kas

type AccessServiceClient interface {
	PublicKey(ctx context.Context, in *PublicKeyRequest, opts ...grpc.CallOption) (*PublicKeyResponse, error)
	// Deprecated: Do not use.
	// Endpoint intended for gRPC Gateway's REST endpoint to provide v1 compatibility with older TDF clients
	//
	// This endpoint is not recommended for use in new applications, prefer the v2 endpoint ('PublicKey') instead.
	//
	// buf:lint:ignore RPC_RESPONSE_STANDARD_NAME
	LegacyPublicKey(ctx context.Context, in *LegacyPublicKeyRequest, opts ...grpc.CallOption) (*wrapperspb.StringValue, error)
	Rewrap(ctx context.Context, in *RewrapRequest, opts ...grpc.CallOption) (*RewrapResponse, error)
}

type AccessServiceServer interface {
	PublicKey(context.Context, *PublicKeyRequest) (*PublicKeyResponse, error)
	// Deprecated: Do not use.
	// Endpoint intended for gRPC Gateway's REST endpoint to provide v1 compatibility with older TDF clients
	//
	// This endpoint is not recommended for use in new applications, prefer the v2 endpoint ('PublicKey') instead.
	//
	// buf:lint:ignore RPC_RESPONSE_STANDARD_NAME
	LegacyPublicKey(context.Context, *LegacyPublicKeyRequest) (*wrapperspb.StringValue, error)
	Rewrap(context.Context, *RewrapRequest) (*RewrapResponse, error)
	// contains filtered or unexported methods
}

type InfoRequest struct {
	// contains filtered or unexported fields
}

type InfoResponse struct {
	Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
	// contains filtered or unexported fields
}

type KeyAccess struct {

	// Base64-encoded encrypted metadata containing additional key information
	// Optional: Not used during KAS rewrap operations (client-side only)
	// KAS service passes this through without processing or validation
	EncryptedMetadata string `protobuf:"bytes,1,opt,name=encrypted_metadata,json=encryptedMetadata,proto3" json:"encrypted_metadata,omitempty"`
	// Policy binding ensuring cryptographic integrity between policy and wrapped key
	// Required: ZTDF (contains hash and algorithm)
	// Links the policy to the wrapped key cryptographically
	PolicyBinding *PolicyBinding `protobuf:"bytes,2,opt,name=policy_binding,json=policyBinding,proto3" json:"policy_binding,omitempty"`
	// Protocol identifier for the key access mechanism
	// Optional: Defaults to 'kas'
	// Typically: 'kas' for standard Key Access Service protocol
	// Example: "kas"
	Protocol string `protobuf:"bytes,3,opt,name=protocol,proto3" json:"protocol,omitempty"`
	// Type of key wrapping used for the data encryption key
	// Required: Always
	// Values: 'wrapped' (RSA-wrapped for ZTDF), 'ec-wrapped' (experimental ECDH-wrapped)
	KeyType string `protobuf:"bytes,4,opt,name=key_type,json=type,proto3" json:"key_type,omitempty"`
	// URL of the Key Access Server that can unwrap this key
	// Optional: May be omitted if KAS URL is known from context
	// Used to route rewrap requests to the correct KAS instance
	// Example: "https://kas.example.com"
	KasUrl string `protobuf:"bytes,5,opt,name=kas_url,json=url,proto3" json:"kas_url,omitempty"`
	// Key identifier for the KAS public key used for wrapping
	// Optional: ZTDF (may specify which KAS key to use, required if present in the TDF)
	// References a specific public key in the KAS key storage (either local keyring or KAS Registry service)
	// Example: "k1", "ec-key-2024"
	Kid string `protobuf:"bytes,6,opt,name=kid,proto3" json:"kid,omitempty"`
	// Split identifier for key splitting scenarios
	// Optional: ZTDF (used in advanced key splitting configurations)
	// Used when keys are split across multiple parties for enhanced security
	SplitId string `protobuf:"bytes,7,opt,name=split_id,json=sid,proto3" json:"split_id,omitempty"`
	// Client-generated data encryption key wrapped by KAS
	// Required: Always
	// Contains the actual DEK encrypted with KAS's public key
	// This is the core cryptographic material needed for TDF decryption
	WrappedKey []byte `protobuf:"bytes,8,opt,name=wrapped_key,json=wrappedKey,proto3" json:"wrapped_key,omitempty"`
	// Complete header containing all metadata and policy information (for formats that embed it)
	// Optional: Not used by ZTDF (policy and metadata are separate)
	// Contains magic bytes, version, algorithm, policy, and ephemeral key information
	Header []byte `protobuf:"bytes,9,opt,name=header,proto3" json:"header,omitempty"`
	// Ephemeral public key for ECDH key derivation (ec-wrapped type only)
	// Required: When key_type="ec-wrapped" (experimental ECDH-based ZTDF)
	// Omitted: When key_type="wrapped" (RSA-based ZTDF)
	// Should be a PEM-encoded PKCS#8 (ASN.1) formatted public key
	// Used to derive the symmetric key for unwrapping the DEK
	EphemeralPublicKey string `protobuf:"bytes,10,opt,name=ephemeral_public_key,json=ephemeralPublicKey,proto3" json:"ephemeral_public_key,omitempty"`
	// contains filtered or unexported fields
}

