtoReflect.Descriptor instead.

func (*MeshEvent) GetEventTime 

func (x *MeshEvent) GetEventTime() *timestamppb.Timestamp

func (*MeshEvent) GetNewPublicKey 

func (x *MeshEvent) GetNewPublicKey() []byte

func (*MeshEvent) GetPeerId 

func (x *MeshEvent) GetPeerId() string

func (*MeshEvent) GetSignature 

func (x *MeshEvent) GetSignature() []byte

func (*MeshEvent) GetType 

func (x *MeshEvent) GetType() MeshEvent_Type

func (*MeshEvent) ProtoMessage 

func (*MeshEvent) ProtoMessage()

func (*MeshEvent) ProtoReflect 

func (x *MeshEvent) ProtoReflect() protoreflect.Message

func (*MeshEvent) Reset 

func (x *MeshEvent) Reset()

func (*MeshEvent) String 

func (x *MeshEvent) String() string

type MeshEvent_Type 

type MeshEvent_Type int32
const (
	MeshEvent_BANNED        MeshEvent_Type = 0
	MeshEvent_KEY_ROTATION  MeshEvent_Type = 1
	MeshEvent_POLICY_UPDATE MeshEvent_Type = 2
)

func (MeshEvent_Type) Descriptor 

func (MeshEvent_Type) Descriptor() protoreflect.EnumDescriptor

func (MeshEvent_Type) Enum 

func (x MeshEvent_Type) Enum() *MeshEvent_Type

func (MeshEvent_Type) EnumDescriptor deprecated 

func (MeshEvent_Type) EnumDescriptor() ([]byte, []int)

Deprecated: Use MeshEvent_Type.Descriptor instead.

func (MeshEvent_Type) Number 

func (x MeshEvent_Type) Number() protoreflect.EnumNumber

func (MeshEvent_Type) String 

func (x MeshEvent_Type) String() string

func (MeshEvent_Type) Type 

func (MeshEvent_Type) Type() protoreflect.EnumType

type NodeCatalogReport 

type NodeCatalogReport struct {
	Services []*ServiceInfo `protobuf:"bytes,1,rep,name=services,proto3" json:"services,omitempty"`
	// contains filtered or unexported fields
}

NodeCatalogReport is the body of POST /nodes/catalog: a node's self-reported list of locally registered services. The reporting peer is taken from the presented biscuit, never from the body, so a node can only ever describe itself. Display-only; carries no authorization weight.

func (*NodeCatalogReport) Descriptor deprecated 

func (*NodeCatalogReport) Descriptor() ([]byte, []int)

Deprecated: Use NodeCatalogReport.ProtoReflect.Descriptor instead.

func (*NodeCatalogReport) GetServices 

func (x *NodeCatalogReport) GetServices() []*ServiceInfo

func (*NodeCatalogReport) ProtoMessage 

func (*NodeCatalogReport) ProtoMessage()

func (*NodeCatalogReport) ProtoReflect 

func (x *NodeCatalogReport) ProtoReflect() protoreflect.Message

func (*NodeCatalogReport) Reset 

func (x *NodeCatalogReport) Reset()

func (*NodeCatalogReport) String 

func (x *NodeCatalogReport) String() string

type NodeConfig 

type NodeConfig struct {
	Version     string          `yaml:"version"`
	Attenuation Attenuation     `yaml:"attenuation"`
	Services    []ServiceConfig `yaml:"services"`
	// Labels is what this node is, attested at enrollment; Egress is what it
	// demands of the peers it talks to. Adjacent because they are read
	// together and mean opposite directions.
	Labels map[string]string `yaml:"labels,omitempty"`
	Egress Egress            `yaml:"egress"`
}

NodeConfig defines the optional attenuation rules and static services for a specific SAM Node.

type OIDCSession 

type OIDCSession struct {
	Issuer       string `protobuf:"bytes,1,opt,name=issuer,proto3" json:"issuer,omitempty"`
	ClientId     string `protobuf:"bytes,2,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
	Audience     string `protobuf:"bytes,3,opt,name=audience,proto3" json:"audience,omitempty"`
	RefreshToken string `protobuf:"bytes,4,opt,name=refresh_token,json=refreshToken,proto3" json:"refresh_token,omitempty"`
	// contains filtered or unexported fields
}

func (*OIDCSession) Descriptor deprecated 

func (*OIDCSession) Descriptor() ([]byte, []int)

Deprecated: Use OIDCSession.ProtoReflect.Descriptor instead.

