metadata

type ACE struct {
	Op    Operation `protobuf:"varint,1,opt,name=op,proto3,enum=metadata.Operation" json:"op,omitempty"`
	Local bool      `protobuf:"varint,2,opt,name=local,proto3" json:"local,omitempty"` // if true, ACE is not inherited
	Agent bool      `protobuf:"varint,9,opt,name=agent,proto3" json:"agent,omitempty"` // if true, this ACE is for the agent of the op else it is for the target
	Acls  []*ACL    `protobuf:"bytes,3,rep,name=acls,proto3" json:"acls,omitempty"`    // all of these ACLs must be satisfied
	// common fields for all annotations
	Tag         string `protobuf:"bytes,4,opt,name=tag,proto3" json:"tag,omitempty"`                  // "ace" for all kinds of ACEs
	Unique      int64  `protobuf:"varint,5,opt,name=unique,proto3" json:"unique,omitempty"`           // unique-ifier to avoid collisions for annotations on a metadata node
	Version     int64  `protobuf:"varint,6,opt,name=version,proto3" json:"version,omitempty"`         // version for safe updates
	StartMillis int64  `protobuf:"varint,7,opt,name=startMillis,proto3" json:"startMillis,omitempty"` // what clock time does this ACE take effect
	EndMillis   int64  `protobuf:"varint,8,opt,name=endMillis,proto3" json:"endMillis,omitempty"`     // when does this ACE lose effect
	// contains filtered or unexported fields
}

type ACEPersist struct {
	Op    Operation     `protobuf:"varint,1,opt,name=op,proto3,enum=metadata.Operation" json:"op,omitempty"` // what operation is controlled
	Local bool          `protobuf:"varint,2,opt,name=local,proto3" json:"local,omitempty"`                   // if true, ACE is not inherited
	Acls  []*ACLPersist `protobuf:"bytes,3,rep,name=acls,proto3" json:"acls,omitempty"`                      // all of these ACLs must be satisfied
	// contains filtered or unexported fields
}

type ACL struct {
	Roles []string `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
	// contains filtered or unexported fields
}

type ACLPersist struct {
	Roles []string `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
	// contains filtered or unexported fields
}

type Annotation struct {
	Unique      int64         `json:",string"` //  unique-ifier to avoid collisions for annotations on a metadata node
	Version     int64         `json:",string"` // version for safe updates
	Global      int64         `json:",string"` // the global revision number for last modification
	StartMillis int64         `json:",string"` // what clock time did this annotation take effect
	EndMillis   int64         `json:",string"` // when does this annotation lose effect
	Tag         string        // hint for the interpretation of the value
	Raw         *anypb.Any    // any data specific to the annotation goes here in marshalled form
	Value       proto.Message // and here in unmarshalled form
}

type AnnotationStore interface {
	// Annotate adds an annotation to an existing node
	Annotate(ctx context.Context, path string, ann Notable) (int64, error)

	// ScanPath walks the metadata tree from root to `path` and calls the checker
	// function at each prefix. If the checker returns the sentinel as the error,
	// the scan will stop. It is expected that the checker will have a side effect
	// that achieves the goal of the scan; the scanner does not do anything but
	// provide a control flow.
	ScanPath(ctx context.Context, path string, includeLast bool, checker func(path string, ace *ACE, abortScan error) error) error

	// PutNode creates a node or updates one
	PutNode(ctx context.Context, path string, version int64) (int64, error)

	// PutTree writes and entire tree or subtree for bootstrapping or testing.
	// An error should be thrown if the data already exists
	PutTree(ctx context.Context, tree *MetaTree) error

	// GetTree serializes the entire metadata state in a form suitable for preserving
	GetTree(ctx context.Context) (*MetaTree, error)

	// Get reads the metadata for a path with an optional filter. Filters are of the form
	// `metaType/subType` or `metaType` and only metadata annotations that matches at
	// least one of the filters will be returned. If no filters are given, then all
	// metadata annotations are returned.
	Get(ctx context.Context, path string, filters ...KeyOption) ([]*Annotation, error)

	// GetChildren returns the list of the names of the children of the current node
	GetChildren(ctx context.Context, path string) ([]string, error)

	// Delete deletes an object along with all children and annotations
	Delete(ctx context.Context, path string) error

	// DeleteAnnotation deletes a single annotation. Version can be -1 to force the deletion, but tag and unique must be valid
	DeleteAnnotation(ctx context.Context, path string, tag string, version int64, unique int64) error

	// IsFolder returns true if a path names a directory, false if it names a leaf
	// node like a role or a user. An error is thrown if nothing exists with that
	// name.
	IsFolder(ctx context.Context, path string) (bool, error)
}

type AnnotationWrapper struct {
	Unique      int64      `protobuf:"varint,1,opt,name=Unique,proto3" json:"Unique,omitempty"`           // unique-ifier to avoid collisions for annotations on a metadata node
	Version     int64      `protobuf:"varint,2,opt,name=Version,proto3" json:"Version,omitempty"`         // version for safe updates
	Global      int64      `protobuf:"varint,3,opt,name=Global,proto3" json:"Global,omitempty"`           // the global revision number for last modification
	StartMillis int64      `protobuf:"varint,4,opt,name=StartMillis,proto3" json:"StartMillis,omitempty"` // what clock time did this annotation take effect
	EndMillis   int64      `protobuf:"varint,5,opt,name=EndMillis,proto3" json:"EndMillis,omitempty"`     // when does this annotation lose effect
	Tag         string     `protobuf:"bytes,6,opt,name=Tag,proto3" json:"Tag,omitempty"`                  // hint for the interpretation of the value such as "role", "ace", or "ssh-key"
	Raw         *anypb.Any `protobuf:"bytes,7,opt,name=Raw,proto3" json:"Raw,omitempty"`                  // any data specific to the annotation goes here in marshalled form
	// contains filtered or unexported fields
}