type KeyAccessRewrapResult struct {

	// Metadata associated with this KAO result (e.g., required obligations)
	// Optional: May contain obligation requirements or other policy metadata
	// Common keys: "X-Required-Obligations" with array of obligation FQNs
	Metadata map[string]*structpb.Value `` /* 157-byte string literal not displayed */
	// Identifier matching the key_access_object_id from the request
	// Required: Always matches the ID from UnsignedRewrapRequest_WithKeyAccessObject
	KeyAccessObjectId string `protobuf:"bytes,2,opt,name=key_access_object_id,json=keyAccessObjectId,proto3" json:"key_access_object_id,omitempty"`
	// Status of the rewrap operation for this KAO
	// Required: Always
	// Values: "permit" (success), "fail" (failure)
	Status string `protobuf:"bytes,3,opt,name=status,proto3" json:"status,omitempty"`
	// Result of the rewrap operation - either success or error
	//
	// Types that are assignable to Result:
	//
	//	*KeyAccessRewrapResult_KasWrappedKey
	//	*KeyAccessRewrapResult_Error
	Result isKeyAccessRewrapResult_Result `protobuf_oneof:"result"`
	// contains filtered or unexported fields
}

type KeyAccessRewrapResult_Error struct {
	// Error message when rewrap failed
	// Present when status="fail"
	// Human-readable description of the failure reason
	Error string `protobuf:"bytes,5,opt,name=error,proto3,oneof"`
}

type KeyAccessRewrapResult_KasWrappedKey struct {
	// Successfully rewrapped key encrypted with the session key
	// Present when status="permit"
	// Contains the DEK encrypted with the ephemeral session key
	KasWrappedKey []byte `protobuf:"bytes,4,opt,name=kas_wrapped_key,json=kasWrappedKey,proto3,oneof"`
}

type LegacyPublicKeyRequest struct {
	Algorithm string `protobuf:"bytes,1,opt,name=algorithm,proto3" json:"algorithm,omitempty"`
	// contains filtered or unexported fields
}

type PolicyBinding struct {

	// Cryptographic hashing algorithm used for policy binding
	// Optional: ZTDF (when policy_binding is an object)
	// Value: Always "HS256" (HMAC-SHA256) - other algorithms not supported
	// Example: "HS256"
	Algorithm string `protobuf:"bytes,1,opt,name=algorithm,json=alg,proto3" json:"algorithm,omitempty"`
	// HMAC-SHA256 hash of the base64-encoded policy using the DEK as the secret key
	// 4.2.2 TDFs are hex and base64 encoded before HMAC computation
	// Required: ZTDF (when policy_binding is an object)
	// Links the policy content to the wrapped DEK cryptographically via HMAC
	// Computed as HMAC-SHA256(DEK, base64_policy) then hex-encoded and base64-encoded
	Hash string `protobuf:"bytes,2,opt,name=hash,proto3" json:"hash,omitempty"`
	// contains filtered or unexported fields
}