func (*OIDCSession) GetAudience 

func (x *OIDCSession) GetAudience() string

func (*OIDCSession) GetClientId 

func (x *OIDCSession) GetClientId() string

func (*OIDCSession) GetIssuer 

func (x *OIDCSession) GetIssuer() string

func (*OIDCSession) GetRefreshToken 

func (x *OIDCSession) GetRefreshToken() string

func (*OIDCSession) ProtoMessage 

func (*OIDCSession) ProtoMessage()

func (*OIDCSession) ProtoReflect 

func (x *OIDCSession) ProtoReflect() protoreflect.Message

func (*OIDCSession) Reset 

func (x *OIDCSession) Reset()

func (*OIDCSession) String 

func (x *OIDCSession) String() string

type PeerEvidenceResponse 

type PeerEvidenceResponse struct {
	PeerId        string                 `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	Biscuit       []byte                 `protobuf:"bytes,2,opt,name=biscuit,proto3" json:"biscuit,omitempty"`
	VerifyingKey  []byte                 `protobuf:"bytes,3,opt,name=verifying_key,json=verifyingKey,proto3" json:"verifying_key,omitempty"` // Ed25519 SPKI DER, member of the trusted set
	Roles         []string               `protobuf:"bytes,4,rep,name=roles,proto3" json:"roles,omitempty"`
	Labels        map[string]string      `` /* 139-byte string literal not displayed */
	ExpireTime    *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	RevocationIds []string               `protobuf:"bytes,7,rep,name=revocation_ids,json=revocationIds,proto3" json:"revocation_ids,omitempty"` // hex
	CheckTime     *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=check_time,json=checkTime,proto3" json:"check_time,omitempty"`
	// contains filtered or unexported fields
}

func (*PeerEvidenceResponse) Descriptor deprecated 

func (*PeerEvidenceResponse) Descriptor() ([]byte, []int)

Deprecated: Use PeerEvidenceResponse.ProtoReflect.Descriptor instead.

func (*PeerEvidenceResponse) GetBiscuit 

func (x *PeerEvidenceResponse) GetBiscuit() []byte

func (*PeerEvidenceResponse) GetCheckTime 

func (x *PeerEvidenceResponse) GetCheckTime() *timestamppb.Timestamp

func (*PeerEvidenceResponse) GetExpireTime 

func (x *PeerEvidenceResponse) GetExpireTime() *timestamppb.Timestamp

func (*PeerEvidenceResponse) GetLabels 

func (x *PeerEvidenceResponse) GetLabels() map[string]string

func (*PeerEvidenceResponse) GetPeerId 

func (x *PeerEvidenceResponse) GetPeerId() string

func (*PeerEvidenceResponse) GetRevocationIds 

func (x *PeerEvidenceResponse) GetRevocationIds() []string

func (*PeerEvidenceResponse) GetRoles 

func (x *PeerEvidenceResponse) GetRoles() []string

func (*PeerEvidenceResponse) GetVerifyingKey 

func (x *PeerEvidenceResponse) GetVerifyingKey() []byte

func (*PeerEvidenceResponse) ProtoMessage 

func (*PeerEvidenceResponse) ProtoMessage()

func (*PeerEvidenceResponse) ProtoReflect 

func (x *PeerEvidenceResponse) ProtoReflect() protoreflect.Message

func (*PeerEvidenceResponse) Reset 

func (x *PeerEvidenceResponse) Reset()

func (*PeerEvidenceResponse) String 

func (x *PeerEvidenceResponse) String() string

type PolicyBinding 

type PolicyBinding struct {
	Role    string   `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
	Members []string `protobuf:"bytes,2,rep,name=members,proto3" json:"members,omitempty"`
	// contains filtered or unexported fields
}

func (*PolicyBinding) Descriptor deprecated 

func (*PolicyBinding) Descriptor() ([]byte, []int)

Deprecated: Use PolicyBinding.ProtoReflect.Descriptor instead.

func (*PolicyBinding) GetMembers 

func (x *PolicyBinding) GetMembers() []string

func (*PolicyBinding) GetRole 

func (x *PolicyBinding) GetRole() string

func (*PolicyBinding) ProtoMessage 

func (*PolicyBinding) ProtoMessage()

func (*PolicyBinding) ProtoReflect 

func (x *PolicyBinding) ProtoReflect() protoreflect.Message

func (*PolicyBinding) Reset 

func (x *PolicyBinding) Reset()

func (*PolicyBinding) String 

func (x *PolicyBinding) String() string

type PolicyConfig 

type PolicyConfig struct {
	Roles    []*PolicyRole        `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
	Bindings []*PolicyBinding     `protobuf:"bytes,2,rep,name=bindings,proto3" json:"bindings,omitempty"`
	Egress   []*EgressDestination `protobuf:"bytes,3,rep,name=egress,proto3" json:"egress,omitempty"`
	// contains filtered or unexported fields
}

