accessmanager

type AccessManagerClient interface {
	Bootstrap(ctx context.Context, in *BoostrapRequest, opts ...grpc.CallOption) (*BootstrapResponse, error)
	// Used by an identity plugin to generate a signed credential for a user or workload. The plugin
	// must have the right to VouchFor the user or workload
	GetPrincipalCredential(ctx context.Context, in *GetPrincipalCredentialRequest, opts ...grpc.CallOption) (*GetPrincipalCredentialResponse, error)
	// Creates an object with the specified name. This object can be data, user, workload, role
	// or key. Subsequent calls can decorate the object with any required annotations like applied
	// roles, permissions or special keys. This object will be marked as a leaf, not a directory.
	CreateObject(ctx context.Context, in *CreateObjectRequest, opts ...grpc.CallOption) (*CreateObjectResponse, error)
	// Creates a directory with the specified name.
	CreateDirectory(ctx context.Context, in *CreateDirectoryRequest, opts ...grpc.CallOption) (*CreateDirectoryResponse, error)
	// Deletes any object at a specified path. This entails the deletion
	// of all of the metadata at that path as well and thus is likely
	// to require quite a number of permissions (UseRole+View on any role in
	// ACEs, Admin+View on the object). Internally, this function dispatches
	// to the specialized delete operation for whatever kind of object is
	// being deleted.
	// If the path is not an object, but is rather a directory, this operation
	// will only proceed if that directory has no children unless the recursive
	// flag is set in the request.
	DeleteObject(ctx context.Context, in *DeleteObjectRequest, opts ...grpc.CallOption) (*DeleteObjectResponse, error)
	// add or update an annotation on an object. If the unique value on the annotation
	// matches an existing annotation, that annotation is replaced. If the unique value
	// is novel, the annotation is added.
	Annotate(ctx context.Context, in *AnnotateRequest, opts ...grpc.CallOption) (*AnnotateResponse, error)
	DeleteAnnotation(ctx context.Context, in *DeleteAnnotationRequest, opts ...grpc.CallOption) (*DeleteAnnotationResponse, error)
	// Details for a particular path are returned with all roles,
	// direct or inherited and all permissions, also direct or
	// inherited.  Note that roles in the details may be redacted if the
	// caller does not have sufficient permission to see them. An error
	// will be returned if the path does not exist or if the caller
	// does not have view permission for the requested path.
	GetDetails(ctx context.Context, in *GetDetailsRequest, opts ...grpc.CallOption) (*GetDetailsResponse, error)
	GetDatasetCredential(ctx context.Context, in *GetDatasetCredentialRequest, opts ...grpc.CallOption) (*GetDatasetCredentialResponse, error)
	// credential validation
	ValidateCredential(ctx context.Context, in *ValidateCredentialRequest, opts ...grpc.CallOption) (*ValidateCredentialResponse, error)
	// get the list of all live signing keys
	GetSigningKeys(ctx context.Context, in *GetSigningKeysRequest, opts ...grpc.CallOption) (*GetSigningKeysResponse, error)
}