type PolicyRewrapResult struct {

	// Policy identifier matching the policy.id from the request
	// Required: Always matches the ID from UnsignedRewrapRequest_WithPolicy
	PolicyId string `protobuf:"bytes,1,opt,name=policy_id,json=policyId,proto3" json:"policy_id,omitempty"`
	// Results for each KAO under this policy
	// Required: One result per KAO in the original request
	Results []*KeyAccessRewrapResult `protobuf:"bytes,2,rep,name=results,proto3" json:"results,omitempty"`
	// contains filtered or unexported fields
}

type PublicKeyRequest struct {
	Algorithm string `protobuf:"bytes,1,opt,name=algorithm,proto3" json:"algorithm,omitempty"`
	Fmt       string `protobuf:"bytes,2,opt,name=fmt,proto3" json:"fmt,omitempty"`
	V         string `protobuf:"bytes,3,opt,name=v,proto3" json:"v,omitempty"`
	// contains filtered or unexported fields
}

type PublicKeyResponse struct {
	PublicKey string `protobuf:"bytes,1,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
	Kid       string `protobuf:"bytes,2,opt,name=kid,proto3" json:"kid,omitempty"`
	// contains filtered or unexported fields
}

type RewrapRequest struct {

	// A JWT signed by the DPoP (Demonstration of Proof of Possession) private key
	// Required: Always
	// Version differences:
	// - v1 (legacy): Uses existing TDF spec schema in requestBody
	// - v2 (bulk): Uses UnsignedRewrapRequest proto serialized as JSON in requestBody
	SignedRequestToken string `protobuf:"bytes,1,opt,name=signed_request_token,json=signedRequestToken,proto3" json:"signed_request_token,omitempty"`
	// contains filtered or unexported fields
}

type RewrapResponse struct {

	// Deprecated: Legacy metadata field
	// Modern responses use metadata in individual KeyAccessRewrapResult
	//
	// Deprecated: Marked as deprecated in kas/kas.proto.
	Metadata map[string]*structpb.Value `` /* 157-byte string literal not displayed */
	// Deprecated: Legacy single entity wrapped key
	// Modern responses use kas_wrapped_key in KeyAccessRewrapResult
	//
	// Deprecated: Marked as deprecated in kas/kas.proto.
	EntityWrappedKey []byte `protobuf:"bytes,2,opt,name=entity_wrapped_key,json=entityWrappedKey,proto3" json:"entity_wrapped_key,omitempty"`
	// KAS's ephemeral session public key in PEM format
	// Required: For EC-based operations (key_type="ec-wrapped")
	// Optional: Empty for RSA-based ZTDF (key_type="wrapped")
	// Used by client to perform ECDH key agreement and decrypt the kas_wrapped_key values
	SessionPublicKey string `protobuf:"bytes,3,opt,name=session_public_key,json=sessionPublicKey,proto3" json:"session_public_key,omitempty"`
	// Deprecated: Legacy schema version identifier
	// Modern responses use implicit versioning
	//
	// Deprecated: Marked as deprecated in kas/kas.proto.
	SchemaVersion string `protobuf:"bytes,4,opt,name=schema_version,json=schemaVersion,proto3" json:"schema_version,omitempty"`
	// Policy-grouped rewrap results for the bulk API
	// Required: Modern v2 API responses
	// Each PolicyRewrapResult contains results for all KAOs under that policy
	Responses []*PolicyRewrapResult `protobuf:"bytes,5,rep,name=responses,proto3" json:"responses,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedAccessServiceServer struct {
}

type UnsafeAccessServiceServer interface {
	// contains filtered or unexported methods
}

