feat(sdk): Hide connect rpc client side

.github/workflows/checks.yaml

@@ -346,6 +346,7 @@ jobs:
       focus-sdk: go
       # use commit instead of ref so we can "go get" specific sdk version
       platform-ref: ${{ github.event.pull_request.head.sha || github.sha }} lts
+      otdfctl-ref: 107e016c326564234757a55e55086fdf66e83078
 
   # test latest otdfctl CLI 'main' against platform PR branch
   otdfctl-test:
@@ -392,6 +393,8 @@ jobs:
       - run: cd service && go get github.com/pseudomuto/protoc-gen-doc/cmd/protoc-gen-doc
       - run: cd service && go install github.com/pseudomuto/protoc-gen-doc/cmd/protoc-gen-doc
       - run: make proto-generate
+      - name: generate connect wrappers
+        run: make connect-wrapper-generate
       - name: Restore go.mod after installing protoc-gen-doc
         run: git restore {service,protocol/go}/go.{mod,sum}
       - name: validate go mod tidy
@@ -401,7 +404,7 @@ jobs:
           git restore go.sum
       - run: git diff
       - run: git diff-files --ignore-submodules
-      - name: Check that make proto-generate has run before PR submission; see above for error details
+      - name: Check that make proto-generate and connect-wrapper-generate have run before PR submission; see above for error details
         run: git diff-files --quiet --ignore-submodules
 
   ci:

Makefile

@@ -1,7 +1,7 @@
 # make
 # To run all lint checks: `LINT_OPTIONS= make lint`
 
-.PHONY: all build clean docker-build fix fmt go-lint license lint proto-generate proto-lint sdk/sdk test tidy toolcheck
+.PHONY: all build clean docker-build fix fmt go-lint license lint proto-generate connect-wrapper-generate proto-lint sdk/sdk test tidy toolcheck
 
 MODS=protocol/go lib/ocrypto lib/fixtures lib/flattening lib/identifier sdk service examples
 HAND_MODS=lib/ocrypto lib/fixtures lib/flattening lib/identifier sdk service examples
@@ -71,6 +71,9 @@ proto-generate:
 	buf generate buf.build/grpc-ecosystem/grpc-gateway -o tmp-gen --template buf.gen.grpc.docs.yaml
 	buf generate buf.build/grpc-ecosystem/grpc-gateway -o tmp-gen --template buf.gen.openapi.docs.yaml
 
+connect-wrapper-generate:
+	go run ./sdk/internal/codegen
+
 policy-sql-gen:
 	@which sqlc > /dev/null || { echo "sqlc not found, please install it: https://docs.sqlc.dev/en/stable/overview/install.html"; exit 1; }
 	sqlc generate -f service/policy/db/sqlc.yaml
@@ -95,7 +98,7 @@ clean:
 	for m in $(MODS); do (cd $$m && go clean) || exit 1; done
 	rm -f opentdf examples/examples
 
-build: proto-generate opentdf sdk/sdk examples/examples
+build: proto-generate connect-wrapper-generate opentdf sdk/sdk examples/examples
 
 opentdf: $(shell find service)
 	go build -o opentdf -v service/main.go

examples/cmd/attributes.go

@@ -9,7 +9,6 @@ import (
 	"regexp"
 	"strings"
 