type AccessManagerServer interface {
	Bootstrap(context.Context, *BoostrapRequest) (*BootstrapResponse, error)
	// Used by an identity plugin to generate a signed credential for a user or workload. The plugin
	// must have the right to VouchFor the user or workload
	GetPrincipalCredential(context.Context, *GetPrincipalCredentialRequest) (*GetPrincipalCredentialResponse, error)
	// Creates an object with the specified name. This object can be data, user, workload, role
	// or key. Subsequent calls can decorate the object with any required annotations like applied
	// roles, permissions or special keys. This object will be marked as a leaf, not a directory.
	CreateObject(context.Context, *CreateObjectRequest) (*CreateObjectResponse, error)
	// Creates a directory with the specified name.
	CreateDirectory(context.Context, *CreateDirectoryRequest) (*CreateDirectoryResponse, error)
	// Deletes any object at a specified path. This entails the deletion
	// of all of the metadata at that path as well and thus is likely
	// to require quite a number of permissions (UseRole+View on any role in
	// ACEs, Admin+View on the object). Internally, this function dispatches
	// to the specialized delete operation for whatever kind of object is
	// being deleted.
	// If the path is not an object, but is rather a directory, this operation
	// will only proceed if that directory has no children unless the recursive
	// flag is set in the request.
	DeleteObject(context.Context, *DeleteObjectRequest) (*DeleteObjectResponse, error)
	// add or update an annotation on an object. If the unique value on the annotation
	// matches an existing annotation, that annotation is replaced. If the unique value
	// is novel, the annotation is added.
	Annotate(context.Context, *AnnotateRequest) (*AnnotateResponse, error)
	DeleteAnnotation(context.Context, *DeleteAnnotationRequest) (*DeleteAnnotationResponse, error)
	// Details for a particular path are returned with all roles,
	// direct or inherited and all permissions, also direct or
	// inherited.  Note that roles in the details may be redacted if the
	// caller does not have sufficient permission to see them. An error
	// will be returned if the path does not exist or if the caller
	// does not have view permission for the requested path.
	GetDetails(context.Context, *GetDetailsRequest) (*GetDetailsResponse, error)
	GetDatasetCredential(context.Context, *GetDatasetCredentialRequest) (*GetDatasetCredentialResponse, error)
	// credential validation
	ValidateCredential(context.Context, *ValidateCredentialRequest) (*ValidateCredentialResponse, error)
	// get the list of all live signing keys
	GetSigningKeys(context.Context, *GetSigningKeysRequest) (*GetSigningKeysResponse, error)
	// contains filtered or unexported methods
}

type AnnotateRequest struct {
	Path       string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
	Annotation string `protobuf:"bytes,2,opt,name=annotation,proto3" json:"annotation,omitempty"` // json form of the annotation itself
	CallerId   string `protobuf:"bytes,3,opt,name=caller_id,json=callerId,proto3" json:"caller_id,omitempty"`
	// contains filtered or unexported fields
}

type AnnotateResponse struct {
	Error *Status `protobuf:"bytes,1,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

type BoostrapRequest struct {
	Boot string `protobuf:"bytes,1,opt,name=boot,proto3" json:"boot,omitempty"` // the bootstrap image to load
	Key  string `protobuf:"bytes,2,opt,name=key,proto3" json:"key,omitempty"`   // the key to use to sign the bootstrap (if not empty)
	// contains filtered or unexported fields
}

type BootstrapResponse struct {
	Error *Status `protobuf:"bytes,1,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

type ConcreteAccessManager struct {
	UnimplementedAccessManagerServer
	// contains filtered or unexported fields
}

type CreateDirectoryRequest struct {
	Path     string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
	CallerId string `protobuf:"bytes,2,opt,name=caller_id,json=callerId,proto3" json:"caller_id,omitempty"`
	// contains filtered or unexported fields
}

type CreateDirectoryResponse struct {
	Version int64   `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	Error   *Status `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

type CreateObjectRequest struct {
	Path        string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
	AsDirectory bool   `protobuf:"varint,2,opt,name=asDirectory,proto3" json:"asDirectory,omitempty"`
	CallerId    string `protobuf:"bytes,3,opt,name=caller_id,json=callerId,proto3" json:"caller_id,omitempty"`
	// contains filtered or unexported fields
}

type CreateObjectResponse struct {
	Version int64   `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	Error   *Status `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

type DataCredentialProvider struct {
	Factory string `protobuf:"bytes,1,opt,name=factory,proto3" json:"factory,omitempty"` // URL of credential factory
	// contains filtered or unexported fields
}

type DataInfo struct {
	DelegatedAttributes []string `protobuf:"bytes,1,rep,name=delegatedAttributes,proto3" json:"delegatedAttributes,omitempty"` // if non-empty, these are the attributes to pass through (delegate)
	// contains filtered or unexported fields
}