PolicyConfig is the mesh policy as the operator writes it: roles and bindings. It is the body of POST /policies and the answer of GET /admin/policy, both protojson. Only the control plane reads it, to mint tokens and to render PolicyConfigGetResponse.

func (*PolicyConfig) Descriptor deprecated 

func (*PolicyConfig) Descriptor() ([]byte, []int)

Deprecated: Use PolicyConfig.ProtoReflect.Descriptor instead.

func (*PolicyConfig) GetBindings 

func (x *PolicyConfig) GetBindings() []*PolicyBinding

func (*PolicyConfig) GetEgress 

func (x *PolicyConfig) GetEgress() []*EgressDestination

func (*PolicyConfig) GetRoles 

func (x *PolicyConfig) GetRoles() []*PolicyRole

func (*PolicyConfig) ProtoMessage 

func (*PolicyConfig) ProtoMessage()

func (*PolicyConfig) ProtoReflect 

func (x *PolicyConfig) ProtoReflect() protoreflect.Message

func (*PolicyConfig) Reset 

func (x *PolicyConfig) Reset()

func (*PolicyConfig) String 

func (x *PolicyConfig) String() string

type PolicyConfigGetRequest 

type PolicyConfigGetRequest struct {
	// contains filtered or unexported fields
}

func (*PolicyConfigGetRequest) Descriptor deprecated 

func (*PolicyConfigGetRequest) Descriptor() ([]byte, []int)

Deprecated: Use PolicyConfigGetRequest.ProtoReflect.Descriptor instead.

func (*PolicyConfigGetRequest) ProtoMessage 

func (*PolicyConfigGetRequest) ProtoMessage()

func (*PolicyConfigGetRequest) ProtoReflect 

func (x *PolicyConfigGetRequest) ProtoReflect() protoreflect.Message

func (*PolicyConfigGetRequest) Reset 

func (x *PolicyConfigGetRequest) Reset()

func (*PolicyConfigGetRequest) String 

func (x *PolicyConfigGetRequest) String() string

type PolicyConfigGetResponse 

type PolicyConfigGetResponse struct {

	// One rule per entry, rendered by the control plane with api.BuildPolicyRules.
	DatalogRules []string `protobuf:"bytes,3,rep,name=datalog_rules,json=datalogRules,proto3" json:"datalog_rules,omitempty"`
	// contains filtered or unexported fields
}

PolicyConfigGetResponse answers GET /policies for a mesh member holding a biscuit. It carries the policy only as Datalog text: this is the contract every member evaluates, and none derives rules from roles and bindings.

func (*PolicyConfigGetResponse) Descriptor deprecated 

func (*PolicyConfigGetResponse) Descriptor() ([]byte, []int)

Deprecated: Use PolicyConfigGetResponse.ProtoReflect.Descriptor instead.

func (*PolicyConfigGetResponse) GetDatalogRules 

func (x *PolicyConfigGetResponse) GetDatalogRules() []string

func (*PolicyConfigGetResponse) ProtoMessage 

func (*PolicyConfigGetResponse) ProtoMessage()

func (*PolicyConfigGetResponse) ProtoReflect 

func (x *PolicyConfigGetResponse) ProtoReflect() protoreflect.Message

func (*PolicyConfigGetResponse) Reset 

func (x *PolicyConfigGetResponse) Reset()

func (*PolicyConfigGetResponse) String 

func (x *PolicyConfigGetResponse) String() string

type PolicyConfigUpdateResponse 

type PolicyConfigUpdateResponse struct {
	Success bool   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
	Error   string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

func (*PolicyConfigUpdateResponse) Descriptor deprecated 

func (*PolicyConfigUpdateResponse) Descriptor() ([]byte, []int)

Deprecated: Use PolicyConfigUpdateResponse.ProtoReflect.Descriptor instead.

func (*PolicyConfigUpdateResponse) GetError 

func (x *PolicyConfigUpdateResponse) GetError() string

func (*PolicyConfigUpdateResponse) GetSuccess 

func (x *PolicyConfigUpdateResponse) GetSuccess() bool

func (*PolicyConfigUpdateResponse) ProtoMessage 

func (*PolicyConfigUpdateResponse) ProtoMessage()

func (*PolicyConfigUpdateResponse) ProtoReflect 

func (x *PolicyConfigUpdateResponse) ProtoReflect() protoreflect.Message

func (*PolicyConfigUpdateResponse) Reset 

func (x *PolicyConfigUpdateResponse) Reset()