-	"connectrpc.com/connect"
 	"github.com/opentdf/platform/protocol/go/common"
 	"github.com/opentdf/platform/protocol/go/policy"
 	"github.com/opentdf/platform/protocol/go/policy/attributes"
@@ -112,12 +111,12 @@ func listAttributes(cmd *cobra.Command) error {
 	var nsuris []string
 	if ns == "" {
 		slog.Info("listing namespaces")
-		listResp, err := s.Namespaces.ListNamespaces(ctx, connect.NewRequest(&namespaces.ListNamespacesRequest{}))
+		listResp, err := s.Namespaces.ListNamespaces(ctx, &namespaces.ListNamespacesRequest{})
 		if err != nil {
 			return err
 		}
-		slog.Info(fmt.Sprintf("found %d namespaces", len(listResp.Msg.GetNamespaces())))
-		for _, n := range listResp.Msg.GetNamespaces() {
+		slog.Info(fmt.Sprintf("found %d namespaces", len(listResp.GetNamespaces())))
+		for _, n := range listResp.GetNamespaces() {
 			nsuris = append(nsuris, n.GetFqn())
 		}
 	} else {
@@ -128,15 +127,15 @@ func listAttributes(cmd *cobra.Command) error {
 		if err != nil {
 			return err
 		}
-		lsr, err := s.Attributes.ListAttributes(ctx, connect.NewRequest(&attributes.ListAttributesRequest{
+		lsr, err := s.Attributes.ListAttributes(ctx, &attributes.ListAttributesRequest{
 			// namespace here must be the namespace name
 			Namespace: u.Host,
-		}))
+		})
 		if err != nil {
 			return err
 		}
-		slog.Info(fmt.Sprintf("found %d attributes in namespace", len(lsr.Msg.GetAttributes())), "ns", n)
-		for _, a := range lsr.Msg.GetAttributes() {
+		slog.Info(fmt.Sprintf("found %d attributes in namespace", len(lsr.GetAttributes())), "ns", n)
+		for _, a := range lsr.GetAttributes() {
 			if longformat {
 				fmt.Printf("%s\t%s\n", a.GetFqn(), a.GetId())
 			} else {
@@ -160,12 +159,12 @@ func nsuuid(ctx context.Context, s *sdk.SDK, u string) (string, error) {
 		slog.Error("namespace url.Parse", "err", err, "url", u)
 		return "", errors.Join(err, ErrInvalidArgument)
 	}
-	listResp, err := s.Namespaces.ListNamespaces(ctx, connect.NewRequest(&namespaces.ListNamespacesRequest{}))
+	listResp, err := s.Namespaces.ListNamespaces(ctx, &namespaces.ListNamespacesRequest{})
 	if err != nil {
 		slog.Error("ListNamespaces", "err", err)
 		return "", errors.Join(err, ErrInvalidArgument)
 	}
-	for _, n := range listResp.Msg.GetNamespaces() {
+	for _, n := range listResp.GetNamespaces() {
 		if n.GetName() == url.Hostname() {
 			return n.GetId(), nil
 		}
@@ -174,15 +173,15 @@ func nsuuid(ctx context.Context, s *sdk.SDK, u string) (string, error) {
 }
 
 func attruuid(ctx context.Context, s *sdk.SDK, nsu, fqn string) (string, error) {
-	resp, err := s.Attributes.ListAttributes(ctx, connect.NewRequest(&attributes.ListAttributesRequest{
+	resp, err := s.Attributes.ListAttributes(ctx, &attributes.ListAttributesRequest{
 		Namespace: nsu,
 		State:     common.ActiveStateEnum_ACTIVE_STATE_ENUM_ANY,
-	}))
+	})
 	if err != nil {
 		slog.Error("ListAttributes", "err", err)
 		return "", errors.Join(err, ErrInvalidArgument)
 	}
-	for _, a := range resp.Msg.GetAttributes() {
+	for _, a := range resp.GetAttributes() {
 		if strings.ToLower(a.GetFqn()) == strings.ToLower(fqn) {
 			return a.GetId(), nil
 		}
@@ -191,12 +190,12 @@ func attruuid(ctx context.Context, s *sdk.SDK, nsu, fqn string) (string, error)
 }
 
 func avuuid(ctx context.Context, s *sdk.SDK, auuid, vs string) (string, error) {
-	resp, err := s.Attributes.GetAttribute(ctx, connect.NewRequest(&attributes.GetAttributeRequest{Id: auuid}))
+	resp, err := s.Attributes.GetAttribute(ctx, &attributes.GetAttributeRequest{Id: auuid})
 	if err != nil {
 		slog.Error("GetAttribute", "err", err)
 		return "", errors.Join(err, ErrInvalidArgument)
 	}
-	for _, v := range resp.Msg.GetAttribute().GetValues() {
+	for _, v := range resp.GetAttribute().GetValues() {
 		if strings.ToLower(v.GetValue()) == strings.ToLower(vs) {
 			return v.GetId(), nil
 		}
@@ -210,12 +209,12 @@ func addNamespace(ctx context.Context, s *sdk.SDK, u string) (string, error) {
 		slog.Error("url.Parse", "err", err)
 		return "", errors.Join(err, ErrInvalidArgument)
 	}
-	resp, err := s.Namespaces.CreateNamespace(ctx, connect.NewRequest(&namespaces.CreateNamespaceRequest{Name: url.Hostname()}))
+	resp, err := s.Namespaces.CreateNamespace(ctx, &namespaces.CreateNamespaceRequest{Name: url.Hostname()})
 	if err != nil {
 		slog.Error("CreateNamespace", "err", err)
 		return "", errors.Join(err, ErrInvalidArgument)
 	}
-	return resp.Msg.GetNamespace().GetId(), nil
+	return resp.GetNamespace().GetId(), nil
 }
 
