diff --git a/docs/Configuring.md b/docs/Configuring.md index c99fb0e24c..f5232857c4 100644 --- a/docs/Configuring.md +++ b/docs/Configuring.md @@ -445,6 +445,11 @@ Root level key `authorization` | ------------------------------------------- | -------------------------------------------------------------- | ------- | --------------------- | | `entitlement_policy_cache.enabled` | Enable the entitlement policy cache | `false` | | | `entitlement_policy_cache.refresh_interval` | How often to refresh the entitlement policy cache (e.g. `30s`) | | | +| `request_limits.resource_attribute_values_fqns_max` | Maximum attribute value FQNs allowed in Decision Requests | `20` | | +| `request_limits.entity_identifier_entity_chain_entities_max` | Maximum entities allowed in Decision Request entity chains | `10` | | +| `request_limits.decision_request_fulfillable_obligation_fqns_max` | Maximum fulfillable obligation FQNs allowed per Decision Request | `50` | | +| `request_limits.get_decision_multi_resource_resources_max` | Maximum resources allowed in `GetDecisionMultiResourceRequest` | `1000` | | +| `request_limits.get_decision_bulk_decision_requests_max` | Maximum decision requests allowed in `GetDecisionBulkRequest` | `200` | | #### Example: Authorization v1 @@ -464,6 +469,12 @@ services: entitlement_policy_cache: enabled: false refresh_interval: 30s + request_limits: + resource_attribute_values_fqns_max: 20 + entity_identifier_entity_chain_entities_max: 10 + decision_request_fulfillable_obligation_fqns_max: 50 + get_decision_multi_resource_resources_max: 1000 + get_decision_bulk_decision_requests_max: 200 ``` ### Entity Resolution diff --git a/docs/grpc/index.html b/docs/grpc/index.html index fda3e9f267..01223f9f3d 100644 --- a/docs/grpc/index.html +++ b/docs/grpc/index.html @@ -5313,7 +5313,7 @@

EntityIdentifier

entity_chain entity.EntityChain -

chain of one or more entities and at most 10

+

chain of one or more entities

@@ -5394,7 +5394,7 @@

GetDecisionBulkResponse

GetDecisionMultiResourceRequest

-

Can the identified entity/entities access?

1. one entity reference (actor)

2. one action

3. multiple resources

If entitled, checks obligation policy: fulfillable obligations must satisfy all triggered.

Note: this is a more performant bulk request for multiple resource decisions, up to 1000 per request

+

Can the identified entity/entities access?

1. one entity reference (actor)

2. one action

3. multiple resources

If entitled, checks obligation policy: fulfillable obligations must satisfy all triggered.