type UnsignedRewrapRequest struct {

	// Client's public key in PEM format for establishing a session key
	// Required: Always
	// Used by KAS to generate an ephemeral session key for secure key exchange
	ClientPublicKey string `protobuf:"bytes,1,opt,name=client_public_key,json=clientPublicKey,proto3" json:"client_public_key,omitempty"`
	// List of policy requests to be processed
	// Required: Always (at least one)
	// Each request represents a policy with its associated key access objects
	Requests []*UnsignedRewrapRequest_WithPolicyRequest `protobuf:"bytes,2,rep,name=requests,proto3" json:"requests,omitempty"`
	// Deprecated: Legacy single Key Access Object
	// Used for legacy non-bulk requests (v1 API)
	// Modern clients should use the 'requests' field instead
	//
	// Deprecated: Marked as deprecated in kas/kas.proto.
	KeyAccess *KeyAccess `protobuf:"bytes,3,opt,name=key_access,json=keyAccess,proto3" json:"key_access,omitempty"`
	// Deprecated: Legacy single policy
	// Used for legacy non-bulk requests (v1 API)
	// Modern clients should use the 'requests' field instead
	//
	// Deprecated: Marked as deprecated in kas/kas.proto.
	Policy string `protobuf:"bytes,4,opt,name=policy,proto3" json:"policy,omitempty"`
	// Deprecated: Legacy algorithm specification
	// Used for legacy non-bulk requests (v1 API)
	// Modern clients should use the 'requests' field instead
	//
	// Deprecated: Marked as deprecated in kas/kas.proto.
	Algorithm string `protobuf:"bytes,5,opt,name=algorithm,proto3" json:"algorithm,omitempty"`
	// contains filtered or unexported fields
}

type UnsignedRewrapRequest_WithKeyAccessObject struct {

	// Ephemeral, unique identifier for this KAO within the request
	// Required: Always
	// Example: "kao-0", "kao-1", "key-access-object-uuid"
	KeyAccessObjectId string `protobuf:"bytes,1,opt,name=key_access_object_id,json=keyAccessObjectId,proto3" json:"key_access_object_id,omitempty"`
	// The actual Key Access Object containing cryptographic material and metadata
	// Required: Always
	KeyAccessObject *KeyAccess `protobuf:"bytes,2,opt,name=key_access_object,json=keyAccessObject,proto3" json:"key_access_object,omitempty"`
	// contains filtered or unexported fields
}

type UnsignedRewrapRequest_WithPolicy struct {

	// An identifier unique within the scope of the rewrap request
	// Used for mapping between request and response items.
	// Required: Always
	// Example: "policy", "policy-0", "policy-1"
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Policy content - format varies by TDF type:
	// ZTDF: Base64-encoded JSON policy object containing attributes and other policy data
	// Required: ZTDF (base64-encoded policy JSON)
	Body string `protobuf:"bytes,2,opt,name=body,proto3" json:"body,omitempty"`
	// contains filtered or unexported fields
}

type UnsignedRewrapRequest_WithPolicyRequest struct {

	// List of Key Access Objects associated with this policy
	// Required: Always (at least one)
	// Some formats require exactly one KAO per policy
	KeyAccessObjects []*UnsignedRewrapRequest_WithKeyAccessObject `protobuf:"bytes,1,rep,name=key_access_objects,json=keyAccessObjects,proto3" json:"key_access_objects,omitempty"`
	// Policy information for this group of KAOs
	// Required: Always
	Policy *UnsignedRewrapRequest_WithPolicy `protobuf:"bytes,2,opt,name=policy,proto3" json:"policy,omitempty"`
	// Cryptographic algorithm identifier for the TDF type
	// Optional: Defaults to rsa:2048 if omitted
	// Values: "ec:secp256r1" (EC-based), "rsa:2048" (RSA-based), "" (defaults to rsa:2048)
	// Example: "ec:secp256r1"
	Algorithm string `protobuf:"bytes,3,opt,name=algorithm,proto3" json:"algorithm,omitempty"`
	// contains filtered or unexported fields
}