func (*PolicyConfigUpdateResponse) String 

func (x *PolicyConfigUpdateResponse) String() string

type PolicyRole 

type PolicyRole struct {
	Name            string   `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	AllowedTargets  []string `protobuf:"bytes,2,rep,name=allowed_targets,json=allowedTargets,proto3" json:"allowed_targets,omitempty"`
	AllowedServices []string `protobuf:"bytes,3,rep,name=allowed_services,json=allowedServices,proto3" json:"allowed_services,omitempty"`
	CustomDatalog   []string `protobuf:"bytes,4,rep,name=custom_datalog,json=customDatalog,proto3" json:"custom_datalog,omitempty"`
	// Agent namespaces the holder may speak for, e.g. "*.prod.acme.example".
	// An agent claim is the calling node's word, so it is only worth what the
	// control plane attested about that node. Distinct from allowed_targets:
	// being allowed to call an agent is not being allowed to impersonate it.
	AllowedAgents []string `protobuf:"bytes,5,rep,name=allowed_agents,json=allowedAgents,proto3" json:"allowed_agents,omitempty"`
	// Labels a node with this role may declare at enrollment, as "*", "key=*"
	// or "key=value". A node declares its own labels, so this is what turns a
	// declaration into something the control plane is willing to sign.
	AllowedLabels []string `protobuf:"bytes,6,rep,name=allowed_labels,json=allowedLabels,proto3" json:"allowed_labels,omitempty"`
	// HTTP narrowing of allowed_services entries; see HTTPGrant.
	Http []*HTTPGrant `protobuf:"bytes,7,rep,name=http,proto3" json:"http,omitempty"`
	// contains filtered or unexported fields
}

func (*PolicyRole) Descriptor deprecated 

func (*PolicyRole) Descriptor() ([]byte, []int)

Deprecated: Use PolicyRole.ProtoReflect.Descriptor instead.

func (*PolicyRole) GetAllowedAgents 

func (x *PolicyRole) GetAllowedAgents() []string

func (*PolicyRole) GetAllowedLabels 

func (x *PolicyRole) GetAllowedLabels() []string

func (*PolicyRole) GetAllowedServices 

func (x *PolicyRole) GetAllowedServices() []string

func (*PolicyRole) GetAllowedTargets 

func (x *PolicyRole) GetAllowedTargets() []string

func (*PolicyRole) GetCustomDatalog 

func (x *PolicyRole) GetCustomDatalog() []string

func (*PolicyRole) GetHttp 

func (x *PolicyRole) GetHttp() []*HTTPGrant

func (*PolicyRole) GetName 

func (x *PolicyRole) GetName() string

func (*PolicyRole) ProtoMessage 

func (*PolicyRole) ProtoMessage()

func (*PolicyRole) ProtoReflect 

func (x *PolicyRole) ProtoReflect() protoreflect.Message

func (*PolicyRole) Reset 

func (x *PolicyRole) Reset()

func (*PolicyRole) String 

func (x *PolicyRole) String() string

type PolicyRule 

type PolicyRule struct {
	Rule biscuit.Rule
	Text string
}

PolicyRule is one mesh policy rule in both the form biscuit-go evaluates and the Datalog text every other Biscuit implementation parses.

func BuildEgressServingRules 

func BuildEgressServingRules(egress []*EgressDestination) []PolicyRule

BuildEgressServingRules grants each destination to the nodes that serve it: granted_service_exact("egress", name) <- role(r) or <- label(k, v) for every served_by entry. The serving node evaluates its own credential when a local client asks for the destination, so the grant has to reach it; the rules travel with the mesh policy like every other grant.

func BuildPolicyRules 

func BuildPolicyRules(roles []*PolicyRole, bindings []*PolicyBinding) (rules []PolicyRule, warnings []string)

BuildPolicyRules turns the mesh policy into the Datalog rules a provider adds to its authorizer: bindings grant role() from attested identity facts, roles grant granted_* facts from role(). Warnings name entries that were skipped or that widen the mesh more than an operator may expect; the caller decides how to surface them.

type RegisterServiceRequest 

type RegisterServiceRequest struct {
	Service *ServiceInfo `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
	// Types that are valid to be assigned to Backend:
	//
	//	*RegisterServiceRequest_TargetUrl
	//	*RegisterServiceRequest_Command
	Backend isRegisterServiceRequest_Backend `protobuf_oneof:"backend"`
	// contains filtered or unexported fields
}

func (*RegisterServiceRequest) Descriptor deprecated 

func (*RegisterServiceRequest) Descriptor() ([]byte, []int)

Deprecated: Use RegisterServiceRequest.ProtoReflect.Descriptor instead.