Note: this is a more performant bulk request for multiple resource decisions

@@ -5617,7 +5617,7 @@

Resource

- + diff --git a/docs/openapi/authorization/authorization.openapi.yaml b/docs/openapi/authorization/authorization.openapi.yaml index bc3a5104e6..5a112b61b6 100644 --- a/docs/openapi/authorization/authorization.openapi.yaml +++ b/docs/openapi/authorization/authorization.openapi.yaml @@ -109,6 +109,65 @@ paths: $ref: '#/components/schemas/authorization.GetEntitlementsResponse' components: schemas: + authorization.DecisionResponse.Decision: + type: string + title: Decision + enum: + - DECISION_UNSPECIFIED + - DECISION_DENY + - DECISION_PERMIT + authorization.Entity.Category: + type: string + title: Category + enum: + - CATEGORY_UNSPECIFIED + - CATEGORY_SUBJECT + - CATEGORY_ENVIRONMENT + policy.Action.StandardAction: + type: string + title: StandardAction + enum: + - STANDARD_ACTION_UNSPECIFIED + - STANDARD_ACTION_DECRYPT + - STANDARD_ACTION_TRANSMIT + policy.Algorithm: + type: string + title: Algorithm + enum: + - ALGORITHM_UNSPECIFIED + - ALGORITHM_RSA_2048 + - ALGORITHM_RSA_4096 + - ALGORITHM_EC_P256 + - ALGORITHM_EC_P384 + - ALGORITHM_EC_P521 + - ALGORITHM_HPQT_XWING + - ALGORITHM_HPQT_SECP256R1_MLKEM768 + - ALGORITHM_HPQT_SECP384R1_MLKEM1024 + description: Supported key algorithms. + policy.KasPublicKeyAlgEnum: + type: string + title: KasPublicKeyAlgEnum + enum: + - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 + policy.SourceType: + type: string + title: SourceType + enum: + - SOURCE_TYPE_UNSPECIFIED + - SOURCE_TYPE_INTERNAL + - SOURCE_TYPE_EXTERNAL + description: |- + Describes whether this kas is managed by the organization or if they imported + the kas information from an external party. These two modes are necessary in order + to encrypt a tdf dek with an external parties kas public key. authorization.DecisionRequest: type: object properties: @@ -235,92 +294,70 @@ components: "resourceAttributesId": "attr-set-2", "decision": "DECISION_DENY" } - authorization.DecisionResponse.Decision: - type: string - title: Decision - enum: - - DECISION_UNSPECIFIED - - DECISION_DENY - - DECISION_PERMIT authorization.Entity: type: object - allOf: + oneOf: - properties: - id: - type: string - title: id - description: ephemeral id for tracking between request and response - category: - title: category - $ref: '#/components/schemas/authorization.Entity.Category' - - oneOf: - - type: object - properties: - claims: - title: claims - $ref: '#/components/schemas/google.protobuf.Any' + claims: title: claims - required: - - claims - - type: object - properties: - clientId: - type: string - title: client_id + $ref: '#/components/schemas/google.protobuf.Any' + title: claims + required: + - claims + - properties: + clientId: + type: string title: client_id - required: - - clientId - - type: object - properties: - custom: - title: custom - $ref: '#/components/schemas/authorization.EntityCustom' + title: client_id + required: + - clientId + - properties: + custom: title: custom - required: - - custom - - type: object - properties: - emailAddress: - type: string - title: email_address - description: one of the entity options must be set + $ref: '#/components/schemas/authorization.EntityCustom' + title: custom + required: + - custom + - properties: + emailAddress: + type: string title: email_address - required: - - emailAddress - - type: object - properties: - remoteClaimsUrl: - type: string - title: remote_claims_url + description: one of the entity options must be set + title: email_address + required: + - emailAddress + - properties: + remoteClaimsUrl: + type: string title: remote_claims_url - required: - - remoteClaimsUrl - - type: object - properties: - userName: - type: string - title: user_name + title: remote_claims_url + required: + - remoteClaimsUrl + - properties: + userName: + type: string title: user_name - required: - - userName - - type: object - properties: - uuid: - type: string - title: uuid + title: user_name + required: + - userName + - properties: + uuid: + type: string title: uuid - required: - - uuid + title: uuid + required: + - uuid + properties: + id: + type: string + title: id + description: ephemeral id for tracking between request and response + category: + title: category + $ref: '#/components/schemas/authorization.Entity.Category' title: Entity additionalProperties: false description: PE (Person Entity) or NPE (Non-Person Entity) - authorization.Entity.Category: - type: string - title: Category - enum: - - CATEGORY_UNSPECIFIED - - CATEGORY_SUBJECT - - CATEGORY_ENVIRONMENT authorization.EntityChain: type: object properties: @@ -408,17 +445,15 @@ components: title: entities description: list of requested entities scope: - oneOf: - - $ref: '#/components/schemas/authorization.ResourceAttribute' - - type: "null" title: scope description: optional attribute fqn as a scope + nullable: true + $ref: '#/components/schemas/authorization.ResourceAttribute' withComprehensiveHierarchy: - type: - - boolean - - "null" + type: boolean title: with_comprehensive_hierarchy description: optional parameter to return a full list of entitlements - returns lower hierarchy attributes + nullable: true title: GetEntitlementsRequest additionalProperties: false description: |- @@ -591,75 +626,6 @@ components: title: value title: LabelsEntry additionalProperties: false - connect-protocol-version: - type: number - title: Connect-Protocol-Version - enum: - - 1 - description: Define the version of the Connect protocol - const: 1 - connect-timeout-header: - type: number - title: Connect-Timeout-Ms - description: Define the timeout, in ms - connect.error: - type: object - properties: - code: - type: string - examples: - - not_found - enum: - - canceled - - unknown - - invalid_argument - - deadline_exceeded - - not_found - - already_exists - - permission_denied - - resource_exhausted - - failed_precondition - - aborted - - out_of_range - - unimplemented - - internal - - unavailable - - data_loss - - unauthenticated - description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. - message: - type: string - description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. - details: - type: array - items: - $ref: '#/components/schemas/connect.error_details.Any' - description: A list of messages that carry the error details. There is no limit on the number of messages. - title: Connect Error - additionalProperties: true - description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' - connect.error_details.Any: - type: object - properties: - type: - type: string - description: 'A URL that acts as a globally unique identifier for the type of the serialized message. For example: `type.googleapis.com/google.rpc.ErrorInfo`. This is used to determine the schema of the data in the `value` field and is the discriminator for the `debug` field.' - value: - type: string - format: binary - description: The Protobuf message, serialized as bytes and base64-encoded. The specific message type is identified by the `type` field. - debug: - oneOf: - - type: object - title: Any - additionalProperties: true - description: Detailed error information. - discriminator: - propertyName: type - title: Debug - description: Deserialized error detail payload. The 'type' field indicates the schema. This field is for easier debugging and should not be relied upon for application logic. - additionalProperties: true - description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message, with an additional debug field for ConnectRPC error details. google.protobuf.Any: type: object properties: @@ -668,6 +634,9 @@ components: value: type: string format: binary + debug: + type: object + additionalProperties: true additionalProperties: true description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. google.protobuf.BoolValue: @@ -682,8 +651,8 @@ components: google.protobuf.Timestamp: type: string examples: - - "2023-01-15T01:30:15.01Z" - - "2024-12-25T12:00:00Z" + - 1s + - 1.000340012s format: date-time description: |- A Timestamp represents a point in time independent of any time zone or local @@ -777,65 +746,41 @@ components: ) to obtain a formatter capable of generating timestamps in this format. policy.Action: type: object - allOf: + oneOf: - properties: - id: + custom: type: string - title: id - description: Generated uuid in database - name: - type: string - title: name - namespace: - title: namespace - description: Namespace context for this action - $ref: '#/components/schemas/policy.Namespace' - metadata: - title: metadata - $ref: '#/components/schemas/common.Metadata' - - oneOf: - - type: object - properties: - custom: - type: string - title: custom - description: Deprecated title: custom - required: - - custom - - type: object - properties: - standard: - title: standard - description: Deprecated - $ref: '#/components/schemas/policy.Action.StandardAction' + description: Deprecated + title: custom + required: + - custom + - properties: + standard: title: standard - required: - - standard + description: Deprecated + $ref: '#/components/schemas/policy.Action.StandardAction' + title: standard + required: + - standard + properties: + id: + type: string + title: id + description: Generated uuid in database + name: + type: string + title: name + namespace: + title: namespace + description: Namespace context for this action + $ref: '#/components/schemas/policy.Namespace' + metadata: + title: metadata + $ref: '#/components/schemas/common.Metadata' title: Action additionalProperties: false description: An action an entity can take - policy.Action.StandardAction: - type: string - title: StandardAction - enum: - - STANDARD_ACTION_UNSPECIFIED - - STANDARD_ACTION_DECRYPT - - STANDARD_ACTION_TRANSMIT - policy.Algorithm: - type: string - title: Algorithm - enum: - - ALGORITHM_UNSPECIFIED - - ALGORITHM_RSA_2048 - - ALGORITHM_RSA_4096 - - ALGORITHM_EC_P256 - - ALGORITHM_EC_P384 - - ALGORITHM_EC_P521 - - ALGORITHM_HPQT_XWING - - ALGORITHM_HPQT_SECP256R1_MLKEM768 - - ALGORITHM_HPQT_SECP384R1_MLKEM1024 - description: Supported key algorithms. policy.KasPublicKey: type: object properties: @@ -854,7 +799,7 @@ components: alg: not: enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - 0 title: alg description: |- A known algorithm type with any additional parameters encoded. @@ -866,19 +811,6 @@ components: description: |- Deprecated A KAS public key and some associated metadata for further identifcation - policy.KasPublicKeyAlgEnum: - type: string - title: KasPublicKeyAlgEnum - enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 policy.KasPublicKeySet: type: object properties: @@ -901,9 +833,13 @@ components: uri: type: string title: uri - description: | + description: |+ Address of a KAS instance - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https?://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(:[0-9]+)?(/.*)?$') + ``` + publicKey: title: public_key description: 'Deprecated: KAS can have multiple key pairs' @@ -971,8 +907,7 @@ components: policy.PublicKey: type: object oneOf: - - type: object - properties: + - properties: cached: title: cached description: public key with additional information. Current preferred version @@ -980,14 +915,17 @@ components: title: cached required: - cached - - type: object - properties: + - properties: remote: type: string title: remote - description: | + description: |+ kas public key url - optional since can also be retrieved via public key - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(/.*)?$') + ``` + title: remote required: - remote @@ -1025,17 +963,50 @@ components: title: pem title: SimpleKasPublicKey additionalProperties: false - policy.SourceType: - type: string - title: SourceType + connect-protocol-version: + type: number + title: Connect-Protocol-Version enum: - - SOURCE_TYPE_UNSPECIFIED - - SOURCE_TYPE_INTERNAL - - SOURCE_TYPE_EXTERNAL - description: |- - Describes whether this kas is managed by the organization or if they imported - the kas information from an external party. These two modes are necessary in order - to encrypt a tdf dek with an external parties kas public key. + - 1 + description: Define the version of the Connect protocol + const: 1 + connect-timeout-header: + type: number + title: Connect-Timeout-Ms + description: Define the timeout, in ms + connect.error: + type: object + properties: + code: + type: string + examples: + - not_found + enum: + - canceled + - unknown + - invalid_argument + - deadline_exceeded + - not_found + - already_exists + - permission_denied + - resource_exhausted + - failed_precondition + - aborted + - out_of_range + - unimplemented + - internal + - unavailable + - data_loss + - unauthenticated + description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. + message: + type: string + description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. + detail: + $ref: '#/components/schemas/google.protobuf.Any' + title: Connect Error + additionalProperties: true + description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' security: [] tags: - name: authorization.AuthorizationService diff --git a/docs/openapi/authorization/v2/authorization.openapi.yaml b/docs/openapi/authorization/v2/authorization.openapi.yaml index b4dbfa42d6..0e03a9e182 100644 --- a/docs/openapi/authorization/v2/authorization.openapi.yaml +++ b/docs/openapi/authorization/v2/authorization.openapi.yaml @@ -37,12 +37,12 @@ paths: application/json: schema: $ref: '#/components/schemas/authorization.v2.GetDecisionResponse' - /authorization.v2.AuthorizationService/GetDecisionBulk: + /authorization.v2.AuthorizationService/GetDecisionMultiResource: post: tags: - authorization.v2.AuthorizationService - summary: GetDecisionBulk - operationId: authorization.v2.AuthorizationService.GetDecisionBulk + summary: GetDecisionMultiResource + operationId: authorization.v2.AuthorizationService.GetDecisionMultiResource parameters: - name: Connect-Protocol-Version in: header @@ -57,7 +57,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/authorization.v2.GetDecisionBulkRequest' + $ref: '#/components/schemas/authorization.v2.GetDecisionMultiResourceRequest' required: true responses: default: @@ -71,13 +71,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/authorization.v2.GetDecisionBulkResponse' - /authorization.v2.AuthorizationService/GetDecisionMultiResource: + $ref: '#/components/schemas/authorization.v2.GetDecisionMultiResourceResponse' + /authorization.v2.AuthorizationService/GetDecisionBulk: post: tags: - authorization.v2.AuthorizationService - summary: GetDecisionMultiResource - operationId: authorization.v2.AuthorizationService.GetDecisionMultiResource + summary: GetDecisionBulk + operationId: authorization.v2.AuthorizationService.GetDecisionBulk parameters: - name: Connect-Protocol-Version in: header @@ -92,7 +92,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/authorization.v2.GetDecisionMultiResourceRequest' + $ref: '#/components/schemas/authorization.v2.GetDecisionBulkRequest' required: true responses: default: @@ -106,7 +106,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/authorization.v2.GetDecisionMultiResourceResponse' + $ref: '#/components/schemas/authorization.v2.GetDecisionBulkResponse' /authorization.v2.AuthorizationService/GetEntitlements: post: tags: @@ -151,6 +151,58 @@ components: - DECISION_UNSPECIFIED - DECISION_DENY - DECISION_PERMIT + entity.Entity.Category: + type: string + title: Category + enum: + - CATEGORY_UNSPECIFIED + - CATEGORY_SUBJECT + - CATEGORY_ENVIRONMENT + policy.Action.StandardAction: + type: string + title: StandardAction + enum: + - STANDARD_ACTION_UNSPECIFIED + - STANDARD_ACTION_DECRYPT + - STANDARD_ACTION_TRANSMIT + policy.Algorithm: + type: string + title: Algorithm + enum: + - ALGORITHM_UNSPECIFIED + - ALGORITHM_RSA_2048 + - ALGORITHM_RSA_4096 + - ALGORITHM_EC_P256 + - ALGORITHM_EC_P384 + - ALGORITHM_EC_P521 + - ALGORITHM_HPQT_XWING + - ALGORITHM_HPQT_SECP256R1_MLKEM768 + - ALGORITHM_HPQT_SECP384R1_MLKEM1024 + description: Supported key algorithms. + policy.KasPublicKeyAlgEnum: + type: string + title: KasPublicKeyAlgEnum + enum: + - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 + policy.SourceType: + type: string + title: SourceType + enum: + - SOURCE_TYPE_UNSPECIFIED + - SOURCE_TYPE_INTERNAL + - SOURCE_TYPE_EXTERNAL + description: |- + Describes whether this kas is managed by the organization or if they imported + the kas information from an external party. These two modes are necessary in order + to encrypt a tdf dek with an external parties kas public key. authorization.v2.EntityEntitlements: type: object properties: @@ -191,19 +243,21 @@ components: authorization.v2.EntityIdentifier: type: object oneOf: - - type: object - properties: + - properties: entityChain: title: entity_chain - description: | - chain of one or more entities and at most 10 - entity_chain_required // entities must be provided and between 1 and 10 in count + description: |+ + chain of one or more entities + entities must be provided and contain at least 1 entity: + ``` + has(this.entities) && this.entities.size() > 0 + ``` + $ref: '#/components/schemas/entity.EntityChain' title: entity_chain required: - entityChain - - type: object - properties: + - properties: registeredResourceValueFqn: type: string title: registered_resource_value_fqn @@ -215,24 +269,30 @@ components: title: registered_resource_value_fqn required: - registeredResourceValueFqn - - type: object - properties: + - properties: token: title: token - description: | + description: |+ access token (JWT), which is used to create an entity chain (comprising one or more entities) - token_required // token must be provided + token must be provided: + ``` + has(this.jwt) && this.jwt.size() > 0 + ``` + $ref: '#/components/schemas/entity.Token' title: token required: - token - - type: object - properties: + - properties: withRequestToken: title: with_request_token - description: | + description: |+ derive the entity from the request's authorization access token JWT, rather than passing in the body - with_request_token_must_be_true // with_request_token must be true when set + with_request_token must be true when set: + ``` + this == true + ``` + $ref: '#/components/schemas/google.protobuf.BoolValue' title: with_request_token required: @@ -251,7 +311,6 @@ components: items: $ref: '#/components/schemas/authorization.v2.GetDecisionMultiResourceRequest' title: decision_requests - maxItems: 200 minItems: 1 title: GetDecisionBulkRequest additionalProperties: false @@ -286,25 +345,32 @@ components: items: $ref: '#/components/schemas/authorization.v2.Resource' title: resources - maxItems: 1000 minItems: 1 fulfillableObligationFqns: type: array items: type: string - description: | - obligation_value_fqns_valid // if provided, fulfillable_obligation_fqns must be between 1 and 50 in count with all valid FQNs + description: |+ + if provided, fulfillable_obligation_fqns must contain only valid FQNs: + ``` + this.size() == 0 || this.all(item, item.isUri()) + ``` + title: fulfillable_obligation_fqns - description: | + description: |+ obligations (fully qualified values) the requester is capable of fulfilling i.e. https:///obl//value/ - obligation_value_fqns_valid // if provided, fulfillable_obligation_fqns must be between 1 and 50 in count with all valid FQNs + if provided, fulfillable_obligation_fqns must contain only valid FQNs: + ``` + this.size() == 0 || this.all(item, item.isUri()) + ``` + title: GetDecisionMultiResourceRequest required: - entityIdentifier - action additionalProperties: false - description: | + description: |+ Can the identified entity/entities access? 1. one entity reference (actor) 2. one action @@ -312,8 +378,12 @@ components: If entitled, checks obligation policy: fulfillable obligations must satisfy all triggered. - Note: this is a more performant bulk request for multiple resource decisions, up to 1000 per request - get_decision_multi_request.action_name_required // action.name must be provided + Note: this is a more performant bulk request for multiple resource decisions + action.name must be provided: + ``` + has(this.action.name) + ``` + authorization.v2.GetDecisionMultiResourceResponse: type: object properties: @@ -347,27 +417,39 @@ components: type: array items: type: string - description: | - obligation_value_fqns_valid // if provided, fulfillable_obligation_fqns must be between 1 and 50 in count with all valid FQNs + description: |+ + if provided, fulfillable_obligation_fqns must contain only valid FQNs: + ``` + this.size() == 0 || this.all(item, item.isUri()) + ``` + title: fulfillable_obligation_fqns - description: | + description: |+ obligations (fully qualified values) the requester is capable of fulfilling i.e. https:///obl//value/ - obligation_value_fqns_valid // if provided, fulfillable_obligation_fqns must be between 1 and 50 in count with all valid FQNs + if provided, fulfillable_obligation_fqns must contain only valid FQNs: + ``` + this.size() == 0 || this.all(item, item.isUri()) + ``` + title: GetDecisionRequest required: - entityIdentifier - action - resource additionalProperties: false - description: | + description: |+ Can the identified entity/entities access? 1. one entity reference (actor) 2. one action 3. one resource If entitled, checks obligation policy: fulfillable obligations must satisfy all triggered. - get_decision_request.action_name_required // action.name must be provided + action.name must be provided: + ``` + has(this.action.name) + ``` + authorization.v2.GetDecisionResponse: type: object properties: @@ -385,13 +467,12 @@ components: description: an entity must be identified for entitlement decisioning $ref: '#/components/schemas/authorization.v2.EntityIdentifier' withComprehensiveHierarchy: - type: - - boolean - - "null" + type: boolean title: with_comprehensive_hierarchy description: |- optional parameter to return all entitled values for attribute definitions with hierarchy rules, propagating down the hierarchical values instead of returning solely the value that is directly entitled + nullable: true title: GetEntitlementsRequest required: - entityIdentifier @@ -413,35 +494,36 @@ components: additionalProperties: false authorization.v2.Resource: type: object - allOf: + oneOf: - properties: - ephemeralId: - type: string - title: ephemeral_id - description: ephemeral id for tracking between request and response - - oneOf: - - type: object - properties: - attributeValues: - title: attribute_values - description: | - a set of attribute value FQNs, such as those on a TDF, between 1 and 20 in count - attribute_values_required // if provided, resource.attribute_values must be between 1 and 20 in count with all valid FQNs - $ref: '#/components/schemas/authorization.v2.Resource.AttributeValues' + attributeValues: title: attribute_values - required: - - attributeValues - - type: object - properties: - registeredResourceValueFqn: - type: string - title: registered_resource_value_fqn - minLength: 1 - format: uri - description: fully qualified name of the registered resource value stored in platform policy + description: |+ + a set of attribute value FQNs, such as those on a TDF, containing at least 1 value + if provided, resource.attribute_values must contain at least 1 valid FQN: + ``` + this.fqns.size() > 0 && this.fqns.all(item, item.isUri()) + ``` + + $ref: '#/components/schemas/authorization.v2.Resource.AttributeValues' + title: attribute_values + required: + - attributeValues + - properties: + registeredResourceValueFqn: + type: string title: registered_resource_value_fqn - required: - - registeredResourceValueFqn + minLength: 1 + format: uri + description: fully qualified name of the registered resource value stored in platform policy + title: registered_resource_value_fqn + required: + - registeredResourceValueFqn + properties: + ephemeralId: + type: string + title: ephemeral_id + description: ephemeral id for tracking between request and response title: Resource additionalProperties: false description: Either a set of attribute values (such as those on a TDF) or a registered resource value @@ -508,130 +590,49 @@ components: title: value title: LabelsEntry additionalProperties: false - connect-protocol-version: - type: number - title: Connect-Protocol-Version - enum: - - 1 - description: Define the version of the Connect protocol - const: 1 - connect-timeout-header: - type: number - title: Connect-Timeout-Ms - description: Define the timeout, in ms - connect.error: - type: object - properties: - code: - type: string - examples: - - not_found - enum: - - canceled - - unknown - - invalid_argument - - deadline_exceeded - - not_found - - already_exists - - permission_denied - - resource_exhausted - - failed_precondition - - aborted - - out_of_range - - unimplemented - - internal - - unavailable - - data_loss - - unauthenticated - description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. - message: - type: string - description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. - details: - type: array - items: - $ref: '#/components/schemas/connect.error_details.Any' - description: A list of messages that carry the error details. There is no limit on the number of messages. - title: Connect Error - additionalProperties: true - description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' - connect.error_details.Any: - type: object - properties: - type: - type: string - description: 'A URL that acts as a globally unique identifier for the type of the serialized message. For example: `type.googleapis.com/google.rpc.ErrorInfo`. This is used to determine the schema of the data in the `value` field and is the discriminator for the `debug` field.' - value: - type: string - format: binary - description: The Protobuf message, serialized as bytes and base64-encoded. The specific message type is identified by the `type` field. - debug: - oneOf: - - type: object - title: Any - additionalProperties: true - description: Detailed error information. - discriminator: - propertyName: type - title: Debug - description: Deserialized error detail payload. The 'type' field indicates the schema. This field is for easier debugging and should not be relied upon for application logic. - additionalProperties: true - description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message, with an additional debug field for ConnectRPC error details. entity.Entity: type: object - allOf: + oneOf: - properties: - ephemeralId: - type: string - title: ephemeral_id - description: ephemeral id for tracking between request and response - category: - title: category - $ref: '#/components/schemas/entity.Entity.Category' - - oneOf: - - type: object - properties: - claims: - title: claims - description: used by ERS claims mode - $ref: '#/components/schemas/google.protobuf.Any' + claims: title: claims - required: - - claims - - type: object - properties: - clientId: - type: string - title: client_id + description: used by ERS claims mode + $ref: '#/components/schemas/google.protobuf.Any' + title: claims + required: + - claims + - properties: + clientId: + type: string title: client_id - required: - - clientId - - type: object - properties: - emailAddress: - type: string - title: email_address + title: client_id + required: + - clientId + - properties: + emailAddress: + type: string title: email_address - required: - - emailAddress - - type: object - properties: - userName: - type: string - title: user_name + title: email_address + required: + - emailAddress + - properties: + userName: + type: string title: user_name - required: - - userName + title: user_name + required: + - userName + properties: + ephemeralId: + type: string + title: ephemeral_id + description: ephemeral id for tracking between request and response + category: + title: category + $ref: '#/components/schemas/entity.Entity.Category' title: Entity additionalProperties: false description: PE (Person Entity) or NPE (Non-Person Entity) - entity.Entity.Category: - type: string - title: Category - enum: - - CATEGORY_UNSPECIFIED - - CATEGORY_SUBJECT - - CATEGORY_ENVIRONMENT entity.EntityChain: type: object properties: @@ -670,6 +671,9 @@ components: value: type: string format: binary + debug: + type: object + additionalProperties: true additionalProperties: true description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. google.protobuf.BoolValue: @@ -684,8 +688,8 @@ components: google.protobuf.Timestamp: type: string examples: - - "2023-01-15T01:30:15.01Z" - - "2024-12-25T12:00:00Z" + - 1s + - 1.000340012s format: date-time description: |- A Timestamp represents a point in time independent of any time zone or local @@ -779,65 +783,41 @@ components: ) to obtain a formatter capable of generating timestamps in this format. policy.Action: type: object - allOf: + oneOf: - properties: - id: + custom: type: string - title: id - description: Generated uuid in database - name: - type: string - title: name - namespace: - title: namespace - description: Namespace context for this action - $ref: '#/components/schemas/policy.Namespace' - metadata: - title: metadata - $ref: '#/components/schemas/common.Metadata' - - oneOf: - - type: object - properties: - custom: - type: string - title: custom - description: Deprecated title: custom - required: - - custom - - type: object - properties: - standard: - title: standard - description: Deprecated - $ref: '#/components/schemas/policy.Action.StandardAction' + description: Deprecated + title: custom + required: + - custom + - properties: + standard: title: standard - required: - - standard + description: Deprecated + $ref: '#/components/schemas/policy.Action.StandardAction' + title: standard + required: + - standard + properties: + id: + type: string + title: id + description: Generated uuid in database + name: + type: string + title: name + namespace: + title: namespace + description: Namespace context for this action + $ref: '#/components/schemas/policy.Namespace' + metadata: + title: metadata + $ref: '#/components/schemas/common.Metadata' title: Action additionalProperties: false description: An action an entity can take - policy.Action.StandardAction: - type: string - title: StandardAction - enum: - - STANDARD_ACTION_UNSPECIFIED - - STANDARD_ACTION_DECRYPT - - STANDARD_ACTION_TRANSMIT - policy.Algorithm: - type: string - title: Algorithm - enum: - - ALGORITHM_UNSPECIFIED - - ALGORITHM_RSA_2048 - - ALGORITHM_RSA_4096 - - ALGORITHM_EC_P256 - - ALGORITHM_EC_P384 - - ALGORITHM_EC_P521 - - ALGORITHM_HPQT_XWING - - ALGORITHM_HPQT_SECP256R1_MLKEM768 - - ALGORITHM_HPQT_SECP384R1_MLKEM1024 - description: Supported key algorithms. policy.KasPublicKey: type: object properties: @@ -856,7 +836,7 @@ components: alg: not: enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - 0 title: alg description: |- A known algorithm type with any additional parameters encoded. @@ -868,19 +848,6 @@ components: description: |- Deprecated A KAS public key and some associated metadata for further identifcation - policy.KasPublicKeyAlgEnum: - type: string - title: KasPublicKeyAlgEnum - enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 policy.KasPublicKeySet: type: object properties: @@ -903,9 +870,13 @@ components: uri: type: string title: uri - description: | + description: |+ Address of a KAS instance - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https?://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(:[0-9]+)?(/.*)?$') + ``` + publicKey: title: public_key description: 'Deprecated: KAS can have multiple key pairs' @@ -973,8 +944,7 @@ components: policy.PublicKey: type: object oneOf: - - type: object - properties: + - properties: cached: title: cached description: public key with additional information. Current preferred version @@ -982,14 +952,17 @@ components: title: cached required: - cached - - type: object - properties: + - properties: remote: type: string title: remote - description: | + description: |+ kas public key url - optional since can also be retrieved via public key - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(/.*)?$') + ``` + title: remote required: - remote @@ -1027,17 +1000,50 @@ components: title: pem title: SimpleKasPublicKey additionalProperties: false - policy.SourceType: - type: string - title: SourceType + connect-protocol-version: + type: number + title: Connect-Protocol-Version enum: - - SOURCE_TYPE_UNSPECIFIED - - SOURCE_TYPE_INTERNAL - - SOURCE_TYPE_EXTERNAL - description: |- - Describes whether this kas is managed by the organization or if they imported - the kas information from an external party. These two modes are necessary in order - to encrypt a tdf dek with an external parties kas public key. + - 1 + description: Define the version of the Connect protocol + const: 1 + connect-timeout-header: + type: number + title: Connect-Timeout-Ms + description: Define the timeout, in ms + connect.error: + type: object + properties: + code: + type: string + examples: + - not_found + enum: + - canceled + - unknown + - invalid_argument + - deadline_exceeded + - not_found + - already_exists + - permission_denied + - resource_exhausted + - failed_precondition + - aborted + - out_of_range + - unimplemented + - internal + - unavailable + - data_loss + - unauthenticated + description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. + message: + type: string + description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. + detail: + $ref: '#/components/schemas/google.protobuf.Any' + title: Connect Error + additionalProperties: true + description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' security: [] tags: - name: authorization.v2.AuthorizationService diff --git a/docs/openapi/common/common.openapi.yaml b/docs/openapi/common/common.openapi.yaml index 093091b6a7..0d1e60b152 100644 --- a/docs/openapi/common/common.openapi.yaml +++ b/docs/openapi/common/common.openapi.yaml @@ -13,14 +13,15 @@ components: - ACTIVE_STATE_ENUM_INACTIVE - ACTIVE_STATE_ENUM_ANY description: 'buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren''t violated when users add new enum values to an enum in a given package' + common.MetadataUpdateEnum: + type: string + title: MetadataUpdateEnum + enum: + - METADATA_UPDATE_ENUM_UNSPECIFIED + - METADATA_UPDATE_ENUM_EXTEND + - METADATA_UPDATE_ENUM_REPLACE common.IdFqnIdentifier: type: object - allOf: - - oneOf: - - required: - - id - - required: - - fqn properties: id: type: string @@ -35,12 +36,6 @@ components: additionalProperties: false common.IdNameIdentifier: type: object - allOf: - - oneOf: - - required: - - id - - required: - - name properties: id: type: string @@ -51,8 +46,12 @@ components: title: name maxLength: 253 minLength: 1 - description: | - name_format // Name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored name will be normalized to lower case. + description: |+ + Name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored name will be normalized to lower case.: + ``` + this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') + ``` + title: IdNameIdentifier additionalProperties: false common.Metadata: @@ -110,18 +109,11 @@ components: title: value title: LabelsEntry additionalProperties: false - common.MetadataUpdateEnum: - type: string - title: MetadataUpdateEnum - enum: - - METADATA_UPDATE_ENUM_UNSPECIFIED - - METADATA_UPDATE_ENUM_EXTEND - - METADATA_UPDATE_ENUM_REPLACE google.protobuf.Timestamp: type: string examples: - - "2023-01-15T01:30:15.01Z" - - "2024-12-25T12:00:00Z" + - 1s + - 1.000340012s format: date-time description: |- A Timestamp represents a point in time independent of any time zone or local diff --git a/docs/openapi/entity/entity.openapi.yaml b/docs/openapi/entity/entity.openapi.yaml index 388fb1f7a3..6484c863a0 100644 --- a/docs/openapi/entity/entity.openapi.yaml +++ b/docs/openapi/entity/entity.openapi.yaml @@ -4,61 +4,56 @@ info: paths: {} components: schemas: + entity.Entity.Category: + type: string + title: Category + enum: + - CATEGORY_UNSPECIFIED + - CATEGORY_SUBJECT + - CATEGORY_ENVIRONMENT entity.Entity: type: object - allOf: + oneOf: - properties: - ephemeralId: - type: string - title: ephemeral_id - description: ephemeral id for tracking between request and response - category: - title: category - $ref: '#/components/schemas/entity.Entity.Category' - - oneOf: - - type: object - properties: - claims: - title: claims - description: used by ERS claims mode - $ref: '#/components/schemas/google.protobuf.Any' + claims: title: claims - required: - - claims - - type: object - properties: - clientId: - type: string - title: client_id + description: used by ERS claims mode + $ref: '#/components/schemas/google.protobuf.Any' + title: claims + required: + - claims + - properties: + clientId: + type: string title: client_id - required: - - clientId - - type: object - properties: - emailAddress: - type: string - title: email_address + title: client_id + required: + - clientId + - properties: + emailAddress: + type: string title: email_address - required: - - emailAddress - - type: object - properties: - userName: - type: string - title: user_name + title: email_address + required: + - emailAddress + - properties: + userName: + type: string title: user_name - required: - - userName + title: user_name + required: + - userName + properties: + ephemeralId: + type: string + title: ephemeral_id + description: ephemeral id for tracking between request and response + category: + title: category + $ref: '#/components/schemas/entity.Entity.Category' title: Entity additionalProperties: false description: PE (Person Entity) or NPE (Non-Person Entity) - entity.Entity.Category: - type: string - title: Category - enum: - - CATEGORY_UNSPECIFIED - - CATEGORY_SUBJECT - - CATEGORY_ENVIRONMENT entity.EntityChain: type: object properties: @@ -97,6 +92,9 @@ components: value: type: string format: binary + debug: + type: object + additionalProperties: true additionalProperties: true description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. security: [] diff --git a/docs/openapi/entityresolution/entity_resolution.openapi.yaml b/docs/openapi/entityresolution/entity_resolution.openapi.yaml index 6a57e3b749..ac5e8021f4 100644 --- a/docs/openapi/entityresolution/entity_resolution.openapi.yaml +++ b/docs/openapi/entityresolution/entity_resolution.openapi.yaml @@ -2,13 +2,13 @@ openapi: 3.1.0 info: title: entityresolution paths: - /entityresolution.EntityResolutionService/CreateEntityChainFromJwt: + /entityresolution.EntityResolutionService/ResolveEntities: post: tags: - entityresolution.EntityResolutionService - summary: CreateEntityChainFromJwt - description: 'Deprecated: use v2 CreateEntityChainsFromTokens instead' - operationId: entityresolution.EntityResolutionService.CreateEntityChainFromJwt + summary: ResolveEntities + description: 'Deprecated: use v2 ResolveEntities instead' + operationId: entityresolution.EntityResolutionService.ResolveEntities parameters: - name: Connect-Protocol-Version in: header @@ -23,7 +23,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/entityresolution.CreateEntityChainFromJwtRequest' + $ref: '#/components/schemas/entityresolution.ResolveEntitiesRequest' required: true responses: default: @@ -37,14 +37,14 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/entityresolution.CreateEntityChainFromJwtResponse' - /entityresolution.EntityResolutionService/ResolveEntities: + $ref: '#/components/schemas/entityresolution.ResolveEntitiesResponse' + /entityresolution.EntityResolutionService/CreateEntityChainFromJwt: post: tags: - entityresolution.EntityResolutionService - summary: ResolveEntities - description: 'Deprecated: use v2 ResolveEntities instead' - operationId: entityresolution.EntityResolutionService.ResolveEntities + summary: CreateEntityChainFromJwt + description: 'Deprecated: use v2 CreateEntityChainsFromTokens instead' + operationId: entityresolution.EntityResolutionService.CreateEntityChainFromJwt parameters: - name: Connect-Protocol-Version in: header @@ -59,7 +59,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/entityresolution.ResolveEntitiesRequest' + $ref: '#/components/schemas/entityresolution.CreateEntityChainFromJwtRequest' required: true responses: default: @@ -73,88 +73,90 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/entityresolution.ResolveEntitiesResponse' + $ref: '#/components/schemas/entityresolution.CreateEntityChainFromJwtResponse' components: schemas: + authorization.Entity.Category: + type: string + title: Category + enum: + - CATEGORY_UNSPECIFIED + - CATEGORY_SUBJECT + - CATEGORY_ENVIRONMENT + google.protobuf.NullValue: + type: string + title: NullValue + enum: + - NULL_VALUE + description: |- + `NullValue` is a singleton enumeration to represent the null value for the + `Value` type union. + + The JSON representation for `NullValue` is JSON `null`. authorization.Entity: type: object - allOf: + oneOf: - properties: - id: - type: string - title: id - description: ephemeral id for tracking between request and response - category: - title: category - $ref: '#/components/schemas/authorization.Entity.Category' - - oneOf: - - type: object - properties: - claims: - title: claims - $ref: '#/components/schemas/google.protobuf.Any' + claims: title: claims - required: - - claims - - type: object - properties: - clientId: - type: string - title: client_id + $ref: '#/components/schemas/google.protobuf.Any' + title: claims + required: + - claims + - properties: + clientId: + type: string title: client_id - required: - - clientId - - type: object - properties: - custom: - title: custom - $ref: '#/components/schemas/authorization.EntityCustom' + title: client_id + required: + - clientId + - properties: + custom: title: custom - required: - - custom - - type: object - properties: - emailAddress: - type: string - title: email_address - description: one of the entity options must be set + $ref: '#/components/schemas/authorization.EntityCustom' + title: custom + required: + - custom + - properties: + emailAddress: + type: string title: email_address - required: - - emailAddress - - type: object - properties: - remoteClaimsUrl: - type: string - title: remote_claims_url + description: one of the entity options must be set + title: email_address + required: + - emailAddress + - properties: + remoteClaimsUrl: + type: string title: remote_claims_url - required: - - remoteClaimsUrl - - type: object - properties: - userName: - type: string - title: user_name + title: remote_claims_url + required: + - remoteClaimsUrl + - properties: + userName: + type: string title: user_name - required: - - userName - - type: object - properties: - uuid: - type: string - title: uuid + title: user_name + required: + - userName + - properties: + uuid: + type: string title: uuid - required: - - uuid + title: uuid + required: + - uuid + properties: + id: + type: string + title: id + description: ephemeral id for tracking between request and response + category: + title: category + $ref: '#/components/schemas/authorization.Entity.Category' title: Entity additionalProperties: false description: PE (Person Entity) or NPE (Non-Person Entity) - authorization.Entity.Category: - type: string - title: Category - enum: - - CATEGORY_UNSPECIFIED - - CATEGORY_SUBJECT - - CATEGORY_ENVIRONMENT authorization.EntityChain: type: object properties: @@ -192,75 +194,6 @@ components: description: the token title: Token additionalProperties: false - connect-protocol-version: - type: number - title: Connect-Protocol-Version - enum: - - 1 - description: Define the version of the Connect protocol - const: 1 - connect-timeout-header: - type: number - title: Connect-Timeout-Ms - description: Define the timeout, in ms - connect.error: - type: object - properties: - code: - type: string - examples: - - not_found - enum: - - canceled - - unknown - - invalid_argument - - deadline_exceeded - - not_found - - already_exists - - permission_denied - - resource_exhausted - - failed_precondition - - aborted - - out_of_range - - unimplemented - - internal - - unavailable - - data_loss - - unauthenticated - description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. - message: - type: string - description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. - details: - type: array - items: - $ref: '#/components/schemas/connect.error_details.Any' - description: A list of messages that carry the error details. There is no limit on the number of messages. - title: Connect Error - additionalProperties: true - description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' - connect.error_details.Any: - type: object - properties: - type: - type: string - description: 'A URL that acts as a globally unique identifier for the type of the serialized message. For example: `type.googleapis.com/google.rpc.ErrorInfo`. This is used to determine the schema of the data in the `value` field and is the discriminator for the `debug` field.' - value: - type: string - format: binary - description: The Protobuf message, serialized as bytes and base64-encoded. The specific message type is identified by the `type` field. - debug: - oneOf: - - type: object - title: Any - additionalProperties: true - description: Detailed error information. - discriminator: - propertyName: type - title: Debug - description: Deserialized error detail payload. The 'type' field indicates the schema. This field is for easier debugging and should not be relied upon for application logic. - additionalProperties: true - description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message, with an additional debug field for ConnectRPC error details. entityresolution.CreateEntityChainFromJwtRequest: type: object properties: @@ -402,6 +335,9 @@ components: value: type: string format: binary + debug: + type: object + additionalProperties: true additionalProperties: true description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. google.protobuf.ListValue: @@ -419,16 +355,6 @@ components: `ListValue` is a wrapper around a repeated field of values. The JSON representation for `ListValue` is JSON array. - google.protobuf.NullValue: - type: string - title: NullValue - enum: - - NULL_VALUE - description: |- - `NullValue` is a singleton enumeration to represent the null value for the - `Value` type union. - - The JSON representation for `NullValue` is JSON `null`. google.protobuf.Struct: type: object additionalProperties: @@ -469,6 +395,50 @@ components: variants. Absence of any variant indicates an error. The JSON representation for `Value` is JSON value. + connect-protocol-version: + type: number + title: Connect-Protocol-Version + enum: + - 1 + description: Define the version of the Connect protocol + const: 1 + connect-timeout-header: + type: number + title: Connect-Timeout-Ms + description: Define the timeout, in ms + connect.error: + type: object + properties: + code: + type: string + examples: + - not_found + enum: + - canceled + - unknown + - invalid_argument + - deadline_exceeded + - not_found + - already_exists + - permission_denied + - resource_exhausted + - failed_precondition + - aborted + - out_of_range + - unimplemented + - internal + - unavailable + - data_loss + - unauthenticated + description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. + message: + type: string + description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. + detail: + $ref: '#/components/schemas/google.protobuf.Any' + title: Connect Error + additionalProperties: true + description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' security: [] tags: - name: entityresolution.EntityResolutionService diff --git a/docs/openapi/entityresolution/v2/entity_resolution.openapi.yaml b/docs/openapi/entityresolution/v2/entity_resolution.openapi.yaml index 52baa90875..b56324b9c4 100644 --- a/docs/openapi/entityresolution/v2/entity_resolution.openapi.yaml +++ b/docs/openapi/entityresolution/v2/entity_resolution.openapi.yaml @@ -2,12 +2,12 @@ openapi: 3.1.0 info: title: entityresolution.v2 paths: - /entityresolution.v2.EntityResolutionService/CreateEntityChainsFromTokens: + /entityresolution.v2.EntityResolutionService/ResolveEntities: post: tags: - entityresolution.v2.EntityResolutionService - summary: CreateEntityChainsFromTokens - operationId: entityresolution.v2.EntityResolutionService.CreateEntityChainsFromTokens + summary: ResolveEntities + operationId: entityresolution.v2.EntityResolutionService.ResolveEntities parameters: - name: Connect-Protocol-Version in: header @@ -22,7 +22,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/entityresolution.v2.CreateEntityChainsFromTokensRequest' + $ref: '#/components/schemas/entityresolution.v2.ResolveEntitiesRequest' required: true responses: default: @@ -36,13 +36,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/entityresolution.v2.CreateEntityChainsFromTokensResponse' - /entityresolution.v2.EntityResolutionService/ResolveEntities: + $ref: '#/components/schemas/entityresolution.v2.ResolveEntitiesResponse' + /entityresolution.v2.EntityResolutionService/CreateEntityChainsFromTokens: post: tags: - entityresolution.v2.EntityResolutionService - summary: ResolveEntities - operationId: entityresolution.v2.EntityResolutionService.ResolveEntities + summary: CreateEntityChainsFromTokens + operationId: entityresolution.v2.EntityResolutionService.CreateEntityChainsFromTokens parameters: - name: Connect-Protocol-Version in: header @@ -57,7 +57,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/entityresolution.v2.ResolveEntitiesRequest' + $ref: '#/components/schemas/entityresolution.v2.CreateEntityChainsFromTokensRequest' required: true responses: default: @@ -71,40 +71,58 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/entityresolution.v2.ResolveEntitiesResponse' + $ref: '#/components/schemas/entityresolution.v2.CreateEntityChainsFromTokensResponse' components: schemas: + entity.Entity.Category: + type: string + title: Category + enum: + - CATEGORY_UNSPECIFIED + - CATEGORY_SUBJECT + - CATEGORY_ENVIRONMENT + google.protobuf.NullValue: + type: string + title: NullValue + enum: + - NULL_VALUE + description: |- + `NullValue` is a singleton enumeration to represent the null value for the + `Value` type union. + + The JSON representation for `NullValue` is JSON `null`. authorization.v2.Resource: type: object - allOf: + oneOf: - properties: - ephemeralId: - type: string - title: ephemeral_id - description: ephemeral id for tracking between request and response - - oneOf: - - type: object - properties: - attributeValues: - title: attribute_values - description: | - a set of attribute value FQNs, such as those on a TDF, between 1 and 20 in count - attribute_values_required // if provided, resource.attribute_values must be between 1 and 20 in count with all valid FQNs - $ref: '#/components/schemas/authorization.v2.Resource.AttributeValues' + attributeValues: title: attribute_values - required: - - attributeValues - - type: object - properties: - registeredResourceValueFqn: - type: string - title: registered_resource_value_fqn - minLength: 1 - format: uri - description: fully qualified name of the registered resource value stored in platform policy + description: |+ + a set of attribute value FQNs, such as those on a TDF, containing at least 1 value + if provided, resource.attribute_values must contain at least 1 valid FQN: + ``` + this.fqns.size() > 0 && this.fqns.all(item, item.isUri()) + ``` + + $ref: '#/components/schemas/authorization.v2.Resource.AttributeValues' + title: attribute_values + required: + - attributeValues + - properties: + registeredResourceValueFqn: + type: string title: registered_resource_value_fqn - required: - - registeredResourceValueFqn + minLength: 1 + format: uri + description: fully qualified name of the registered resource value stored in platform policy + title: registered_resource_value_fqn + required: + - registeredResourceValueFqn + properties: + ephemeralId: + type: string + title: ephemeral_id + description: ephemeral id for tracking between request and response title: Resource additionalProperties: false description: Either a set of attribute values (such as those on a TDF) or a registered resource value @@ -118,130 +136,49 @@ components: title: fqns title: AttributeValues additionalProperties: false - connect-protocol-version: - type: number - title: Connect-Protocol-Version - enum: - - 1 - description: Define the version of the Connect protocol - const: 1 - connect-timeout-header: - type: number - title: Connect-Timeout-Ms - description: Define the timeout, in ms - connect.error: - type: object - properties: - code: - type: string - examples: - - not_found - enum: - - canceled - - unknown - - invalid_argument - - deadline_exceeded - - not_found - - already_exists - - permission_denied - - resource_exhausted - - failed_precondition - - aborted - - out_of_range - - unimplemented - - internal - - unavailable - - data_loss - - unauthenticated - description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. - message: - type: string - description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. - details: - type: array - items: - $ref: '#/components/schemas/connect.error_details.Any' - description: A list of messages that carry the error details. There is no limit on the number of messages. - title: Connect Error - additionalProperties: true - description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' - connect.error_details.Any: - type: object - properties: - type: - type: string - description: 'A URL that acts as a globally unique identifier for the type of the serialized message. For example: `type.googleapis.com/google.rpc.ErrorInfo`. This is used to determine the schema of the data in the `value` field and is the discriminator for the `debug` field.' - value: - type: string - format: binary - description: The Protobuf message, serialized as bytes and base64-encoded. The specific message type is identified by the `type` field. - debug: - oneOf: - - type: object - title: Any - additionalProperties: true - description: Detailed error information. - discriminator: - propertyName: type - title: Debug - description: Deserialized error detail payload. The 'type' field indicates the schema. This field is for easier debugging and should not be relied upon for application logic. - additionalProperties: true - description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message, with an additional debug field for ConnectRPC error details. entity.Entity: type: object - allOf: + oneOf: - properties: - ephemeralId: - type: string - title: ephemeral_id - description: ephemeral id for tracking between request and response - category: - title: category - $ref: '#/components/schemas/entity.Entity.Category' - - oneOf: - - type: object - properties: - claims: - title: claims - description: used by ERS claims mode - $ref: '#/components/schemas/google.protobuf.Any' + claims: title: claims - required: - - claims - - type: object - properties: - clientId: - type: string - title: client_id + description: used by ERS claims mode + $ref: '#/components/schemas/google.protobuf.Any' + title: claims + required: + - claims + - properties: + clientId: + type: string title: client_id - required: - - clientId - - type: object - properties: - emailAddress: - type: string - title: email_address + title: client_id + required: + - clientId + - properties: + emailAddress: + type: string title: email_address - required: - - emailAddress - - type: object - properties: - userName: - type: string - title: user_name + title: email_address + required: + - emailAddress + - properties: + userName: + type: string title: user_name - required: - - userName + title: user_name + required: + - userName + properties: + ephemeralId: + type: string + title: ephemeral_id + description: ephemeral id for tracking between request and response + category: + title: category + $ref: '#/components/schemas/entity.Entity.Category' title: Entity additionalProperties: false description: PE (Person Entity) or NPE (Non-Person Entity) - entity.Entity.Category: - type: string - title: Category - enum: - - CATEGORY_UNSPECIFIED - - CATEGORY_SUBJECT - - CATEGORY_ENVIRONMENT entity.EntityChain: type: object properties: @@ -385,6 +322,9 @@ components: value: type: string format: binary + debug: + type: object + additionalProperties: true additionalProperties: true description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. google.protobuf.ListValue: @@ -402,16 +342,6 @@ components: `ListValue` is a wrapper around a repeated field of values. The JSON representation for `ListValue` is JSON array. - google.protobuf.NullValue: - type: string - title: NullValue - enum: - - NULL_VALUE - description: |- - `NullValue` is a singleton enumeration to represent the null value for the - `Value` type union. - - The JSON representation for `NullValue` is JSON `null`. google.protobuf.Struct: type: object additionalProperties: @@ -452,6 +382,50 @@ components: variants. Absence of any variant indicates an error. The JSON representation for `Value` is JSON value. + connect-protocol-version: + type: number + title: Connect-Protocol-Version + enum: + - 1 + description: Define the version of the Connect protocol + const: 1 + connect-timeout-header: + type: number + title: Connect-Timeout-Ms + description: Define the timeout, in ms + connect.error: + type: object + properties: + code: + type: string + examples: + - not_found + enum: + - canceled + - unknown + - invalid_argument + - deadline_exceeded + - not_found + - already_exists + - permission_denied + - resource_exhausted + - failed_precondition + - aborted + - out_of_range + - unimplemented + - internal + - unavailable + - data_loss + - unauthenticated + description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. + message: + type: string + description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. + detail: + $ref: '#/components/schemas/google.protobuf.Any' + title: Connect Error + additionalProperties: true + description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' security: [] tags: - name: entityresolution.v2.EntityResolutionService diff --git a/docs/openapi/kas/kas.openapi.yaml b/docs/openapi/kas/kas.openapi.yaml index 147aea0ddf..a357028153 100644 --- a/docs/openapi/kas/kas.openapi.yaml +++ b/docs/openapi/kas/kas.openapi.yaml @@ -2,16 +2,12 @@ openapi: 3.1.0 info: title: kas paths: - /kas.AccessService/LegacyPublicKey: + /kas.AccessService/PublicKey: post: tags: - kas.AccessService - summary: Endpoint intended for gRPC Gateway's REST endpoint to provide v1 compatibility with older TDF clients - description: |- - This endpoint is not recommended for use in new applications, prefer the v2 endpoint ('PublicKey') instead. - - buf:lint:ignore RPC_RESPONSE_STANDARD_NAME - operationId: kas.AccessService.LegacyPublicKey + summary: PublicKey + operationId: kas.AccessService.PublicKey parameters: - name: Connect-Protocol-Version in: header @@ -26,7 +22,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/kas.LegacyPublicKeyRequest' + $ref: '#/components/schemas/kas.PublicKeyRequest' required: true responses: default: @@ -40,14 +36,19 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/google.protobuf.StringValue' - deprecated: true - /kas.AccessService/PublicKey: + $ref: '#/components/schemas/kas.PublicKeyResponse' + /kas.AccessService/LegacyPublicKey: post: tags: - kas.AccessService - summary: PublicKey - operationId: kas.AccessService.PublicKey + summary: LegacyPublicKey + description: |- + Endpoint intended for gRPC Gateway's REST endpoint to provide v1 compatibility with older TDF clients + + This endpoint is not recommended for use in new applications, prefer the v2 endpoint ('PublicKey') instead. + + buf:lint:ignore RPC_RESPONSE_STANDARD_NAME + operationId: kas.AccessService.LegacyPublicKey parameters: - name: Connect-Protocol-Version in: header @@ -62,7 +63,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/kas.PublicKeyRequest' + $ref: '#/components/schemas/kas.LegacyPublicKeyRequest' required: true responses: default: @@ -76,7 +77,8 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/kas.PublicKeyResponse' + $ref: '#/components/schemas/google.protobuf.StringValue' + deprecated: true /kas.AccessService/Rewrap: post: tags: @@ -114,75 +116,16 @@ paths: $ref: '#/components/schemas/kas.RewrapResponse' components: schemas: - connect-protocol-version: - type: number - title: Connect-Protocol-Version + google.protobuf.NullValue: + type: string + title: NullValue enum: - - 1 - description: Define the version of the Connect protocol - const: 1 - connect-timeout-header: - type: number - title: Connect-Timeout-Ms - description: Define the timeout, in ms - connect.error: - type: object - properties: - code: - type: string - examples: - - not_found - enum: - - canceled - - unknown - - invalid_argument - - deadline_exceeded - - not_found - - already_exists - - permission_denied - - resource_exhausted - - failed_precondition - - aborted - - out_of_range - - unimplemented - - internal - - unavailable - - data_loss - - unauthenticated - description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. - message: - type: string - description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. - details: - type: array - items: - $ref: '#/components/schemas/connect.error_details.Any' - description: A list of messages that carry the error details. There is no limit on the number of messages. - title: Connect Error - additionalProperties: true - description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' - connect.error_details.Any: - type: object - properties: - type: - type: string - description: 'A URL that acts as a globally unique identifier for the type of the serialized message. For example: `type.googleapis.com/google.rpc.ErrorInfo`. This is used to determine the schema of the data in the `value` field and is the discriminator for the `debug` field.' - value: - type: string - format: binary - description: The Protobuf message, serialized as bytes and base64-encoded. The specific message type is identified by the `type` field. - debug: - oneOf: - - type: object - title: Any - additionalProperties: true - description: Detailed error information. - discriminator: - propertyName: type - title: Debug - description: Deserialized error detail payload. The 'type' field indicates the schema. This field is for easier debugging and should not be relied upon for application logic. - additionalProperties: true - description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message, with an additional debug field for ConnectRPC error details. + - NULL_VALUE + description: |- + `NullValue` is a singleton enumeration to represent the null value for the + `Value` type union. + + The JSON representation for `NullValue` is JSON `null`. google.protobuf.ListValue: type: object properties: @@ -198,16 +141,6 @@ components: `ListValue` is a wrapper around a repeated field of values. The JSON representation for `ListValue` is JSON array. - google.protobuf.NullValue: - type: string - title: NullValue - enum: - - NULL_VALUE - description: |- - `NullValue` is a singleton enumeration to represent the null value for the - `Value` type union. - - The JSON representation for `NullValue` is JSON `null`. google.protobuf.StringValue: type: string description: |- @@ -357,57 +290,54 @@ components: description: Key Access Object containing cryptographic material and metadata for TDF decryption kas.KeyAccessRewrapResult: type: object - allOf: + oneOf: - properties: - metadata: - type: object - title: metadata - additionalProperties: - title: value - $ref: '#/components/schemas/google.protobuf.Value' - description: |- - Metadata associated with this KAO result (e.g., required obligations) - Optional: May contain obligation requirements or other policy metadata - Common keys: "X-Required-Obligations" with array of obligation FQNs - keyAccessObjectId: + error: type: string - title: key_access_object_id + title: error description: |- - Identifier matching the key_access_object_id from the request - Required: Always matches the ID from UnsignedRewrapRequest_WithKeyAccessObject - status: + Error message when rewrap failed + Present when status="fail" + Human-readable description of the failure reason + title: error + required: + - error + - properties: + kasWrappedKey: type: string - title: status - description: |- - Status of the rewrap operation for this KAO - Required: Always - Values: "permit" (success), "fail" (failure) - - oneOf: - - type: object - properties: - error: - type: string - title: error - description: |- - Error message when rewrap failed - Present when status="fail" - Human-readable description of the failure reason - title: error - required: - - error - - type: object - properties: - kasWrappedKey: - type: string - title: kas_wrapped_key - format: byte - description: |- - Successfully rewrapped key encrypted with the session key - Present when status="permit" - Contains the DEK encrypted with the ephemeral session key title: kas_wrapped_key - required: - - kasWrappedKey + format: byte + description: |- + Successfully rewrapped key encrypted with the session key + Present when status="permit" + Contains the DEK encrypted with the ephemeral session key + title: kas_wrapped_key + required: + - kasWrappedKey + properties: + metadata: + type: object + title: metadata + additionalProperties: + title: value + $ref: '#/components/schemas/google.protobuf.Value' + description: |- + Metadata associated with this KAO result (e.g., required obligations) + Optional: May contain obligation requirements or other policy metadata + Common keys: "X-Required-Obligations" with array of obligation FQNs + keyAccessObjectId: + type: string + title: key_access_object_id + description: |- + Identifier matching the key_access_object_id from the request + Required: Always matches the ID from UnsignedRewrapRequest_WithKeyAccessObject + status: + type: string + title: status + description: |- + Status of the rewrap operation for this KAO + Required: Always + Values: "permit" (success), "fail" (failure) title: KeyAccessRewrapResult additionalProperties: false description: Result of a key access object rewrap operation @@ -689,6 +619,63 @@ components: title: WithPolicyRequest additionalProperties: false description: Request grouping policy with associated key access objects + connect-protocol-version: + type: number + title: Connect-Protocol-Version + enum: + - 1 + description: Define the version of the Connect protocol + const: 1 + connect-timeout-header: + type: number + title: Connect-Timeout-Ms + description: Define the timeout, in ms + connect.error: + type: object + properties: + code: + type: string + examples: + - not_found + enum: + - canceled + - unknown + - invalid_argument + - deadline_exceeded + - not_found + - already_exists + - permission_denied + - resource_exhausted + - failed_precondition + - aborted + - out_of_range + - unimplemented + - internal + - unavailable + - data_loss + - unauthenticated + description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. + message: + type: string + description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. + detail: + $ref: '#/components/schemas/google.protobuf.Any' + title: Connect Error + additionalProperties: true + description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' + google.protobuf.Any: + type: object + properties: + type: + type: string + value: + type: string + format: binary + debug: + type: object + additionalProperties: true + additionalProperties: true + description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. security: [] tags: - name: kas.AccessService diff --git a/docs/openapi/policy/actions/actions.openapi.yaml b/docs/openapi/policy/actions/actions.openapi.yaml index a27c6ff804..da57657292 100644 --- a/docs/openapi/policy/actions/actions.openapi.yaml +++ b/docs/openapi/policy/actions/actions.openapi.yaml @@ -2,12 +2,12 @@ openapi: 3.1.0 info: title: policy.actions paths: - /policy.actions.ActionService/CreateAction: + /policy.actions.ActionService/GetAction: post: tags: - policy.actions.ActionService - summary: CreateAction - operationId: policy.actions.ActionService.CreateAction + summary: GetAction + operationId: policy.actions.ActionService.GetAction parameters: - name: Connect-Protocol-Version in: header @@ -22,7 +22,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.actions.CreateActionRequest' + $ref: '#/components/schemas/policy.actions.GetActionRequest' required: true responses: default: @@ -36,13 +36,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.actions.CreateActionResponse' - /policy.actions.ActionService/DeleteAction: + $ref: '#/components/schemas/policy.actions.GetActionResponse' + /policy.actions.ActionService/ListActions: post: tags: - policy.actions.ActionService - summary: DeleteAction - operationId: policy.actions.ActionService.DeleteAction + summary: ListActions + operationId: policy.actions.ActionService.ListActions parameters: - name: Connect-Protocol-Version in: header @@ -57,7 +57,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.actions.DeleteActionRequest' + $ref: '#/components/schemas/policy.actions.ListActionsRequest' required: true responses: default: @@ -71,13 +71,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.actions.DeleteActionResponse' - /policy.actions.ActionService/GetAction: + $ref: '#/components/schemas/policy.actions.ListActionsResponse' + /policy.actions.ActionService/CreateAction: post: tags: - policy.actions.ActionService - summary: GetAction - operationId: policy.actions.ActionService.GetAction + summary: CreateAction + operationId: policy.actions.ActionService.CreateAction parameters: - name: Connect-Protocol-Version in: header @@ -92,7 +92,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.actions.GetActionRequest' + $ref: '#/components/schemas/policy.actions.CreateActionRequest' required: true responses: default: @@ -106,13 +106,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.actions.GetActionResponse' - /policy.actions.ActionService/ListActions: + $ref: '#/components/schemas/policy.actions.CreateActionResponse' + /policy.actions.ActionService/UpdateAction: post: tags: - policy.actions.ActionService - summary: ListActions - operationId: policy.actions.ActionService.ListActions + summary: UpdateAction + operationId: policy.actions.ActionService.UpdateAction parameters: - name: Connect-Protocol-Version in: header @@ -127,7 +127,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.actions.ListActionsRequest' + $ref: '#/components/schemas/policy.actions.UpdateActionRequest' required: true responses: default: @@ -141,13 +141,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.actions.ListActionsResponse' - /policy.actions.ActionService/UpdateAction: + $ref: '#/components/schemas/policy.actions.UpdateActionResponse' + /policy.actions.ActionService/DeleteAction: post: tags: - policy.actions.ActionService - summary: UpdateAction - operationId: policy.actions.ActionService.UpdateAction + summary: DeleteAction + operationId: policy.actions.ActionService.DeleteAction parameters: - name: Connect-Protocol-Version in: header @@ -162,7 +162,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.actions.UpdateActionRequest' + $ref: '#/components/schemas/policy.actions.DeleteActionRequest' required: true responses: default: @@ -176,9 +176,84 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.actions.UpdateActionResponse' + $ref: '#/components/schemas/policy.actions.DeleteActionResponse' components: schemas: + common.MetadataUpdateEnum: + type: string + title: MetadataUpdateEnum + enum: + - METADATA_UPDATE_ENUM_UNSPECIFIED + - METADATA_UPDATE_ENUM_EXTEND + - METADATA_UPDATE_ENUM_REPLACE + policy.Action.StandardAction: + type: string + title: StandardAction + enum: + - STANDARD_ACTION_UNSPECIFIED + - STANDARD_ACTION_DECRYPT + - STANDARD_ACTION_TRANSMIT + policy.Algorithm: + type: string + title: Algorithm + enum: + - ALGORITHM_UNSPECIFIED + - ALGORITHM_RSA_2048 + - ALGORITHM_RSA_4096 + - ALGORITHM_EC_P256 + - ALGORITHM_EC_P384 + - ALGORITHM_EC_P521 + - ALGORITHM_HPQT_XWING + - ALGORITHM_HPQT_SECP256R1_MLKEM768 + - ALGORITHM_HPQT_SECP384R1_MLKEM1024 + description: Supported key algorithms. + policy.AttributeRuleTypeEnum: + type: string + title: AttributeRuleTypeEnum + enum: + - ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED + - ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF + - ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF + - ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY + policy.ConditionBooleanTypeEnum: + type: string + title: ConditionBooleanTypeEnum + enum: + - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED + - CONDITION_BOOLEAN_TYPE_ENUM_AND + - CONDITION_BOOLEAN_TYPE_ENUM_OR + policy.KasPublicKeyAlgEnum: + type: string + title: KasPublicKeyAlgEnum + enum: + - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 + policy.SourceType: + type: string + title: SourceType + enum: + - SOURCE_TYPE_UNSPECIFIED + - SOURCE_TYPE_INTERNAL + - SOURCE_TYPE_EXTERNAL + description: |- + Describes whether this kas is managed by the organization or if they imported + the kas information from an external party. These two modes are necessary in order + to encrypt a tdf dek with an external parties kas public key. + policy.SubjectMappingOperatorEnum: + type: string + title: SubjectMappingOperatorEnum + enum: + - SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED + - SUBJECT_MAPPING_OPERATOR_ENUM_IN + - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN + - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS common.Metadata: type: object properties: @@ -234,82 +309,6 @@ components: title: value title: LabelsEntry additionalProperties: false - common.MetadataUpdateEnum: - type: string - title: MetadataUpdateEnum - enum: - - METADATA_UPDATE_ENUM_UNSPECIFIED - - METADATA_UPDATE_ENUM_EXTEND - - METADATA_UPDATE_ENUM_REPLACE - connect-protocol-version: - type: number - title: Connect-Protocol-Version - enum: - - 1 - description: Define the version of the Connect protocol - const: 1 - connect-timeout-header: - type: number - title: Connect-Timeout-Ms - description: Define the timeout, in ms - connect.error: - type: object - properties: - code: - type: string - examples: - - not_found - enum: - - canceled - - unknown - - invalid_argument - - deadline_exceeded - - not_found - - already_exists - - permission_denied - - resource_exhausted - - failed_precondition - - aborted - - out_of_range - - unimplemented - - internal - - unavailable - - data_loss - - unauthenticated - description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. - message: - type: string - description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. - details: - type: array - items: - $ref: '#/components/schemas/connect.error_details.Any' - description: A list of messages that carry the error details. There is no limit on the number of messages. - title: Connect Error - additionalProperties: true - description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' - connect.error_details.Any: - type: object - properties: - type: - type: string - description: 'A URL that acts as a globally unique identifier for the type of the serialized message. For example: `type.googleapis.com/google.rpc.ErrorInfo`. This is used to determine the schema of the data in the `value` field and is the discriminator for the `debug` field.' - value: - type: string - format: binary - description: The Protobuf message, serialized as bytes and base64-encoded. The specific message type is identified by the `type` field. - debug: - oneOf: - - type: object - title: Any - additionalProperties: true - description: Detailed error information. - discriminator: - propertyName: type - title: Debug - description: Deserialized error detail payload. The 'type' field indicates the schema. This field is for easier debugging and should not be relied upon for application logic. - additionalProperties: true - description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message, with an additional debug field for ConnectRPC error details. google.protobuf.BoolValue: type: boolean description: |- @@ -322,8 +321,8 @@ components: google.protobuf.Timestamp: type: string examples: - - "2023-01-15T01:30:15.01Z" - - "2024-12-25T12:00:00Z" + - 1s + - 1.000340012s format: date-time description: |- A Timestamp represents a point in time independent of any time zone or local @@ -417,65 +416,41 @@ components: ) to obtain a formatter capable of generating timestamps in this format. policy.Action: type: object - allOf: + oneOf: - properties: - id: - type: string - title: id - description: Generated uuid in database - name: + custom: type: string - title: name - namespace: - title: namespace - description: Namespace context for this action - $ref: '#/components/schemas/policy.Namespace' - metadata: - title: metadata - $ref: '#/components/schemas/common.Metadata' - - oneOf: - - type: object - properties: - custom: - type: string - title: custom - description: Deprecated title: custom - required: - - custom - - type: object - properties: - standard: - title: standard - description: Deprecated - $ref: '#/components/schemas/policy.Action.StandardAction' + description: Deprecated + title: custom + required: + - custom + - properties: + standard: title: standard - required: - - standard + description: Deprecated + $ref: '#/components/schemas/policy.Action.StandardAction' + title: standard + required: + - standard + properties: + id: + type: string + title: id + description: Generated uuid in database + name: + type: string + title: name + namespace: + title: namespace + description: Namespace context for this action + $ref: '#/components/schemas/policy.Namespace' + metadata: + title: metadata + $ref: '#/components/schemas/common.Metadata' title: Action additionalProperties: false description: An action an entity can take - policy.Action.StandardAction: - type: string - title: StandardAction - enum: - - STANDARD_ACTION_UNSPECIFIED - - STANDARD_ACTION_DECRYPT - - STANDARD_ACTION_TRANSMIT - policy.Algorithm: - type: string - title: Algorithm - enum: - - ALGORITHM_UNSPECIFIED - - ALGORITHM_RSA_2048 - - ALGORITHM_RSA_4096 - - ALGORITHM_EC_P256 - - ALGORITHM_EC_P384 - - ALGORITHM_EC_P521 - - ALGORITHM_HPQT_XWING - - ALGORITHM_HPQT_SECP256R1_MLKEM768 - - ALGORITHM_HPQT_SECP384R1_MLKEM1024 - description: Supported key algorithms. policy.Attribute: type: object properties: @@ -532,14 +507,6 @@ components: required: - rule additionalProperties: false - policy.AttributeRuleTypeEnum: - type: string - title: AttributeRuleTypeEnum - enum: - - ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED - - ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF - - ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF - - ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY policy.Condition: type: object properties: @@ -557,6 +524,7 @@ components: type: array items: type: string + minItems: 1 title: subject_external_values minItems: 1 description: |- @@ -572,13 +540,6 @@ components: * A Condition defines a rule of - policy.ConditionBooleanTypeEnum: - type: string - title: ConditionBooleanTypeEnum - enum: - - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED - - CONDITION_BOOLEAN_TYPE_ENUM_AND - - CONDITION_BOOLEAN_TYPE_ENUM_OR policy.ConditionGroup: type: object properties: @@ -615,7 +576,7 @@ components: alg: not: enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - 0 title: alg description: |- A known algorithm type with any additional parameters encoded. @@ -627,19 +588,6 @@ components: description: |- Deprecated A KAS public key and some associated metadata for further identifcation - policy.KasPublicKeyAlgEnum: - type: string - title: KasPublicKeyAlgEnum - enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 policy.KasPublicKeySet: type: object properties: @@ -662,9 +610,13 @@ components: uri: type: string title: uri - description: | + description: |+ Address of a KAS instance - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https?://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(:[0-9]+)?(/.*)?$') + ``` + publicKey: title: public_key description: 'Deprecated: KAS can have multiple key pairs' @@ -862,8 +814,7 @@ components: policy.PublicKey: type: object oneOf: - - type: object - properties: + - properties: cached: title: cached description: public key with additional information. Current preferred version @@ -871,14 +822,17 @@ components: title: cached required: - cached - - type: object - properties: + - properties: remote: type: string title: remote - description: | + description: |+ kas public key url - optional since can also be retrieved via public key - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(/.*)?$') + ``` + title: remote required: - remote @@ -993,17 +947,6 @@ components: title: pem title: SimpleKasPublicKey additionalProperties: false - policy.SourceType: - type: string - title: SourceType - enum: - - SOURCE_TYPE_UNSPECIFIED - - SOURCE_TYPE_INTERNAL - - SOURCE_TYPE_EXTERNAL - description: |- - Describes whether this kas is managed by the organization or if they imported - the kas information from an external party. These two modes are necessary in order - to encrypt a tdf dek with an external parties kas public key. policy.SubjectConditionSet: type: object properties: @@ -1069,14 +1012,6 @@ components: description: |- Subject Mapping: A Policy assigning Subject Set(s) to a permitted attribute value + action(s) combination - policy.SubjectMappingOperatorEnum: - type: string - title: SubjectMappingOperatorEnum - enum: - - SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED - - SUBJECT_MAPPING_OPERATOR_ENUM_IN - - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN - - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS policy.SubjectSet: type: object properties: @@ -1150,9 +1085,13 @@ components: type: string title: name maxLength: 253 - description: | + description: |+ Required - action_name_format // Action name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored action name will be normalized to lower case. + Action name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored action name will be normalized to lower case.: + ``` + this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') + ``` + namespaceId: type: string title: namespace_id @@ -1208,44 +1147,45 @@ components: additionalProperties: false policy.actions.GetActionRequest: type: object - allOf: + oneOf: - properties: - namespaceId: + id: type: string - title: namespace_id + title: id format: uuid - description: |- - Optional namespace ID to scope name-based lookup. - If omitted for name-based lookup, action search is limited to legacy (namespace_id = NULL) actions. - namespaceFqn: + title: id + required: + - id + - properties: + name: type: string - title: namespace_fqn - minLength: 1 - format: uri - description: |- - Optional namespace FQN to scope name-based lookup. - If omitted for name-based lookup, action search is limited to legacy (namespace_id = NULL) actions. - - oneOf: - - type: object - properties: - id: - type: string - title: id - format: uuid - title: id - required: - - id - - type: object - properties: - name: - type: string - title: name - maxLength: 253 - description: | - action_name_format // Action name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored action name will be normalized to lower case. title: name - required: - - name + maxLength: 253 + description: |+ + Action name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored action name will be normalized to lower case.: + ``` + this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') + ``` + + title: name + required: + - name + properties: + namespaceId: + type: string + title: namespace_id + format: uuid + description: |- + Optional namespace ID to scope name-based lookup. + If omitted for name-based lookup, action search is limited to legacy (namespace_id = NULL) actions. + namespaceFqn: + type: string + title: namespace_fqn + minLength: 1 + format: uri + description: |- + Optional namespace FQN to scope name-based lookup. + If omitted for name-based lookup, action search is limited to legacy (namespace_id = NULL) actions. title: GetActionRequest additionalProperties: false policy.actions.GetActionResponse: @@ -1312,10 +1252,14 @@ components: type: string title: name maxLength: 253 - description: | + description: |+ Optional Custom actions only: replaces the existing action name - action_name_format // Action name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored action name will be normalized to lower case. + Action name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored action name will be normalized to lower case.: + ``` + size(this) == 0 || this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') + ``` + metadata: title: metadata description: Common metadata @@ -1336,6 +1280,63 @@ components: $ref: '#/components/schemas/policy.Action' title: UpdateActionResponse additionalProperties: false + connect-protocol-version: + type: number + title: Connect-Protocol-Version + enum: + - 1 + description: Define the version of the Connect protocol + const: 1 + connect-timeout-header: + type: number + title: Connect-Timeout-Ms + description: Define the timeout, in ms + connect.error: + type: object + properties: + code: + type: string + examples: + - not_found + enum: + - canceled + - unknown + - invalid_argument + - deadline_exceeded + - not_found + - already_exists + - permission_denied + - resource_exhausted + - failed_precondition + - aborted + - out_of_range + - unimplemented + - internal + - unavailable + - data_loss + - unauthenticated + description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. + message: + type: string + description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. + detail: + $ref: '#/components/schemas/google.protobuf.Any' + title: Connect Error + additionalProperties: true + description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' + google.protobuf.Any: + type: object + properties: + type: + type: string + value: + type: string + format: binary + debug: + type: object + additionalProperties: true + additionalProperties: true + description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. security: [] tags: - name: policy.actions.ActionService diff --git a/docs/openapi/policy/attributes/attributes.openapi.yaml b/docs/openapi/policy/attributes/attributes.openapi.yaml index c53042bbfc..a340ec1720 100644 --- a/docs/openapi/policy/attributes/attributes.openapi.yaml +++ b/docs/openapi/policy/attributes/attributes.openapi.yaml @@ -2,13 +2,16 @@ openapi: 3.1.0 info: title: policy.attributes paths: - /policy.attributes.AttributesService/AssignKeyAccessServerToAttribute: + /policy.attributes.AttributesService/ListAttributes: post: tags: - policy.attributes.AttributesService - summary: AssignKeyAccessServerToAttribute - description: 'Deprecated: utilize AssignPublicKeyToAttribute' - operationId: policy.attributes.AttributesService.AssignKeyAccessServerToAttribute + summary: ListAttributes + description: |- + --------------------------------------* + Attribute RPCs + --------------------------------------- + operationId: policy.attributes.AttributesService.ListAttributes parameters: - name: Connect-Protocol-Version in: header @@ -23,7 +26,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.AssignKeyAccessServerToAttributeRequest' + $ref: '#/components/schemas/policy.attributes.ListAttributesRequest' required: true responses: default: @@ -37,15 +40,16 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.AssignKeyAccessServerToAttributeResponse' - deprecated: true - /policy.attributes.AttributesService/AssignKeyAccessServerToValue: + $ref: '#/components/schemas/policy.attributes.ListAttributesResponse' + /policy.attributes.AttributesService/ListAttributeValues: post: tags: - policy.attributes.AttributesService - summary: AssignKeyAccessServerToValue - description: 'Deprecated: utilize AssignPublicKeyToValue' - operationId: policy.attributes.AttributesService.AssignKeyAccessServerToValue + summary: ListAttributeValues + description: |- + Deprecated + Use GetAttribute + operationId: policy.attributes.AttributesService.ListAttributeValues parameters: - name: Connect-Protocol-Version in: header @@ -60,7 +64,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.AssignKeyAccessServerToValueRequest' + $ref: '#/components/schemas/policy.attributes.ListAttributeValuesRequest' required: true responses: default: @@ -74,14 +78,14 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.AssignKeyAccessServerToValueResponse' + $ref: '#/components/schemas/policy.attributes.ListAttributeValuesResponse' deprecated: true - /policy.attributes.AttributesService/AssignPublicKeyToAttribute: + /policy.attributes.AttributesService/GetAttribute: post: tags: - policy.attributes.AttributesService - summary: AssignPublicKeyToAttribute - operationId: policy.attributes.AttributesService.AssignPublicKeyToAttribute + summary: GetAttribute + operationId: policy.attributes.AttributesService.GetAttribute parameters: - name: Connect-Protocol-Version in: header @@ -96,7 +100,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.AssignPublicKeyToAttributeRequest' + $ref: '#/components/schemas/policy.attributes.GetAttributeRequest' required: true responses: default: @@ -110,13 +114,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.AssignPublicKeyToAttributeResponse' - /policy.attributes.AttributesService/AssignPublicKeyToValue: + $ref: '#/components/schemas/policy.attributes.GetAttributeResponse' + /policy.attributes.AttributesService/GetAttributeValuesByFqns: post: tags: - policy.attributes.AttributesService - summary: AssignPublicKeyToValue - operationId: policy.attributes.AttributesService.AssignPublicKeyToValue + summary: GetAttributeValuesByFqns + operationId: policy.attributes.AttributesService.GetAttributeValuesByFqns parameters: - name: Connect-Protocol-Version in: header @@ -131,7 +135,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.AssignPublicKeyToValueRequest' + $ref: '#/components/schemas/policy.attributes.GetAttributeValuesByFqnsRequest' required: true responses: default: @@ -145,7 +149,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.AssignPublicKeyToValueResponse' + $ref: '#/components/schemas/policy.attributes.GetAttributeValuesByFqnsResponse' /policy.attributes.AttributesService/CreateAttribute: post: tags: @@ -181,12 +185,12 @@ paths: application/json: schema: $ref: '#/components/schemas/policy.attributes.CreateAttributeResponse' - /policy.attributes.AttributesService/CreateAttributeValue: + /policy.attributes.AttributesService/UpdateAttribute: post: tags: - policy.attributes.AttributesService - summary: CreateAttributeValue - operationId: policy.attributes.AttributesService.CreateAttributeValue + summary: UpdateAttribute + operationId: policy.attributes.AttributesService.UpdateAttribute parameters: - name: Connect-Protocol-Version in: header @@ -201,7 +205,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.CreateAttributeValueRequest' + $ref: '#/components/schemas/policy.attributes.UpdateAttributeRequest' required: true responses: default: @@ -215,7 +219,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.CreateAttributeValueResponse' + $ref: '#/components/schemas/policy.attributes.UpdateAttributeResponse' /policy.attributes.AttributesService/DeactivateAttribute: post: tags: @@ -251,12 +255,16 @@ paths: application/json: schema: $ref: '#/components/schemas/policy.attributes.DeactivateAttributeResponse' - /policy.attributes.AttributesService/DeactivateAttributeValue: + /policy.attributes.AttributesService/GetAttributeValue: post: tags: - policy.attributes.AttributesService - summary: DeactivateAttributeValue - operationId: policy.attributes.AttributesService.DeactivateAttributeValue + summary: GetAttributeValue + description: |- + --------------------------------------* + Value RPCs + --------------------------------------- + operationId: policy.attributes.AttributesService.GetAttributeValue parameters: - name: Connect-Protocol-Version in: header @@ -271,7 +279,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.DeactivateAttributeValueRequest' + $ref: '#/components/schemas/policy.attributes.GetAttributeValueRequest' required: true responses: default: @@ -285,13 +293,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.DeactivateAttributeValueResponse' - /policy.attributes.AttributesService/GetAttribute: + $ref: '#/components/schemas/policy.attributes.GetAttributeValueResponse' + /policy.attributes.AttributesService/CreateAttributeValue: post: tags: - policy.attributes.AttributesService - summary: GetAttribute - operationId: policy.attributes.AttributesService.GetAttribute + summary: CreateAttributeValue + operationId: policy.attributes.AttributesService.CreateAttributeValue parameters: - name: Connect-Protocol-Version in: header @@ -306,7 +314,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.GetAttributeRequest' + $ref: '#/components/schemas/policy.attributes.CreateAttributeValueRequest' required: true responses: default: @@ -320,17 +328,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.GetAttributeResponse' - /policy.attributes.AttributesService/GetAttributeValue: + $ref: '#/components/schemas/policy.attributes.CreateAttributeValueResponse' + /policy.attributes.AttributesService/UpdateAttributeValue: post: tags: - policy.attributes.AttributesService - summary: GetAttributeValue - description: |- - --------------------------------------* - Value RPCs - --------------------------------------- - operationId: policy.attributes.AttributesService.GetAttributeValue + summary: UpdateAttributeValue + operationId: policy.attributes.AttributesService.UpdateAttributeValue parameters: - name: Connect-Protocol-Version in: header @@ -345,7 +349,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.GetAttributeValueRequest' + $ref: '#/components/schemas/policy.attributes.UpdateAttributeValueRequest' required: true responses: default: @@ -359,13 +363,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.GetAttributeValueResponse' - /policy.attributes.AttributesService/GetAttributeValuesByFqns: + $ref: '#/components/schemas/policy.attributes.UpdateAttributeValueResponse' + /policy.attributes.AttributesService/DeactivateAttributeValue: post: tags: - policy.attributes.AttributesService - summary: GetAttributeValuesByFqns - operationId: policy.attributes.AttributesService.GetAttributeValuesByFqns + summary: DeactivateAttributeValue + operationId: policy.attributes.AttributesService.DeactivateAttributeValue parameters: - name: Connect-Protocol-Version in: header @@ -380,7 +384,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.GetAttributeValuesByFqnsRequest' + $ref: '#/components/schemas/policy.attributes.DeactivateAttributeValueRequest' required: true responses: default: @@ -394,16 +398,14 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.GetAttributeValuesByFqnsResponse' - /policy.attributes.AttributesService/ListAttributeValues: + $ref: '#/components/schemas/policy.attributes.DeactivateAttributeValueResponse' + /policy.attributes.AttributesService/AssignKeyAccessServerToAttribute: post: tags: - policy.attributes.AttributesService - summary: ListAttributeValues - description: |- - Deprecated - Use GetAttribute - operationId: policy.attributes.AttributesService.ListAttributeValues + summary: AssignKeyAccessServerToAttribute + description: 'Deprecated: utilize AssignPublicKeyToAttribute' + operationId: policy.attributes.AttributesService.AssignKeyAccessServerToAttribute parameters: - name: Connect-Protocol-Version in: header @@ -418,7 +420,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.ListAttributeValuesRequest' + $ref: '#/components/schemas/policy.attributes.AssignKeyAccessServerToAttributeRequest' required: true responses: default: @@ -432,18 +434,15 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.ListAttributeValuesResponse' + $ref: '#/components/schemas/policy.attributes.AssignKeyAccessServerToAttributeResponse' deprecated: true - /policy.attributes.AttributesService/ListAttributes: + /policy.attributes.AttributesService/RemoveKeyAccessServerFromAttribute: post: tags: - policy.attributes.AttributesService - summary: ListAttributes - description: |- - --------------------------------------* - Attribute RPCs - --------------------------------------- - operationId: policy.attributes.AttributesService.ListAttributes + summary: RemoveKeyAccessServerFromAttribute + description: 'Deprecated: utilize RemovePublicKeyFromAttribute' + operationId: policy.attributes.AttributesService.RemoveKeyAccessServerFromAttribute parameters: - name: Connect-Protocol-Version in: header @@ -458,7 +457,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.ListAttributesRequest' + $ref: '#/components/schemas/policy.attributes.RemoveKeyAccessServerFromAttributeRequest' required: true responses: default: @@ -472,14 +471,15 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.ListAttributesResponse' - /policy.attributes.AttributesService/RemoveKeyAccessServerFromAttribute: + $ref: '#/components/schemas/policy.attributes.RemoveKeyAccessServerFromAttributeResponse' + deprecated: true + /policy.attributes.AttributesService/AssignKeyAccessServerToValue: post: tags: - policy.attributes.AttributesService - summary: RemoveKeyAccessServerFromAttribute - description: 'Deprecated: utilize RemovePublicKeyFromAttribute' - operationId: policy.attributes.AttributesService.RemoveKeyAccessServerFromAttribute + summary: AssignKeyAccessServerToValue + description: 'Deprecated: utilize AssignPublicKeyToValue' + operationId: policy.attributes.AttributesService.AssignKeyAccessServerToValue parameters: - name: Connect-Protocol-Version in: header @@ -494,7 +494,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.RemoveKeyAccessServerFromAttributeRequest' + $ref: '#/components/schemas/policy.attributes.AssignKeyAccessServerToValueRequest' required: true responses: default: @@ -508,7 +508,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.RemoveKeyAccessServerFromAttributeResponse' + $ref: '#/components/schemas/policy.attributes.AssignKeyAccessServerToValueResponse' deprecated: true /policy.attributes.AttributesService/RemoveKeyAccessServerFromValue: post: @@ -547,12 +547,12 @@ paths: schema: $ref: '#/components/schemas/policy.attributes.RemoveKeyAccessServerFromValueResponse' deprecated: true - /policy.attributes.AttributesService/RemovePublicKeyFromAttribute: + /policy.attributes.AttributesService/AssignPublicKeyToAttribute: post: tags: - policy.attributes.AttributesService - summary: RemovePublicKeyFromAttribute - operationId: policy.attributes.AttributesService.RemovePublicKeyFromAttribute + summary: AssignPublicKeyToAttribute + operationId: policy.attributes.AttributesService.AssignPublicKeyToAttribute parameters: - name: Connect-Protocol-Version in: header @@ -567,7 +567,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.RemovePublicKeyFromAttributeRequest' + $ref: '#/components/schemas/policy.attributes.AssignPublicKeyToAttributeRequest' required: true responses: default: @@ -581,13 +581,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.RemovePublicKeyFromAttributeResponse' - /policy.attributes.AttributesService/RemovePublicKeyFromValue: + $ref: '#/components/schemas/policy.attributes.AssignPublicKeyToAttributeResponse' + /policy.attributes.AttributesService/RemovePublicKeyFromAttribute: post: tags: - policy.attributes.AttributesService - summary: RemovePublicKeyFromValue - operationId: policy.attributes.AttributesService.RemovePublicKeyFromValue + summary: RemovePublicKeyFromAttribute + operationId: policy.attributes.AttributesService.RemovePublicKeyFromAttribute parameters: - name: Connect-Protocol-Version in: header @@ -602,7 +602,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.RemovePublicKeyFromValueRequest' + $ref: '#/components/schemas/policy.attributes.RemovePublicKeyFromAttributeRequest' required: true responses: default: @@ -616,13 +616,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.RemovePublicKeyFromValueResponse' - /policy.attributes.AttributesService/UpdateAttribute: + $ref: '#/components/schemas/policy.attributes.RemovePublicKeyFromAttributeResponse' + /policy.attributes.AttributesService/AssignPublicKeyToValue: post: tags: - policy.attributes.AttributesService - summary: UpdateAttribute - operationId: policy.attributes.AttributesService.UpdateAttribute + summary: AssignPublicKeyToValue + operationId: policy.attributes.AttributesService.AssignPublicKeyToValue parameters: - name: Connect-Protocol-Version in: header @@ -637,7 +637,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.UpdateAttributeRequest' + $ref: '#/components/schemas/policy.attributes.AssignPublicKeyToValueRequest' required: true responses: default: @@ -651,13 +651,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.UpdateAttributeResponse' - /policy.attributes.AttributesService/UpdateAttributeValue: + $ref: '#/components/schemas/policy.attributes.AssignPublicKeyToValueResponse' + /policy.attributes.AttributesService/RemovePublicKeyFromValue: post: tags: - policy.attributes.AttributesService - summary: UpdateAttributeValue - operationId: policy.attributes.AttributesService.UpdateAttributeValue + summary: RemovePublicKeyFromValue + operationId: policy.attributes.AttributesService.RemovePublicKeyFromValue parameters: - name: Connect-Protocol-Version in: header @@ -672,7 +672,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.UpdateAttributeValueRequest' + $ref: '#/components/schemas/policy.attributes.RemovePublicKeyFromValueRequest' required: true responses: default: @@ -686,7 +686,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.attributes.UpdateAttributeValueResponse' + $ref: '#/components/schemas/policy.attributes.RemovePublicKeyFromValueResponse' components: schemas: common.ActiveStateEnum: @@ -698,14 +698,103 @@ components: - ACTIVE_STATE_ENUM_INACTIVE - ACTIVE_STATE_ENUM_ANY description: 'buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren''t violated when users add new enum values to an enum in a given package' + common.MetadataUpdateEnum: + type: string + title: MetadataUpdateEnum + enum: + - METADATA_UPDATE_ENUM_UNSPECIFIED + - METADATA_UPDATE_ENUM_EXTEND + - METADATA_UPDATE_ENUM_REPLACE + policy.Action.StandardAction: + type: string + title: StandardAction + enum: + - STANDARD_ACTION_UNSPECIFIED + - STANDARD_ACTION_DECRYPT + - STANDARD_ACTION_TRANSMIT + policy.Algorithm: + type: string + title: Algorithm + enum: + - ALGORITHM_UNSPECIFIED + - ALGORITHM_RSA_2048 + - ALGORITHM_RSA_4096 + - ALGORITHM_EC_P256 + - ALGORITHM_EC_P384 + - ALGORITHM_EC_P521 + - ALGORITHM_HPQT_XWING + - ALGORITHM_HPQT_SECP256R1_MLKEM768 + - ALGORITHM_HPQT_SECP384R1_MLKEM1024 + description: Supported key algorithms. + policy.AttributeRuleTypeEnum: + type: string + title: AttributeRuleTypeEnum + enum: + - ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED + - ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF + - ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF + - ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY + policy.ConditionBooleanTypeEnum: + type: string + title: ConditionBooleanTypeEnum + enum: + - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED + - CONDITION_BOOLEAN_TYPE_ENUM_AND + - CONDITION_BOOLEAN_TYPE_ENUM_OR + policy.KasPublicKeyAlgEnum: + type: string + title: KasPublicKeyAlgEnum + enum: + - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 + policy.SortDirection: + type: string + title: SortDirection + enum: + - SORT_DIRECTION_UNSPECIFIED + - SORT_DIRECTION_ASC + - SORT_DIRECTION_DESC + description: |- + Sorting direction shared across list APIs. + When the 'sort' field is omitted or the chosen sort 'field' is UNSPECIFIED, + the endpoint's request message defines the default ordering; see the + specific List* request docs. + policy.SourceType: + type: string + title: SourceType + enum: + - SOURCE_TYPE_UNSPECIFIED + - SOURCE_TYPE_INTERNAL + - SOURCE_TYPE_EXTERNAL + description: |- + Describes whether this kas is managed by the organization or if they imported + the kas information from an external party. These two modes are necessary in order + to encrypt a tdf dek with an external parties kas public key. + policy.SubjectMappingOperatorEnum: + type: string + title: SubjectMappingOperatorEnum + enum: + - SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED + - SUBJECT_MAPPING_OPERATOR_ENUM_IN + - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN + - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS + policy.attributes.SortAttributesType: + type: string + title: SortAttributesType + enum: + - SORT_ATTRIBUTES_TYPE_UNSPECIFIED + - SORT_ATTRIBUTES_TYPE_NAME + - SORT_ATTRIBUTES_TYPE_CREATED_AT + - SORT_ATTRIBUTES_TYPE_UPDATED_AT common.IdFqnIdentifier: type: object - allOf: - - oneOf: - - required: - - id - - required: - - fqn properties: id: type: string @@ -720,12 +809,6 @@ components: additionalProperties: false common.IdNameIdentifier: type: object - allOf: - - oneOf: - - required: - - id - - required: - - name properties: id: type: string @@ -736,8 +819,12 @@ components: title: name maxLength: 253 minLength: 1 - description: | - name_format // Name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored name will be normalized to lower case. + description: |+ + Name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored name will be normalized to lower case.: + ``` + this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') + ``` + title: IdNameIdentifier additionalProperties: false common.Metadata: @@ -795,82 +882,6 @@ components: title: value title: LabelsEntry additionalProperties: false - common.MetadataUpdateEnum: - type: string - title: MetadataUpdateEnum - enum: - - METADATA_UPDATE_ENUM_UNSPECIFIED - - METADATA_UPDATE_ENUM_EXTEND - - METADATA_UPDATE_ENUM_REPLACE - connect-protocol-version: - type: number - title: Connect-Protocol-Version - enum: - - 1 - description: Define the version of the Connect protocol - const: 1 - connect-timeout-header: - type: number - title: Connect-Timeout-Ms - description: Define the timeout, in ms - connect.error: - type: object - properties: - code: - type: string - examples: - - not_found - enum: - - canceled - - unknown - - invalid_argument - - deadline_exceeded - - not_found - - already_exists - - permission_denied - - resource_exhausted - - failed_precondition - - aborted - - out_of_range - - unimplemented - - internal - - unavailable - - data_loss - - unauthenticated - description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. - message: - type: string - description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. - details: - type: array - items: - $ref: '#/components/schemas/connect.error_details.Any' - description: A list of messages that carry the error details. There is no limit on the number of messages. - title: Connect Error - additionalProperties: true - description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' - connect.error_details.Any: - type: object - properties: - type: - type: string - description: 'A URL that acts as a globally unique identifier for the type of the serialized message. For example: `type.googleapis.com/google.rpc.ErrorInfo`. This is used to determine the schema of the data in the `value` field and is the discriminator for the `debug` field.' - value: - type: string - format: binary - description: The Protobuf message, serialized as bytes and base64-encoded. The specific message type is identified by the `type` field. - debug: - oneOf: - - type: object - title: Any - additionalProperties: true - description: Detailed error information. - discriminator: - propertyName: type - title: Debug - description: Deserialized error detail payload. The 'type' field indicates the schema. This field is for easier debugging and should not be relied upon for application logic. - additionalProperties: true - description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message, with an additional debug field for ConnectRPC error details. google.protobuf.BoolValue: type: boolean description: |- @@ -883,8 +894,8 @@ components: google.protobuf.Timestamp: type: string examples: - - "2023-01-15T01:30:15.01Z" - - "2024-12-25T12:00:00Z" + - 1s + - 1.000340012s format: date-time description: |- A Timestamp represents a point in time independent of any time zone or local @@ -978,65 +989,41 @@ components: ) to obtain a formatter capable of generating timestamps in this format. policy.Action: type: object - allOf: + oneOf: - properties: - id: - type: string - title: id - description: Generated uuid in database - name: + custom: type: string - title: name - namespace: - title: namespace - description: Namespace context for this action - $ref: '#/components/schemas/policy.Namespace' - metadata: - title: metadata - $ref: '#/components/schemas/common.Metadata' - - oneOf: - - type: object - properties: - custom: - type: string - title: custom - description: Deprecated title: custom - required: - - custom - - type: object - properties: - standard: - title: standard - description: Deprecated - $ref: '#/components/schemas/policy.Action.StandardAction' + description: Deprecated + title: custom + required: + - custom + - properties: + standard: title: standard - required: - - standard + description: Deprecated + $ref: '#/components/schemas/policy.Action.StandardAction' + title: standard + required: + - standard + properties: + id: + type: string + title: id + description: Generated uuid in database + name: + type: string + title: name + namespace: + title: namespace + description: Namespace context for this action + $ref: '#/components/schemas/policy.Namespace' + metadata: + title: metadata + $ref: '#/components/schemas/common.Metadata' title: Action additionalProperties: false description: An action an entity can take - policy.Action.StandardAction: - type: string - title: StandardAction - enum: - - STANDARD_ACTION_UNSPECIFIED - - STANDARD_ACTION_DECRYPT - - STANDARD_ACTION_TRANSMIT - policy.Algorithm: - type: string - title: Algorithm - enum: - - ALGORITHM_UNSPECIFIED - - ALGORITHM_RSA_2048 - - ALGORITHM_RSA_4096 - - ALGORITHM_EC_P256 - - ALGORITHM_EC_P384 - - ALGORITHM_EC_P521 - - ALGORITHM_HPQT_XWING - - ALGORITHM_HPQT_SECP256R1_MLKEM768 - - ALGORITHM_HPQT_SECP384R1_MLKEM1024 - description: Supported key algorithms. policy.Attribute: type: object properties: @@ -1093,14 +1080,6 @@ components: required: - rule additionalProperties: false - policy.AttributeRuleTypeEnum: - type: string - title: AttributeRuleTypeEnum - enum: - - ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED - - ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF - - ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF - - ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY policy.Condition: type: object properties: @@ -1118,6 +1097,7 @@ components: type: array items: type: string + minItems: 1 title: subject_external_values minItems: 1 description: |- @@ -1133,13 +1113,6 @@ components: * A Condition defines a rule of - policy.ConditionBooleanTypeEnum: - type: string - title: ConditionBooleanTypeEnum - enum: - - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED - - CONDITION_BOOLEAN_TYPE_ENUM_AND - - CONDITION_BOOLEAN_TYPE_ENUM_OR policy.ConditionGroup: type: object properties: @@ -1176,7 +1149,7 @@ components: alg: not: enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - 0 title: alg description: |- A known algorithm type with any additional parameters encoded. @@ -1188,19 +1161,6 @@ components: description: |- Deprecated A KAS public key and some associated metadata for further identifcation - policy.KasPublicKeyAlgEnum: - type: string - title: KasPublicKeyAlgEnum - enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 policy.KasPublicKeySet: type: object properties: @@ -1223,9 +1183,13 @@ components: uri: type: string title: uri - description: | + description: |+ Address of a KAS instance - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https?://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(:[0-9]+)?(/.*)?$') + ``` + publicKey: title: public_key description: 'Deprecated: KAS can have multiple key pairs' @@ -1423,8 +1387,7 @@ components: policy.PublicKey: type: object oneOf: - - type: object - properties: + - properties: cached: title: cached description: public key with additional information. Current preferred version @@ -1432,14 +1395,17 @@ components: title: cached required: - cached - - type: object - properties: + - properties: remote: type: string title: remote - description: | + description: |+ kas public key url - optional since can also be retrieved via public key - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(/.*)?$') + ``` + title: remote required: - remote @@ -1554,29 +1520,6 @@ components: title: pem title: SimpleKasPublicKey additionalProperties: false - policy.SortDirection: - type: string - title: SortDirection - enum: - - SORT_DIRECTION_UNSPECIFIED - - SORT_DIRECTION_ASC - - SORT_DIRECTION_DESC - description: |- - Sorting direction shared across list APIs. - When the 'sort' field is omitted or the chosen sort 'field' is UNSPECIFIED, - the endpoint's request message defines the default ordering; see the - specific List* request docs. - policy.SourceType: - type: string - title: SourceType - enum: - - SOURCE_TYPE_UNSPECIFIED - - SOURCE_TYPE_INTERNAL - - SOURCE_TYPE_EXTERNAL - description: |- - Describes whether this kas is managed by the organization or if they imported - the kas information from an external party. These two modes are necessary in order - to encrypt a tdf dek with an external parties kas public key. policy.SubjectConditionSet: type: object properties: @@ -1642,14 +1585,6 @@ components: description: |- Subject Mapping: A Policy assigning Subject Set(s) to a permitted attribute value + action(s) combination - policy.SubjectMappingOperatorEnum: - type: string - title: SubjectMappingOperatorEnum - enum: - - SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED - - SUBJECT_MAPPING_OPERATOR_ENUM_IN - - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN - - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS policy.SubjectSet: type: object properties: @@ -1873,9 +1808,13 @@ components: type: string title: name maxLength: 253 - description: | + description: |+ Required - attribute_name_format // Attribute name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored attribute name will be normalized to lower case. + Attribute name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored attribute name will be normalized to lower case.: + ``` + this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') + ``` + rule: title: rule description: Required @@ -1886,6 +1825,7 @@ components: type: string maxLength: 253 pattern: ^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$ + uniqueItems: true title: values uniqueItems: true description: |- @@ -1931,9 +1871,13 @@ components: type: string title: value maxLength: 253 - description: | + description: |+ Required - attribute_value_format // Attribute value must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored attribute value will be normalized to lower case. + Attribute value must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored attribute value will be normalized to lower case.: + ``` + this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') + ``` + obligationTriggers: type: array items: @@ -1998,40 +1942,45 @@ components: additionalProperties: false policy.attributes.GetAttributeRequest: type: object - allOf: + oneOf: - properties: - id: + attributeId: type: string - title: id - format: uuid - description: 'Deprecated: utilize identifier' - deprecated: true - - oneOf: - - type: object - properties: - attributeId: - type: string - title: attribute_id - format: uuid - description: 'option (buf.validate.oneof).required = true; // TODO: enable this when we remove the deprecated field' title: attribute_id - required: - - attributeId - - type: object - properties: - fqn: - type: string - title: fqn - minLength: 1 - format: uri + format: uuid + description: 'option (buf.validate.oneof).required = true; // TODO: enable this when we remove the deprecated field' + title: attribute_id + required: + - attributeId + - properties: + fqn: + type: string title: fqn - required: - - fqn + minLength: 1 + format: uri + title: fqn + required: + - fqn + properties: + id: + type: string + title: id + format: uuid + description: 'Deprecated: utilize identifier' + deprecated: true title: GetAttributeRequest additionalProperties: false - description: | - exclusive_fields // Either use deprecated 'id' field or one of 'attribute_id' or 'fqn', but not both - required_fields // Either id or one of attribute_id or fqn must be set + description: |+ + Either use deprecated 'id' field or one of 'attribute_id' or 'fqn', but not both: + ``` + !(has(this.id) && (has(this.attribute_id) || has(this.fqn))) + ``` + + Either id or one of attribute_id or fqn must be set: + ``` + has(this.id) || has(this.attribute_id) || has(this.fqn) + ``` + policy.attributes.GetAttributeResponse: type: object properties: @@ -2042,43 +1991,48 @@ components: additionalProperties: false policy.attributes.GetAttributeValueRequest: type: object - allOf: + oneOf: - properties: - id: + fqn: type: string - title: id - format: uuid - description: 'Deprecated: utilize identifier' - deprecated: true - - oneOf: - - type: object - properties: - fqn: - type: string - title: fqn - minLength: 1 - format: uri title: fqn - required: - - fqn - - type: object - properties: - valueId: - type: string - title: value_id - format: uuid - description: 'option (buf.validate.oneof).required = true; // TODO: enable this when we remove the deprecated field' + minLength: 1 + format: uri + title: fqn + required: + - fqn + - properties: + valueId: + type: string title: value_id - required: - - valueId + format: uuid + description: 'option (buf.validate.oneof).required = true; // TODO: enable this when we remove the deprecated field' + title: value_id + required: + - valueId + properties: + id: + type: string + title: id + format: uuid + description: 'Deprecated: utilize identifier' + deprecated: true title: GetAttributeValueRequest additionalProperties: false - description: | + description: |+ / / Value RPC messages / - exclusive_fields // Either use deprecated 'id' field or one of 'value_id' or 'fqn', but not both - required_fields // Either id or one of value_id or fqn must be set + Either use deprecated 'id' field or one of 'value_id' or 'fqn', but not both: + ``` + !(has(this.id) && (has(this.value_id) || has(this.fqn))) + ``` + + Either id or one of value_id or fqn must be set: + ``` + has(this.id) || has(this.value_id) || has(this.fqn) + ``` + policy.attributes.GetAttributeValueResponse: type: object properties: @@ -2094,6 +2048,8 @@ components: type: array items: type: string + maxItems: 250 + minItems: 1 title: fqns maxItems: 250 minItems: 1 @@ -2291,14 +2247,6 @@ components: $ref: '#/components/schemas/policy.attributes.ValueKey' title: RemovePublicKeyFromValueResponse additionalProperties: false - policy.attributes.SortAttributesType: - type: string - title: SortAttributesType - enum: - - SORT_ATTRIBUTES_TYPE_UNSPECIFIED - - SORT_ATTRIBUTES_TYPE_NAME - - SORT_ATTRIBUTES_TYPE_CREATED_AT - - SORT_ATTRIBUTES_TYPE_UPDATED_AT policy.attributes.UpdateAttributeRequest: type: object properties: @@ -2384,6 +2332,63 @@ components: description: Required title: ValueKeyAccessServer additionalProperties: false + connect-protocol-version: + type: number + title: Connect-Protocol-Version + enum: + - 1 + description: Define the version of the Connect protocol + const: 1 + connect-timeout-header: + type: number + title: Connect-Timeout-Ms + description: Define the timeout, in ms + connect.error: + type: object + properties: + code: + type: string + examples: + - not_found + enum: + - canceled + - unknown + - invalid_argument + - deadline_exceeded + - not_found + - already_exists + - permission_denied + - resource_exhausted + - failed_precondition + - aborted + - out_of_range + - unimplemented + - internal + - unavailable + - data_loss + - unauthenticated + description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. + message: + type: string + description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. + detail: + $ref: '#/components/schemas/google.protobuf.Any' + title: Connect Error + additionalProperties: true + description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' + google.protobuf.Any: + type: object + properties: + type: + type: string + value: + type: string + format: binary + debug: + type: object + additionalProperties: true + additionalProperties: true + description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. security: [] tags: - name: policy.attributes.AttributesService diff --git a/docs/openapi/policy/kasregistry/key_access_server_registry.openapi.yaml b/docs/openapi/policy/kasregistry/key_access_server_registry.openapi.yaml index 8d9f785054..a3eb12f037 100644 --- a/docs/openapi/policy/kasregistry/key_access_server_registry.openapi.yaml +++ b/docs/openapi/policy/kasregistry/key_access_server_registry.openapi.yaml @@ -2,15 +2,12 @@ openapi: 3.1.0 info: title: policy.kasregistry paths: - /policy.kasregistry.KeyAccessServerRegistryService/CreateKey: + /policy.kasregistry.KeyAccessServerRegistryService/ListKeyAccessServers: post: tags: - policy.kasregistry.KeyAccessServerRegistryService - summary: CreateKey - description: |- - KAS Key Management - Request to create a new key in the Key Access Service. - operationId: policy.kasregistry.KeyAccessServerRegistryService.CreateKey + summary: ListKeyAccessServers + operationId: policy.kasregistry.KeyAccessServerRegistryService.ListKeyAccessServers parameters: - name: Connect-Protocol-Version in: header @@ -25,7 +22,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.CreateKeyRequest' + $ref: '#/components/schemas/policy.kasregistry.ListKeyAccessServersRequest' required: true responses: default: @@ -39,13 +36,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.CreateKeyResponse' - /policy.kasregistry.KeyAccessServerRegistryService/CreateKeyAccessServer: + $ref: '#/components/schemas/policy.kasregistry.ListKeyAccessServersResponse' + /policy.kasregistry.KeyAccessServerRegistryService/GetKeyAccessServer: post: tags: - policy.kasregistry.KeyAccessServerRegistryService - summary: CreateKeyAccessServer - operationId: policy.kasregistry.KeyAccessServerRegistryService.CreateKeyAccessServer + summary: GetKeyAccessServer + operationId: policy.kasregistry.KeyAccessServerRegistryService.GetKeyAccessServer parameters: - name: Connect-Protocol-Version in: header @@ -60,7 +57,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.CreateKeyAccessServerRequest' + $ref: '#/components/schemas/policy.kasregistry.GetKeyAccessServerRequest' required: true responses: default: @@ -74,13 +71,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.CreateKeyAccessServerResponse' - /policy.kasregistry.KeyAccessServerRegistryService/DeleteKeyAccessServer: + $ref: '#/components/schemas/policy.kasregistry.GetKeyAccessServerResponse' + /policy.kasregistry.KeyAccessServerRegistryService/CreateKeyAccessServer: post: tags: - policy.kasregistry.KeyAccessServerRegistryService - summary: DeleteKeyAccessServer - operationId: policy.kasregistry.KeyAccessServerRegistryService.DeleteKeyAccessServer + summary: CreateKeyAccessServer + operationId: policy.kasregistry.KeyAccessServerRegistryService.CreateKeyAccessServer parameters: - name: Connect-Protocol-Version in: header @@ -95,7 +92,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.DeleteKeyAccessServerRequest' + $ref: '#/components/schemas/policy.kasregistry.CreateKeyAccessServerRequest' required: true responses: default: @@ -109,14 +106,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.DeleteKeyAccessServerResponse' - /policy.kasregistry.KeyAccessServerRegistryService/GetBaseKey: + $ref: '#/components/schemas/policy.kasregistry.CreateKeyAccessServerResponse' + /policy.kasregistry.KeyAccessServerRegistryService/UpdateKeyAccessServer: post: tags: - policy.kasregistry.KeyAccessServerRegistryService - summary: GetBaseKey - description: Get Default kas keys - operationId: policy.kasregistry.KeyAccessServerRegistryService.GetBaseKey + summary: UpdateKeyAccessServer + operationId: policy.kasregistry.KeyAccessServerRegistryService.UpdateKeyAccessServer parameters: - name: Connect-Protocol-Version in: header @@ -131,7 +127,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.GetBaseKeyRequest' + $ref: '#/components/schemas/policy.kasregistry.UpdateKeyAccessServerRequest' required: true responses: default: @@ -145,14 +141,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.GetBaseKeyResponse' - /policy.kasregistry.KeyAccessServerRegistryService/GetKey: + $ref: '#/components/schemas/policy.kasregistry.UpdateKeyAccessServerResponse' + /policy.kasregistry.KeyAccessServerRegistryService/DeleteKeyAccessServer: post: tags: - policy.kasregistry.KeyAccessServerRegistryService - summary: GetKey - description: Request to retrieve a key from the Key Access Service. - operationId: policy.kasregistry.KeyAccessServerRegistryService.GetKey + summary: DeleteKeyAccessServer + operationId: policy.kasregistry.KeyAccessServerRegistryService.DeleteKeyAccessServer parameters: - name: Connect-Protocol-Version in: header @@ -167,7 +162,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.GetKeyRequest' + $ref: '#/components/schemas/policy.kasregistry.DeleteKeyAccessServerRequest' required: true responses: default: @@ -181,13 +176,14 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.GetKeyResponse' - /policy.kasregistry.KeyAccessServerRegistryService/GetKeyAccessServer: + $ref: '#/components/schemas/policy.kasregistry.DeleteKeyAccessServerResponse' + /policy.kasregistry.KeyAccessServerRegistryService/ListKeyAccessServerGrants: post: tags: - policy.kasregistry.KeyAccessServerRegistryService - summary: GetKeyAccessServer - operationId: policy.kasregistry.KeyAccessServerRegistryService.GetKeyAccessServer + summary: ListKeyAccessServerGrants + description: Deprecated + operationId: policy.kasregistry.KeyAccessServerRegistryService.ListKeyAccessServerGrants parameters: - name: Connect-Protocol-Version in: header @@ -202,7 +198,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.GetKeyAccessServerRequest' + $ref: '#/components/schemas/policy.kasregistry.ListKeyAccessServerGrantsRequest' required: true responses: default: @@ -216,14 +212,17 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.GetKeyAccessServerResponse' - /policy.kasregistry.KeyAccessServerRegistryService/ListKeyAccessServerGrants: + $ref: '#/components/schemas/policy.kasregistry.ListKeyAccessServerGrantsResponse' + deprecated: true + /policy.kasregistry.KeyAccessServerRegistryService/CreateKey: post: tags: - policy.kasregistry.KeyAccessServerRegistryService - summary: ListKeyAccessServerGrants - description: Deprecated - operationId: policy.kasregistry.KeyAccessServerRegistryService.ListKeyAccessServerGrants + summary: CreateKey + description: |- + KAS Key Management + Request to create a new key in the Key Access Service. + operationId: policy.kasregistry.KeyAccessServerRegistryService.CreateKey parameters: - name: Connect-Protocol-Version in: header @@ -238,7 +237,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.ListKeyAccessServerGrantsRequest' + $ref: '#/components/schemas/policy.kasregistry.CreateKeyRequest' required: true responses: default: @@ -252,14 +251,14 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.ListKeyAccessServerGrantsResponse' - deprecated: true - /policy.kasregistry.KeyAccessServerRegistryService/ListKeyAccessServers: + $ref: '#/components/schemas/policy.kasregistry.CreateKeyResponse' + /policy.kasregistry.KeyAccessServerRegistryService/GetKey: post: tags: - policy.kasregistry.KeyAccessServerRegistryService - summary: ListKeyAccessServers - operationId: policy.kasregistry.KeyAccessServerRegistryService.ListKeyAccessServers + summary: GetKey + description: Request to retrieve a key from the Key Access Service. + operationId: policy.kasregistry.KeyAccessServerRegistryService.GetKey parameters: - name: Connect-Protocol-Version in: header @@ -274,7 +273,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.ListKeyAccessServersRequest' + $ref: '#/components/schemas/policy.kasregistry.GetKeyRequest' required: true responses: default: @@ -288,14 +287,14 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.ListKeyAccessServersResponse' - /policy.kasregistry.KeyAccessServerRegistryService/ListKeyMappings: + $ref: '#/components/schemas/policy.kasregistry.GetKeyResponse' + /policy.kasregistry.KeyAccessServerRegistryService/ListKeys: post: tags: - policy.kasregistry.KeyAccessServerRegistryService - summary: ListKeyMappings - description: Request to list key mappings in the Key Access Service. - operationId: policy.kasregistry.KeyAccessServerRegistryService.ListKeyMappings + summary: ListKeys + description: Request to list keys in the Key Access Service. + operationId: policy.kasregistry.KeyAccessServerRegistryService.ListKeys parameters: - name: Connect-Protocol-Version in: header @@ -310,7 +309,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.ListKeyMappingsRequest' + $ref: '#/components/schemas/policy.kasregistry.ListKeysRequest' required: true responses: default: @@ -324,14 +323,14 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.ListKeyMappingsResponse' - /policy.kasregistry.KeyAccessServerRegistryService/ListKeys: + $ref: '#/components/schemas/policy.kasregistry.ListKeysResponse' + /policy.kasregistry.KeyAccessServerRegistryService/UpdateKey: post: tags: - policy.kasregistry.KeyAccessServerRegistryService - summary: ListKeys - description: Request to list keys in the Key Access Service. - operationId: policy.kasregistry.KeyAccessServerRegistryService.ListKeys + summary: UpdateKey + description: Request to update a key in the Key Access Service. + operationId: policy.kasregistry.KeyAccessServerRegistryService.UpdateKey parameters: - name: Connect-Protocol-Version in: header @@ -346,7 +345,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.ListKeysRequest' + $ref: '#/components/schemas/policy.kasregistry.UpdateKeyRequest' required: true responses: default: @@ -360,7 +359,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.ListKeysResponse' + $ref: '#/components/schemas/policy.kasregistry.UpdateKeyResponse' /policy.kasregistry.KeyAccessServerRegistryService/RotateKey: post: tags: @@ -433,13 +432,13 @@ paths: application/json: schema: $ref: '#/components/schemas/policy.kasregistry.SetBaseKeyResponse' - /policy.kasregistry.KeyAccessServerRegistryService/UpdateKey: + /policy.kasregistry.KeyAccessServerRegistryService/GetBaseKey: post: tags: - policy.kasregistry.KeyAccessServerRegistryService - summary: UpdateKey - description: Request to update a key in the Key Access Service. - operationId: policy.kasregistry.KeyAccessServerRegistryService.UpdateKey + summary: GetBaseKey + description: Get Default kas keys + operationId: policy.kasregistry.KeyAccessServerRegistryService.GetBaseKey parameters: - name: Connect-Protocol-Version in: header @@ -454,7 +453,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.UpdateKeyRequest' + $ref: '#/components/schemas/policy.kasregistry.GetBaseKeyRequest' required: true responses: default: @@ -468,13 +467,14 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.UpdateKeyResponse' - /policy.kasregistry.KeyAccessServerRegistryService/UpdateKeyAccessServer: + $ref: '#/components/schemas/policy.kasregistry.GetBaseKeyResponse' + /policy.kasregistry.KeyAccessServerRegistryService/ListKeyMappings: post: tags: - policy.kasregistry.KeyAccessServerRegistryService - summary: UpdateKeyAccessServer - operationId: policy.kasregistry.KeyAccessServerRegistryService.UpdateKeyAccessServer + summary: ListKeyMappings + description: Request to list key mappings in the Key Access Service. + operationId: policy.kasregistry.KeyAccessServerRegistryService.ListKeyMappings parameters: - name: Connect-Protocol-Version in: header @@ -489,7 +489,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.UpdateKeyAccessServerRequest' + $ref: '#/components/schemas/policy.kasregistry.ListKeyMappingsRequest' required: true responses: default: @@ -503,9 +503,101 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.kasregistry.UpdateKeyAccessServerResponse' + $ref: '#/components/schemas/policy.kasregistry.ListKeyMappingsResponse' components: schemas: + common.MetadataUpdateEnum: + type: string + title: MetadataUpdateEnum + enum: + - METADATA_UPDATE_ENUM_UNSPECIFIED + - METADATA_UPDATE_ENUM_EXTEND + - METADATA_UPDATE_ENUM_REPLACE + policy.Algorithm: + type: string + title: Algorithm + enum: + - ALGORITHM_UNSPECIFIED + - ALGORITHM_RSA_2048 + - ALGORITHM_RSA_4096 + - ALGORITHM_EC_P256 + - ALGORITHM_EC_P384 + - ALGORITHM_EC_P521 + - ALGORITHM_HPQT_XWING + - ALGORITHM_HPQT_SECP256R1_MLKEM768 + - ALGORITHM_HPQT_SECP384R1_MLKEM1024 + description: Supported key algorithms. + policy.KasPublicKeyAlgEnum: + type: string + title: KasPublicKeyAlgEnum + enum: + - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 + policy.KeyMode: + type: string + title: KeyMode + enum: + - KEY_MODE_UNSPECIFIED + - KEY_MODE_CONFIG_ROOT_KEY + - KEY_MODE_PROVIDER_ROOT_KEY + - KEY_MODE_REMOTE + - KEY_MODE_PUBLIC_KEY_ONLY + description: Describes the management and operational mode of a cryptographic key. + policy.KeyStatus: + type: string + title: KeyStatus + enum: + - KEY_STATUS_UNSPECIFIED + - KEY_STATUS_ACTIVE + - KEY_STATUS_ROTATED + description: The status of the key + policy.SortDirection: + type: string + title: SortDirection + enum: + - SORT_DIRECTION_UNSPECIFIED + - SORT_DIRECTION_ASC + - SORT_DIRECTION_DESC + description: |- + Sorting direction shared across list APIs. + When the 'sort' field is omitted or the chosen sort 'field' is UNSPECIFIED, + the endpoint's request message defines the default ordering; see the + specific List* request docs. + policy.SourceType: + type: string + title: SourceType + enum: + - SOURCE_TYPE_UNSPECIFIED + - SOURCE_TYPE_INTERNAL + - SOURCE_TYPE_EXTERNAL + description: |- + Describes whether this kas is managed by the organization or if they imported + the kas information from an external party. These two modes are necessary in order + to encrypt a tdf dek with an external parties kas public key. + policy.kasregistry.SortKasKeysType: + type: string + title: SortKasKeysType + enum: + - SORT_KAS_KEYS_TYPE_UNSPECIFIED + - SORT_KAS_KEYS_TYPE_KEY_ID + - SORT_KAS_KEYS_TYPE_CREATED_AT + - SORT_KAS_KEYS_TYPE_UPDATED_AT + policy.kasregistry.SortKeyAccessServersType: + type: string + title: SortKeyAccessServersType + enum: + - SORT_KEY_ACCESS_SERVERS_TYPE_UNSPECIFIED + - SORT_KEY_ACCESS_SERVERS_TYPE_NAME + - SORT_KEY_ACCESS_SERVERS_TYPE_URI + - SORT_KEY_ACCESS_SERVERS_TYPE_CREATED_AT + - SORT_KEY_ACCESS_SERVERS_TYPE_UPDATED_AT common.Metadata: type: object properties: @@ -561,82 +653,6 @@ components: title: value title: LabelsEntry additionalProperties: false - common.MetadataUpdateEnum: - type: string - title: MetadataUpdateEnum - enum: - - METADATA_UPDATE_ENUM_UNSPECIFIED - - METADATA_UPDATE_ENUM_EXTEND - - METADATA_UPDATE_ENUM_REPLACE - connect-protocol-version: - type: number - title: Connect-Protocol-Version - enum: - - 1 - description: Define the version of the Connect protocol - const: 1 - connect-timeout-header: - type: number - title: Connect-Timeout-Ms - description: Define the timeout, in ms - connect.error: - type: object - properties: - code: - type: string - examples: - - not_found - enum: - - canceled - - unknown - - invalid_argument - - deadline_exceeded - - not_found - - already_exists - - permission_denied - - resource_exhausted - - failed_precondition - - aborted - - out_of_range - - unimplemented - - internal - - unavailable - - data_loss - - unauthenticated - description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. - message: - type: string - description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. - details: - type: array - items: - $ref: '#/components/schemas/connect.error_details.Any' - description: A list of messages that carry the error details. There is no limit on the number of messages. - title: Connect Error - additionalProperties: true - description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' - connect.error_details.Any: - type: object - properties: - type: - type: string - description: 'A URL that acts as a globally unique identifier for the type of the serialized message. For example: `type.googleapis.com/google.rpc.ErrorInfo`. This is used to determine the schema of the data in the `value` field and is the discriminator for the `debug` field.' - value: - type: string - format: binary - description: The Protobuf message, serialized as bytes and base64-encoded. The specific message type is identified by the `type` field. - debug: - oneOf: - - type: object - title: Any - additionalProperties: true - description: Detailed error information. - discriminator: - propertyName: type - title: Debug - description: Deserialized error detail payload. The 'type' field indicates the schema. This field is for easier debugging and should not be relied upon for application logic. - additionalProperties: true - description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message, with an additional debug field for ConnectRPC error details. google.protobuf.BoolValue: type: boolean description: |- @@ -649,8 +665,8 @@ components: google.protobuf.Timestamp: type: string examples: - - "2023-01-15T01:30:15.01Z" - - "2024-12-25T12:00:00Z" + - 1s + - 1.000340012s format: date-time description: |- A Timestamp represents a point in time independent of any time zone or local @@ -742,20 +758,6 @@ components: the Joda Time's [`ISODateTimeFormat.dateTime()`]( http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime() ) to obtain a formatter capable of generating timestamps in this format. - policy.Algorithm: - type: string - title: Algorithm - enum: - - ALGORITHM_UNSPECIFIED - - ALGORITHM_RSA_2048 - - ALGORITHM_RSA_4096 - - ALGORITHM_EC_P256 - - ALGORITHM_EC_P384 - - ALGORITHM_EC_P521 - - ALGORITHM_HPQT_XWING - - ALGORITHM_HPQT_SECP256R1_MLKEM768 - - ALGORITHM_HPQT_SECP384R1_MLKEM1024 - description: Supported key algorithms. policy.AsymmetricKey: type: object properties: @@ -833,7 +835,7 @@ components: alg: not: enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - 0 title: alg description: |- A known algorithm type with any additional parameters encoded. @@ -845,19 +847,6 @@ components: description: |- Deprecated A KAS public key and some associated metadata for further identifcation - policy.KasPublicKeyAlgEnum: - type: string - title: KasPublicKeyAlgEnum - enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 policy.KasPublicKeySet: type: object properties: @@ -905,9 +894,13 @@ components: uri: type: string title: uri - description: | + description: |+ Address of a KAS instance - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https?://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(:[0-9]+)?