type AppliedRole struct {
	Role        string `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
	Tag         string `protobuf:"bytes,2,opt,name=tag,proto3" json:"tag,omitempty"`
	Unique      int64  `protobuf:"varint,3,opt,name=unique,proto3" json:"unique,omitempty"`
	Version     int64  `protobuf:"varint,4,opt,name=version,proto3" json:"version,omitempty"`
	StartMillis int64  `protobuf:"varint,5,opt,name=startMillis,proto3" json:"startMillis,omitempty"`
	EndMillis   int64  `protobuf:"varint,6,opt,name=endMillis,proto3" json:"endMillis,omitempty"`
	// contains filtered or unexported fields
}

type JsonPersist struct {
	Data string `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
	// contains filtered or unexported fields
}

type KeyOption struct {
	// contains filtered or unexported fields
}

type KeyOptionKind int

type KeyStore interface {
	GetSignedJWTWithClaims(duration time.Duration, claims TokenClaims) (string, error)

	ValidateJWT(token string) (*TokenClaims, error)

	// GetSigningKey returns a credential signing key that has at least the required
	// life span remaining. Keys are shared across all access manager instances and
	// have a lifespan set on creation. Old keys are deleted when their life is over
	// and created when there is a need for a key that will outlive any current key.
	// Typically, the returned key will be an RSA key, but the type is not
	// guaranteed. It is guaranteed that the key type will correspond to the
	// advertised JWT signing method.
	GetSigningKey(ctx context.Context, requiredLife time.Duration) (any, int64, error)

	// GetJWTSigningMethod returns the signing method that corresponds to the keys
	// returned by this KeyStore instance. To use a KeyStore (ks) to sign a JWT with
	// a lifetime of at least one hour, you should use something like this:
	//
	// key, err = ks.GetSigningKey(ctx, time.Hour)
	// if err !=nil { ... }
	// token = jwt.NewWithClaims(ks.GetJWTSigningMethod(ctx)jwt.MapClaims{
	//"foo": "bar",
	//"nbf": time.Date(2015, 10, 10, 12, 0, 0, 0, time.UTC).Unix(),
	//})
	// ... add more fields to the token ...
	// signedJWT = token.SignedString(key)
	GetJWTSigningMethod(ctx context.Context) jwt.SigningMethod

	// GetPublicSigningKeys returns a list of public keys that can be used to verify
	// JWTs signed by this KeyStore. The keys are returned in a format that is
	// compatible with the `jwt.Parse` function and any unexpired credential will be
	// verifiable with one of the keys returned by this function.
	GetPublicSigningKeys(ctx context.Context) (map[int64]string, error)
}

type MetaStore interface {
	AnnotationStore
	KeyStore
}

type MetaStoreX struct {
	// contains filtered or unexported fields
}

type MetaTree struct {
	Path     string
	Meta     []*Annotation
	Children []*MetaTree
}

type Notable interface {
	AsAnnotation() (*Annotation, error)
}

type Operation int32

type RolePersist struct {
	Path string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
	// contains filtered or unexported fields
}

type S3Urls struct {
	Tag         string `protobuf:"bytes,1,opt,name=tag,proto3" json:"tag,omitempty"`
	Url         string `protobuf:"bytes,2,opt,name=url,proto3" json:"url,omitempty"`
	UrlWildcard string `protobuf:"bytes,3,opt,name=urlWildcard,proto3" json:"urlWildcard,omitempty"`
	// contains filtered or unexported fields
}

type SigningKey struct {
	Created int64  `protobuf:"varint,1,opt,name=created,proto3" json:"created,omitempty"` // when was this key created
	Unique  int64  `protobuf:"varint,2,opt,name=unique,proto3" json:"unique,omitempty"`   // bits that identify this key, no relation to the key itself
	Key     []byte `protobuf:"bytes,3,opt,name=key,proto3" json:"key,omitempty"`          // the key in PKCS1 format
	// contains filtered or unexported fields
}

type TaggedString struct {
	Tag   string `protobuf:"bytes,1,opt,name=tag,proto3" json:"tag,omitempty"`
	Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
	// contains filtered or unexported fields
}

type TokenClaims struct {
	jwt.RegisteredClaims
	Key      int64    `json:"key"`
	Identity string   `json:"id"`
	Roles    []string `json:"roles"`
}

type TransactionFailure struct {
	Msg  string
	Path string
}

type TraversalOrder int

type UserAnnotation struct {
	Data        string `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
	Tag         string `protobuf:"bytes,2,opt,name=tag,proto3" json:"tag,omitempty"`
	Unique      int64  `protobuf:"varint,3,opt,name=unique,proto3" json:"unique,omitempty"`
	Version     int64  `protobuf:"varint,4,opt,name=version,proto3" json:"version,omitempty"`
	StartMillis int64  `protobuf:"varint,5,opt,name=startMillis,proto3" json:"startMillis,omitempty"`
	EndMillis   int64  `protobuf:"varint,6,opt,name=endMillis,proto3" json:"endMillis,omitempty"`
	// contains filtered or unexported fields
}