func (*RegisterServiceRequest) GetBackend 

func (x *RegisterServiceRequest) GetBackend() isRegisterServiceRequest_Backend

func (*RegisterServiceRequest) GetCommand 

func (x *RegisterServiceRequest) GetCommand() *CommandBackend

func (*RegisterServiceRequest) GetService 

func (x *RegisterServiceRequest) GetService() *ServiceInfo

func (*RegisterServiceRequest) GetTargetUrl 

func (x *RegisterServiceRequest) GetTargetUrl() string

func (*RegisterServiceRequest) ProtoMessage 

func (*RegisterServiceRequest) ProtoMessage()

func (*RegisterServiceRequest) ProtoReflect 

func (x *RegisterServiceRequest) ProtoReflect() protoreflect.Message

func (*RegisterServiceRequest) Reset 

func (x *RegisterServiceRequest) Reset()

func (*RegisterServiceRequest) String 

func (x *RegisterServiceRequest) String() string

type RegisterServiceRequest_Command 

type RegisterServiceRequest_Command struct {
	Command *CommandBackend `protobuf:"bytes,3,opt,name=command,proto3,oneof"`
}

type RegisterServiceRequest_TargetUrl 

type RegisterServiceRequest_TargetUrl struct {
	TargetUrl string `protobuf:"bytes,2,opt,name=target_url,json=targetUrl,proto3,oneof"`
}

type RouterLeaseRequest 

type RouterLeaseRequest struct {
	PeerId         string   `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	Addresses      []string `protobuf:"bytes,2,rep,name=addresses,proto3" json:"addresses,omitempty"`
	Biscuit        []byte   `protobuf:"bytes,3,opt,name=biscuit,proto3" json:"biscuit,omitempty"`
	ConnectedPeers []string `protobuf:"bytes,4,rep,name=connected_peers,json=connectedPeers,proto3" json:"connected_peers,omitempty"`
	DhtSize        int32    `protobuf:"varint,5,opt,name=dht_size,json=dhtSize,proto3" json:"dht_size,omitempty"`
	// Proof of possession of the router's enrolled key: challenge_unix_ms is
	// the caller's clock in unix milliseconds and challenge_signature signs
	// the UTF-8 bytes of "sam:routers-lease:<peer_id>:<challenge_unix_ms>"
	// with the key the router enrolled with. Required. The biscuit alone is
	// not proof: routers hand theirs to every peer they authenticate.
	ChallengeUnixMs    int64  `protobuf:"varint,6,opt,name=challenge_unix_ms,json=challengeUnixMs,proto3" json:"challenge_unix_ms,omitempty"`
	ChallengeSignature []byte `protobuf:"bytes,7,opt,name=challenge_signature,json=challengeSignature,proto3" json:"challenge_signature,omitempty"`
	// contains filtered or unexported fields
}

func (*RouterLeaseRequest) Descriptor deprecated 

func (*RouterLeaseRequest) Descriptor() ([]byte, []int)

Deprecated: Use RouterLeaseRequest.ProtoReflect.Descriptor instead.

func (*RouterLeaseRequest) GetAddresses 

func (x *RouterLeaseRequest) GetAddresses() []string

func (*RouterLeaseRequest) GetBiscuit 

func (x *RouterLeaseRequest) GetBiscuit() []byte

func (*RouterLeaseRequest) GetChallengeSignature 

func (x *RouterLeaseRequest) GetChallengeSignature() []byte

func (*RouterLeaseRequest) GetChallengeUnixMs 

func (x *RouterLeaseRequest) GetChallengeUnixMs() int64

func (*RouterLeaseRequest) GetConnectedPeers 

func (x *RouterLeaseRequest) GetConnectedPeers() []string

func (*RouterLeaseRequest) GetDhtSize 

func (x *RouterLeaseRequest) GetDhtSize() int32

func (*RouterLeaseRequest) GetPeerId 

func (x *RouterLeaseRequest) GetPeerId() string

func (*RouterLeaseRequest) ProtoMessage 

func (*RouterLeaseRequest) ProtoMessage()

func (*RouterLeaseRequest) ProtoReflect 

func (x *RouterLeaseRequest) ProtoReflect() protoreflect.Message

func (*RouterLeaseRequest) Reset 

func (x *RouterLeaseRequest) Reset()

func (*RouterLeaseRequest) String 

func (x *RouterLeaseRequest) String() string

type RouterLeaseResponse 

type RouterLeaseResponse struct {
	Success    bool                   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
	Error      string                 `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	ExpireTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	// contains filtered or unexported fields
}

func (*RouterLeaseResponse) Descriptor deprecated 

func (*RouterLeaseResponse) Descriptor() ([]byte, []int)

Deprecated: Use RouterLeaseResponse.ProtoReflect.Descriptor instead.