(/.*)?$') + ``` + publicKey: title: public_key description: 'Deprecated: KAS can have multiple key pairs' @@ -935,16 +928,6 @@ components: title: KeyAccessServer additionalProperties: false description: Key Access Server Registry - policy.KeyMode: - type: string - title: KeyMode - enum: - - KEY_MODE_UNSPECIFIED - - KEY_MODE_CONFIG_ROOT_KEY - - KEY_MODE_PROVIDER_ROOT_KEY - - KEY_MODE_REMOTE - - KEY_MODE_PUBLIC_KEY_ONLY - description: Describes the management and operational mode of a cryptographic key. policy.KeyProviderConfig: type: object properties: @@ -967,14 +950,6 @@ components: $ref: '#/components/schemas/common.Metadata' title: KeyProviderConfig additionalProperties: false - policy.KeyStatus: - type: string - title: KeyStatus - enum: - - KEY_STATUS_UNSPECIFIED - - KEY_STATUS_ACTIVE - - KEY_STATUS_ROTATED - description: The status of the key policy.PageRequest: type: object properties: @@ -1034,8 +1009,7 @@ components: policy.PublicKey: type: object oneOf: - - type: object - properties: + - properties: cached: title: cached description: public key with additional information. Current preferred version @@ -1043,14 +1017,17 @@ components: title: cached required: - cached - - type: object - properties: + - properties: remote: type: string title: remote - description: | + description: |+ kas public key url - optional since can also be retrieved via public key - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(/.*)?$') + ``` + title: remote required: - remote @@ -1097,30 +1074,7 @@ components: type: string title: pem title: SimpleKasPublicKey - additionalProperties: false - policy.SortDirection: - type: string - title: SortDirection - enum: - - SORT_DIRECTION_UNSPECIFIED - - SORT_DIRECTION_ASC - - SORT_DIRECTION_DESC - description: |- - Sorting direction shared across list APIs. - When the 'sort' field is omitted or the chosen sort 'field' is UNSPECIFIED, - the endpoint's request message defines the default ordering; see the - specific List* request docs. - policy.SourceType: - type: string - title: SourceType - enum: - - SOURCE_TYPE_UNSPECIFIED - - SOURCE_TYPE_INTERNAL - - SOURCE_TYPE_EXTERNAL - description: |- - Describes whether this kas is managed by the organization or if they imported - the kas information from an external party. These two modes are necessary in order - to encrypt a tdf dek with an external parties kas public key. + additionalProperties: false policy.kasregistry.ActivatePublicKeyRequest: type: object properties: @@ -1158,9 +1112,13 @@ components: uri: type: string title: uri - description: | + description: |+ Required - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.isUri() + ``` + publicKey: title: public_key description: Deprecated @@ -1173,9 +1131,13 @@ components: type: string title: name maxLength: 253 - description: | + description: |+ Optional - kas_name_format // Registered KAS name must be an alphanumeric string, allowing hyphens, and underscores but not as the first or last character. The stored KAS name will be normalized to lower case. + Registered KAS name must be an alphanumeric string, allowing hyphens, and underscores but not as the first or last character. The stored KAS name will be normalized to lower case.: + ``` + size(this) > 0 ? this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') : true + ``` + metadata: title: metadata description: Common metadata @@ -1205,15 +1167,23 @@ components: description: Required A user-defined identifier for the key keyAlgorithm: title: key_algorithm - description: | + description: |+ Required The algorithm to be used for the key - key_algorithm_defined // The key_algorithm must be one of the defined values. + The key_algorithm must be one of the defined values.: + ``` + this in [1, 2, 3, 4, 5, 6, 7, 8] + ``` + $ref: '#/components/schemas/policy.Algorithm' keyMode: title: key_mode - description: | + description: |+ Required The mode of the key (e.g., local or external) - key_mode_defined // The key_mode must be one of the defined values (1-4). + The key_mode must be one of the defined values (1-4).: + ``` + this >= 1 && this <= 4 + ``` + $ref: '#/components/schemas/policy.KeyMode' publicKeyCtx: title: public_key_ctx @@ -1239,11 +1209,23 @@ components: required: - publicKeyCtx additionalProperties: false - description: | + description: |+ Create a new asymmetric key for the specified Key Access Server (KAS) - private_key_ctx_for_public_key_only // private_key_ctx must not be set if key_mode is KEY_MODE_PUBLIC_KEY_ONLY. - private_key_ctx_optionally_required // The wrapped_key is required if key_mode is KEY_MODE_CONFIG_ROOT_KEY or KEY_MODE_PROVIDER_ROOT_KEY. The wrapped_key must be empty if key_mode is KEY_MODE_REMOTE or KEY_MODE_PUBLIC_KEY_ONLY. - provider_config_id_optionally_required // Provider config id is required if key_mode is KEY_MODE_PROVIDER_ROOT_KEY or KEY_MODE_REMOTE. It must be empty for KEY_MODE_CONFIG_ROOT_KEY and KEY_MODE_PUBLIC_KEY_ONLY. + The wrapped_key is required if key_mode is KEY_MODE_CONFIG_ROOT_KEY or KEY_MODE_PROVIDER_ROOT_KEY. The wrapped_key must be empty if key_mode is KEY_MODE_REMOTE or KEY_MODE_PUBLIC_KEY_ONLY.: + ``` + ((this.key_mode == 1 || this.key_mode == 2) && this.private_key_ctx.wrapped_key != '') || ((this.key_mode == 3 || this.key_mode == 4) && this.private_key_ctx.wrapped_key == '') + ``` + + Provider config id is required if key_mode is KEY_MODE_PROVIDER_ROOT_KEY or KEY_MODE_REMOTE. It must be empty for KEY_MODE_CONFIG_ROOT_KEY and KEY_MODE_PUBLIC_KEY_ONLY.: + ``` + ((this.key_mode == 1 || this.key_mode == 4) && this.provider_config_id == '') || ((this.key_mode == 2 || this.key_mode == 3) && this.provider_config_id != '') + ``` + + private_key_ctx must not be set if key_mode is KEY_MODE_PUBLIC_KEY_ONLY.: + ``` + !(this.key_mode == 4 && has(this.private_key_ctx)) + ``` + policy.kasregistry.CreateKeyResponse: type: object properties: @@ -1332,49 +1314,53 @@ components: additionalProperties: false policy.kasregistry.GetKeyAccessServerRequest: type: object - allOf: + oneOf: - properties: - id: + kasId: type: string - title: id - format: uuid - description: Deprecated - deprecated: true - - oneOf: - - type: object - properties: - kasId: - type: string - title: kas_id - format: uuid - description: 'option (buf.validate.oneof).required = true; // TODO: enable this when we remove the deprecated field' title: kas_id - required: - - kasId - - type: object - properties: - name: - type: string - title: name - minLength: 1 + format: uuid + description: 'option (buf.validate.oneof).required = true; // TODO: enable this when we remove the deprecated field' + title: kas_id + required: + - kasId + - properties: + name: + type: string title: name - required: - - name - - type: object - properties: - uri: - type: string - title: uri - minLength: 1 - format: uri + minLength: 1 + title: name + required: + - name + - properties: + uri: + type: string title: uri - required: - - uri + minLength: 1 + format: uri + title: uri + required: + - uri + properties: + id: + type: string + title: id + format: uuid + description: Deprecated + deprecated: true title: GetKeyAccessServerRequest additionalProperties: false - description: | - exclusive_fields // Either use deprecated 'id' field or one of 'kas_id' or 'uri', but not both - required_fields // Either id or one of kas_id or uri must be set + description: |+ + Either use deprecated 'id' field or one of 'kas_id' or 'uri', but not both: + ``` + !(has(this.id) && (has(this.kas_id) || has(this.uri) || has(this.name))) + ``` + + Either id or one of kas_id or uri must be set: + ``` + has(this.id) || has(this.kas_id) || has(this.uri) || has(this.name) + ``` + policy.kasregistry.GetKeyAccessServerResponse: type: object properties: @@ -1386,8 +1372,7 @@ components: policy.kasregistry.GetKeyRequest: type: object oneOf: - - type: object - properties: + - properties: id: type: string title: id @@ -1396,8 +1381,7 @@ components: title: id required: - id - - type: object - properties: + - properties: key: title: key $ref: '#/components/schemas/policy.kasregistry.KasKeyIdentifier' @@ -1420,8 +1404,7 @@ components: policy.kasregistry.GetPublicKeyRequest: type: object oneOf: - - type: object - properties: + - properties: id: type: string title: id @@ -1453,42 +1436,38 @@ components: description: Can be namespace, attribute definition, or value policy.kasregistry.KasKeyIdentifier: type: object - allOf: + oneOf: - properties: - kid: + kasId: type: string - title: kid - minLength: 1 - description: Required Key ID of the key in question - - oneOf: - - type: object - properties: - kasId: - type: string - title: kas_id - format: uuid title: kas_id - required: - - kasId - - type: object - properties: - name: - type: string - title: name - minLength: 1 + format: uuid + title: kas_id + required: + - kasId + - properties: + name: + type: string title: name - required: - - name - - type: object - properties: - uri: - type: string - title: uri - minLength: 1 - format: uri + minLength: 1 + title: name + required: + - name + - properties: + uri: + type: string title: uri - required: - - uri + minLength: 1 + format: uri + title: uri + required: + - uri + properties: + kid: + type: string + title: kid + minLength: 1 + description: Required Key ID of the key in question title: KasKeyIdentifier additionalProperties: false description: Nested message for specifying the active key using KAS ID and Key ID @@ -1573,31 +1552,43 @@ components: kasId: type: string title: kas_id - description: | + description: |+ Optional Filter LIST by ID of a registered Key Access Server. If neither is provided, grants from all registered KASs to policy attribute objects are returned. - optional_uuid_format // Optional field must be a valid UUID + Optional field must be a valid UUID: + ``` + size(this) == 0 || this.matches('[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}') + ``` + kasUri: type: string title: kas_uri - description: | + description: |+ Optional Filter LIST by URI of a registered Key Access Server. If none is provided, grants from all registered KASs to policy attribute objects are returned. - optional_uri_format // Optional URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + Optional URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + size(this) == 0 || this.isUri() + ``` + kasName: type: string title: kas_name maxLength: 253 - description: | + description: |+ Optional Filter LIST by name of a registered Key Access Server. If none are provided, grants from all registered KASs to policy attribute objects are returned. - kas_name_format // Registered KAS name must be an alphanumeric string, allowing hyphens, and underscores but not as the first or last character. The stored KAS name will be normalized to lower case. + Registered KAS name must be an alphanumeric string, allowing hyphens, and underscores but not as the first or last character. The stored KAS name will be normalized to lower case.: + ``` + size(this) == 0 || this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') + ``` + pagination: title: pagination description: Optional @@ -1660,31 +1651,28 @@ components: additionalProperties: false policy.kasregistry.ListKeyMappingsRequest: type: object - allOf: + oneOf: - properties: - pagination: - title: pagination - description: Pagination request for the list of keys - $ref: '#/components/schemas/policy.PageRequest' - - oneOf: - - type: object - properties: - id: - type: string - title: id - format: uuid - description: The unique identifier of the key to retrieve + id: + type: string title: id - required: - - id - - type: object - properties: - key: - title: key - $ref: '#/components/schemas/policy.kasregistry.KasKeyIdentifier' + format: uuid + description: The unique identifier of the key to retrieve + title: id + required: + - id + - properties: + key: title: key - required: - - key + $ref: '#/components/schemas/policy.kasregistry.KasKeyIdentifier' + title: key + required: + - key + properties: + pagination: + title: pagination + description: Pagination request for the list of keys + $ref: '#/components/schemas/policy.PageRequest' title: ListKeyMappingsRequest additionalProperties: false policy.kasregistry.ListKeyMappingsResponse: @@ -1704,68 +1692,67 @@ components: additionalProperties: false policy.kasregistry.ListKeysRequest: type: object - allOf: + oneOf: - properties: - keyAlgorithm: - title: key_algorithm - description: | - Filter keys by algorithm - key_algorithm_defined // The key_algorithm must be one of the defined values. - $ref: '#/components/schemas/policy.Algorithm' - legacy: - type: - - boolean - - "null" - title: legacy - description: Optional Filter for legacy keys - pagination: - title: pagination - description: Optional Pagination request for the list of keys - $ref: '#/components/schemas/policy.PageRequest' - sort: - type: array - items: - $ref: '#/components/schemas/policy.kasregistry.KasKeysSort' - title: sort - maxItems: 1 - description: |- - Optional - CONSTRAINT: max 1 item - Sort defaults: - - direction UNSPECIFIED defaults to DESC for the specified field - - field UNSPECIFIED defaults to created_at with the specified direction - - both UNSPECIFIED or sort omitted defaults to created_at DESC - - oneOf: - - type: object - properties: - kasId: - type: string - title: kas_id - format: uuid - description: Filter keys by the KAS ID + kasId: + type: string title: kas_id - required: - - kasId - - type: object - properties: - kasName: - type: string - title: kas_name - minLength: 1 - description: Filter keys by the KAS name + format: uuid + description: Filter keys by the KAS ID + title: kas_id + required: + - kasId + - properties: + kasName: + type: string title: kas_name - required: - - kasName - - type: object - properties: - kasUri: - type: string - title: kas_uri - minLength: 1 - format: uri - description: Filter keys by the KAS URI + minLength: 1 + description: Filter keys by the KAS name + title: kas_name + required: + - kasName + - properties: + kasUri: + type: string title: kas_uri - required: - - kasUri + minLength: 1 + format: uri + description: Filter keys by the KAS URI + title: kas_uri + required: + - kasUri + properties: + keyAlgorithm: + title: key_algorithm + description: |+ + Filter keys by algorithm + The key_algorithm must be one of the defined values.: + ``` + this in [0, 1, 2, 3, 4, 5, 6, 7, 8] + ``` + + $ref: '#/components/schemas/policy.Algorithm' + legacy: + type: boolean + title: legacy + description: Optional Filter for legacy keys + nullable: true + pagination: + title: pagination + description: Optional Pagination request for the list of keys + $ref: '#/components/schemas/policy.PageRequest' + sort: + type: array + items: + $ref: '#/components/schemas/policy.kasregistry.KasKeysSort' + title: sort + maxItems: 1 + description: |- + Optional - CONSTRAINT: max 1 item + Sort defaults: + - direction UNSPECIFIED defaults to DESC for the specified field + - field UNSPECIFIED defaults to created_at with the specified direction + - both UNSPECIFIED or sort omitted defaults to created_at DESC title: ListKeysRequest additionalProperties: false description: List all asymmetric keys managed by a specific Key Access Server or with a given algorithm @@ -1787,49 +1774,45 @@ components: description: Response to a ListKeysRequest, containing the list of asymmetric keys and pagination information policy.kasregistry.ListPublicKeyMappingRequest: type: object - allOf: + oneOf: - properties: - publicKeyId: + kasId: type: string - title: public_key_id + title: kas_id format: uuid - description: Optional Public Key ID - pagination: - title: pagination description: Optional - $ref: '#/components/schemas/policy.PageRequest' - - oneOf: - - type: object - properties: - kasId: - type: string - title: kas_id - format: uuid - description: Optional - title: kas_id - required: - - kasId - - type: object - properties: - kasName: - type: string - title: kas_name - minLength: 1 - description: Optional + title: kas_id + required: + - kasId + - properties: + kasName: + type: string title: kas_name - required: - - kasName - - type: object - properties: - kasUri: - type: string - title: kas_uri - minLength: 1 - format: uri - description: Optional + minLength: 1 + description: Optional + title: kas_name + required: + - kasName + - properties: + kasUri: + type: string title: kas_uri - required: - - kasUri + minLength: 1 + format: uri + description: Optional + title: kas_uri + required: + - kasUri + properties: + publicKeyId: + type: string + title: public_key_id + format: uuid + description: Optional Public Key ID + pagination: + title: pagination + description: Optional + $ref: '#/components/schemas/policy.PageRequest' title: ListPublicKeyMappingRequest additionalProperties: false policy.kasregistry.ListPublicKeyMappingResponse: @@ -1900,44 +1883,40 @@ components: additionalProperties: false policy.kasregistry.ListPublicKeysRequest: type: object - allOf: + oneOf: - properties: - pagination: - title: pagination - description: Optional - $ref: '#/components/schemas/policy.PageRequest' - - oneOf: - - type: object - properties: - kasId: - type: string - title: kas_id - format: uuid - description: Optional + kasId: + type: string title: kas_id - required: - - kasId - - type: object - properties: - kasName: - type: string - title: kas_name - minLength: 1 - description: Optional + format: uuid + description: Optional + title: kas_id + required: + - kasId + - properties: + kasName: + type: string title: kas_name - required: - - kasName - - type: object - properties: - kasUri: - type: string - title: kas_uri - minLength: 1 - format: uri - description: Optional + minLength: 1 + description: Optional + title: kas_name + required: + - kasName + - properties: + kasUri: + type: string title: kas_uri - required: - - kasUri + minLength: 1 + format: uri + description: Optional + title: kas_uri + required: + - kasUri + properties: + pagination: + title: pagination + description: Optional + $ref: '#/components/schemas/policy.PageRequest' title: ListPublicKeysRequest additionalProperties: false policy.kasregistry.ListPublicKeysResponse: @@ -1968,38 +1947,47 @@ components: additionalProperties: false policy.kasregistry.RotateKeyRequest: type: object - allOf: + oneOf: - properties: - newKey: - title: new_key - description: Information about the new key to be rotated in - $ref: '#/components/schemas/policy.kasregistry.RotateKeyRequest.NewKey' - - oneOf: - - type: object - properties: - id: - type: string - title: id - format: uuid - description: Current Active Key UUID + id: + type: string title: id - required: - - id - - type: object - properties: - key: - title: key - description: Alternative way to specify the active key using KAS ID and Key ID - $ref: '#/components/schemas/policy.kasregistry.KasKeyIdentifier' + format: uuid + description: Current Active Key UUID + title: id + required: + - id + - properties: + key: title: key - required: - - key + description: Alternative way to specify the active key using KAS ID and Key ID + $ref: '#/components/schemas/policy.kasregistry.KasKeyIdentifier' + title: key + required: + - key + properties: + newKey: + title: new_key + description: Information about the new key to be rotated in + $ref: '#/components/schemas/policy.kasregistry.RotateKeyRequest.NewKey' title: RotateKeyRequest additionalProperties: false - description: | - private_key_ctx_for_public_key_only // private_key_ctx must not be set if key_mode is KEY_MODE_PUBLIC_KEY_ONLY. - private_key_ctx_optionally_required // For the new key, the wrapped_key is required if key_mode is KEY_MODE_CONFIG_ROOT_KEY or KEY_MODE_PROVIDER_ROOT_KEY. The wrapped_key must be empty if key_mode is KEY_MODE_REMOTE or KEY_MODE_PUBLIC_KEY_ONLY. - provider_config_id_optionally_required // For the new key, provider config id is required if key_mode is KEY_MODE_PROVIDER_ROOT_KEY or KEY_MODE_REMOTE. It must be empty for KEY_MODE_CONFIG_ROOT_KEY and KEY_MODE_PUBLIC_KEY_ONLY. + description: |+ + For the new key, the wrapped_key is required if key_mode is KEY_MODE_CONFIG_ROOT_KEY or KEY_MODE_PROVIDER_ROOT_KEY. The wrapped_key must be empty if key_mode is KEY_MODE_REMOTE or KEY_MODE_PUBLIC_KEY_ONLY.: + ``` + ((this.new_key.key_mode == 1 || this.new_key.key_mode == 2) && this.new_key.private_key_ctx.wrapped_key != '') || ((this.new_key.key_mode == 3 || this.new_key.key_mode == 4) && this.new_key.private_key_ctx.wrapped_key == '') + ``` + + For the new key, provider config id is required if key_mode is KEY_MODE_PROVIDER_ROOT_KEY or KEY_MODE_REMOTE. It must be empty for KEY_MODE_CONFIG_ROOT_KEY and KEY_MODE_PUBLIC_KEY_ONLY.: + ``` + ((this.new_key.key_mode == 1 || this.new_key.key_mode == 4) && this.new_key.provider_config_id == '') || ((this.new_key.key_mode == 2 || this.new_key.key_mode == 3) && this.new_key.provider_config_id != '') + ``` + + private_key_ctx must not be set if key_mode is KEY_MODE_PUBLIC_KEY_ONLY.: + ``` + !(this.new_key.key_mode == 4 && has(this.new_key.private_key_ctx)) + ``` + policy.kasregistry.RotateKeyRequest.NewKey: type: object properties: @@ -2010,15 +1998,23 @@ components: description: Required algorithm: title: algorithm - description: | + description: |+ Required - key_algorithm_defined // The key_algorithm must be one of the defined values. + The key_algorithm must be one of the defined values.: + ``` + this in [1, 2, 3, 4, 5, 6, 7, 8] + ``` + $ref: '#/components/schemas/policy.Algorithm' keyMode: title: key_mode - description: | + description: |+ Required - new_key_mode_defined // The new key_mode must be one of the defined values (1-4). + The new key_mode must be one of the defined values (1-4).: + ``` + this in [1, 2, 3, 4] + ``` + $ref: '#/components/schemas/policy.KeyMode' publicKeyCtx: title: public_key_ctx @@ -2083,8 +2079,7 @@ components: policy.kasregistry.SetBaseKeyRequest: type: object oneOf: - - type: object - properties: + - properties: id: type: string title: id @@ -2093,8 +2088,7 @@ components: title: id required: - id - - type: object - properties: + - properties: key: title: key description: Alternative way to specify the key using KAS ID and Key ID @@ -2120,23 +2114,6 @@ components: $ref: '#/components/schemas/policy.SimpleKasKey' title: SetBaseKeyResponse additionalProperties: false - policy.kasregistry.SortKasKeysType: - type: string - title: SortKasKeysType - enum: - - SORT_KAS_KEYS_TYPE_UNSPECIFIED - - SORT_KAS_KEYS_TYPE_KEY_ID - - SORT_KAS_KEYS_TYPE_CREATED_AT - - SORT_KAS_KEYS_TYPE_UPDATED_AT - policy.kasregistry.SortKeyAccessServersType: - type: string - title: SortKeyAccessServersType - enum: - - SORT_KEY_ACCESS_SERVERS_TYPE_UNSPECIFIED - - SORT_KEY_ACCESS_SERVERS_TYPE_NAME - - SORT_KEY_ACCESS_SERVERS_TYPE_URI - - SORT_KEY_ACCESS_SERVERS_TYPE_CREATED_AT - - SORT_KEY_ACCESS_SERVERS_TYPE_UPDATED_AT policy.kasregistry.UpdateKeyAccessServerRequest: type: object properties: @@ -2148,9 +2125,13 @@ components: uri: type: string title: uri - description: | + description: |+ Optional - optional_uri_format // Optional URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + Optional URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + size(this) == 0 || this.isUri() + ``` + publicKey: title: public_key description: |- @@ -2170,9 +2151,13 @@ components: type: string title: name maxLength: 253 - description: | + description: |+ Optional - kas_name_format // Registered KAS name must be an alphanumeric string, allowing hyphens, and underscores but not as the first or last character. The stored KAS name will be normalized to lower case. + Registered KAS name must be an alphanumeric string, allowing hyphens, and underscores but not as the first or last character. The stored KAS name will be normalized to lower case.: + ``` + size(this) == 0 || this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') + ``` + metadata: title: metadata description: |- @@ -2212,9 +2197,13 @@ components: $ref: '#/components/schemas/common.MetadataUpdateEnum' title: UpdateKeyRequest additionalProperties: false - description: | + description: |+ Update an existing asymmetric key in the Key Management System - metadata_update_behavior // Metadata update behavior must be either APPEND or REPLACE, when updating metadata. + Metadata update behavior must be either APPEND or REPLACE, when updating metadata.: + ``` + ((!has(this.metadata)) || (has(this.metadata) && this.metadata_update_behavior != 0)) + ``` + policy.kasregistry.UpdateKeyResponse: type: object properties: @@ -2252,6 +2241,63 @@ components: $ref: '#/components/schemas/policy.Key' title: UpdatePublicKeyResponse additionalProperties: false + connect-protocol-version: + type: number + title: Connect-Protocol-Version + enum: + - 1 + description: Define the version of the Connect protocol + const: 1 + connect-timeout-header: + type: number + title: Connect-Timeout-Ms + description: Define the timeout, in ms + connect.error: + type: object + properties: + code: + type: string + examples: + - not_found + enum: + - canceled + - unknown + - invalid_argument + - deadline_exceeded + - not_found + - already_exists + - permission_denied + - resource_exhausted + - failed_precondition + - aborted + - out_of_range + - unimplemented + - internal + - unavailable + - data_loss + - unauthenticated + description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. + message: + type: string + description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. + detail: + $ref: '#/components/schemas/google.protobuf.Any' + title: Connect Error + additionalProperties: true + description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' + google.protobuf.Any: + type: object + properties: + type: + type: string + value: + type: string + format: binary + debug: + type: object + additionalProperties: true + additionalProperties: true + description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. security: [] tags: - name: policy.kasregistry.KeyAccessServerRegistryService diff --git a/docs/openapi/policy/keymanagement/key_management.openapi.yaml b/docs/openapi/policy/keymanagement/key_management.openapi.yaml index 94f70d9b92..61a3e433ba 100644 --- a/docs/openapi/policy/keymanagement/key_management.openapi.yaml +++ b/docs/openapi/policy/keymanagement/key_management.openapi.yaml @@ -40,12 +40,12 @@ paths: application/json: schema: $ref: '#/components/schemas/policy.keymanagement.CreateProviderConfigResponse' - /policy.keymanagement.KeyManagementService/DeleteProviderConfig: + /policy.keymanagement.KeyManagementService/GetProviderConfig: post: tags: - policy.keymanagement.KeyManagementService - summary: DeleteProviderConfig - operationId: policy.keymanagement.KeyManagementService.DeleteProviderConfig + summary: GetProviderConfig + operationId: policy.keymanagement.KeyManagementService.GetProviderConfig parameters: - name: Connect-Protocol-Version in: header @@ -60,7 +60,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.keymanagement.DeleteProviderConfigRequest' + $ref: '#/components/schemas/policy.keymanagement.GetProviderConfigRequest' required: true responses: default: @@ -74,13 +74,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.keymanagement.DeleteProviderConfigResponse' - /policy.keymanagement.KeyManagementService/GetProviderConfig: + $ref: '#/components/schemas/policy.keymanagement.GetProviderConfigResponse' + /policy.keymanagement.KeyManagementService/ListProviderConfigs: post: tags: - policy.keymanagement.KeyManagementService - summary: GetProviderConfig - operationId: policy.keymanagement.KeyManagementService.GetProviderConfig + summary: ListProviderConfigs + operationId: policy.keymanagement.KeyManagementService.ListProviderConfigs parameters: - name: Connect-Protocol-Version in: header @@ -95,7 +95,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.keymanagement.GetProviderConfigRequest' + $ref: '#/components/schemas/policy.keymanagement.ListProviderConfigsRequest' required: true responses: default: @@ -109,13 +109,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.keymanagement.GetProviderConfigResponse' - /policy.keymanagement.KeyManagementService/ListProviderConfigs: + $ref: '#/components/schemas/policy.keymanagement.ListProviderConfigsResponse' + /policy.keymanagement.KeyManagementService/UpdateProviderConfig: post: tags: - policy.keymanagement.KeyManagementService - summary: ListProviderConfigs - operationId: policy.keymanagement.KeyManagementService.ListProviderConfigs + summary: UpdateProviderConfig + operationId: policy.keymanagement.KeyManagementService.UpdateProviderConfig parameters: - name: Connect-Protocol-Version in: header @@ -130,7 +130,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.keymanagement.ListProviderConfigsRequest' + $ref: '#/components/schemas/policy.keymanagement.UpdateProviderConfigRequest' required: true responses: default: @@ -144,13 +144,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.keymanagement.ListProviderConfigsResponse' - /policy.keymanagement.KeyManagementService/UpdateProviderConfig: + $ref: '#/components/schemas/policy.keymanagement.UpdateProviderConfigResponse' + /policy.keymanagement.KeyManagementService/DeleteProviderConfig: post: tags: - policy.keymanagement.KeyManagementService - summary: UpdateProviderConfig - operationId: policy.keymanagement.KeyManagementService.UpdateProviderConfig + summary: DeleteProviderConfig + operationId: policy.keymanagement.KeyManagementService.DeleteProviderConfig parameters: - name: Connect-Protocol-Version in: header @@ -165,7 +165,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.keymanagement.UpdateProviderConfigRequest' + $ref: '#/components/schemas/policy.keymanagement.DeleteProviderConfigRequest' required: true responses: default: @@ -179,9 +179,16 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.keymanagement.UpdateProviderConfigResponse' + $ref: '#/components/schemas/policy.keymanagement.DeleteProviderConfigResponse' components: schemas: + common.MetadataUpdateEnum: + type: string + title: MetadataUpdateEnum + enum: + - METADATA_UPDATE_ENUM_UNSPECIFIED + - METADATA_UPDATE_ENUM_EXTEND + - METADATA_UPDATE_ENUM_REPLACE common.Metadata: type: object properties: @@ -237,87 +244,11 @@ components: title: value title: LabelsEntry additionalProperties: false - common.MetadataUpdateEnum: - type: string - title: MetadataUpdateEnum - enum: - - METADATA_UPDATE_ENUM_UNSPECIFIED - - METADATA_UPDATE_ENUM_EXTEND - - METADATA_UPDATE_ENUM_REPLACE - connect-protocol-version: - type: number - title: Connect-Protocol-Version - enum: - - 1 - description: Define the version of the Connect protocol - const: 1 - connect-timeout-header: - type: number - title: Connect-Timeout-Ms - description: Define the timeout, in ms - connect.error: - type: object - properties: - code: - type: string - examples: - - not_found - enum: - - canceled - - unknown - - invalid_argument - - deadline_exceeded - - not_found - - already_exists - - permission_denied - - resource_exhausted - - failed_precondition - - aborted - - out_of_range - - unimplemented - - internal - - unavailable - - data_loss - - unauthenticated - description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. - message: - type: string - description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. - details: - type: array - items: - $ref: '#/components/schemas/connect.error_details.Any' - description: A list of messages that carry the error details. There is no limit on the number of messages. - title: Connect Error - additionalProperties: true - description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' - connect.error_details.Any: - type: object - properties: - type: - type: string - description: 'A URL that acts as a globally unique identifier for the type of the serialized message. For example: `type.googleapis.com/google.rpc.ErrorInfo`. This is used to determine the schema of the data in the `value` field and is the discriminator for the `debug` field.' - value: - type: string - format: binary - description: The Protobuf message, serialized as bytes and base64-encoded. The specific message type is identified by the `type` field. - debug: - oneOf: - - type: object - title: Any - additionalProperties: true - description: Detailed error information. - discriminator: - propertyName: type - title: Debug - description: Deserialized error detail payload. The 'type' field indicates the schema. This field is for easier debugging and should not be relied upon for application logic. - additionalProperties: true - description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message, with an additional debug field for ConnectRPC error details. google.protobuf.Timestamp: type: string examples: - - "2023-01-15T01:30:15.01Z" - - "2024-12-25T12:00:00Z" + - 1s + - 1.000340012s format: date-time description: |- A Timestamp represents a point in time independent of any time zone or local @@ -535,31 +466,28 @@ components: additionalProperties: false policy.keymanagement.GetProviderConfigRequest: type: object - allOf: + oneOf: - properties: - manager: + id: type: string - title: manager - description: Optional - filter by manager type when searching by name - - oneOf: - - type: object - properties: - id: - type: string - title: id - format: uuid title: id - required: - - id - - type: object - properties: - name: - type: string - title: name - minLength: 1 + format: uuid + title: id + required: + - id + - properties: + name: + type: string title: name - required: - - name + minLength: 1 + title: name + required: + - name + properties: + manager: + type: string + title: manager + description: Optional - filter by manager type when searching by name title: GetProviderConfigRequest additionalProperties: false policy.keymanagement.GetProviderConfigResponse: @@ -632,6 +560,63 @@ components: $ref: '#/components/schemas/policy.KeyProviderConfig' title: UpdateProviderConfigResponse additionalProperties: false + connect-protocol-version: + type: number + title: Connect-Protocol-Version + enum: + - 1 + description: Define the version of the Connect protocol + const: 1 + connect-timeout-header: + type: number + title: Connect-Timeout-Ms + description: Define the timeout, in ms + connect.error: + type: object + properties: + code: + type: string + examples: + - not_found + enum: + - canceled + - unknown + - invalid_argument + - deadline_exceeded + - not_found + - already_exists + - permission_denied + - resource_exhausted + - failed_precondition + - aborted + - out_of_range + - unimplemented + - internal + - unavailable + - data_loss + - unauthenticated + description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. + message: + type: string + description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. + detail: + $ref: '#/components/schemas/google.protobuf.Any' + title: Connect Error + additionalProperties: true + description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' + google.protobuf.Any: + type: object + properties: + type: + type: string + value: + type: string + format: binary + debug: + type: object + additionalProperties: true + additionalProperties: true + description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. security: [] tags: - name: policy.keymanagement.KeyManagementService diff --git a/docs/openapi/policy/namespaces/namespaces.openapi.yaml b/docs/openapi/policy/namespaces/namespaces.openapi.yaml index 506217b193..191af3eaf6 100644 --- a/docs/openapi/policy/namespaces/namespaces.openapi.yaml +++ b/docs/openapi/policy/namespaces/namespaces.openapi.yaml @@ -2,13 +2,12 @@ openapi: 3.1.0 info: title: policy.namespaces paths: - /policy.namespaces.NamespaceService/AssignKeyAccessServerToNamespace: + /policy.namespaces.NamespaceService/GetNamespace: post: tags: - policy.namespaces.NamespaceService - summary: AssignKeyAccessServerToNamespace - description: 'Deprecated: utilize AssignPublicKeyToNamespace' - operationId: policy.namespaces.NamespaceService.AssignKeyAccessServerToNamespace + summary: GetNamespace + operationId: policy.namespaces.NamespaceService.GetNamespace parameters: - name: Connect-Protocol-Version in: header @@ -23,7 +22,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.namespaces.AssignKeyAccessServerToNamespaceRequest' + $ref: '#/components/schemas/policy.namespaces.GetNamespaceRequest' required: true responses: default: @@ -37,18 +36,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.namespaces.AssignKeyAccessServerToNamespaceResponse' - deprecated: true - /policy.namespaces.NamespaceService/AssignPublicKeyToNamespace: + $ref: '#/components/schemas/policy.namespaces.GetNamespaceResponse' + /policy.namespaces.NamespaceService/ListNamespaces: post: tags: - policy.namespaces.NamespaceService - summary: AssignPublicKeyToNamespace - description: |- - --------------------------------------* - Namespace <> Key RPCs - --------------------------------------- - operationId: policy.namespaces.NamespaceService.AssignPublicKeyToNamespace + summary: ListNamespaces + operationId: policy.namespaces.NamespaceService.ListNamespaces parameters: - name: Connect-Protocol-Version in: header @@ -63,7 +57,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.namespaces.AssignPublicKeyToNamespaceRequest' + $ref: '#/components/schemas/policy.namespaces.ListNamespacesRequest' required: true responses: default: @@ -77,7 +71,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.namespaces.AssignPublicKeyToNamespaceResponse' + $ref: '#/components/schemas/policy.namespaces.ListNamespacesResponse' /policy.namespaces.NamespaceService/CreateNamespace: post: tags: @@ -113,12 +107,12 @@ paths: application/json: schema: $ref: '#/components/schemas/policy.namespaces.CreateNamespaceResponse' - /policy.namespaces.NamespaceService/DeactivateNamespace: + /policy.namespaces.NamespaceService/UpdateNamespace: post: tags: - policy.namespaces.NamespaceService - summary: DeactivateNamespace - operationId: policy.namespaces.NamespaceService.DeactivateNamespace + summary: UpdateNamespace + operationId: policy.namespaces.NamespaceService.UpdateNamespace parameters: - name: Connect-Protocol-Version in: header @@ -133,7 +127,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.namespaces.DeactivateNamespaceRequest' + $ref: '#/components/schemas/policy.namespaces.UpdateNamespaceRequest' required: true responses: default: @@ -147,13 +141,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.namespaces.DeactivateNamespaceResponse' - /policy.namespaces.NamespaceService/GetNamespace: + $ref: '#/components/schemas/policy.namespaces.UpdateNamespaceResponse' + /policy.namespaces.NamespaceService/DeactivateNamespace: post: tags: - policy.namespaces.NamespaceService - summary: GetNamespace - operationId: policy.namespaces.NamespaceService.GetNamespace + summary: DeactivateNamespace + operationId: policy.namespaces.NamespaceService.DeactivateNamespace parameters: - name: Connect-Protocol-Version in: header @@ -168,7 +162,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.namespaces.GetNamespaceRequest' + $ref: '#/components/schemas/policy.namespaces.DeactivateNamespaceRequest' required: true responses: default: @@ -182,13 +176,14 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.namespaces.GetNamespaceResponse' - /policy.namespaces.NamespaceService/ListNamespaces: + $ref: '#/components/schemas/policy.namespaces.DeactivateNamespaceResponse' + /policy.namespaces.NamespaceService/AssignKeyAccessServerToNamespace: post: tags: - policy.namespaces.NamespaceService - summary: ListNamespaces - operationId: policy.namespaces.NamespaceService.ListNamespaces + summary: AssignKeyAccessServerToNamespace + description: 'Deprecated: utilize AssignPublicKeyToNamespace' + operationId: policy.namespaces.NamespaceService.AssignKeyAccessServerToNamespace parameters: - name: Connect-Protocol-Version in: header @@ -203,7 +198,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.namespaces.ListNamespacesRequest' + $ref: '#/components/schemas/policy.namespaces.AssignKeyAccessServerToNamespaceRequest' required: true responses: default: @@ -217,7 +212,8 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.namespaces.ListNamespacesResponse' + $ref: '#/components/schemas/policy.namespaces.AssignKeyAccessServerToNamespaceResponse' + deprecated: true /policy.namespaces.NamespaceService/RemoveKeyAccessServerFromNamespace: post: tags: @@ -255,12 +251,16 @@ paths: schema: $ref: '#/components/schemas/policy.namespaces.RemoveKeyAccessServerFromNamespaceResponse' deprecated: true - /policy.namespaces.NamespaceService/RemovePublicKeyFromNamespace: + /policy.namespaces.NamespaceService/AssignPublicKeyToNamespace: post: tags: - policy.namespaces.NamespaceService - summary: RemovePublicKeyFromNamespace - operationId: policy.namespaces.NamespaceService.RemovePublicKeyFromNamespace + summary: AssignPublicKeyToNamespace + description: |- + --------------------------------------* + Namespace <> Key RPCs + --------------------------------------- + operationId: policy.namespaces.NamespaceService.AssignPublicKeyToNamespace parameters: - name: Connect-Protocol-Version in: header @@ -275,7 +275,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.namespaces.RemovePublicKeyFromNamespaceRequest' + $ref: '#/components/schemas/policy.namespaces.AssignPublicKeyToNamespaceRequest' required: true responses: default: @@ -289,13 +289,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.namespaces.RemovePublicKeyFromNamespaceResponse' - /policy.namespaces.NamespaceService/UpdateNamespace: + $ref: '#/components/schemas/policy.namespaces.AssignPublicKeyToNamespaceResponse' + /policy.namespaces.NamespaceService/RemovePublicKeyFromNamespace: post: tags: - policy.namespaces.NamespaceService - summary: UpdateNamespace - operationId: policy.namespaces.NamespaceService.UpdateNamespace + summary: RemovePublicKeyFromNamespace + operationId: policy.namespaces.NamespaceService.RemovePublicKeyFromNamespace parameters: - name: Connect-Protocol-Version in: header @@ -310,7 +310,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.namespaces.UpdateNamespaceRequest' + $ref: '#/components/schemas/policy.namespaces.RemovePublicKeyFromNamespaceRequest' required: true responses: default: @@ -324,7 +324,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.namespaces.UpdateNamespaceResponse' + $ref: '#/components/schemas/policy.namespaces.RemovePublicKeyFromNamespaceResponse' components: schemas: common.ActiveStateEnum: @@ -336,6 +336,72 @@ components: - ACTIVE_STATE_ENUM_INACTIVE - ACTIVE_STATE_ENUM_ANY description: 'buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren''t violated when users add new enum values to an enum in a given package' + common.MetadataUpdateEnum: + type: string + title: MetadataUpdateEnum + enum: + - METADATA_UPDATE_ENUM_UNSPECIFIED + - METADATA_UPDATE_ENUM_EXTEND + - METADATA_UPDATE_ENUM_REPLACE + policy.Algorithm: + type: string + title: Algorithm + enum: + - ALGORITHM_UNSPECIFIED + - ALGORITHM_RSA_2048 + - ALGORITHM_RSA_4096 + - ALGORITHM_EC_P256 + - ALGORITHM_EC_P384 + - ALGORITHM_EC_P521 + - ALGORITHM_HPQT_XWING + - ALGORITHM_HPQT_SECP256R1_MLKEM768 + - ALGORITHM_HPQT_SECP384R1_MLKEM1024 + description: Supported key algorithms. + policy.KasPublicKeyAlgEnum: + type: string + title: KasPublicKeyAlgEnum + enum: + - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 + policy.SortDirection: + type: string + title: SortDirection + enum: + - SORT_DIRECTION_UNSPECIFIED + - SORT_DIRECTION_ASC + - SORT_DIRECTION_DESC + description: |- + Sorting direction shared across list APIs. + When the 'sort' field is omitted or the chosen sort 'field' is UNSPECIFIED, + the endpoint's request message defines the default ordering; see the + specific List* request docs. + policy.SourceType: + type: string + title: SourceType + enum: + - SOURCE_TYPE_UNSPECIFIED + - SOURCE_TYPE_INTERNAL + - SOURCE_TYPE_EXTERNAL + description: |- + Describes whether this kas is managed by the organization or if they imported + the kas information from an external party. These two modes are necessary in order + to encrypt a tdf dek with an external parties kas public key. + policy.namespaces.SortNamespacesType: + type: string + title: SortNamespacesType + enum: + - SORT_NAMESPACES_TYPE_UNSPECIFIED + - SORT_NAMESPACES_TYPE_NAME + - SORT_NAMESPACES_TYPE_FQN + - SORT_NAMESPACES_TYPE_CREATED_AT + - SORT_NAMESPACES_TYPE_UPDATED_AT common.Metadata: type: object properties: @@ -391,82 +457,6 @@ components: title: value title: LabelsEntry additionalProperties: false - common.MetadataUpdateEnum: - type: string - title: MetadataUpdateEnum - enum: - - METADATA_UPDATE_ENUM_UNSPECIFIED - - METADATA_UPDATE_ENUM_EXTEND - - METADATA_UPDATE_ENUM_REPLACE - connect-protocol-version: - type: number - title: Connect-Protocol-Version - enum: - - 1 - description: Define the version of the Connect protocol - const: 1 - connect-timeout-header: - type: number - title: Connect-Timeout-Ms - description: Define the timeout, in ms - connect.error: - type: object - properties: - code: - type: string - examples: - - not_found - enum: - - canceled - - unknown - - invalid_argument - - deadline_exceeded - - not_found - - already_exists - - permission_denied - - resource_exhausted - - failed_precondition - - aborted - - out_of_range - - unimplemented - - internal - - unavailable - - data_loss - - unauthenticated - description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. - message: - type: string - description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. - details: - type: array - items: - $ref: '#/components/schemas/connect.error_details.Any' - description: A list of messages that carry the error details. There is no limit on the number of messages. - title: Connect Error - additionalProperties: true - description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' - connect.error_details.Any: - type: object - properties: - type: - type: string - description: 'A URL that acts as a globally unique identifier for the type of the serialized message. For example: `type.googleapis.com/google.rpc.ErrorInfo`. This is used to determine the schema of the data in the `value` field and is the discriminator for the `debug` field.' - value: - type: string - format: binary - description: The Protobuf message, serialized as bytes and base64-encoded. The specific message type is identified by the `type` field. - debug: - oneOf: - - type: object - title: Any - additionalProperties: true - description: Detailed error information. - discriminator: - propertyName: type - title: Debug - description: Deserialized error detail payload. The 'type' field indicates the schema. This field is for easier debugging and should not be relied upon for application logic. - additionalProperties: true - description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message, with an additional debug field for ConnectRPC error details. google.protobuf.BoolValue: type: boolean description: |- @@ -479,8 +469,8 @@ components: google.protobuf.Timestamp: type: string examples: - - "2023-01-15T01:30:15.01Z" - - "2024-12-25T12:00:00Z" + - 1s + - 1.000340012s format: date-time description: |- A Timestamp represents a point in time independent of any time zone or local @@ -572,20 +562,6 @@ components: the Joda Time's [`ISODateTimeFormat.dateTime()`]( http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime() ) to obtain a formatter capable of generating timestamps in this format. - policy.Algorithm: - type: string - title: Algorithm - enum: - - ALGORITHM_UNSPECIFIED - - ALGORITHM_RSA_2048 - - ALGORITHM_RSA_4096 - - ALGORITHM_EC_P256 - - ALGORITHM_EC_P384 - - ALGORITHM_EC_P521 - - ALGORITHM_HPQT_XWING - - ALGORITHM_HPQT_SECP256R1_MLKEM768 - - ALGORITHM_HPQT_SECP384R1_MLKEM1024 - description: Supported key algorithms. policy.KasPublicKey: type: object properties: @@ -604,7 +580,7 @@ components: alg: not: enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - 0 title: alg description: |- A known algorithm type with any additional parameters encoded. @@ -616,19 +592,6 @@ components: description: |- Deprecated A KAS public key and some associated metadata for further identifcation - policy.KasPublicKeyAlgEnum: - type: string - title: KasPublicKeyAlgEnum - enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 policy.KasPublicKeySet: type: object properties: @@ -651,9 +614,13 @@ components: uri: type: string title: uri - description: | + description: |+ Address of a KAS instance - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https?://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(:[0-9]+)?(/.*)?$') + ``` + publicKey: title: public_key description: 'Deprecated: KAS can have multiple key pairs' @@ -763,8 +730,7 @@ components: policy.PublicKey: type: object oneOf: - - type: object - properties: + - properties: cached: title: cached description: public key with additional information. Current preferred version @@ -772,14 +738,17 @@ components: title: cached required: - cached - - type: object - properties: + - properties: remote: type: string title: remote - description: | + description: |+ kas public key url - optional since can also be retrieved via public key - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(/.*)?$') + ``` + title: remote required: - remote @@ -817,29 +786,6 @@ components: title: pem title: SimpleKasPublicKey additionalProperties: false - policy.SortDirection: - type: string - title: SortDirection - enum: - - SORT_DIRECTION_UNSPECIFIED - - SORT_DIRECTION_ASC - - SORT_DIRECTION_DESC - description: |- - Sorting direction shared across list APIs. - When the 'sort' field is omitted or the chosen sort 'field' is UNSPECIFIED, - the endpoint's request message defines the default ordering; see the - specific List* request docs. - policy.SourceType: - type: string - title: SourceType - enum: - - SOURCE_TYPE_UNSPECIFIED - - SOURCE_TYPE_INTERNAL - - SOURCE_TYPE_EXTERNAL - description: |- - Describes whether this kas is managed by the organization or if they imported - the kas information from an external party. These two modes are necessary in order - to encrypt a tdf dek with an external parties kas public key. policy.namespaces.AssignKeyAccessServerToNamespaceRequest: type: object properties: @@ -883,9 +829,13 @@ components: type: string title: name maxLength: 253 - description: | + description: |+ Required - namespace_format // Namespace must be a valid hostname. It should include at least one dot, with each segment (label) starting and ending with an alphanumeric character. Each label must be 1 to 63 characters long, allowing hyphens but not as the first or last character. The top-level domain (the last segment after the final dot) must consist of at least two alphabetic characters. The stored namespace will be normalized to lower case. + Namespace must be a valid hostname. It should include at least one dot, with each segment (label) starting and ending with an alphanumeric character. Each label must be 1 to 63 characters long, allowing hyphens but not as the first or last character. The top-level domain (the last segment after the final dot) must consist of at least two alphabetic characters. The stored namespace will be normalized to lower case.: + ``` + this.matches('^([a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?\\.)+[a-zA-Z]{2,}$') + ``` + metadata: title: metadata description: Optional @@ -918,40 +868,45 @@ components: additionalProperties: false policy.namespaces.GetNamespaceRequest: type: object - allOf: + oneOf: - properties: - id: + fqn: type: string - title: id - format: uuid - description: Deprecated - deprecated: true - - oneOf: - - type: object - properties: - fqn: - type: string - title: fqn - minLength: 1 - format: uri title: fqn - required: - - fqn - - type: object - properties: - namespaceId: - type: string - title: namespace_id - format: uuid - description: 'option (buf.validate.oneof).required = true; // TODO: enable this when we remove the deprecated field' + minLength: 1 + format: uri + title: fqn + required: + - fqn + - properties: + namespaceId: + type: string title: namespace_id - required: - - namespaceId + format: uuid + description: 'option (buf.validate.oneof).required = true; // TODO: enable this when we remove the deprecated field' + title: namespace_id + required: + - namespaceId + properties: + id: + type: string + title: id + format: uuid + description: Deprecated + deprecated: true title: GetNamespaceRequest additionalProperties: false - description: | - exclusive_fields // Either use deprecated 'id' field or one of 'namespace_id' or 'fqn', but not both - required_fields // Either id or one of namespace_id or fqn must be set + description: |+ + Either use deprecated 'id' field or one of 'namespace_id' or 'fqn', but not both: + ``` + !(has(this.id) && (has(this.namespace_id) || has(this.fqn))) + ``` + + Either id or one of namespace_id or fqn must be set: + ``` + has(this.id) || has(this.namespace_id) || has(this.fqn) + ``` + policy.namespaces.GetNamespaceResponse: type: object properties: @@ -1080,15 +1035,6 @@ components: $ref: '#/components/schemas/policy.namespaces.NamespaceKey' title: RemovePublicKeyFromNamespaceResponse additionalProperties: false - policy.namespaces.SortNamespacesType: - type: string - title: SortNamespacesType - enum: - - SORT_NAMESPACES_TYPE_UNSPECIFIED - - SORT_NAMESPACES_TYPE_NAME - - SORT_NAMESPACES_TYPE_FQN - - SORT_NAMESPACES_TYPE_CREATED_AT - - SORT_NAMESPACES_TYPE_UPDATED_AT policy.namespaces.UpdateNamespaceRequest: type: object properties: @@ -1114,6 +1060,63 @@ components: $ref: '#/components/schemas/policy.Namespace' title: UpdateNamespaceResponse additionalProperties: false + connect-protocol-version: + type: number + title: Connect-Protocol-Version + enum: + - 1 + description: Define the version of the Connect protocol + const: 1 + connect-timeout-header: + type: number + title: Connect-Timeout-Ms + description: Define the timeout, in ms + connect.error: + type: object + properties: + code: + type: string + examples: + - not_found + enum: + - canceled + - unknown + - invalid_argument + - deadline_exceeded + - not_found + - already_exists + - permission_denied + - resource_exhausted + - failed_precondition + - aborted + - out_of_range + - unimplemented + - internal + - unavailable + - data_loss + - unauthenticated + description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. + message: + type: string + description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. + detail: + $ref: '#/components/schemas/google.protobuf.Any' + title: Connect Error + additionalProperties: true + description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' + google.protobuf.Any: + type: object + properties: + type: + type: string + value: + type: string + format: binary + debug: + type: object + additionalProperties: true + additionalProperties: true + description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. security: [] tags: - name: policy.namespaces.NamespaceService diff --git a/docs/openapi/policy/objects.openapi.yaml b/docs/openapi/policy/objects.openapi.yaml index b59d9acce7..00630c5163 100644 --- a/docs/openapi/policy/objects.openapi.yaml +++ b/docs/openapi/policy/objects.openapi.yaml @@ -4,6 +4,92 @@ info: paths: {} components: schemas: + policy.Action.StandardAction: + type: string + title: StandardAction + enum: + - STANDARD_ACTION_UNSPECIFIED + - STANDARD_ACTION_DECRYPT + - STANDARD_ACTION_TRANSMIT + policy.Algorithm: + type: string + title: Algorithm + enum: + - ALGORITHM_UNSPECIFIED + - ALGORITHM_RSA_2048 + - ALGORITHM_RSA_4096 + - ALGORITHM_EC_P256 + - ALGORITHM_EC_P384 + - ALGORITHM_EC_P521 + - ALGORITHM_HPQT_XWING + - ALGORITHM_HPQT_SECP256R1_MLKEM768 + - ALGORITHM_HPQT_SECP384R1_MLKEM1024 + description: Supported key algorithms. + policy.AttributeRuleTypeEnum: + type: string + title: AttributeRuleTypeEnum + enum: + - ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED + - ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF + - ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF + - ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY + policy.ConditionBooleanTypeEnum: + type: string + title: ConditionBooleanTypeEnum + enum: + - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED + - CONDITION_BOOLEAN_TYPE_ENUM_AND + - CONDITION_BOOLEAN_TYPE_ENUM_OR + policy.KasPublicKeyAlgEnum: + type: string + title: KasPublicKeyAlgEnum + enum: + - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 + policy.KeyMode: + type: string + title: KeyMode + enum: + - KEY_MODE_UNSPECIFIED + - KEY_MODE_CONFIG_ROOT_KEY + - KEY_MODE_PROVIDER_ROOT_KEY + - KEY_MODE_REMOTE + - KEY_MODE_PUBLIC_KEY_ONLY + description: Describes the management and operational mode of a cryptographic key. + policy.KeyStatus: + type: string + title: KeyStatus + enum: + - KEY_STATUS_UNSPECIFIED + - KEY_STATUS_ACTIVE + - KEY_STATUS_ROTATED + description: The status of the key + policy.SourceType: + type: string + title: SourceType + enum: + - SOURCE_TYPE_UNSPECIFIED + - SOURCE_TYPE_INTERNAL + - SOURCE_TYPE_EXTERNAL + description: |- + Describes whether this kas is managed by the organization or if they imported + the kas information from an external party. These two modes are necessary in order + to encrypt a tdf dek with an external parties kas public key. + policy.SubjectMappingOperatorEnum: + type: string + title: SubjectMappingOperatorEnum + enum: + - SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED + - SUBJECT_MAPPING_OPERATOR_ENUM_IN + - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN + - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS common.Metadata: type: object properties: @@ -48,8 +134,8 @@ components: google.protobuf.Timestamp: type: string examples: - - "2023-01-15T01:30:15.01Z" - - "2024-12-25T12:00:00Z" + - 1s + - 1.000340012s format: date-time description: |- A Timestamp represents a point in time independent of any time zone or local @@ -143,65 +229,41 @@ components: ) to obtain a formatter capable of generating timestamps in this format. policy.Action: type: object - allOf: + oneOf: - properties: - id: - type: string - title: id - description: Generated uuid in database - name: + custom: type: string - title: name - namespace: - title: namespace - description: Namespace context for this action - $ref: '#/components/schemas/policy.Namespace' - metadata: - title: metadata - $ref: '#/components/schemas/common.Metadata' - - oneOf: - - type: object - properties: - custom: - type: string - title: custom - description: Deprecated title: custom - required: - - custom - - type: object - properties: - standard: - title: standard - description: Deprecated - $ref: '#/components/schemas/policy.Action.StandardAction' + description: Deprecated + title: custom + required: + - custom + - properties: + standard: title: standard - required: - - standard + description: Deprecated + $ref: '#/components/schemas/policy.Action.StandardAction' + title: standard + required: + - standard + properties: + id: + type: string + title: id + description: Generated uuid in database + name: + type: string + title: name + namespace: + title: namespace + description: Namespace context for this action + $ref: '#/components/schemas/policy.Namespace' + metadata: + title: metadata + $ref: '#/components/schemas/common.Metadata' title: Action additionalProperties: false description: An action an entity can take - policy.Action.StandardAction: - type: string - title: StandardAction - enum: - - STANDARD_ACTION_UNSPECIFIED - - STANDARD_ACTION_DECRYPT - - STANDARD_ACTION_TRANSMIT - policy.Algorithm: - type: string - title: Algorithm - enum: - - ALGORITHM_UNSPECIFIED - - ALGORITHM_RSA_2048 - - ALGORITHM_RSA_4096 - - ALGORITHM_EC_P256 - - ALGORITHM_EC_P384 - - ALGORITHM_EC_P521 - - ALGORITHM_HPQT_XWING - - ALGORITHM_HPQT_SECP256R1_MLKEM768 - - ALGORITHM_HPQT_SECP384R1_MLKEM1024 - description: Supported key algorithms. policy.AsymmetricKey: type: object properties: @@ -303,14 +365,6 @@ components: required: - rule additionalProperties: false - policy.AttributeRuleTypeEnum: - type: string - title: AttributeRuleTypeEnum - enum: - - ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED - - ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF - - ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF - - ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY policy.Condition: type: object properties: @@ -328,6 +382,7 @@ components: type: array items: type: string + minItems: 1 title: subject_external_values minItems: 1 description: |- @@ -343,13 +398,6 @@ components: * A Condition defines a rule of - policy.ConditionBooleanTypeEnum: - type: string - title: ConditionBooleanTypeEnum - enum: - - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED - - CONDITION_BOOLEAN_TYPE_ENUM_AND - - CONDITION_BOOLEAN_TYPE_ENUM_OR policy.ConditionGroup: type: object properties: @@ -400,7 +448,7 @@ components: alg: not: enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - 0 title: alg description: |- A known algorithm type with any additional parameters encoded. @@ -412,19 +460,6 @@ components: description: |- Deprecated A KAS public key and some associated metadata for further identifcation - policy.KasPublicKeyAlgEnum: - type: string - title: KasPublicKeyAlgEnum - enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 policy.KasPublicKeySet: type: object properties: @@ -472,9 +507,13 @@ components: uri: type: string title: uri - description: | + description: |+ Address of a KAS instance - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https?://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(:[0-9]+)?(/.*)?$') + ``` + publicKey: title: public_key description: 'Deprecated: KAS can have multiple key pairs' @@ -502,16 +541,6 @@ components: title: KeyAccessServer additionalProperties: false description: Key Access Server Registry - policy.KeyMode: - type: string - title: KeyMode - enum: - - KEY_MODE_UNSPECIFIED - - KEY_MODE_CONFIG_ROOT_KEY - - KEY_MODE_PROVIDER_ROOT_KEY - - KEY_MODE_REMOTE - - KEY_MODE_PUBLIC_KEY_ONLY - description: Describes the management and operational mode of a cryptographic key. policy.KeyProviderConfig: type: object properties: @@ -534,14 +563,6 @@ components: $ref: '#/components/schemas/common.Metadata' title: KeyProviderConfig additionalProperties: false - policy.KeyStatus: - type: string - title: KeyStatus - enum: - - KEY_STATUS_UNSPECIFIED - - KEY_STATUS_ACTIVE - - KEY_STATUS_ROTATED - description: The status of the key policy.Namespace: type: object properties: @@ -684,8 +705,7 @@ components: policy.PublicKey: type: object oneOf: - - type: object - properties: + - properties: cached: title: cached description: public key with additional information. Current preferred version @@ -693,14 +713,17 @@ components: title: cached required: - cached - - type: object - properties: + - properties: remote: type: string title: remote - description: | + description: |+ kas public key url - optional since can also be retrieved via public key - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(/.*)?$') + ``` + title: remote required: - remote @@ -892,17 +915,6 @@ components: title: pem title: SimpleKasPublicKey additionalProperties: false - policy.SourceType: - type: string - title: SourceType - enum: - - SOURCE_TYPE_UNSPECIFIED - - SOURCE_TYPE_INTERNAL - - SOURCE_TYPE_EXTERNAL - description: |- - Describes whether this kas is managed by the organization or if they imported - the kas information from an external party. These two modes are necessary in order - to encrypt a tdf dek with an external parties kas public key. policy.SubjectConditionSet: type: object properties: @@ -968,14 +980,6 @@ components: description: |- Subject Mapping: A Policy assigning Subject Set(s) to a permitted attribute value + action(s) combination - policy.SubjectMappingOperatorEnum: - type: string - title: SubjectMappingOperatorEnum - enum: - - SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED - - SUBJECT_MAPPING_OPERATOR_ENUM_IN - - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN - - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS policy.SubjectProperty: type: object properties: diff --git a/docs/openapi/policy/obligations/obligations.openapi.yaml b/docs/openapi/policy/obligations/obligations.openapi.yaml index 439d3ba240..b914d00dbc 100644 --- a/docs/openapi/policy/obligations/obligations.openapi.yaml +++ b/docs/openapi/policy/obligations/obligations.openapi.yaml @@ -2,12 +2,12 @@ openapi: 3.1.0 info: title: policy.obligations paths: - /policy.obligations.Service/AddObligationTrigger: + /policy.obligations.Service/ListObligations: post: tags: - policy.obligations.Service - summary: AddObligationTrigger - operationId: policy.obligations.Service.AddObligationTrigger + summary: ListObligations + operationId: policy.obligations.Service.ListObligations parameters: - name: Connect-Protocol-Version in: header @@ -22,7 +22,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.AddObligationTriggerRequest' + $ref: '#/components/schemas/policy.obligations.ListObligationsRequest' required: true responses: default: @@ -36,13 +36,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.AddObligationTriggerResponse' - /policy.obligations.Service/CreateObligation: + $ref: '#/components/schemas/policy.obligations.ListObligationsResponse' + /policy.obligations.Service/GetObligation: post: tags: - policy.obligations.Service - summary: CreateObligation - operationId: policy.obligations.Service.CreateObligation + summary: GetObligation + operationId: policy.obligations.Service.GetObligation parameters: - name: Connect-Protocol-Version in: header @@ -57,7 +57,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.CreateObligationRequest' + $ref: '#/components/schemas/policy.obligations.GetObligationRequest' required: true responses: default: @@ -71,13 +71,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.CreateObligationResponse' - /policy.obligations.Service/CreateObligationValue: + $ref: '#/components/schemas/policy.obligations.GetObligationResponse' + /policy.obligations.Service/GetObligationsByFQNs: post: tags: - policy.obligations.Service - summary: CreateObligationValue - operationId: policy.obligations.Service.CreateObligationValue + summary: GetObligationsByFQNs + operationId: policy.obligations.Service.GetObligationsByFQNs parameters: - name: Connect-Protocol-Version in: header @@ -92,7 +92,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.CreateObligationValueRequest' + $ref: '#/components/schemas/policy.obligations.GetObligationsByFQNsRequest' required: true responses: default: @@ -106,13 +106,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.CreateObligationValueResponse' - /policy.obligations.Service/DeleteObligation: + $ref: '#/components/schemas/policy.obligations.GetObligationsByFQNsResponse' + /policy.obligations.Service/CreateObligation: post: tags: - policy.obligations.Service - summary: DeleteObligation - operationId: policy.obligations.Service.DeleteObligation + summary: CreateObligation + operationId: policy.obligations.Service.CreateObligation parameters: - name: Connect-Protocol-Version in: header @@ -127,7 +127,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.DeleteObligationRequest' + $ref: '#/components/schemas/policy.obligations.CreateObligationRequest' required: true responses: default: @@ -141,13 +141,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.DeleteObligationResponse' - /policy.obligations.Service/DeleteObligationValue: + $ref: '#/components/schemas/policy.obligations.CreateObligationResponse' + /policy.obligations.Service/UpdateObligation: post: tags: - policy.obligations.Service - summary: DeleteObligationValue - operationId: policy.obligations.Service.DeleteObligationValue + summary: UpdateObligation + operationId: policy.obligations.Service.UpdateObligation parameters: - name: Connect-Protocol-Version in: header @@ -162,7 +162,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.DeleteObligationValueRequest' + $ref: '#/components/schemas/policy.obligations.UpdateObligationRequest' required: true responses: default: @@ -176,13 +176,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.DeleteObligationValueResponse' - /policy.obligations.Service/GetObligation: + $ref: '#/components/schemas/policy.obligations.UpdateObligationResponse' + /policy.obligations.Service/DeleteObligation: post: tags: - policy.obligations.Service - summary: GetObligation - operationId: policy.obligations.Service.GetObligation + summary: DeleteObligation + operationId: policy.obligations.Service.DeleteObligation parameters: - name: Connect-Protocol-Version in: header @@ -197,7 +197,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.GetObligationRequest' + $ref: '#/components/schemas/policy.obligations.DeleteObligationRequest' required: true responses: default: @@ -211,13 +211,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.GetObligationResponse' - /policy.obligations.Service/GetObligationTrigger: + $ref: '#/components/schemas/policy.obligations.DeleteObligationResponse' + /policy.obligations.Service/GetObligationValue: post: tags: - policy.obligations.Service - summary: GetObligationTrigger - operationId: policy.obligations.Service.GetObligationTrigger + summary: GetObligationValue + operationId: policy.obligations.Service.GetObligationValue parameters: - name: Connect-Protocol-Version in: header @@ -232,7 +232,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.GetObligationTriggerRequest' + $ref: '#/components/schemas/policy.obligations.GetObligationValueRequest' required: true responses: default: @@ -246,13 +246,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.GetObligationTriggerResponse' - /policy.obligations.Service/GetObligationValue: + $ref: '#/components/schemas/policy.obligations.GetObligationValueResponse' + /policy.obligations.Service/GetObligationValuesByFQNs: post: tags: - policy.obligations.Service - summary: GetObligationValue - operationId: policy.obligations.Service.GetObligationValue + summary: GetObligationValuesByFQNs + operationId: policy.obligations.Service.GetObligationValuesByFQNs parameters: - name: Connect-Protocol-Version in: header @@ -267,7 +267,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.GetObligationValueRequest' + $ref: '#/components/schemas/policy.obligations.GetObligationValuesByFQNsRequest' required: true responses: default: @@ -281,13 +281,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.GetObligationValueResponse' - /policy.obligations.Service/GetObligationValuesByFQNs: + $ref: '#/components/schemas/policy.obligations.GetObligationValuesByFQNsResponse' + /policy.obligations.Service/CreateObligationValue: post: tags: - policy.obligations.Service - summary: GetObligationValuesByFQNs - operationId: policy.obligations.Service.GetObligationValuesByFQNs + summary: CreateObligationValue + operationId: policy.obligations.Service.CreateObligationValue parameters: - name: Connect-Protocol-Version in: header @@ -302,7 +302,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.GetObligationValuesByFQNsRequest' + $ref: '#/components/schemas/policy.obligations.CreateObligationValueRequest' required: true responses: default: @@ -316,13 +316,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.GetObligationValuesByFQNsResponse' - /policy.obligations.Service/GetObligationsByFQNs: + $ref: '#/components/schemas/policy.obligations.CreateObligationValueResponse' + /policy.obligations.Service/UpdateObligationValue: post: tags: - policy.obligations.Service - summary: GetObligationsByFQNs - operationId: policy.obligations.Service.GetObligationsByFQNs + summary: UpdateObligationValue + operationId: policy.obligations.Service.UpdateObligationValue parameters: - name: Connect-Protocol-Version in: header @@ -337,7 +337,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.GetObligationsByFQNsRequest' + $ref: '#/components/schemas/policy.obligations.UpdateObligationValueRequest' required: true responses: default: @@ -351,13 +351,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.GetObligationsByFQNsResponse' - /policy.obligations.Service/ListObligationTriggers: + $ref: '#/components/schemas/policy.obligations.UpdateObligationValueResponse' + /policy.obligations.Service/DeleteObligationValue: post: tags: - policy.obligations.Service - summary: ListObligationTriggers - operationId: policy.obligations.Service.ListObligationTriggers + summary: DeleteObligationValue + operationId: policy.obligations.Service.DeleteObligationValue parameters: - name: Connect-Protocol-Version in: header @@ -372,7 +372,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.ListObligationTriggersRequest' + $ref: '#/components/schemas/policy.obligations.DeleteObligationValueRequest' required: true responses: default: @@ -386,13 +386,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.ListObligationTriggersResponse' - /policy.obligations.Service/ListObligations: + $ref: '#/components/schemas/policy.obligations.DeleteObligationValueResponse' + /policy.obligations.Service/GetObligationTrigger: post: tags: - policy.obligations.Service - summary: ListObligations - operationId: policy.obligations.Service.ListObligations + summary: GetObligationTrigger + operationId: policy.obligations.Service.GetObligationTrigger parameters: - name: Connect-Protocol-Version in: header @@ -407,7 +407,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.ListObligationsRequest' + $ref: '#/components/schemas/policy.obligations.GetObligationTriggerRequest' required: true responses: default: @@ -421,13 +421,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.ListObligationsResponse' - /policy.obligations.Service/RemoveObligationTrigger: + $ref: '#/components/schemas/policy.obligations.GetObligationTriggerResponse' + /policy.obligations.Service/AddObligationTrigger: post: tags: - policy.obligations.Service - summary: RemoveObligationTrigger - operationId: policy.obligations.Service.RemoveObligationTrigger + summary: AddObligationTrigger + operationId: policy.obligations.Service.AddObligationTrigger parameters: - name: Connect-Protocol-Version in: header @@ -442,7 +442,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.RemoveObligationTriggerRequest' + $ref: '#/components/schemas/policy.obligations.AddObligationTriggerRequest' required: true responses: default: @@ -456,13 +456,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.RemoveObligationTriggerResponse' - /policy.obligations.Service/UpdateObligation: + $ref: '#/components/schemas/policy.obligations.AddObligationTriggerResponse' + /policy.obligations.Service/RemoveObligationTrigger: post: tags: - policy.obligations.Service - summary: UpdateObligation - operationId: policy.obligations.Service.UpdateObligation + summary: RemoveObligationTrigger + operationId: policy.obligations.Service.RemoveObligationTrigger parameters: - name: Connect-Protocol-Version in: header @@ -477,7 +477,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.UpdateObligationRequest' + $ref: '#/components/schemas/policy.obligations.RemoveObligationTriggerRequest' required: true responses: default: @@ -491,13 +491,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.UpdateObligationResponse' - /policy.obligations.Service/UpdateObligationValue: + $ref: '#/components/schemas/policy.obligations.RemoveObligationTriggerResponse' + /policy.obligations.Service/ListObligationTriggers: post: tags: - policy.obligations.Service - summary: UpdateObligationValue - operationId: policy.obligations.Service.UpdateObligationValue + summary: ListObligationTriggers + operationId: policy.obligations.Service.ListObligationTriggers parameters: - name: Connect-Protocol-Version in: header @@ -512,7 +512,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.UpdateObligationValueRequest' + $ref: '#/components/schemas/policy.obligations.ListObligationTriggersRequest' required: true responses: default: @@ -526,17 +526,107 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.obligations.UpdateObligationValueResponse' + $ref: '#/components/schemas/policy.obligations.ListObligationTriggersResponse' components: schemas: + common.MetadataUpdateEnum: + type: string + title: MetadataUpdateEnum + enum: + - METADATA_UPDATE_ENUM_UNSPECIFIED + - METADATA_UPDATE_ENUM_EXTEND + - METADATA_UPDATE_ENUM_REPLACE + policy.Action.StandardAction: + type: string + title: StandardAction + enum: + - STANDARD_ACTION_UNSPECIFIED + - STANDARD_ACTION_DECRYPT + - STANDARD_ACTION_TRANSMIT + policy.Algorithm: + type: string + title: Algorithm + enum: + - ALGORITHM_UNSPECIFIED + - ALGORITHM_RSA_2048 + - ALGORITHM_RSA_4096 + - ALGORITHM_EC_P256 + - ALGORITHM_EC_P384 + - ALGORITHM_EC_P521 + - ALGORITHM_HPQT_XWING + - ALGORITHM_HPQT_SECP256R1_MLKEM768 + - ALGORITHM_HPQT_SECP384R1_MLKEM1024 + description: Supported key algorithms. + policy.AttributeRuleTypeEnum: + type: string + title: AttributeRuleTypeEnum + enum: + - ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED + - ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF + - ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF + - ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY + policy.ConditionBooleanTypeEnum: + type: string + title: ConditionBooleanTypeEnum + enum: + - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED + - CONDITION_BOOLEAN_TYPE_ENUM_AND + - CONDITION_BOOLEAN_TYPE_ENUM_OR + policy.KasPublicKeyAlgEnum: + type: string + title: KasPublicKeyAlgEnum + enum: + - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 + policy.SortDirection: + type: string + title: SortDirection + enum: + - SORT_DIRECTION_UNSPECIFIED + - SORT_DIRECTION_ASC + - SORT_DIRECTION_DESC + description: |- + Sorting direction shared across list APIs. + When the 'sort' field is omitted or the chosen sort 'field' is UNSPECIFIED, + the endpoint's request message defines the default ordering; see the + specific List* request docs. + policy.SourceType: + type: string + title: SourceType + enum: + - SOURCE_TYPE_UNSPECIFIED + - SOURCE_TYPE_INTERNAL + - SOURCE_TYPE_EXTERNAL + description: |- + Describes whether this kas is managed by the organization or if they imported + the kas information from an external party. These two modes are necessary in order + to encrypt a tdf dek with an external parties kas public key. + policy.SubjectMappingOperatorEnum: + type: string + title: SubjectMappingOperatorEnum + enum: + - SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED + - SUBJECT_MAPPING_OPERATOR_ENUM_IN + - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN + - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS + policy.obligations.SortObligationsType: + type: string + title: SortObligationsType + enum: + - SORT_OBLIGATIONS_TYPE_UNSPECIFIED + - SORT_OBLIGATIONS_TYPE_NAME + - SORT_OBLIGATIONS_TYPE_FQN + - SORT_OBLIGATIONS_TYPE_CREATED_AT + - SORT_OBLIGATIONS_TYPE_UPDATED_AT common.IdFqnIdentifier: type: object - allOf: - - oneOf: - - required: - - id - - required: - - fqn properties: id: type: string @@ -551,12 +641,6 @@ components: additionalProperties: false common.IdNameIdentifier: type: object - allOf: - - oneOf: - - required: - - id - - required: - - name properties: id: type: string @@ -567,8 +651,12 @@ components: title: name maxLength: 253 minLength: 1 - description: | - name_format // Name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored name will be normalized to lower case. + description: |+ + Name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored name will be normalized to lower case.: + ``` + this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') + ``` + title: IdNameIdentifier additionalProperties: false common.Metadata: @@ -626,82 +714,6 @@ components: title: value title: LabelsEntry additionalProperties: false - common.MetadataUpdateEnum: - type: string - title: MetadataUpdateEnum - enum: - - METADATA_UPDATE_ENUM_UNSPECIFIED - - METADATA_UPDATE_ENUM_EXTEND - - METADATA_UPDATE_ENUM_REPLACE - connect-protocol-version: - type: number - title: Connect-Protocol-Version - enum: - - 1 - description: Define the version of the Connect protocol - const: 1 - connect-timeout-header: - type: number - title: Connect-Timeout-Ms - description: Define the timeout, in ms - connect.error: - type: object - properties: - code: - type: string - examples: - - not_found - enum: - - canceled - - unknown - - invalid_argument - - deadline_exceeded - - not_found - - already_exists - - permission_denied - - resource_exhausted - - failed_precondition - - aborted - - out_of_range - - unimplemented - - internal - - unavailable - - data_loss - - unauthenticated - description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. - message: - type: string - description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. - details: - type: array - items: - $ref: '#/components/schemas/connect.error_details.Any' - description: A list of messages that carry the error details. There is no limit on the number of messages. - title: Connect Error - additionalProperties: true - description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' - connect.error_details.Any: - type: object - properties: - type: - type: string - description: 'A URL that acts as a globally unique identifier for the type of the serialized message. For example: `type.googleapis.com/google.rpc.ErrorInfo`. This is used to determine the schema of the data in the `value` field and is the discriminator for the `debug` field.' - value: - type: string - format: binary - description: The Protobuf message, serialized as bytes and base64-encoded. The specific message type is identified by the `type` field. - debug: - oneOf: - - type: object - title: Any - additionalProperties: true - description: Detailed error information. - discriminator: - propertyName: type - title: Debug - description: Deserialized error detail payload. The 'type' field indicates the schema. This field is for easier debugging and should not be relied upon for application logic. - additionalProperties: true - description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message, with an additional debug field for ConnectRPC error details. google.protobuf.BoolValue: type: boolean description: |- @@ -714,8 +726,8 @@ components: google.protobuf.Timestamp: type: string examples: - - "2023-01-15T01:30:15.01Z" - - "2024-12-25T12:00:00Z" + - 1s + - 1.000340012s format: date-time description: |- A Timestamp represents a point in time independent of any time zone or local @@ -809,65 +821,41 @@ components: ) to obtain a formatter capable of generating timestamps in this format. policy.Action: type: object - allOf: + oneOf: - properties: - id: - type: string - title: id - description: Generated uuid in database - name: + custom: type: string - title: name - namespace: - title: namespace - description: Namespace context for this action - $ref: '#/components/schemas/policy.Namespace' - metadata: - title: metadata - $ref: '#/components/schemas/common.Metadata' - - oneOf: - - type: object - properties: - custom: - type: string - title: custom - description: Deprecated title: custom - required: - - custom - - type: object - properties: - standard: - title: standard - description: Deprecated - $ref: '#/components/schemas/policy.Action.StandardAction' + description: Deprecated + title: custom + required: + - custom + - properties: + standard: title: standard - required: - - standard + description: Deprecated + $ref: '#/components/schemas/policy.Action.StandardAction' + title: standard + required: + - standard + properties: + id: + type: string + title: id + description: Generated uuid in database + name: + type: string + title: name + namespace: + title: namespace + description: Namespace context for this action + $ref: '#/components/schemas/policy.Namespace' + metadata: + title: metadata + $ref: '#/components/schemas/common.Metadata' title: Action additionalProperties: false description: An action an entity can take - policy.Action.StandardAction: - type: string - title: StandardAction - enum: - - STANDARD_ACTION_UNSPECIFIED - - STANDARD_ACTION_DECRYPT - - STANDARD_ACTION_TRANSMIT - policy.Algorithm: - type: string - title: Algorithm - enum: - - ALGORITHM_UNSPECIFIED - - ALGORITHM_RSA_2048 - - ALGORITHM_RSA_4096 - - ALGORITHM_EC_P256 - - ALGORITHM_EC_P384 - - ALGORITHM_EC_P521 - - ALGORITHM_HPQT_XWING - - ALGORITHM_HPQT_SECP256R1_MLKEM768 - - ALGORITHM_HPQT_SECP384R1_MLKEM1024 - description: Supported key algorithms. policy.Attribute: type: object properties: @@ -924,14 +912,6 @@ components: required: - rule additionalProperties: false - policy.AttributeRuleTypeEnum: - type: string - title: AttributeRuleTypeEnum - enum: - - ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED - - ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF - - ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF - - ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY policy.Condition: type: object properties: @@ -949,6 +929,7 @@ components: type: array items: type: string + minItems: 1 title: subject_external_values minItems: 1 description: |- @@ -964,13 +945,6 @@ components: * A Condition defines a rule of - policy.ConditionBooleanTypeEnum: - type: string - title: ConditionBooleanTypeEnum - enum: - - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED - - CONDITION_BOOLEAN_TYPE_ENUM_AND - - CONDITION_BOOLEAN_TYPE_ENUM_OR policy.ConditionGroup: type: object properties: @@ -1007,7 +981,7 @@ components: alg: not: enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - 0 title: alg description: |- A known algorithm type with any additional parameters encoded. @@ -1019,19 +993,6 @@ components: description: |- Deprecated A KAS public key and some associated metadata for further identifcation - policy.KasPublicKeyAlgEnum: - type: string - title: KasPublicKeyAlgEnum - enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 policy.KasPublicKeySet: type: object properties: @@ -1054,9 +1015,13 @@ components: uri: type: string title: uri - description: | + description: |+ Address of a KAS instance - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https?://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(:[0-9]+)?