type DeleteAnnotationRequest struct {
	Path     string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
	Tag      string `protobuf:"bytes,2,opt,name=tag,proto3" json:"tag,omitempty"`
	Unique   int64  `protobuf:"varint,3,opt,name=unique,proto3" json:"unique,omitempty"`
	CallerId string `protobuf:"bytes,4,opt,name=caller_id,json=callerId,proto3" json:"caller_id,omitempty"`
	// contains filtered or unexported fields
}

type DeleteAnnotationResponse struct {
	Error *Status `protobuf:"bytes,1,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

type DeleteObjectRequest struct {
	Path      string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
	Version   int64  `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
	Recursive bool   `protobuf:"varint,3,opt,name=recursive,proto3" json:"recursive,omitempty"`
	CallerId  string `protobuf:"bytes,4,opt,name=caller_id,json=callerId,proto3" json:"caller_id,omitempty"`
	// contains filtered or unexported fields
}

type DeleteObjectResponse struct {
	Error *Status `protobuf:"bytes,1,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

type GetDatasetCredentialRequest struct {
	Path       string               `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
	Operations []metadata.Operation `protobuf:"varint,2,rep,packed,name=operations,proto3,enum=metadata.Operation" json:"operations,omitempty"`
	CallerId   string               `protobuf:"bytes,3,opt,name=caller_id,json=callerId,proto3" json:"caller_id,omitempty"`
	// contains filtered or unexported fields
}

type GetDatasetCredentialResponse struct {
	Url        string  `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`               // a physical location for the credential in device specific format
	Info       string  `protobuf:"bytes,2,opt,name=info,proto3" json:"info,omitempty"`             // a human readable description of the credential
	Credential string  `protobuf:"bytes,3,opt,name=credential,proto3" json:"credential,omitempty"` // the signed credential itself, also device specific format
	Error      *Status `protobuf:"bytes,4,opt,name=error,proto3" json:"error,omitempty"`           // error status
	// contains filtered or unexported fields
}

type GetDetailsRequest struct {
	Path            string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`                                               // the path. May or may not include am:// prefix
	IncludeChildren bool   `protobuf:"varint,2,opt,name=include_children,json=includeChildren,proto3" json:"include_children,omitempty"` // if true, return details on the children as well
	CallerId        string `protobuf:"bytes,3,opt,name=caller_id,json=callerId,proto3" json:"caller_id,omitempty"`                       // who is asking?
	// contains filtered or unexported fields
}

type GetDetailsResponse struct {
	Details  *NodeDetails `protobuf:"bytes,1,opt,name=details,proto3" json:"details,omitempty"`
	Children []string     `protobuf:"bytes,2,rep,name=children,proto3" json:"children,omitempty"`
	Error    *Status      `protobuf:"bytes,3,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

type GetPrincipalCredentialRequest struct {
	Path     string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
	CallerId string `protobuf:"bytes,2,opt,name=caller_id,json=callerId,proto3" json:"caller_id,omitempty"`
	// contains filtered or unexported fields
}

type GetPrincipalCredentialResponse struct {
	Credential string  `protobuf:"bytes,1,opt,name=credential,proto3" json:"credential,omitempty"` // the signed credential
	Error      *Status `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

type GetSigningKeysRequest struct {
	CallerId string `protobuf:"bytes,1,opt,name=caller_id,json=callerId,proto3" json:"caller_id,omitempty"` // who is asking?
	// contains filtered or unexported fields
}

type GetSigningKeysResponse struct {
	Keys map[int64]string `` // the signing keys indexed by expiration time
	/* 136-byte string literal not displayed */
	Error *Status `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"` // error status
	// contains filtered or unexported fields
}