 func addAttribute(cmd *cobra.Command) error {
@@ -275,20 +274,20 @@ func removeAttribute(cmd *cobra.Command) error {
 	}
 	if len(values) == 0 {
 		if unsafeBool {
-			resp, err := s.Unsafe.UnsafeDeleteAttribute(cmd.Context(), connect.NewRequest(&unsafe.UnsafeDeleteAttributeRequest{
+			resp, err := s.Unsafe.UnsafeDeleteAttribute(cmd.Context(), &unsafe.UnsafeDeleteAttributeRequest{
 				Id:  auuid,
 				Fqn: strings.ToLower(attr),
-			}))
+			})
 			if err != nil {
 				slog.Error("UnsafeDeleteAttribute", "err", err, "id", auuid)
 				return err
 			}
 			slog.Info("deleted attribute", "attr", attr, "resp", resp)
 			return nil
 		}
-		resp, err := s.Attributes.DeactivateAttribute(cmd.Context(), connect.NewRequest(&attributes.DeactivateAttributeRequest{
+		resp, err := s.Attributes.DeactivateAttribute(cmd.Context(), &attributes.DeactivateAttributeRequest{
 			Id: auuid,
-		}))
+		})
 		if err != nil {
 			slog.Error("DeactivateAttribute", "err", err, "id", auuid)
 			return err
@@ -302,19 +301,19 @@ func removeAttribute(cmd *cobra.Command) error {
 				return err
 			}
 			if unsafeBool {
-				r, err := s.Unsafe.UnsafeDeleteAttributeValue(cmd.Context(), connect.NewRequest(&unsafe.UnsafeDeleteAttributeValueRequest{
+				r, err := s.Unsafe.UnsafeDeleteAttributeValue(cmd.Context(), &unsafe.UnsafeDeleteAttributeValueRequest{
 					Id:  avu,
 					Fqn: strings.ToLower(attr + "/value/" + url.PathEscape(v)),
-				}))
+				})
 				if err != nil {
 					slog.Error("UnsafeDeleteAttributeValue", "err", err, "id", avu)
 					return err
 				}
 				slog.Info("deactivated attribute value", "attr", attr, "value", v, "resp", r)
 			} else {
-				r, err := s.Attributes.DeactivateAttributeValue(cmd.Context(), connect.NewRequest(&attributes.DeactivateAttributeValueRequest{
+				r, err := s.Attributes.DeactivateAttributeValue(cmd.Context(), &attributes.DeactivateAttributeValueRequest{
 					Id: avu,
-				}))
+				})
 				if err != nil {
 					slog.Error("DeactivateAttributeValue", "err", err, "id", avu)
 					return err
@@ -369,11 +368,11 @@ func assignAttribute(cmd *cobra.Command, assign bool) error {
 		return fmt.Errorf("assign must take a `--kas` parameter")
 	case len(values) == 0:
 		// look up all kasids associated with the attribute
-		ar, err := s.Attributes.GetAttribute(cmd.Context(), connect.NewRequest(&attributes.GetAttributeRequest{Id: auuid}))
+		ar, err := s.Attributes.GetAttribute(cmd.Context(), &attributes.GetAttributeRequest{Id: auuid})
 		if err != nil {
 			return err
 		}
-		for _, b := range ar.Msg.GetAttribute().GetGrants() {
+		for _, b := range ar.GetAttribute().GetGrants() {
 			kasids = append(kasids, b.GetId())
 			kasById[b.GetId()] = b.GetUri()
 		}
@@ -385,11 +384,11 @@ func assignAttribute(cmd *cobra.Command, assign bool) error {
 		if err != nil {
 			return err
 		}
-		ar, err := s.Attributes.GetAttributeValue(cmd.Context(), connect.NewRequest(&attributes.GetAttributeValueRequest{Id: avu}))
+		ar, err := s.Attributes.GetAttributeValue(cmd.Context(), &attributes.GetAttributeValueRequest{Id: avu})
 		if err != nil {
 			return err
 		}
-		for _, b := range ar.Msg.GetValue().GetGrants() {
+		for _, b := range ar.GetValue().GetGrants() {
 			kasids = append(kasids, b.GetId())
 			kasById[b.GetId()] = b.GetUri()
 		}
@@ -398,27 +397,27 @@ func assignAttribute(cmd *cobra.Command, assign bool) error {