func (*RouterLeaseResponse) GetError 

func (x *RouterLeaseResponse) GetError() string

func (*RouterLeaseResponse) GetExpireTime 

func (x *RouterLeaseResponse) GetExpireTime() *timestamppb.Timestamp

func (*RouterLeaseResponse) GetSuccess 

func (x *RouterLeaseResponse) GetSuccess() bool

func (*RouterLeaseResponse) ProtoMessage 

func (*RouterLeaseResponse) ProtoMessage()

func (*RouterLeaseResponse) ProtoReflect 

func (x *RouterLeaseResponse) ProtoReflect() protoreflect.Message

func (*RouterLeaseResponse) Reset 

func (x *RouterLeaseResponse) Reset()

func (*RouterLeaseResponse) String 

func (x *RouterLeaseResponse) String() string

type ServiceAnnounce 

type ServiceAnnounce struct {
	PeerId      string      `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	Type        ServiceType `protobuf:"varint,2,opt,name=type,proto3,enum=sam.v1.ServiceType" json:"type,omitempty"`
	ServiceName string      `protobuf:"bytes,3,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
	// Routing keys served by this service: model IDs for inference,
	// tool names for MCP.
	Keys []string `protobuf:"bytes,4,rep,name=keys,proto3" json:"keys,omitempty"`
	// Operator-declared labels (e.g. "region"). Operator claims always
	// take precedence over runtime-derived values.
	Labels map[string]string `` /* 139-byte string literal not displayed */
	// Runtime load hints; zero values mean unknown.
	ActiveRequests uint32                 `protobuf:"varint,6,opt,name=active_requests,json=activeRequests,proto3" json:"active_requests,omitempty"`
	LatencyEwmaMs  float64                `protobuf:"fixed64,7,opt,name=latency_ewma_ms,json=latencyEwmaMs,proto3" json:"latency_ewma_ms,omitempty"`
	AnnounceTime   *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=announce_time,json=announceTime,proto3" json:"announce_time,omitempty"`
	// contains filtered or unexported fields
}

ServiceAnnounce is gossiped by a node on per-key topics (see DiscoveryTopic) while those topics have subscribers. It is a routing hint signed at the pubsub layer by the announcing peer: consumers use it for freshness and load awareness, never for authorization.

func (*ServiceAnnounce) Descriptor deprecated 

func (*ServiceAnnounce) Descriptor() ([]byte, []int)

Deprecated: Use ServiceAnnounce.ProtoReflect.Descriptor instead.

func (*ServiceAnnounce) GetActiveRequests 

func (x *ServiceAnnounce) GetActiveRequests() uint32

func (*ServiceAnnounce) GetAnnounceTime 

func (x *ServiceAnnounce) GetAnnounceTime() *timestamppb.Timestamp

func (*ServiceAnnounce) GetKeys 

func (x *ServiceAnnounce) GetKeys() []string

func (*ServiceAnnounce) GetLabels 

func (x *ServiceAnnounce) GetLabels() map[string]string

func (*ServiceAnnounce) GetLatencyEwmaMs 

func (x *ServiceAnnounce) GetLatencyEwmaMs() float64

func (*ServiceAnnounce) GetPeerId 

func (x *ServiceAnnounce) GetPeerId() string

func (*ServiceAnnounce) GetServiceName 

func (x *ServiceAnnounce) GetServiceName() string

func (*ServiceAnnounce) GetType 

func (x *ServiceAnnounce) GetType() ServiceType

func (*ServiceAnnounce) ProtoMessage 

func (*ServiceAnnounce) ProtoMessage()

func (*ServiceAnnounce) ProtoReflect 

func (x *ServiceAnnounce) ProtoReflect() protoreflect.Message

func (*ServiceAnnounce) Reset 

func (x *ServiceAnnounce) Reset()

func (*ServiceAnnounce) String 

func (x *ServiceAnnounce) String() string

type ServiceConfig 

type ServiceConfig struct {
	Type        string `yaml:"type"` // e.g., "mcp", "inference"
	Name        string `yaml:"name"`
	Description string `yaml:"description"`
	TargetURL   string `yaml:"target_url,omitempty"`
	// TargetAuthPath names a file holding the credential the backend at
	// TargetURL requires: "TOKEN" is sent as "Authorization: Bearer TOKEN",
	// "user:pass" as HTTP Basic. A file, not a value, for the same reason
	// the CLI takes --api-token-path: config files are copied, committed and
	// rendered into ConfigMaps; a credential in one is a credential in all.
	TargetAuthPath string            `yaml:"target_auth_path,omitempty"`
	Command        []string          `yaml:"command,omitempty"`
	Env            map[string]string `yaml:"env,omitempty"`
}

type ServiceInfo 

type ServiceInfo struct {
	Type        ServiceType `protobuf:"varint,1,opt,name=type,proto3,enum=sam.v1.ServiceType" json:"type,omitempty"`
	Name        string      `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	Description string      `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
	// contains filtered or unexported fields
}

func (*ServiceInfo) Descriptor deprecated 

func (*ServiceInfo) Descriptor() ([]byte, []int)