type NodeDetails struct {
	Path           string                     `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
	Roles          []*metadata.AppliedRole    `protobuf:"bytes,2,rep,name=roles,proto3" json:"roles,omitempty"`
	InheritedRoles []*metadata.AppliedRole    `protobuf:"bytes,4,rep,name=inheritedRoles,proto3" json:"inheritedRoles,omitempty"`
	Aces           []*metadata.ACE            `protobuf:"bytes,5,rep,name=aces,proto3" json:"aces,omitempty"`
	InheritedAces  []*metadata.ACE            `protobuf:"bytes,6,rep,name=inheritedAces,proto3" json:"inheritedAces,omitempty"`
	Annotations    []*metadata.UserAnnotation `protobuf:"bytes,7,rep,name=annotations,proto3" json:"annotations,omitempty"`
	IsDirectory    bool                       `protobuf:"varint,8,opt,name=isDirectory,proto3" json:"isDirectory,omitempty"`
	// contains filtered or unexported fields
}

type OperationLog struct {
	// contains filtered or unexported fields
}

type PermissionLogic interface {
	// GetPrincipalCredential validates that the caller is allowed to vouch for a
	// user or workload and, if so, generates and returns a credential that can be
	// used by that user or workload on subsequently validate their identity. The
	// caller is typically an identity plugin acting on behalf of a user or workload.
	GetPrincipalCredential(ctx context.Context, principal string, callerId string) (string, error)

	// CreateObject establishes a node in the metadata tree that must be a directory
	// or a leaf. A directory can be the parent of other directories or leaves. A
	// leaf is something like a user, role or dataset and cannot contain other nodes.
	// CreateObject should always be called with a "leaf" or "dir" annotation; an
	// error will be returned otherwise.
	CreateObject(ctx context.Context, path string, callerId string, annotations ...*metadata.Annotation) error

	Annotate(ctx context.Context, path string, annotation *metadata.Annotation, callerId string) error
	GetAnnotations(ctx context.Context, path string, callerID string, filters ...metadata.KeyOption) ([]*metadata.Annotation, error)

	// DeleteObject deletes the specified object which can be a principal, role, user or workload.
	// Note that this will force the deletion of all metadata attached to the object as well.
	// If the object is a directory, then it must be empty or else the recursive flag must be
	// used to force the deletion of all children.
	DeleteObject(ctx context.Context, uri string, recursive bool, callerID string) error

	DeleteAnnotation(ctx context.Context, path string, tag string, unique int64, callerID string) error

	// GetDatasetCredential returns a delegation token or a credential suitable for the datastore
	GetDatasetCredential(ctx context.Context, path string, ops []metadata.Operation, callerID string) (string, string, error)

	// GetACEs returns a list of access control expressions for a URI. The version of the
	// metadata is also returned to allow safe update. The version should be used when
	// calling UpdateAces. This function will return an error if the id is invalid. An
	// error will also be returned if the caller does not have permission for the visible
	// operation.
	GetACEs(ctx context.Context, uri string, callerID string) ([]*metadata.Annotation, error)

	// UpdateACE sets the ACE for a path. ACEs have a globally unique identifier that can
	// be used to determine if the ACEs being passed in to this call refer to ACEs already
	// on the path or not. ACEs that do not already exist on the path but which are given
	// in the argument to UpdateACEs will be added. Those ACEs that already exist on the
	// path, but which are not mentioned in the argument here will be deleted. Those ACEs
	// that exist on the path and which are passed in here will be updated. An error will
	// be returned if the caller id does not exist as a principal. An error will be returned
	// if the version does not match the current version associated with the URI being
	// modified. An error will be returned if the caller does not have permission for the
	// admin operation on the specified object. An error will be returned if caller does
	// not have `UseRole` permission on any roles in ACEs that are deleted, updated or added.
	// An error may be returned if the ACEs refer to any operation that are not applicable
	// to the path.
	UpdateACE(ctx context.Context, uri string, perm *metadata.Annotation, callerID string) (int64, error)

	// GetRoles returns a list of roles for any path starting with `am://user` or
	// `am://workload`. The roles are returned as Annotation structures including a
	// version number to allow safe update of individual applied roles. This function
	// will return an error if the URI is invalid. An error will also be returned if
	// the requester does not have permission for the `View` operation on the path
	// and all prefixes. The roles returned are for the exact path given and do not
	// include any roles inherited from prefixes of the path.
	GetRoles(ctx context.Context, uri string, callerID string) ([]*metadata.Annotation, error)