 	for _, kasid := range kasids {
 		if len(values) == 0 {
 			if assign {
-				r, err := s.Attributes.AssignKeyAccessServerToAttribute(cmd.Context(), connect.NewRequest(&attributes.AssignKeyAccessServerToAttributeRequest{
+				r, err := s.Attributes.AssignKeyAccessServerToAttribute(cmd.Context(), &attributes.AssignKeyAccessServerToAttributeRequest{
 					AttributeKeyAccessServer: &attributes.AttributeKeyAccessServer{
 						AttributeId:       auuid,
 						KeyAccessServerId: kasid,
 					},
-				}))
+				})
 				if err != nil {
 					return err
 				}
-				cmd.Printf("successfully assigned all of [%s] to [%s] (binding [%v])\n", attr, kasById[kasid], *r.Msg.GetAttributeKeyAccessServer())
+				cmd.Printf("successfully assigned all of [%s] to [%s] (binding [%v])\n", attr, kasById[kasid], *r.GetAttributeKeyAccessServer())
 			} else {
-				r, err := s.Attributes.RemoveKeyAccessServerFromAttribute(cmd.Context(), connect.NewRequest(&attributes.RemoveKeyAccessServerFromAttributeRequest{
+				r, err := s.Attributes.RemoveKeyAccessServerFromAttribute(cmd.Context(), &attributes.RemoveKeyAccessServerFromAttributeRequest{
 					AttributeKeyAccessServer: &attributes.AttributeKeyAccessServer{
 						AttributeId:       auuid,
 						KeyAccessServerId: kasid,
 					},
-				}))
+				})
 				if err != nil {
 					return err
 				}
-				cmd.Printf("successfully unassigned [%s] from [%s] (binding %v)\n", attr, kasById[kasid], *r.Msg.GetAttributeKeyAccessServer())
+				cmd.Printf("successfully unassigned [%s] from [%s] (binding %v)\n", attr, kasById[kasid], *r.GetAttributeKeyAccessServer())
 			}
 		} else {
 			for _, v := range values {
@@ -427,27 +426,27 @@ func assignAttribute(cmd *cobra.Command, assign bool) error {
 					return err
 				}
 				if assign {
-					r, err := s.Attributes.AssignKeyAccessServerToValue(cmd.Context(), connect.NewRequest(&attributes.AssignKeyAccessServerToValueRequest{
+					r, err := s.Attributes.AssignKeyAccessServerToValue(cmd.Context(), &attributes.AssignKeyAccessServerToValueRequest{
 						ValueKeyAccessServer: &attributes.ValueKeyAccessServer{
 							ValueId:           avu,
 							KeyAccessServerId: kasid,
 						},
-					}))
+					})
 					if err != nil {
 						return err
 					}
-					cmd.Printf("successfully assigned [%s] to [%s] (binding [%v])\n", attr, kasById[kasid], *r.Msg.GetValueKeyAccessServer())
+					cmd.Printf("successfully assigned [%s] to [%s] (binding [%v])\n", attr, kasById[kasid], *r.GetValueKeyAccessServer())
 				} else {
-					r, err := s.Attributes.RemoveKeyAccessServerFromValue(cmd.Context(), connect.NewRequest(&attributes.RemoveKeyAccessServerFromValueRequest{
+					r, err := s.Attributes.RemoveKeyAccessServerFromValue(cmd.Context(), &attributes.RemoveKeyAccessServerFromValueRequest{
 						ValueKeyAccessServer: &attributes.ValueKeyAccessServer{
 							ValueId:           avu,
 							KeyAccessServerId: kasid,
 						},
-					}))
+					})
 					if err != nil {
 						return err
 					}
-					cmd.Printf("successfully unassigned [%s] from [%s] (binding [%v])\n", attr, kasById[kasid], *r.Msg.GetValueKeyAccessServer())
+					cmd.Printf("successfully unassigned [%s] from [%s] (binding [%v])\n", attr, kasById[kasid], *r.GetValueKeyAccessServer())
 				}
 			}
 		}
@@ -470,15 +469,15 @@ func ruler() policy.AttributeRuleTypeEnum {
 