Deprecated: Use ServiceInfo.ProtoReflect.Descriptor instead.

func (*ServiceInfo) GetDescription 

func (x *ServiceInfo) GetDescription() string

func (*ServiceInfo) GetName 

func (x *ServiceInfo) GetName() string

func (*ServiceInfo) GetType 

func (x *ServiceInfo) GetType() ServiceType

func (*ServiceInfo) ProtoMessage 

func (*ServiceInfo) ProtoMessage()

func (*ServiceInfo) ProtoReflect 

func (x *ServiceInfo) ProtoReflect() protoreflect.Message

func (*ServiceInfo) Reset 

func (x *ServiceInfo) Reset()

func (*ServiceInfo) String 

func (x *ServiceInfo) String() string

type ServiceType 

type ServiceType int32
const (
	ServiceType_SERVICE_TYPE_UNSPECIFIED ServiceType = 0
	ServiceType_SERVICE_TYPE_MCP         ServiceType = 1
	ServiceType_SERVICE_TYPE_INFERENCE   ServiceType = 2
	ServiceType_SERVICE_TYPE_A2A         ServiceType = 3
	// A destination outside the mesh, reached through a node that enforces
	// policy on it. The service name is the destination hostname, so a grant
	// reads egress://api.github.com and the request fact
	// service("egress", "api.github.com"). Egress names have no .sam.alt form:
	// a sandboxed agent connects to the destination name itself.
	ServiceType_SERVICE_TYPE_EGRESS ServiceType = 4
)

func ParseServiceType 

func ParseServiceType(s string) (ServiceType, error)

ParseServiceType converts a string identifier (e.g. from JSON or REST) to the ServiceType protobuf enum.

func (ServiceType) Descriptor 

func (ServiceType) Descriptor() protoreflect.EnumDescriptor

func (ServiceType) Enum 

func (x ServiceType) Enum() *ServiceType

func (ServiceType) EnumDescriptor deprecated 

func (ServiceType) EnumDescriptor() ([]byte, []int)

Deprecated: Use ServiceType.Descriptor instead.

func (ServiceType) Number 

func (x ServiceType) Number() protoreflect.EnumNumber

func (ServiceType) String 

func (x ServiceType) String() string

func (ServiceType) Type 

func (ServiceType) Type() protoreflect.EnumType

type TokenRefreshRequest 

type TokenRefreshRequest struct {

	// Signature with the node key over the UTF-8 bytes of
	// "sam:refresh:<peer_id>:<challenge_unix_ms>", where peer_id is the one
	// bound in the presented biscuit. Peer- and endpoint-bound so a captured
	// signature verifies nowhere else.
	ChallengeSignature []byte `protobuf:"bytes,1,opt,name=challenge_signature,json=challengeSignature,proto3" json:"challenge_signature,omitempty"`
	// The caller's clock in unix milliseconds, the number in the signed text.
	// Must be within the control plane's freshness window.
	ChallengeUnixMs int64 `protobuf:"varint,2,opt,name=challenge_unix_ms,json=challengeUnixMs,proto3" json:"challenge_unix_ms,omitempty"`
	// The caller's peer ID. Optional: the control plane normally reads it
	// from the verified biscuit. It is consulted only when the biscuit's
	// signing key has been retired, so the biscuit cannot be verified: the
	// control plane then looks up the enrolled node record by this ID and,
	// if the node was opted in to autonomous recovery, accepts the request
	// when the presented biscuit is byte-identical to the last one it
	// issued and the challenge verifies against the stored public key.
	PeerId string `protobuf:"bytes,3,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	// contains filtered or unexported fields
}

func (*TokenRefreshRequest) Descriptor deprecated 

func (*TokenRefreshRequest) Descriptor() ([]byte, []int)

Deprecated: Use TokenRefreshRequest.ProtoReflect.Descriptor instead.

func (*TokenRefreshRequest) GetChallengeSignature 

func (x *TokenRefreshRequest) GetChallengeSignature() []byte

func (*TokenRefreshRequest) GetChallengeUnixMs 

func (x *TokenRefreshRequest) GetChallengeUnixMs() int64

func (*TokenRefreshRequest) GetPeerId 

func (x *TokenRefreshRequest) GetPeerId() string

func (*TokenRefreshRequest) ProtoMessage 

func (*TokenRefreshRequest) ProtoMessage()

func (*TokenRefreshRequest) ProtoReflect 

func (x *TokenRefreshRequest) ProtoReflect() protoreflect.Message

func (*TokenRefreshRequest) Reset 

func (x *TokenRefreshRequest) Reset()

func (*TokenRefreshRequest) String 

func (x *TokenRefreshRequest) String() string

type TokenRefreshResponse 

type TokenRefreshResponse struct {
	BiscuitToken []byte                 `protobuf:"bytes,1,opt,name=biscuit_token,json=biscuitToken,proto3" json:"biscuit_token,omitempty"`
	ExpireTime   *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
	ErrorMessage string                 `protobuf:"bytes,3,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"`
	// contains filtered or unexported fields
}

func (*TokenRefreshResponse) Descriptor deprecated 

func (*TokenRefreshResponse) Descriptor() ([]byte, []int)