	// GetAllRoles returns a list all the children and grand children of roles for
	// any path starting with `am://role` This function will return an error
	// if the path is invalid. An error will also be returned if the requester does
	// not have permission for the `View` operation on the path and all prefixes.
	GetAllRoles(ctx context.Context, path, callerID string) ([]string, error)

	GetDetails(ctx context.Context, path string, includeChildren bool, cred string) (*NodeDetails, []string, error)

	// GetInheritedRoles returns a list of all inherited or direct roles for any path starting
	// with `am://user` or `am://workload`. No version is returned because the roles
	// returned don't come from any single structure that could be updated. This function
	// will return an error if the URI is invalid. An error will also be returned if
	// the requester does not have permission for the `View` operation on the path
	// and all prefixes. The roles returned are for the exact path given and do not include
	// any roles inherited from prefixes of the path.
	GetInheritedRoles(ctx context.Context, uri string, callerID string) ([]*metadata.Annotation, error)

	// UpdateAppliedRole adds roles to or removes roles from a principal. An error will be returned
	// if the caller id does not exist as a principal. An error will be returned if the version
	// does not match the current version of the URI. An error will be returned if the caller
	// does not have permission for the `Admin` and `View` operations on the path or if the caller
	// does not have permission for the Apply operation on any roles being added or removed.
	UpdateAppliedRole(ctx context.Context, appliedRole *metadata.Annotation, uri, callerID string) (int64, error)

	// ValidateRoles determines if the list of given roles are valid and exist in the store
	ValidateRoles(ctx context.Context, roles []string) error

	// Exists returns true if a path refers to a directory or a leaf node
	Exists(ctx context.Context, path string, callerId string) (bool, error)

	// IsFolder returns true if a path exists and refers to a directory (i.e. not a Principal, Role or Data)
	IsFolder(ctx context.Context, uri string, callerID string) (bool, error)

	// GetChildren returns a list of the children of a path that are visible to the caller.
	GetChildren(ctx context.Context, path string, callerID string) ([]string, error)

	// Bootstrap loads the metadata store with a bootstrap file. The bootstrap file must be one of
	// a small number of predefined files. The key (if present) is injected as the ssh public key
	// for the operator user.
	Bootstrap(bootstrap string, key string) error

	// GetSigningKeys returns a list of public keys. Any unexpired credential
	// will have been signed the private key corresponding to one of these..
	GetSigningKeys(ctx context.Context, id string) (map[int64]string, error)

	// ValidateCredential verifies that a credential has been properly signed and has not
	// expired.
	ValidateCredential(ctx context.Context, credential string, callerId string) (string, error)
}

type PermissionLogicManager struct {
	// contains filtered or unexported fields
}

type Status struct {
	Error   int32  `protobuf:"varint,3,opt,name=error,proto3" json:"error,omitempty"`    // non-zero implies error
	Message string `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"` // provides some detail about error
	Global  uint64 `protobuf:"varint,5,opt,name=global,proto3" json:"global,omitempty"`  // global transaction number
	// contains filtered or unexported fields
}

type UnimplementedAccessManagerServer struct{}

type UnsafeAccessManagerServer interface {
	// contains filtered or unexported methods
}

type ValidateCredentialRequest struct {
	Credential string `protobuf:"bytes,1,opt,name=credential,proto3" json:"credential,omitempty"`             // the credential to validate
	CallerId   string `protobuf:"bytes,2,opt,name=caller_id,json=callerId,proto3" json:"caller_id,omitempty"` // who is asking?
	// contains filtered or unexported fields
}

type ValidateCredentialResponse struct {
	Valid bool    `protobuf:"varint,1,opt,name=valid,proto3" json:"valid,omitempty"` // true if the credential is valid
	Info  string  `protobuf:"bytes,2,opt,name=info,proto3" json:"info,omitempty"`    // human readable description of the credential
	Error *Status `protobuf:"bytes,3,opt,name=error,proto3" json:"error,omitempty"`  // error status
	// contains filtered or unexported fields
}