 func upsertAttr(ctx context.Context, s *sdk.SDK, auth, name string, values []string) (string, error) {
 	av, err :=
-		s.Attributes.CreateAttribute(ctx, connect.NewRequest(&attributes.CreateAttributeRequest{
+		s.Attributes.CreateAttribute(ctx, &attributes.CreateAttributeRequest{
 			NamespaceId: auth,
 			Name:        name,
 			Rule:        ruler(),
 			Values:      values,
-		}))
+		})
 	if err != nil {
 		slog.Error("CreateAttribute", "err", err, "auth", auth, "name", name, "values", values, "rule", ruler())
 		return "", err
 	}
-	return av.Msg.GetAttribute().GetId(), nil
+	return av.GetAttribute().GetId(), nil
 }

examples/cmd/authorization.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"log/slog"
 
-	"connectrpc.com/connect"
 	"github.com/opentdf/platform/protocol/go/authorization"
 	"github.com/opentdf/platform/protocol/go/policy"
 	"github.com/opentdf/platform/sdk"
@@ -61,15 +60,15 @@ func authorizationExamples() error {
 
 	decisionRequest := &authorization.GetDecisionsRequest{DecisionRequests: drs}
 	slog.Info("Submitting decision request: " + protojson.Format(decisionRequest))
-	decisionResponse, err := s.Authorization.GetDecisions(context.Background(), connect.NewRequest(decisionRequest))
+	decisionResponse, err := s.Authorization.GetDecisions(context.Background(), decisionRequest)
 	if err != nil {
 		return err
 	}
-	slog.Info("Received decision response: " + protojson.Format(decisionResponse.Msg))
+	slog.Info("Received decision response: " + protojson.Format(decisionResponse))
 
 	// map response back to entity chain id
 	decisionsByEntityChain := make(map[string]*authorization.DecisionResponse)
-	for _, dr := range decisionResponse.Msg.GetDecisionResponses() {
+	for _, dr := range decisionResponse.GetDecisionResponses() {
 		decisionsByEntityChain[dr.EntityChainId] = dr
 	}
 

examples/cmd/benchmark_decision.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"time"
 
-	"connectrpc.com/connect"
 	"github.com/opentdf/platform/protocol/go/authorization"
 	"github.com/opentdf/platform/protocol/go/policy"
 	"github.com/spf13/cobra"
@@ -35,7 +34,7 @@ func runDecisionBenchmark(cmd *cobra.Command, args []string) error {
 	}
 
 	start := time.Now()
-	res, err := client.Authorization.GetDecisions(context.Background(), connect.NewRequest(&authorization.GetDecisionsRequest{
+	res, err := client.Authorization.GetDecisions(context.Background(), &authorization.GetDecisionsRequest{
 		DecisionRequests: []*authorization.DecisionRequest{
 			{
 				Actions: []*policy.Action{{Value: &policy.Action_Standard{
@@ -49,14 +48,14 @@ func runDecisionBenchmark(cmd *cobra.Command, args []string) error {
 				ResourceAttributes: ras,
 			},
 		},
-	}))
+	})
 	end := time.Now()
 	totalTime := end.Sub(start)
 
 	numberApproved := 0
 	numberDenied := 0
 	if err == nil {
-		for _, dr := range res.Msg.GetDecisionResponses() {
+		for _, dr := range res.GetDecisionResponses() {
 			if dr.Decision == authorization.DecisionResponse_DECISION_PERMIT {
 				numberApproved += 1
 			} else {