Deprecated: Use TokenRefreshResponse.ProtoReflect.Descriptor instead.

func (*TokenRefreshResponse) GetBiscuitToken 

func (x *TokenRefreshResponse) GetBiscuitToken() []byte

func (*TokenRefreshResponse) GetErrorMessage 

func (x *TokenRefreshResponse) GetErrorMessage() string

func (*TokenRefreshResponse) GetExpireTime 

func (x *TokenRefreshResponse) GetExpireTime() *timestamppb.Timestamp

func (*TokenRefreshResponse) ProtoMessage 

func (*TokenRefreshResponse) ProtoMessage()

func (*TokenRefreshResponse) ProtoReflect 

func (x *TokenRefreshResponse) ProtoReflect() protoreflect.Message

func (*TokenRefreshResponse) Reset 

func (x *TokenRefreshResponse) Reset()

func (*TokenRefreshResponse) String 

func (x *TokenRefreshResponse) String() string

type TokenRevokeRequest 

type TokenRevokeRequest struct {
	PeerId string `protobuf:"bytes,1,opt,name=peer_id,json=peerId,proto3" json:"peer_id,omitempty"`
	// contains filtered or unexported fields
}

func (*TokenRevokeRequest) Descriptor deprecated 

func (*TokenRevokeRequest) Descriptor() ([]byte, []int)

Deprecated: Use TokenRevokeRequest.ProtoReflect.Descriptor instead.

func (*TokenRevokeRequest) GetPeerId 

func (x *TokenRevokeRequest) GetPeerId() string

func (*TokenRevokeRequest) ProtoMessage 

func (*TokenRevokeRequest) ProtoMessage()

func (*TokenRevokeRequest) ProtoReflect 

func (x *TokenRevokeRequest) ProtoReflect() protoreflect.Message

func (*TokenRevokeRequest) Reset 

func (x *TokenRevokeRequest) Reset()

func (*TokenRevokeRequest) String 

func (x *TokenRevokeRequest) String() string

type TokenRevokeResponse 

type TokenRevokeResponse struct {
	Success bool   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
	Error   string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

func (*TokenRevokeResponse) Descriptor deprecated 

func (*TokenRevokeResponse) Descriptor() ([]byte, []int)

Deprecated: Use TokenRevokeResponse.ProtoReflect.Descriptor instead.

func (*TokenRevokeResponse) GetError 

func (x *TokenRevokeResponse) GetError() string

func (*TokenRevokeResponse) GetSuccess 

func (x *TokenRevokeResponse) GetSuccess() bool

func (*TokenRevokeResponse) ProtoMessage 

func (*TokenRevokeResponse) ProtoMessage()

func (*TokenRevokeResponse) ProtoReflect 

func (x *TokenRevokeResponse) ProtoReflect() protoreflect.Message

func (*TokenRevokeResponse) Reset 

func (x *TokenRevokeResponse) Reset()

func (*TokenRevokeResponse) String 

func (x *TokenRevokeResponse) String() string

type TrustedSigningKey 

type TrustedSigningKey struct {

	// Raw ed25519 public key.
	PublicKey []byte `protobuf:"bytes,1,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
	// When the member first learned the key. A key rotated out is dropped a
	// grace period after this; unset means unknown and is read as now.
	ReceiveTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=receive_time,json=receiveTime,proto3" json:"receive_time,omitempty"`
	// contains filtered or unexported fields
}

func (*TrustedSigningKey) Descriptor deprecated 

func (*TrustedSigningKey) Descriptor() ([]byte, []int)

Deprecated: Use TrustedSigningKey.ProtoReflect.Descriptor instead.

func (*TrustedSigningKey) GetPublicKey 

func (x *TrustedSigningKey) GetPublicKey() []byte

func (*TrustedSigningKey) GetReceiveTime 

func (x *TrustedSigningKey) GetReceiveTime() *timestamppb.Timestamp

func (*TrustedSigningKey) ProtoMessage 

func (*TrustedSigningKey) ProtoMessage()

func (*TrustedSigningKey) ProtoReflect 

func (x *TrustedSigningKey) ProtoReflect() protoreflect.Message

func (*TrustedSigningKey) Reset 

func (x *TrustedSigningKey) Reset()

func (*TrustedSigningKey) String 

func (x *TrustedSigningKey) String() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.