(/.*)?$') + ``` + publicKey: title: public_key description: 'Deprecated: KAS can have multiple key pairs' @@ -1254,8 +1219,7 @@ components: policy.PublicKey: type: object oneOf: - - type: object - properties: + - properties: cached: title: cached description: public key with additional information. Current preferred version @@ -1263,14 +1227,17 @@ components: title: cached required: - cached - - type: object - properties: + - properties: remote: type: string title: remote - description: | + description: |+ kas public key url - optional since can also be retrieved via public key - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(/.*)?$') + ``` + title: remote required: - remote @@ -1385,29 +1352,6 @@ components: title: pem title: SimpleKasPublicKey additionalProperties: false - policy.SortDirection: - type: string - title: SortDirection - enum: - - SORT_DIRECTION_UNSPECIFIED - - SORT_DIRECTION_ASC - - SORT_DIRECTION_DESC - description: |- - Sorting direction shared across list APIs. - When the 'sort' field is omitted or the chosen sort 'field' is UNSPECIFIED, - the endpoint's request message defines the default ordering; see the - specific List* request docs. - policy.SourceType: - type: string - title: SourceType - enum: - - SOURCE_TYPE_UNSPECIFIED - - SOURCE_TYPE_INTERNAL - - SOURCE_TYPE_EXTERNAL - description: |- - Describes whether this kas is managed by the organization or if they imported - the kas information from an external party. These two modes are necessary in order - to encrypt a tdf dek with an external parties kas public key. policy.SubjectConditionSet: type: object properties: @@ -1473,14 +1417,6 @@ components: description: |- Subject Mapping: A Policy assigning Subject Set(s) to a permitted attribute value + action(s) combination - policy.SubjectMappingOperatorEnum: - type: string - title: SubjectMappingOperatorEnum - enum: - - SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED - - SUBJECT_MAPPING_OPERATOR_ENUM_IN - - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN - - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS policy.SubjectSet: type: object properties: @@ -1594,12 +1530,6 @@ components: additionalProperties: false policy.obligations.CreateObligationRequest: type: object - allOf: - - oneOf: - - required: - - namespaceId - - required: - - namespaceFqn properties: namespaceId: type: string @@ -1614,14 +1544,19 @@ components: type: string title: name maxLength: 253 - description: | - obligation_name_format // Obligation name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored name will be normalized to lower case. + description: |+ + Obligation name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored name will be normalized to lower case.: + ``` + this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') + ``` + values: type: array items: type: string maxLength: 253 pattern: ^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$ + uniqueItems: true title: values uniqueItems: true description: Optional @@ -1645,12 +1580,6 @@ components: additionalProperties: false policy.obligations.CreateObligationValueRequest: type: object - allOf: - - oneOf: - - required: - - obligationId - - required: - - obligationFqn properties: obligationId: type: string @@ -1665,8 +1594,12 @@ components: type: string title: value maxLength: 253 - description: | - obligation_value_format // Obligation value must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored value will be normalized to lower case. + description: |+ + Obligation value must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored value will be normalized to lower case.: + ``` + this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') + ``` + triggers: type: array items: @@ -1695,12 +1628,6 @@ components: additionalProperties: false policy.obligations.DeleteObligationRequest: type: object - allOf: - - oneOf: - - required: - - id - - required: - - fqn properties: id: type: string @@ -1723,12 +1650,6 @@ components: additionalProperties: false policy.obligations.DeleteObligationValueRequest: type: object - allOf: - - oneOf: - - required: - - id - - required: - - fqn properties: id: type: string @@ -1751,12 +1672,6 @@ components: additionalProperties: false policy.obligations.GetObligationRequest: type: object - allOf: - - oneOf: - - required: - - id - - required: - - fqn properties: id: type: string @@ -1798,12 +1713,6 @@ components: additionalProperties: false policy.obligations.GetObligationValueRequest: type: object - allOf: - - oneOf: - - required: - - id - - required: - - fqn properties: id: type: string @@ -1834,6 +1743,9 @@ components: type: string minLength: 1 format: uri + maxItems: 250 + minItems: 1 + uniqueItems: true title: fqns maxItems: 250 minItems: 1 @@ -1871,6 +1783,9 @@ components: type: string minLength: 1 format: uri + maxItems: 250 + minItems: 1 + uniqueItems: true title: fqns maxItems: 250 minItems: 1 @@ -2002,15 +1917,6 @@ components: $ref: '#/components/schemas/policy.ObligationTrigger' title: RemoveObligationTriggerResponse additionalProperties: false - policy.obligations.SortObligationsType: - type: string - title: SortObligationsType - enum: - - SORT_OBLIGATIONS_TYPE_UNSPECIFIED - - SORT_OBLIGATIONS_TYPE_NAME - - SORT_OBLIGATIONS_TYPE_FQN - - SORT_OBLIGATIONS_TYPE_CREATED_AT - - SORT_OBLIGATIONS_TYPE_UPDATED_AT policy.obligations.UpdateObligationRequest: type: object properties: @@ -2023,9 +1929,13 @@ components: type: string title: name maxLength: 253 - description: | + description: |+ Optional - obligation_name_format // Obligation name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored name will be normalized to lower case. + Obligation name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored name will be normalized to lower case.: + ``` + size(this) > 0 ? this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') : true + ``` + metadata: title: metadata $ref: '#/components/schemas/common.MetadataMutable' @@ -2054,9 +1964,13 @@ components: type: string title: value maxLength: 253 - description: | + description: |+ Optional - obligation_value_format // Obligation value must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored value will be normalized to lower case. + Obligation value must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored value will be normalized to lower case.: + ``` + size(this) > 0 ? this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') : true + ``` + triggers: type: array items: @@ -2104,6 +2018,63 @@ components: - action - attributeValue additionalProperties: false + connect-protocol-version: + type: number + title: Connect-Protocol-Version + enum: + - 1 + description: Define the version of the Connect protocol + const: 1 + connect-timeout-header: + type: number + title: Connect-Timeout-Ms + description: Define the timeout, in ms + connect.error: + type: object + properties: + code: + type: string + examples: + - not_found + enum: + - canceled + - unknown + - invalid_argument + - deadline_exceeded + - not_found + - already_exists + - permission_denied + - resource_exhausted + - failed_precondition + - aborted + - out_of_range + - unimplemented + - internal + - unavailable + - data_loss + - unauthenticated + description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. + message: + type: string + description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. + detail: + $ref: '#/components/schemas/google.protobuf.Any' + title: Connect Error + additionalProperties: true + description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' + google.protobuf.Any: + type: object + properties: + type: + type: string + value: + type: string + format: binary + debug: + type: object + additionalProperties: true + additionalProperties: true + description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. security: [] tags: - name: policy.obligations.Service diff --git a/docs/openapi/policy/registeredresources/registered_resources.openapi.yaml b/docs/openapi/policy/registeredresources/registered_resources.openapi.yaml index ad27e4cc0e..0d1cc8d733 100644 --- a/docs/openapi/policy/registeredresources/registered_resources.openapi.yaml +++ b/docs/openapi/policy/registeredresources/registered_resources.openapi.yaml @@ -37,12 +37,12 @@ paths: application/json: schema: $ref: '#/components/schemas/policy.registeredresources.CreateRegisteredResourceResponse' - /policy.registeredresources.RegisteredResourcesService/CreateRegisteredResourceValue: + /policy.registeredresources.RegisteredResourcesService/GetRegisteredResource: post: tags: - policy.registeredresources.RegisteredResourcesService - summary: CreateRegisteredResourceValue - operationId: policy.registeredresources.RegisteredResourcesService.CreateRegisteredResourceValue + summary: GetRegisteredResource + operationId: policy.registeredresources.RegisteredResourcesService.GetRegisteredResource parameters: - name: Connect-Protocol-Version in: header @@ -57,7 +57,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.CreateRegisteredResourceValueRequest' + $ref: '#/components/schemas/policy.registeredresources.GetRegisteredResourceRequest' required: true responses: default: @@ -71,13 +71,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.CreateRegisteredResourceValueResponse' - /policy.registeredresources.RegisteredResourcesService/DeleteRegisteredResource: + $ref: '#/components/schemas/policy.registeredresources.GetRegisteredResourceResponse' + /policy.registeredresources.RegisteredResourcesService/ListRegisteredResources: post: tags: - policy.registeredresources.RegisteredResourcesService - summary: DeleteRegisteredResource - operationId: policy.registeredresources.RegisteredResourcesService.DeleteRegisteredResource + summary: ListRegisteredResources + operationId: policy.registeredresources.RegisteredResourcesService.ListRegisteredResources parameters: - name: Connect-Protocol-Version in: header @@ -92,7 +92,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.DeleteRegisteredResourceRequest' + $ref: '#/components/schemas/policy.registeredresources.ListRegisteredResourcesRequest' required: true responses: default: @@ -106,13 +106,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.DeleteRegisteredResourceResponse' - /policy.registeredresources.RegisteredResourcesService/DeleteRegisteredResourceValue: + $ref: '#/components/schemas/policy.registeredresources.ListRegisteredResourcesResponse' + /policy.registeredresources.RegisteredResourcesService/UpdateRegisteredResource: post: tags: - policy.registeredresources.RegisteredResourcesService - summary: DeleteRegisteredResourceValue - operationId: policy.registeredresources.RegisteredResourcesService.DeleteRegisteredResourceValue + summary: UpdateRegisteredResource + operationId: policy.registeredresources.RegisteredResourcesService.UpdateRegisteredResource parameters: - name: Connect-Protocol-Version in: header @@ -127,7 +127,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.DeleteRegisteredResourceValueRequest' + $ref: '#/components/schemas/policy.registeredresources.UpdateRegisteredResourceRequest' required: true responses: default: @@ -141,13 +141,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.DeleteRegisteredResourceValueResponse' - /policy.registeredresources.RegisteredResourcesService/GetRegisteredResource: + $ref: '#/components/schemas/policy.registeredresources.UpdateRegisteredResourceResponse' + /policy.registeredresources.RegisteredResourcesService/DeleteRegisteredResource: post: tags: - policy.registeredresources.RegisteredResourcesService - summary: GetRegisteredResource - operationId: policy.registeredresources.RegisteredResourcesService.GetRegisteredResource + summary: DeleteRegisteredResource + operationId: policy.registeredresources.RegisteredResourcesService.DeleteRegisteredResource parameters: - name: Connect-Protocol-Version in: header @@ -162,7 +162,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.GetRegisteredResourceRequest' + $ref: '#/components/schemas/policy.registeredresources.DeleteRegisteredResourceRequest' required: true responses: default: @@ -176,13 +176,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.GetRegisteredResourceResponse' - /policy.registeredresources.RegisteredResourcesService/GetRegisteredResourceValue: + $ref: '#/components/schemas/policy.registeredresources.DeleteRegisteredResourceResponse' + /policy.registeredresources.RegisteredResourcesService/CreateRegisteredResourceValue: post: tags: - policy.registeredresources.RegisteredResourcesService - summary: GetRegisteredResourceValue - operationId: policy.registeredresources.RegisteredResourcesService.GetRegisteredResourceValue + summary: CreateRegisteredResourceValue + operationId: policy.registeredresources.RegisteredResourcesService.CreateRegisteredResourceValue parameters: - name: Connect-Protocol-Version in: header @@ -197,7 +197,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.GetRegisteredResourceValueRequest' + $ref: '#/components/schemas/policy.registeredresources.CreateRegisteredResourceValueRequest' required: true responses: default: @@ -211,13 +211,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.GetRegisteredResourceValueResponse' - /policy.registeredresources.RegisteredResourcesService/GetRegisteredResourceValuesByFQNs: + $ref: '#/components/schemas/policy.registeredresources.CreateRegisteredResourceValueResponse' + /policy.registeredresources.RegisteredResourcesService/GetRegisteredResourceValue: post: tags: - policy.registeredresources.RegisteredResourcesService - summary: GetRegisteredResourceValuesByFQNs - operationId: policy.registeredresources.RegisteredResourcesService.GetRegisteredResourceValuesByFQNs + summary: GetRegisteredResourceValue + operationId: policy.registeredresources.RegisteredResourcesService.GetRegisteredResourceValue parameters: - name: Connect-Protocol-Version in: header @@ -232,7 +232,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.GetRegisteredResourceValuesByFQNsRequest' + $ref: '#/components/schemas/policy.registeredresources.GetRegisteredResourceValueRequest' required: true responses: default: @@ -246,13 +246,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.GetRegisteredResourceValuesByFQNsResponse' - /policy.registeredresources.RegisteredResourcesService/ListRegisteredResourceValues: + $ref: '#/components/schemas/policy.registeredresources.GetRegisteredResourceValueResponse' + /policy.registeredresources.RegisteredResourcesService/GetRegisteredResourceValuesByFQNs: post: tags: - policy.registeredresources.RegisteredResourcesService - summary: ListRegisteredResourceValues - operationId: policy.registeredresources.RegisteredResourcesService.ListRegisteredResourceValues + summary: GetRegisteredResourceValuesByFQNs + operationId: policy.registeredresources.RegisteredResourcesService.GetRegisteredResourceValuesByFQNs parameters: - name: Connect-Protocol-Version in: header @@ -267,7 +267,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.ListRegisteredResourceValuesRequest' + $ref: '#/components/schemas/policy.registeredresources.GetRegisteredResourceValuesByFQNsRequest' required: true responses: default: @@ -281,13 +281,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.ListRegisteredResourceValuesResponse' - /policy.registeredresources.RegisteredResourcesService/ListRegisteredResources: + $ref: '#/components/schemas/policy.registeredresources.GetRegisteredResourceValuesByFQNsResponse' + /policy.registeredresources.RegisteredResourcesService/ListRegisteredResourceValues: post: tags: - policy.registeredresources.RegisteredResourcesService - summary: ListRegisteredResources - operationId: policy.registeredresources.RegisteredResourcesService.ListRegisteredResources + summary: ListRegisteredResourceValues + operationId: policy.registeredresources.RegisteredResourcesService.ListRegisteredResourceValues parameters: - name: Connect-Protocol-Version in: header @@ -302,7 +302,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.ListRegisteredResourcesRequest' + $ref: '#/components/schemas/policy.registeredresources.ListRegisteredResourceValuesRequest' required: true responses: default: @@ -316,13 +316,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.ListRegisteredResourcesResponse' - /policy.registeredresources.RegisteredResourcesService/UpdateRegisteredResource: + $ref: '#/components/schemas/policy.registeredresources.ListRegisteredResourceValuesResponse' + /policy.registeredresources.RegisteredResourcesService/UpdateRegisteredResourceValue: post: tags: - policy.registeredresources.RegisteredResourcesService - summary: UpdateRegisteredResource - operationId: policy.registeredresources.RegisteredResourcesService.UpdateRegisteredResource + summary: UpdateRegisteredResourceValue + operationId: policy.registeredresources.RegisteredResourcesService.UpdateRegisteredResourceValue parameters: - name: Connect-Protocol-Version in: header @@ -337,7 +337,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.UpdateRegisteredResourceRequest' + $ref: '#/components/schemas/policy.registeredresources.UpdateRegisteredResourceValueRequest' required: true responses: default: @@ -351,13 +351,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.UpdateRegisteredResourceResponse' - /policy.registeredresources.RegisteredResourcesService/UpdateRegisteredResourceValue: + $ref: '#/components/schemas/policy.registeredresources.UpdateRegisteredResourceValueResponse' + /policy.registeredresources.RegisteredResourcesService/DeleteRegisteredResourceValue: post: tags: - policy.registeredresources.RegisteredResourcesService - summary: UpdateRegisteredResourceValue - operationId: policy.registeredresources.RegisteredResourcesService.UpdateRegisteredResourceValue + summary: DeleteRegisteredResourceValue + operationId: policy.registeredresources.RegisteredResourcesService.DeleteRegisteredResourceValue parameters: - name: Connect-Protocol-Version in: header @@ -372,7 +372,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.UpdateRegisteredResourceValueRequest' + $ref: '#/components/schemas/policy.registeredresources.DeleteRegisteredResourceValueRequest' required: true responses: default: @@ -386,9 +386,104 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.registeredresources.UpdateRegisteredResourceValueResponse' + $ref: '#/components/schemas/policy.registeredresources.DeleteRegisteredResourceValueResponse' components: schemas: + common.MetadataUpdateEnum: + type: string + title: MetadataUpdateEnum + enum: + - METADATA_UPDATE_ENUM_UNSPECIFIED + - METADATA_UPDATE_ENUM_EXTEND + - METADATA_UPDATE_ENUM_REPLACE + policy.Action.StandardAction: + type: string + title: StandardAction + enum: + - STANDARD_ACTION_UNSPECIFIED + - STANDARD_ACTION_DECRYPT + - STANDARD_ACTION_TRANSMIT + policy.Algorithm: + type: string + title: Algorithm + enum: + - ALGORITHM_UNSPECIFIED + - ALGORITHM_RSA_2048 + - ALGORITHM_RSA_4096 + - ALGORITHM_EC_P256 + - ALGORITHM_EC_P384 + - ALGORITHM_EC_P521 + - ALGORITHM_HPQT_XWING + - ALGORITHM_HPQT_SECP256R1_MLKEM768 + - ALGORITHM_HPQT_SECP384R1_MLKEM1024 + description: Supported key algorithms. + policy.AttributeRuleTypeEnum: + type: string + title: AttributeRuleTypeEnum + enum: + - ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED + - ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF + - ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF + - ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY + policy.ConditionBooleanTypeEnum: + type: string + title: ConditionBooleanTypeEnum + enum: + - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED + - CONDITION_BOOLEAN_TYPE_ENUM_AND + - CONDITION_BOOLEAN_TYPE_ENUM_OR + policy.KasPublicKeyAlgEnum: + type: string + title: KasPublicKeyAlgEnum + enum: + - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 + policy.SortDirection: + type: string + title: SortDirection + enum: + - SORT_DIRECTION_UNSPECIFIED + - SORT_DIRECTION_ASC + - SORT_DIRECTION_DESC + description: |- + Sorting direction shared across list APIs. + When the 'sort' field is omitted or the chosen sort 'field' is UNSPECIFIED, + the endpoint's request message defines the default ordering; see the + specific List* request docs. + policy.SourceType: + type: string + title: SourceType + enum: + - SOURCE_TYPE_UNSPECIFIED + - SOURCE_TYPE_INTERNAL + - SOURCE_TYPE_EXTERNAL + description: |- + Describes whether this kas is managed by the organization or if they imported + the kas information from an external party. These two modes are necessary in order + to encrypt a tdf dek with an external parties kas public key. + policy.SubjectMappingOperatorEnum: + type: string + title: SubjectMappingOperatorEnum + enum: + - SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED + - SUBJECT_MAPPING_OPERATOR_ENUM_IN + - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN + - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS + policy.registeredresources.SortRegisteredResourcesType: + type: string + title: SortRegisteredResourcesType + enum: + - SORT_REGISTERED_RESOURCES_TYPE_UNSPECIFIED + - SORT_REGISTERED_RESOURCES_TYPE_NAME + - SORT_REGISTERED_RESOURCES_TYPE_CREATED_AT + - SORT_REGISTERED_RESOURCES_TYPE_UPDATED_AT common.Metadata: type: object properties: @@ -444,82 +539,6 @@ components: title: value title: LabelsEntry additionalProperties: false - common.MetadataUpdateEnum: - type: string - title: MetadataUpdateEnum - enum: - - METADATA_UPDATE_ENUM_UNSPECIFIED - - METADATA_UPDATE_ENUM_EXTEND - - METADATA_UPDATE_ENUM_REPLACE - connect-protocol-version: - type: number - title: Connect-Protocol-Version - enum: - - 1 - description: Define the version of the Connect protocol - const: 1 - connect-timeout-header: - type: number - title: Connect-Timeout-Ms - description: Define the timeout, in ms - connect.error: - type: object - properties: - code: - type: string - examples: - - not_found - enum: - - canceled - - unknown - - invalid_argument - - deadline_exceeded - - not_found - - already_exists - - permission_denied - - resource_exhausted - - failed_precondition - - aborted - - out_of_range - - unimplemented - - internal - - unavailable - - data_loss - - unauthenticated - description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. - message: - type: string - description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. - details: - type: array - items: - $ref: '#/components/schemas/connect.error_details.Any' - description: A list of messages that carry the error details. There is no limit on the number of messages. - title: Connect Error - additionalProperties: true - description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' - connect.error_details.Any: - type: object - properties: - type: - type: string - description: 'A URL that acts as a globally unique identifier for the type of the serialized message. For example: `type.googleapis.com/google.rpc.ErrorInfo`. This is used to determine the schema of the data in the `value` field and is the discriminator for the `debug` field.' - value: - type: string - format: binary - description: The Protobuf message, serialized as bytes and base64-encoded. The specific message type is identified by the `type` field. - debug: - oneOf: - - type: object - title: Any - additionalProperties: true - description: Detailed error information. - discriminator: - propertyName: type - title: Debug - description: Deserialized error detail payload. The 'type' field indicates the schema. This field is for easier debugging and should not be relied upon for application logic. - additionalProperties: true - description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message, with an additional debug field for ConnectRPC error details. google.protobuf.BoolValue: type: boolean description: |- @@ -532,8 +551,8 @@ components: google.protobuf.Timestamp: type: string examples: - - "2023-01-15T01:30:15.01Z" - - "2024-12-25T12:00:00Z" + - 1s + - 1.000340012s format: date-time description: |- A Timestamp represents a point in time independent of any time zone or local @@ -627,65 +646,41 @@ components: ) to obtain a formatter capable of generating timestamps in this format. policy.Action: type: object - allOf: + oneOf: - properties: - id: - type: string - title: id - description: Generated uuid in database - name: + custom: type: string - title: name - namespace: - title: namespace - description: Namespace context for this action - $ref: '#/components/schemas/policy.Namespace' - metadata: - title: metadata - $ref: '#/components/schemas/common.Metadata' - - oneOf: - - type: object - properties: - custom: - type: string - title: custom - description: Deprecated title: custom - required: - - custom - - type: object - properties: - standard: - title: standard - description: Deprecated - $ref: '#/components/schemas/policy.Action.StandardAction' + description: Deprecated + title: custom + required: + - custom + - properties: + standard: title: standard - required: - - standard + description: Deprecated + $ref: '#/components/schemas/policy.Action.StandardAction' + title: standard + required: + - standard + properties: + id: + type: string + title: id + description: Generated uuid in database + name: + type: string + title: name + namespace: + title: namespace + description: Namespace context for this action + $ref: '#/components/schemas/policy.Namespace' + metadata: + title: metadata + $ref: '#/components/schemas/common.Metadata' title: Action additionalProperties: false description: An action an entity can take - policy.Action.StandardAction: - type: string - title: StandardAction - enum: - - STANDARD_ACTION_UNSPECIFIED - - STANDARD_ACTION_DECRYPT - - STANDARD_ACTION_TRANSMIT - policy.Algorithm: - type: string - title: Algorithm - enum: - - ALGORITHM_UNSPECIFIED - - ALGORITHM_RSA_2048 - - ALGORITHM_RSA_4096 - - ALGORITHM_EC_P256 - - ALGORITHM_EC_P384 - - ALGORITHM_EC_P521 - - ALGORITHM_HPQT_XWING - - ALGORITHM_HPQT_SECP256R1_MLKEM768 - - ALGORITHM_HPQT_SECP384R1_MLKEM1024 - description: Supported key algorithms. policy.Attribute: type: object properties: @@ -742,14 +737,6 @@ components: required: - rule additionalProperties: false - policy.AttributeRuleTypeEnum: - type: string - title: AttributeRuleTypeEnum - enum: - - ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED - - ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF - - ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF - - ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY policy.Condition: type: object properties: @@ -767,6 +754,7 @@ components: type: array items: type: string + minItems: 1 title: subject_external_values minItems: 1 description: |- @@ -782,13 +770,6 @@ components: * A Condition defines a rule of - policy.ConditionBooleanTypeEnum: - type: string - title: ConditionBooleanTypeEnum - enum: - - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED - - CONDITION_BOOLEAN_TYPE_ENUM_AND - - CONDITION_BOOLEAN_TYPE_ENUM_OR policy.ConditionGroup: type: object properties: @@ -825,7 +806,7 @@ components: alg: not: enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - 0 title: alg description: |- A known algorithm type with any additional parameters encoded. @@ -837,19 +818,6 @@ components: description: |- Deprecated A KAS public key and some associated metadata for further identifcation - policy.KasPublicKeyAlgEnum: - type: string - title: KasPublicKeyAlgEnum - enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 policy.KasPublicKeySet: type: object properties: @@ -872,9 +840,13 @@ components: uri: type: string title: uri - description: | + description: |+ Address of a KAS instance - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https?://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(:[0-9]+)?(/.*)?$') + ``` + publicKey: title: public_key description: 'Deprecated: KAS can have multiple key pairs' @@ -1072,8 +1044,7 @@ components: policy.PublicKey: type: object oneOf: - - type: object - properties: + - properties: cached: title: cached description: public key with additional information. Current preferred version @@ -1081,14 +1052,17 @@ components: title: cached required: - cached - - type: object - properties: + - properties: remote: type: string title: remote - description: | + description: |+ kas public key url - optional since can also be retrieved via public key - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(/.*)?$') + ``` + title: remote required: - remote @@ -1270,29 +1244,6 @@ components: title: pem title: SimpleKasPublicKey additionalProperties: false - policy.SortDirection: - type: string - title: SortDirection - enum: - - SORT_DIRECTION_UNSPECIFIED - - SORT_DIRECTION_ASC - - SORT_DIRECTION_DESC - description: |- - Sorting direction shared across list APIs. - When the 'sort' field is omitted or the chosen sort 'field' is UNSPECIFIED, - the endpoint's request message defines the default ordering; see the - specific List* request docs. - policy.SourceType: - type: string - title: SourceType - enum: - - SOURCE_TYPE_UNSPECIFIED - - SOURCE_TYPE_INTERNAL - - SOURCE_TYPE_EXTERNAL - description: |- - Describes whether this kas is managed by the organization or if they imported - the kas information from an external party. These two modes are necessary in order - to encrypt a tdf dek with an external parties kas public key. policy.SubjectConditionSet: type: object properties: @@ -1358,14 +1309,6 @@ components: description: |- Subject Mapping: A Policy assigning Subject Set(s) to a permitted attribute value + action(s) combination - policy.SubjectMappingOperatorEnum: - type: string - title: SubjectMappingOperatorEnum - enum: - - SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED - - SUBJECT_MAPPING_OPERATOR_ENUM_IN - - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN - - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS policy.SubjectSet: type: object properties: @@ -1436,8 +1379,7 @@ components: type: object allOf: - oneOf: - - type: object - properties: + - properties: actionId: type: string title: action_id @@ -1445,20 +1387,22 @@ components: title: action_id required: - actionId - - type: object - properties: + - properties: actionName: type: string title: action_name maxLength: 253 - description: | - action_name_format // Action name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored action name will be normalized to lower case. + description: |+ + Action name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored action name will be normalized to lower case.: + ``` + this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') + ``` + title: action_name required: - actionName - oneOf: - - type: object - properties: + - properties: attributeValueFqn: type: string title: attribute_value_fqn @@ -1467,8 +1411,7 @@ components: title: attribute_value_fqn required: - attributeValueFqn - - type: object - properties: + - properties: attributeValueId: type: string title: attribute_value_id @@ -1485,15 +1428,20 @@ components: type: string title: name maxLength: 253 - description: | + description: |+ Required - rr_name_format // Registered Resource Name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored name will be normalized to lower case. + Registered Resource Name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored name will be normalized to lower case.: + ``` + this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') + ``` + values: type: array items: type: string maxLength: 253 pattern: ^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$ + uniqueItems: true title: values uniqueItems: true description: |- @@ -1539,9 +1487,13 @@ components: type: string title: value maxLength: 253 - description: | + description: |+ Required - rr_value_format // Registered Resource Value must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored value will be normalized to lower case. + Registered Resource Value must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored value will be normalized to lower case.: + ``` + this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') + ``` + actionAttributeValues: type: array items: @@ -1607,38 +1559,39 @@ components: additionalProperties: false policy.registeredresources.GetRegisteredResourceRequest: type: object - allOf: + oneOf: - properties: - namespaceFqn: - type: string - title: namespace_fqn - minLength: 1 - format: uri - namespaceId: + id: type: string - title: namespace_id - format: uuid - - oneOf: - - type: object - properties: - id: - type: string - title: id - format: uuid title: id - required: - - id - - type: object - properties: - name: - type: string - title: name - maxLength: 253 - description: | - rr_name_format // Registered Resource Name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored name will be normalized to lower case. + format: uuid + title: id + required: + - id + - properties: + name: + type: string title: name - required: - - name + maxLength: 253 + description: |+ + Registered Resource Name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored name will be normalized to lower case.: + ``` + size(this) > 0 ? this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') : true + ``` + + title: name + required: + - name + properties: + namespaceFqn: + type: string + title: namespace_fqn + minLength: 1 + format: uri + namespaceId: + type: string + title: namespace_id + format: uuid title: GetRegisteredResourceRequest additionalProperties: false policy.registeredresources.GetRegisteredResourceResponse: @@ -1652,8 +1605,7 @@ components: policy.registeredresources.GetRegisteredResourceValueRequest: type: object oneOf: - - type: object - properties: + - properties: fqn: type: string title: fqn @@ -1662,8 +1614,7 @@ components: title: fqn required: - fqn - - type: object - properties: + - properties: id: type: string title: id @@ -1690,6 +1641,8 @@ components: type: string minLength: 1 format: uri + minItems: 1 + uniqueItems: true title: fqns minItems: 1 uniqueItems: true @@ -1724,9 +1677,13 @@ components: resourceId: type: string title: resource_id - description: | + description: |+ Optional - optional_uuid_format // Optional field must be a valid UUID + Optional field must be a valid UUID: + ``` + size(this) == 0 || this.matches('[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}') + ``` + pagination: title: pagination description: Optional @@ -1800,14 +1757,6 @@ components: $ref: '#/components/schemas/policy.SortDirection' title: RegisteredResourcesSort additionalProperties: false - policy.registeredresources.SortRegisteredResourcesType: - type: string - title: SortRegisteredResourcesType - enum: - - SORT_REGISTERED_RESOURCES_TYPE_UNSPECIFIED - - SORT_REGISTERED_RESOURCES_TYPE_NAME - - SORT_REGISTERED_RESOURCES_TYPE_CREATED_AT - - SORT_REGISTERED_RESOURCES_TYPE_UPDATED_AT policy.registeredresources.UpdateRegisteredResourceRequest: type: object properties: @@ -1820,9 +1769,13 @@ components: type: string title: name maxLength: 253 - description: | + description: |+ Optional - rr_name_format // Registered Resource Name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored name will be normalized to lower case. + Registered Resource Name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored name will be normalized to lower case.: + ``` + size(this) > 0 ? this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') : true + ``` + metadata: title: metadata description: |- @@ -1854,9 +1807,13 @@ components: type: string title: value maxLength: 253 - description: | + description: |+ Optional - rr_value_format // Registered Resource Value must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored value will be normalized to lower case. + Registered Resource Value must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored value will be normalized to lower case.: + ``` + size(this) > 0 ? this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') : true + ``` + actionAttributeValues: type: array items: @@ -1884,6 +1841,63 @@ components: $ref: '#/components/schemas/policy.RegisteredResourceValue' title: UpdateRegisteredResourceValueResponse additionalProperties: false + connect-protocol-version: + type: number + title: Connect-Protocol-Version + enum: + - 1 + description: Define the version of the Connect protocol + const: 1 + connect-timeout-header: + type: number + title: Connect-Timeout-Ms + description: Define the timeout, in ms + connect.error: + type: object + properties: + code: + type: string + examples: + - not_found + enum: + - canceled + - unknown + - invalid_argument + - deadline_exceeded + - not_found + - already_exists + - permission_denied + - resource_exhausted + - failed_precondition + - aborted + - out_of_range + - unimplemented + - internal + - unavailable + - data_loss + - unauthenticated + description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. + message: + type: string + description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. + detail: + $ref: '#/components/schemas/google.protobuf.Any' + title: Connect Error + additionalProperties: true + description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' + google.protobuf.Any: + type: object + properties: + type: + type: string + value: + type: string + format: binary + debug: + type: object + additionalProperties: true + additionalProperties: true + description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. security: [] tags: - name: policy.registeredresources.RegisteredResourcesService diff --git a/docs/openapi/policy/resourcemapping/resource_mapping.openapi.yaml b/docs/openapi/policy/resourcemapping/resource_mapping.openapi.yaml index 6d93e90f9c..a11306bc24 100644 --- a/docs/openapi/policy/resourcemapping/resource_mapping.openapi.yaml +++ b/docs/openapi/policy/resourcemapping/resource_mapping.openapi.yaml @@ -2,12 +2,12 @@ openapi: 3.1.0 info: title: policy.resourcemapping paths: - /policy.resourcemapping.ResourceMappingService/CreateResourceMapping: + /policy.resourcemapping.ResourceMappingService/ListResourceMappingGroups: post: tags: - policy.resourcemapping.ResourceMappingService - summary: CreateResourceMapping - operationId: policy.resourcemapping.ResourceMappingService.CreateResourceMapping + summary: ListResourceMappingGroups + operationId: policy.resourcemapping.ResourceMappingService.ListResourceMappingGroups parameters: - name: Connect-Protocol-Version in: header @@ -22,7 +22,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.CreateResourceMappingRequest' + $ref: '#/components/schemas/policy.resourcemapping.ListResourceMappingGroupsRequest' required: true responses: default: @@ -36,13 +36,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.CreateResourceMappingResponse' - /policy.resourcemapping.ResourceMappingService/CreateResourceMappingGroup: + $ref: '#/components/schemas/policy.resourcemapping.ListResourceMappingGroupsResponse' + /policy.resourcemapping.ResourceMappingService/GetResourceMappingGroup: post: tags: - policy.resourcemapping.ResourceMappingService - summary: CreateResourceMappingGroup - operationId: policy.resourcemapping.ResourceMappingService.CreateResourceMappingGroup + summary: GetResourceMappingGroup + operationId: policy.resourcemapping.ResourceMappingService.GetResourceMappingGroup parameters: - name: Connect-Protocol-Version in: header @@ -57,7 +57,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.CreateResourceMappingGroupRequest' + $ref: '#/components/schemas/policy.resourcemapping.GetResourceMappingGroupRequest' required: true responses: default: @@ -71,13 +71,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.CreateResourceMappingGroupResponse' - /policy.resourcemapping.ResourceMappingService/DeleteResourceMapping: + $ref: '#/components/schemas/policy.resourcemapping.GetResourceMappingGroupResponse' + /policy.resourcemapping.ResourceMappingService/CreateResourceMappingGroup: post: tags: - policy.resourcemapping.ResourceMappingService - summary: DeleteResourceMapping - operationId: policy.resourcemapping.ResourceMappingService.DeleteResourceMapping + summary: CreateResourceMappingGroup + operationId: policy.resourcemapping.ResourceMappingService.CreateResourceMappingGroup parameters: - name: Connect-Protocol-Version in: header @@ -92,7 +92,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.DeleteResourceMappingRequest' + $ref: '#/components/schemas/policy.resourcemapping.CreateResourceMappingGroupRequest' required: true responses: default: @@ -106,13 +106,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.DeleteResourceMappingResponse' - /policy.resourcemapping.ResourceMappingService/DeleteResourceMappingGroup: + $ref: '#/components/schemas/policy.resourcemapping.CreateResourceMappingGroupResponse' + /policy.resourcemapping.ResourceMappingService/UpdateResourceMappingGroup: post: tags: - policy.resourcemapping.ResourceMappingService - summary: DeleteResourceMappingGroup - operationId: policy.resourcemapping.ResourceMappingService.DeleteResourceMappingGroup + summary: UpdateResourceMappingGroup + operationId: policy.resourcemapping.ResourceMappingService.UpdateResourceMappingGroup parameters: - name: Connect-Protocol-Version in: header @@ -127,7 +127,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.DeleteResourceMappingGroupRequest' + $ref: '#/components/schemas/policy.resourcemapping.UpdateResourceMappingGroupRequest' required: true responses: default: @@ -141,13 +141,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.DeleteResourceMappingGroupResponse' - /policy.resourcemapping.ResourceMappingService/GetResourceMapping: + $ref: '#/components/schemas/policy.resourcemapping.UpdateResourceMappingGroupResponse' + /policy.resourcemapping.ResourceMappingService/DeleteResourceMappingGroup: post: tags: - policy.resourcemapping.ResourceMappingService - summary: GetResourceMapping - operationId: policy.resourcemapping.ResourceMappingService.GetResourceMapping + summary: DeleteResourceMappingGroup + operationId: policy.resourcemapping.ResourceMappingService.DeleteResourceMappingGroup parameters: - name: Connect-Protocol-Version in: header @@ -162,7 +162,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.GetResourceMappingRequest' + $ref: '#/components/schemas/policy.resourcemapping.DeleteResourceMappingGroupRequest' required: true responses: default: @@ -176,13 +176,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.GetResourceMappingResponse' - /policy.resourcemapping.ResourceMappingService/GetResourceMappingGroup: + $ref: '#/components/schemas/policy.resourcemapping.DeleteResourceMappingGroupResponse' + /policy.resourcemapping.ResourceMappingService/ListResourceMappings: post: tags: - policy.resourcemapping.ResourceMappingService - summary: GetResourceMappingGroup - operationId: policy.resourcemapping.ResourceMappingService.GetResourceMappingGroup + summary: ListResourceMappings + operationId: policy.resourcemapping.ResourceMappingService.ListResourceMappings parameters: - name: Connect-Protocol-Version in: header @@ -197,7 +197,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.GetResourceMappingGroupRequest' + $ref: '#/components/schemas/policy.resourcemapping.ListResourceMappingsRequest' required: true responses: default: @@ -211,13 +211,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.GetResourceMappingGroupResponse' - /policy.resourcemapping.ResourceMappingService/ListResourceMappingGroups: + $ref: '#/components/schemas/policy.resourcemapping.ListResourceMappingsResponse' + /policy.resourcemapping.ResourceMappingService/ListResourceMappingsByGroupFqns: post: tags: - policy.resourcemapping.ResourceMappingService - summary: ListResourceMappingGroups - operationId: policy.resourcemapping.ResourceMappingService.ListResourceMappingGroups + summary: ListResourceMappingsByGroupFqns + operationId: policy.resourcemapping.ResourceMappingService.ListResourceMappingsByGroupFqns parameters: - name: Connect-Protocol-Version in: header @@ -232,7 +232,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.ListResourceMappingGroupsRequest' + $ref: '#/components/schemas/policy.resourcemapping.ListResourceMappingsByGroupFqnsRequest' required: true responses: default: @@ -246,13 +246,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.ListResourceMappingGroupsResponse' - /policy.resourcemapping.ResourceMappingService/ListResourceMappings: + $ref: '#/components/schemas/policy.resourcemapping.ListResourceMappingsByGroupFqnsResponse' + /policy.resourcemapping.ResourceMappingService/GetResourceMapping: post: tags: - policy.resourcemapping.ResourceMappingService - summary: ListResourceMappings - operationId: policy.resourcemapping.ResourceMappingService.ListResourceMappings + summary: GetResourceMapping + operationId: policy.resourcemapping.ResourceMappingService.GetResourceMapping parameters: - name: Connect-Protocol-Version in: header @@ -267,7 +267,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.ListResourceMappingsRequest' + $ref: '#/components/schemas/policy.resourcemapping.GetResourceMappingRequest' required: true responses: default: @@ -281,13 +281,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.ListResourceMappingsResponse' - /policy.resourcemapping.ResourceMappingService/ListResourceMappingsByGroupFqns: + $ref: '#/components/schemas/policy.resourcemapping.GetResourceMappingResponse' + /policy.resourcemapping.ResourceMappingService/CreateResourceMapping: post: tags: - policy.resourcemapping.ResourceMappingService - summary: ListResourceMappingsByGroupFqns - operationId: policy.resourcemapping.ResourceMappingService.ListResourceMappingsByGroupFqns + summary: CreateResourceMapping + operationId: policy.resourcemapping.ResourceMappingService.CreateResourceMapping parameters: - name: Connect-Protocol-Version in: header @@ -302,7 +302,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.ListResourceMappingsByGroupFqnsRequest' + $ref: '#/components/schemas/policy.resourcemapping.CreateResourceMappingRequest' required: true responses: default: @@ -316,7 +316,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.ListResourceMappingsByGroupFqnsResponse' + $ref: '#/components/schemas/policy.resourcemapping.CreateResourceMappingResponse' /policy.resourcemapping.ResourceMappingService/UpdateResourceMapping: post: tags: @@ -352,12 +352,12 @@ paths: application/json: schema: $ref: '#/components/schemas/policy.resourcemapping.UpdateResourceMappingResponse' - /policy.resourcemapping.ResourceMappingService/UpdateResourceMappingGroup: + /policy.resourcemapping.ResourceMappingService/DeleteResourceMapping: post: tags: - policy.resourcemapping.ResourceMappingService - summary: UpdateResourceMappingGroup - operationId: policy.resourcemapping.ResourceMappingService.UpdateResourceMappingGroup + summary: DeleteResourceMapping + operationId: policy.resourcemapping.ResourceMappingService.DeleteResourceMapping parameters: - name: Connect-Protocol-Version in: header @@ -372,7 +372,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.UpdateResourceMappingGroupRequest' + $ref: '#/components/schemas/policy.resourcemapping.DeleteResourceMappingRequest' required: true responses: default: @@ -386,9 +386,84 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.resourcemapping.UpdateResourceMappingGroupResponse' + $ref: '#/components/schemas/policy.resourcemapping.DeleteResourceMappingResponse' components: schemas: + common.MetadataUpdateEnum: + type: string + title: MetadataUpdateEnum + enum: + - METADATA_UPDATE_ENUM_UNSPECIFIED + - METADATA_UPDATE_ENUM_EXTEND + - METADATA_UPDATE_ENUM_REPLACE + policy.Action.StandardAction: + type: string + title: StandardAction + enum: + - STANDARD_ACTION_UNSPECIFIED + - STANDARD_ACTION_DECRYPT + - STANDARD_ACTION_TRANSMIT + policy.Algorithm: + type: string + title: Algorithm + enum: + - ALGORITHM_UNSPECIFIED + - ALGORITHM_RSA_2048 + - ALGORITHM_RSA_4096 + - ALGORITHM_EC_P256 + - ALGORITHM_EC_P384 + - ALGORITHM_EC_P521 + - ALGORITHM_HPQT_XWING + - ALGORITHM_HPQT_SECP256R1_MLKEM768 + - ALGORITHM_HPQT_SECP384R1_MLKEM1024 + description: Supported key algorithms. + policy.AttributeRuleTypeEnum: + type: string + title: AttributeRuleTypeEnum + enum: + - ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED + - ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF + - ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF + - ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY + policy.ConditionBooleanTypeEnum: + type: string + title: ConditionBooleanTypeEnum + enum: + - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED + - CONDITION_BOOLEAN_TYPE_ENUM_AND + - CONDITION_BOOLEAN_TYPE_ENUM_OR + policy.KasPublicKeyAlgEnum: + type: string + title: KasPublicKeyAlgEnum + enum: + - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 + policy.SourceType: + type: string + title: SourceType + enum: + - SOURCE_TYPE_UNSPECIFIED + - SOURCE_TYPE_INTERNAL + - SOURCE_TYPE_EXTERNAL + description: |- + Describes whether this kas is managed by the organization or if they imported + the kas information from an external party. These two modes are necessary in order + to encrypt a tdf dek with an external parties kas public key. + policy.SubjectMappingOperatorEnum: + type: string + title: SubjectMappingOperatorEnum + enum: + - SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED + - SUBJECT_MAPPING_OPERATOR_ENUM_IN + - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN + - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS common.Metadata: type: object properties: @@ -444,82 +519,6 @@ components: title: value title: LabelsEntry additionalProperties: false - common.MetadataUpdateEnum: - type: string - title: MetadataUpdateEnum - enum: - - METADATA_UPDATE_ENUM_UNSPECIFIED - - METADATA_UPDATE_ENUM_EXTEND - - METADATA_UPDATE_ENUM_REPLACE - connect-protocol-version: - type: number - title: Connect-Protocol-Version - enum: - - 1 - description: Define the version of the Connect protocol - const: 1 - connect-timeout-header: - type: number - title: Connect-Timeout-Ms - description: Define the timeout, in ms - connect.error: - type: object - properties: - code: - type: string - examples: - - not_found - enum: - - canceled - - unknown - - invalid_argument - - deadline_exceeded - - not_found - - already_exists - - permission_denied - - resource_exhausted - - failed_precondition - - aborted - - out_of_range - - unimplemented - - internal - - unavailable - - data_loss - - unauthenticated - description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. - message: - type: string - description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. - details: - type: array - items: - $ref: '#/components/schemas/connect.error_details.Any' - description: A list of messages that carry the error details. There is no limit on the number of messages. - title: Connect Error - additionalProperties: true - description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' - connect.error_details.Any: - type: object - properties: - type: - type: string - description: 'A URL that acts as a globally unique identifier for the type of the serialized message. For example: `type.googleapis.com/google.rpc.ErrorInfo`. This is used to determine the schema of the data in the `value` field and is the discriminator for the `debug` field.' - value: - type: string - format: binary - description: The Protobuf message, serialized as bytes and base64-encoded. The specific message type is identified by the `type` field. - debug: - oneOf: - - type: object - title: Any - additionalProperties: true - description: Detailed error information. - discriminator: - propertyName: type - title: Debug - description: Deserialized error detail payload. The 'type' field indicates the schema. This field is for easier debugging and should not be relied upon for application logic. - additionalProperties: true - description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message, with an additional debug field for ConnectRPC error details. google.protobuf.BoolValue: type: boolean description: |- @@ -532,8 +531,8 @@ components: google.protobuf.Timestamp: type: string examples: - - "2023-01-15T01:30:15.01Z" - - "2024-12-25T12:00:00Z" + - 1s + - 1.000340012s format: date-time description: |- A Timestamp represents a point in time independent of any time zone or local @@ -627,65 +626,41 @@ components: ) to obtain a formatter capable of generating timestamps in this format. policy.Action: type: object - allOf: + oneOf: - properties: - id: + custom: type: string - title: id - description: Generated uuid in database - name: - type: string - title: name - namespace: - title: namespace - description: Namespace context for this action - $ref: '#/components/schemas/policy.Namespace' - metadata: - title: metadata - $ref: '#/components/schemas/common.Metadata' - - oneOf: - - type: object - properties: - custom: - type: string - title: custom - description: Deprecated title: custom - required: - - custom - - type: object - properties: - standard: - title: standard - description: Deprecated - $ref: '#/components/schemas/policy.Action.StandardAction' + description: Deprecated + title: custom + required: + - custom + - properties: + standard: title: standard - required: - - standard + description: Deprecated + $ref: '#/components/schemas/policy.Action.StandardAction' + title: standard + required: + - standard + properties: + id: + type: string + title: id + description: Generated uuid in database + name: + type: string + title: name + namespace: + title: namespace + description: Namespace context for this action + $ref: '#/components/schemas/policy.Namespace' + metadata: + title: metadata + $ref: '#/components/schemas/common.Metadata' title: Action additionalProperties: false description: An action an entity can take - policy.Action.StandardAction: - type: string - title: StandardAction - enum: - - STANDARD_ACTION_UNSPECIFIED - - STANDARD_ACTION_DECRYPT - - STANDARD_ACTION_TRANSMIT - policy.Algorithm: - type: string - title: Algorithm - enum: - - ALGORITHM_UNSPECIFIED - - ALGORITHM_RSA_2048 - - ALGORITHM_RSA_4096 - - ALGORITHM_EC_P256 - - ALGORITHM_EC_P384 - - ALGORITHM_EC_P521 - - ALGORITHM_HPQT_XWING - - ALGORITHM_HPQT_SECP256R1_MLKEM768 - - ALGORITHM_HPQT_SECP384R1_MLKEM1024 - description: Supported key algorithms. policy.Attribute: type: object properties: @@ -742,14 +717,6 @@ components: required: - rule additionalProperties: false - policy.AttributeRuleTypeEnum: - type: string - title: AttributeRuleTypeEnum - enum: - - ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED - - ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF - - ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF - - ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY policy.Condition: type: object properties: @@ -767,6 +734,7 @@ components: type: array items: type: string + minItems: 1 title: subject_external_values minItems: 1 description: |- @@ -782,13 +750,6 @@ components: * A Condition defines a rule of - policy.ConditionBooleanTypeEnum: - type: string - title: ConditionBooleanTypeEnum - enum: - - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED - - CONDITION_BOOLEAN_TYPE_ENUM_AND - - CONDITION_BOOLEAN_TYPE_ENUM_OR policy.ConditionGroup: type: object properties: @@ -825,7 +786,7 @@ components: alg: not: enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - 0 title: alg description: |- A known algorithm type with any additional parameters encoded. @@ -837,19 +798,6 @@ components: description: |- Deprecated A KAS public key and some associated metadata for further identifcation - policy.KasPublicKeyAlgEnum: - type: string - title: KasPublicKeyAlgEnum - enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 policy.KasPublicKeySet: type: object properties: @@ -872,9 +820,13 @@ components: uri: type: string title: uri - description: | + description: |+ Address of a KAS instance - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https?://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(:[0-9]+)?(/.*)?$') + ``` + publicKey: title: public_key description: 'Deprecated: KAS can have multiple key pairs' @@ -1072,8 +1024,7 @@ components: policy.PublicKey: type: object oneOf: - - type: object - properties: + - properties: cached: title: cached description: public key with additional information. Current preferred version @@ -1081,14 +1032,17 @@ components: title: cached required: - cached - - type: object - properties: + - properties: remote: type: string title: remote - description: | + description: |+ kas public key url - optional since can also be retrieved via public key - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(/.*)?$') + ``` + title: remote required: - remote @@ -1203,17 +1157,6 @@ components: title: pem title: SimpleKasPublicKey additionalProperties: false - policy.SourceType: - type: string - title: SourceType - enum: - - SOURCE_TYPE_UNSPECIFIED - - SOURCE_TYPE_INTERNAL - - SOURCE_TYPE_EXTERNAL - description: |- - Describes whether this kas is managed by the organization or if they imported - the kas information from an external party. These two modes are necessary in order - to encrypt a tdf dek with an external parties kas public key. policy.SubjectConditionSet: type: object properties: @@ -1279,14 +1222,6 @@ components: description: |- Subject Mapping: A Policy assigning Subject Set(s) to a permitted attribute value + action(s) combination - policy.SubjectMappingOperatorEnum: - type: string - title: SubjectMappingOperatorEnum - enum: - - SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED - - SUBJECT_MAPPING_OPERATOR_ENUM_IN - - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN - - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS policy.SubjectSet: type: object properties: @@ -1355,12 +1290,6 @@ components: additionalProperties: false policy.resourcemapping.CreateResourceMappingGroupRequest: type: object - allOf: - - oneOf: - - required: - - namespaceId - - required: - - namespaceFqn properties: namespaceId: type: string @@ -1403,6 +1332,8 @@ components: type: array items: type: string + maxItems: 1000 + minItems: 1 title: terms maxItems: 1000 minItems: 1 @@ -1410,9 +1341,13 @@ components: groupId: type: string title: group_id - description: | + description: |+ Optional - optional_uuid_format // Optional field must be a valid UUID + Optional field must be a valid UUID: + ``` + size(this) == 0 || this.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$') + ``` + namespaceId: type: string title: namespace_id @@ -1555,6 +1490,7 @@ components: type: array items: type: string + minItems: 1 title: fqns minItems: 1 description: |- @@ -1590,9 +1526,13 @@ components: groupId: type: string title: group_id - description: | + description: |+ Optional - optional_uuid_format // Optional field must be a valid UUID + Optional field must be a valid UUID: + ``` + size(this) == 0 || this.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$') + ``` + namespaceId: type: string title: namespace_id @@ -1663,9 +1603,13 @@ components: type: string title: name maxLength: 253 - description: | + description: |+ Optional - optional_name_format // Optional field must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored group name will be normalized to lower case. + Optional field must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored group name will be normalized to lower case.: + ``` + size(this) == 0 || this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') + ``` + metadata: title: metadata description: Common metadata @@ -1694,22 +1638,31 @@ components: attributeValueId: type: string title: attribute_value_id - description: | + description: |+ Optional - optional_uuid_format // Optional field must be a valid UUID + Optional field must be a valid UUID: + ``` + size(this) == 0 || this.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$') + ``` + terms: type: array items: type: string + maxItems: 1000 title: terms maxItems: 1000 description: Optional groupId: type: string title: group_id - description: | + description: |+ Optional - optional_uuid_format // Optional field must be a valid UUID + Optional field must be a valid UUID: + ``` + size(this) == 0 || this.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$') + ``` + namespaceId: type: string title: namespace_id @@ -1745,6 +1698,63 @@ components: $ref: '#/components/schemas/policy.ResourceMapping' title: UpdateResourceMappingResponse additionalProperties: false + connect-protocol-version: + type: number + title: Connect-Protocol-Version + enum: + - 1 + description: Define the version of the Connect protocol + const: 1 + connect-timeout-header: + type: number + title: Connect-Timeout-Ms + description: Define the timeout, in ms + connect.error: + type: object + properties: + code: + type: string + examples: + - not_found + enum: + - canceled + - unknown + - invalid_argument + - deadline_exceeded + - not_found + - already_exists + - permission_denied + - resource_exhausted + - failed_precondition + - aborted + - out_of_range + - unimplemented + - internal + - unavailable + - data_loss + - unauthenticated + description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. + message: + type: string + description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. + detail: + $ref: '#/components/schemas/google.protobuf.Any' + title: Connect Error + additionalProperties: true + description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' + google.protobuf.Any: + type: object + properties: + type: + type: string + value: + type: string + format: binary + debug: + type: object + additionalProperties: true + additionalProperties: true + description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. security: [] tags: - name: policy.resourcemapping.ResourceMappingService diff --git a/docs/openapi/policy/selectors.openapi.yaml b/docs/openapi/policy/selectors.openapi.yaml index 65cc330d4a..8b885a5a41 100644 --- a/docs/openapi/policy/selectors.openapi.yaml +++ b/docs/openapi/policy/selectors.openapi.yaml @@ -4,6 +4,18 @@ info: paths: {} components: schemas: + policy.SortDirection: + type: string + title: SortDirection + enum: + - SORT_DIRECTION_UNSPECIFIED + - SORT_DIRECTION_ASC + - SORT_DIRECTION_DESC + description: |- + Sorting direction shared across list APIs. + When the 'sort' field is omitted or the chosen sort 'field' is UNSPECIFIED, + the endpoint's request message defines the default ordering; see the + specific List* request docs. policy.AttributeDefinitionSelector: type: object properties: @@ -152,16 +164,4 @@ components: description: Total count of entire list title: PageResponse additionalProperties: false - policy.SortDirection: - type: string - title: SortDirection - enum: - - SORT_DIRECTION_UNSPECIFIED - - SORT_DIRECTION_ASC - - SORT_DIRECTION_DESC - description: |- - Sorting direction shared across list APIs. - When the 'sort' field is omitted or the chosen sort 'field' is UNSPECIFIED, - the endpoint's request message defines the default ordering; see the - specific List* request docs. security: [] diff --git a/docs/openapi/policy/subjectmapping/subject_mapping.openapi.yaml b/docs/openapi/policy/subjectmapping/subject_mapping.openapi.yaml index 147d1e441a..5dec586826 100644 --- a/docs/openapi/policy/subjectmapping/subject_mapping.openapi.yaml +++ b/docs/openapi/policy/subjectmapping/subject_mapping.openapi.yaml @@ -2,12 +2,13 @@ openapi: 3.1.0 info: title: policy.subjectmapping paths: - /policy.subjectmapping.SubjectMappingService/CreateSubjectConditionSet: + /policy.subjectmapping.SubjectMappingService/MatchSubjectMappings: post: tags: - policy.subjectmapping.SubjectMappingService - summary: CreateSubjectConditionSet - operationId: policy.subjectmapping.SubjectMappingService.CreateSubjectConditionSet + summary: MatchSubjectMappings + description: Find matching Subject Mappings for a given Subject + operationId: policy.subjectmapping.SubjectMappingService.MatchSubjectMappings parameters: - name: Connect-Protocol-Version in: header @@ -22,7 +23,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.CreateSubjectConditionSetRequest' + $ref: '#/components/schemas/policy.subjectmapping.MatchSubjectMappingsRequest' required: true responses: default: @@ -36,13 +37,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.CreateSubjectConditionSetResponse' - /policy.subjectmapping.SubjectMappingService/CreateSubjectMapping: + $ref: '#/components/schemas/policy.subjectmapping.MatchSubjectMappingsResponse' + /policy.subjectmapping.SubjectMappingService/ListSubjectMappings: post: tags: - policy.subjectmapping.SubjectMappingService - summary: CreateSubjectMapping - operationId: policy.subjectmapping.SubjectMappingService.CreateSubjectMapping + summary: ListSubjectMappings + operationId: policy.subjectmapping.SubjectMappingService.ListSubjectMappings parameters: - name: Connect-Protocol-Version in: header @@ -57,7 +58,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.CreateSubjectMappingRequest' + $ref: '#/components/schemas/policy.subjectmapping.ListSubjectMappingsRequest' required: true responses: default: @@ -71,13 +72,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.CreateSubjectMappingResponse' - /policy.subjectmapping.SubjectMappingService/DeleteAllUnmappedSubjectConditionSets: + $ref: '#/components/schemas/policy.subjectmapping.ListSubjectMappingsResponse' + /policy.subjectmapping.SubjectMappingService/GetSubjectMapping: post: tags: - policy.subjectmapping.SubjectMappingService - summary: DeleteAllUnmappedSubjectConditionSets - operationId: policy.subjectmapping.SubjectMappingService.DeleteAllUnmappedSubjectConditionSets + summary: GetSubjectMapping + operationId: policy.subjectmapping.SubjectMappingService.GetSubjectMapping parameters: - name: Connect-Protocol-Version in: header @@ -92,7 +93,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.DeleteAllUnmappedSubjectConditionSetsRequest' + $ref: '#/components/schemas/policy.subjectmapping.GetSubjectMappingRequest' required: true responses: default: @@ -106,13 +107,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.DeleteAllUnmappedSubjectConditionSetsResponse' - /policy.subjectmapping.SubjectMappingService/DeleteSubjectConditionSet: + $ref: '#/components/schemas/policy.subjectmapping.GetSubjectMappingResponse' + /policy.subjectmapping.SubjectMappingService/CreateSubjectMapping: post: tags: - policy.subjectmapping.SubjectMappingService - summary: DeleteSubjectConditionSet - operationId: policy.subjectmapping.SubjectMappingService.DeleteSubjectConditionSet + summary: CreateSubjectMapping + operationId: policy.subjectmapping.SubjectMappingService.CreateSubjectMapping parameters: - name: Connect-Protocol-Version in: header @@ -127,7 +128,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.DeleteSubjectConditionSetRequest' + $ref: '#/components/schemas/policy.subjectmapping.CreateSubjectMappingRequest' required: true responses: default: @@ -141,13 +142,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.DeleteSubjectConditionSetResponse' - /policy.subjectmapping.SubjectMappingService/DeleteSubjectMapping: + $ref: '#/components/schemas/policy.subjectmapping.CreateSubjectMappingResponse' + /policy.subjectmapping.SubjectMappingService/UpdateSubjectMapping: post: tags: - policy.subjectmapping.SubjectMappingService - summary: DeleteSubjectMapping - operationId: policy.subjectmapping.SubjectMappingService.DeleteSubjectMapping + summary: UpdateSubjectMapping + operationId: policy.subjectmapping.SubjectMappingService.UpdateSubjectMapping parameters: - name: Connect-Protocol-Version in: header @@ -162,7 +163,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.DeleteSubjectMappingRequest' + $ref: '#/components/schemas/policy.subjectmapping.UpdateSubjectMappingRequest' required: true responses: default: @@ -176,13 +177,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.DeleteSubjectMappingResponse' - /policy.subjectmapping.SubjectMappingService/GetSubjectConditionSet: + $ref: '#/components/schemas/policy.subjectmapping.UpdateSubjectMappingResponse' + /policy.subjectmapping.SubjectMappingService/DeleteSubjectMapping: post: tags: - policy.subjectmapping.SubjectMappingService - summary: GetSubjectConditionSet - operationId: policy.subjectmapping.SubjectMappingService.GetSubjectConditionSet + summary: DeleteSubjectMapping + operationId: policy.subjectmapping.SubjectMappingService.DeleteSubjectMapping parameters: - name: Connect-Protocol-Version in: header @@ -197,7 +198,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.GetSubjectConditionSetRequest' + $ref: '#/components/schemas/policy.subjectmapping.DeleteSubjectMappingRequest' required: true responses: default: @@ -211,13 +212,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.GetSubjectConditionSetResponse' - /policy.subjectmapping.SubjectMappingService/GetSubjectMapping: + $ref: '#/components/schemas/policy.subjectmapping.DeleteSubjectMappingResponse' + /policy.subjectmapping.SubjectMappingService/ListSubjectConditionSets: post: tags: - policy.subjectmapping.SubjectMappingService - summary: GetSubjectMapping - operationId: policy.subjectmapping.SubjectMappingService.GetSubjectMapping + summary: ListSubjectConditionSets + operationId: policy.subjectmapping.SubjectMappingService.ListSubjectConditionSets parameters: - name: Connect-Protocol-Version in: header @@ -232,7 +233,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.GetSubjectMappingRequest' + $ref: '#/components/schemas/policy.subjectmapping.ListSubjectConditionSetsRequest' required: true responses: default: @@ -246,13 +247,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.GetSubjectMappingResponse' - /policy.subjectmapping.SubjectMappingService/ListSubjectConditionSets: + $ref: '#/components/schemas/policy.subjectmapping.ListSubjectConditionSetsResponse' + /policy.subjectmapping.SubjectMappingService/GetSubjectConditionSet: post: tags: - policy.subjectmapping.SubjectMappingService - summary: ListSubjectConditionSets - operationId: policy.subjectmapping.SubjectMappingService.ListSubjectConditionSets + summary: GetSubjectConditionSet + operationId: policy.subjectmapping.SubjectMappingService.GetSubjectConditionSet parameters: - name: Connect-Protocol-Version in: header @@ -267,7 +268,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.ListSubjectConditionSetsRequest' + $ref: '#/components/schemas/policy.subjectmapping.GetSubjectConditionSetRequest' required: true responses: default: @@ -281,13 +282,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.ListSubjectConditionSetsResponse' - /policy.subjectmapping.SubjectMappingService/ListSubjectMappings: + $ref: '#/components/schemas/policy.subjectmapping.GetSubjectConditionSetResponse' + /policy.subjectmapping.SubjectMappingService/CreateSubjectConditionSet: post: tags: - policy.subjectmapping.SubjectMappingService - summary: ListSubjectMappings - operationId: policy.subjectmapping.SubjectMappingService.ListSubjectMappings + summary: CreateSubjectConditionSet + operationId: policy.subjectmapping.SubjectMappingService.CreateSubjectConditionSet parameters: - name: Connect-Protocol-Version in: header @@ -302,7 +303,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.ListSubjectMappingsRequest' + $ref: '#/components/schemas/policy.subjectmapping.CreateSubjectConditionSetRequest' required: true responses: default: @@ -316,14 +317,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.ListSubjectMappingsResponse' - /policy.subjectmapping.SubjectMappingService/MatchSubjectMappings: + $ref: '#/components/schemas/policy.subjectmapping.CreateSubjectConditionSetResponse' + /policy.subjectmapping.SubjectMappingService/UpdateSubjectConditionSet: post: tags: - policy.subjectmapping.SubjectMappingService - summary: MatchSubjectMappings - description: Find matching Subject Mappings for a given Subject - operationId: policy.subjectmapping.SubjectMappingService.MatchSubjectMappings + summary: UpdateSubjectConditionSet + operationId: policy.subjectmapping.SubjectMappingService.UpdateSubjectConditionSet parameters: - name: Connect-Protocol-Version in: header @@ -338,7 +338,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.MatchSubjectMappingsRequest' + $ref: '#/components/schemas/policy.subjectmapping.UpdateSubjectConditionSetRequest' required: true responses: default: @@ -352,13 +352,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.MatchSubjectMappingsResponse' - /policy.subjectmapping.SubjectMappingService/UpdateSubjectConditionSet: + $ref: '#/components/schemas/policy.subjectmapping.UpdateSubjectConditionSetResponse' + /policy.subjectmapping.SubjectMappingService/DeleteSubjectConditionSet: post: tags: - policy.subjectmapping.SubjectMappingService - summary: UpdateSubjectConditionSet - operationId: policy.subjectmapping.SubjectMappingService.UpdateSubjectConditionSet + summary: DeleteSubjectConditionSet + operationId: policy.subjectmapping.SubjectMappingService.DeleteSubjectConditionSet parameters: - name: Connect-Protocol-Version in: header @@ -373,7 +373,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.UpdateSubjectConditionSetRequest' + $ref: '#/components/schemas/policy.subjectmapping.DeleteSubjectConditionSetRequest' required: true responses: default: @@ -387,13 +387,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.UpdateSubjectConditionSetResponse' - /policy.subjectmapping.SubjectMappingService/UpdateSubjectMapping: + $ref: '#/components/schemas/policy.subjectmapping.DeleteSubjectConditionSetResponse' + /policy.subjectmapping.SubjectMappingService/DeleteAllUnmappedSubjectConditionSets: post: tags: - policy.subjectmapping.SubjectMappingService - summary: UpdateSubjectMapping - operationId: policy.subjectmapping.SubjectMappingService.UpdateSubjectMapping + summary: DeleteAllUnmappedSubjectConditionSets + operationId: policy.subjectmapping.SubjectMappingService.DeleteAllUnmappedSubjectConditionSets parameters: - name: Connect-Protocol-Version in: header @@ -408,7 +408,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.UpdateSubjectMappingRequest' + $ref: '#/components/schemas/policy.subjectmapping.DeleteAllUnmappedSubjectConditionSetsRequest' required: true responses: default: @@ -422,9 +422,110 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.subjectmapping.UpdateSubjectMappingResponse' + $ref: '#/components/schemas/policy.subjectmapping.DeleteAllUnmappedSubjectConditionSetsResponse' components: schemas: + common.MetadataUpdateEnum: + type: string + title: MetadataUpdateEnum + enum: + - METADATA_UPDATE_ENUM_UNSPECIFIED + - METADATA_UPDATE_ENUM_EXTEND + - METADATA_UPDATE_ENUM_REPLACE + policy.Action.StandardAction: + type: string + title: StandardAction + enum: + - STANDARD_ACTION_UNSPECIFIED + - STANDARD_ACTION_DECRYPT + - STANDARD_ACTION_TRANSMIT + policy.Algorithm: + type: string + title: Algorithm + enum: + - ALGORITHM_UNSPECIFIED + - ALGORITHM_RSA_2048 + - ALGORITHM_RSA_4096 + - ALGORITHM_EC_P256 + - ALGORITHM_EC_P384 + - ALGORITHM_EC_P521 + - ALGORITHM_HPQT_XWING + - ALGORITHM_HPQT_SECP256R1_MLKEM768 + - ALGORITHM_HPQT_SECP384R1_MLKEM1024 + description: Supported key algorithms. + policy.AttributeRuleTypeEnum: + type: string + title: AttributeRuleTypeEnum + enum: + - ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED + - ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF + - ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF + - ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY + policy.ConditionBooleanTypeEnum: + type: string + title: ConditionBooleanTypeEnum + enum: + - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED + - CONDITION_BOOLEAN_TYPE_ENUM_AND + - CONDITION_BOOLEAN_TYPE_ENUM_OR + policy.KasPublicKeyAlgEnum: + type: string + title: KasPublicKeyAlgEnum + enum: + - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 + policy.SortDirection: + type: string + title: SortDirection + enum: + - SORT_DIRECTION_UNSPECIFIED + - SORT_DIRECTION_ASC + - SORT_DIRECTION_DESC + description: |- + Sorting direction shared across list APIs. + When the 'sort' field is omitted or the chosen sort 'field' is UNSPECIFIED, + the endpoint's request message defines the default ordering; see the + specific List* request docs. + policy.SourceType: + type: string + title: SourceType + enum: + - SOURCE_TYPE_UNSPECIFIED + - SOURCE_TYPE_INTERNAL + - SOURCE_TYPE_EXTERNAL + description: |- + Describes whether this kas is managed by the organization or if they imported + the kas information from an external party. These two modes are necessary in order + to encrypt a tdf dek with an external parties kas public key. + policy.SubjectMappingOperatorEnum: + type: string + title: SubjectMappingOperatorEnum + enum: + - SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED + - SUBJECT_MAPPING_OPERATOR_ENUM_IN + - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN + - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS + policy.subjectmapping.SortSubjectConditionSetsType: + type: string + title: SortSubjectConditionSetsType + enum: + - SORT_SUBJECT_CONDITION_SETS_TYPE_UNSPECIFIED + - SORT_SUBJECT_CONDITION_SETS_TYPE_CREATED_AT + - SORT_SUBJECT_CONDITION_SETS_TYPE_UPDATED_AT + policy.subjectmapping.SortSubjectMappingsType: + type: string + title: SortSubjectMappingsType + enum: + - SORT_SUBJECT_MAPPINGS_TYPE_UNSPECIFIED + - SORT_SUBJECT_MAPPINGS_TYPE_CREATED_AT + - SORT_SUBJECT_MAPPINGS_TYPE_UPDATED_AT common.Metadata: type: object properties: @@ -480,82 +581,6 @@ components: title: value title: LabelsEntry additionalProperties: false - common.MetadataUpdateEnum: - type: string - title: MetadataUpdateEnum - enum: - - METADATA_UPDATE_ENUM_UNSPECIFIED - - METADATA_UPDATE_ENUM_EXTEND - - METADATA_UPDATE_ENUM_REPLACE - connect-protocol-version: - type: number - title: Connect-Protocol-Version - enum: - - 1 - description: Define the version of the Connect protocol - const: 1 - connect-timeout-header: - type: number - title: Connect-Timeout-Ms - description: Define the timeout, in ms - connect.error: - type: object - properties: - code: - type: string - examples: - - not_found - enum: - - canceled - - unknown - - invalid_argument - - deadline_exceeded - - not_found - - already_exists - - permission_denied - - resource_exhausted - - failed_precondition - - aborted - - out_of_range - - unimplemented - - internal - - unavailable - - data_loss - - unauthenticated - description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. - message: - type: string - description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. - details: - type: array - items: - $ref: '#/components/schemas/connect.error_details.Any' - description: A list of messages that carry the error details. There is no limit on the number of messages. - title: Connect Error - additionalProperties: true - description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' - connect.error_details.Any: - type: object - properties: - type: - type: string - description: 'A URL that acts as a globally unique identifier for the type of the serialized message. For example: `type.googleapis.com/google.rpc.ErrorInfo`. This is used to determine the schema of the data in the `value` field and is the discriminator for the `debug` field.' - value: - type: string - format: binary - description: The Protobuf message, serialized as bytes and base64-encoded. The specific message type is identified by the `type` field. - debug: - oneOf: - - type: object - title: Any - additionalProperties: true - description: Detailed error information. - discriminator: - propertyName: type - title: Debug - description: Deserialized error detail payload. The 'type' field indicates the schema. This field is for easier debugging and should not be relied upon for application logic. - additionalProperties: true - description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message, with an additional debug field for ConnectRPC error details. google.protobuf.BoolValue: type: boolean description: |- @@ -568,8 +593,8 @@ components: google.protobuf.Timestamp: type: string examples: - - "2023-01-15T01:30:15.01Z" - - "2024-12-25T12:00:00Z" + - 1s + - 1.000340012s format: date-time description: |- A Timestamp represents a point in time independent of any time zone or local @@ -663,65 +688,41 @@ components: ) to obtain a formatter capable of generating timestamps in this format. policy.Action: type: object - allOf: + oneOf: - properties: - id: - type: string - title: id - description: Generated uuid in database - name: + custom: type: string - title: name - namespace: - title: namespace - description: Namespace context for this action - $ref: '#/components/schemas/policy.Namespace' - metadata: - title: metadata - $ref: '#/components/schemas/common.Metadata' - - oneOf: - - type: object - properties: - custom: - type: string - title: custom - description: Deprecated title: custom - required: - - custom - - type: object - properties: - standard: - title: standard - description: Deprecated - $ref: '#/components/schemas/policy.Action.StandardAction' + description: Deprecated + title: custom + required: + - custom + - properties: + standard: title: standard - required: - - standard + description: Deprecated + $ref: '#/components/schemas/policy.Action.StandardAction' + title: standard + required: + - standard + properties: + id: + type: string + title: id + description: Generated uuid in database + name: + type: string + title: name + namespace: + title: namespace + description: Namespace context for this action + $ref: '#/components/schemas/policy.Namespace' + metadata: + title: metadata + $ref: '#/components/schemas/common.Metadata' title: Action additionalProperties: false description: An action an entity can take - policy.Action.StandardAction: - type: string - title: StandardAction - enum: - - STANDARD_ACTION_UNSPECIFIED - - STANDARD_ACTION_DECRYPT - - STANDARD_ACTION_TRANSMIT - policy.Algorithm: - type: string - title: Algorithm - enum: - - ALGORITHM_UNSPECIFIED - - ALGORITHM_RSA_2048 - - ALGORITHM_RSA_4096 - - ALGORITHM_EC_P256 - - ALGORITHM_EC_P384 - - ALGORITHM_EC_P521 - - ALGORITHM_HPQT_XWING - - ALGORITHM_HPQT_SECP256R1_MLKEM768 - - ALGORITHM_HPQT_SECP384R1_MLKEM1024 - description: Supported key algorithms. policy.Attribute: type: object properties: @@ -778,14 +779,6 @@ components: required: - rule additionalProperties: false - policy.AttributeRuleTypeEnum: - type: string - title: AttributeRuleTypeEnum - enum: - - ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED - - ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF - - ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF - - ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY policy.Condition: type: object properties: @@ -803,6 +796,7 @@ components: type: array items: type: string + minItems: 1 title: subject_external_values minItems: 1 description: |- @@ -818,13 +812,6 @@ components: * A Condition defines a rule of - policy.ConditionBooleanTypeEnum: - type: string - title: ConditionBooleanTypeEnum - enum: - - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED - - CONDITION_BOOLEAN_TYPE_ENUM_AND - - CONDITION_BOOLEAN_TYPE_ENUM_OR policy.ConditionGroup: type: object properties: @@ -861,7 +848,7 @@ components: alg: not: enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - 0 title: alg description: |- A known algorithm type with any additional parameters encoded. @@ -873,19 +860,6 @@ components: description: |- Deprecated A KAS public key and some associated metadata for further identifcation - policy.KasPublicKeyAlgEnum: - type: string - title: KasPublicKeyAlgEnum - enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 policy.KasPublicKeySet: type: object properties: @@ -908,9 +882,13 @@ components: uri: type: string title: uri - description: | + description: |+ Address of a KAS instance - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https?://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(:[0-9]+)?(/.*)?$') + ``` + publicKey: title: public_key description: 'Deprecated: KAS can have multiple key pairs' @@ -1108,8 +1086,7 @@ components: policy.PublicKey: type: object oneOf: - - type: object - properties: + - properties: cached: title: cached description: public key with additional information. Current preferred version @@ -1117,14 +1094,17 @@ components: title: cached required: - cached - - type: object - properties: + - properties: remote: type: string title: remote - description: | + description: |+ kas public key url - optional since can also be retrieved via public key - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(/.*)?$') + ``` + title: remote required: - remote @@ -1239,29 +1219,6 @@ components: title: pem title: SimpleKasPublicKey additionalProperties: false - policy.SortDirection: - type: string - title: SortDirection - enum: - - SORT_DIRECTION_UNSPECIFIED - - SORT_DIRECTION_ASC - - SORT_DIRECTION_DESC - description: |- - Sorting direction shared across list APIs. - When the 'sort' field is omitted or the chosen sort 'field' is UNSPECIFIED, - the endpoint's request message defines the default ordering; see the - specific List* request docs. - policy.SourceType: - type: string - title: SourceType - enum: - - SOURCE_TYPE_UNSPECIFIED - - SOURCE_TYPE_INTERNAL - - SOURCE_TYPE_EXTERNAL - description: |- - Describes whether this kas is managed by the organization or if they imported - the kas information from an external party. These two modes are necessary in order - to encrypt a tdf dek with an external parties kas public key. policy.SubjectConditionSet: type: object properties: @@ -1327,14 +1284,6 @@ components: description: |- Subject Mapping: A Policy assigning Subject Set(s) to a permitted attribute value + action(s) combination - policy.SubjectMappingOperatorEnum: - type: string - title: SubjectMappingOperatorEnum - enum: - - SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED - - SUBJECT_MAPPING_OPERATOR_ENUM_IN - - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN - - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS policy.SubjectProperty: type: object properties: @@ -1469,17 +1418,25 @@ components: $ref: '#/components/schemas/policy.Action' title: actions minItems: 1 - description: | + description: |+ Required The actions permitted by subjects in this mapping - action_name_or_id_not_empty // Action name or ID must not be empty if provided + Action name or ID must not be empty if provided: + ``` + this.all(item, item.name != '' || item.id != '') + ``` + existingSubjectConditionSetId: type: string title: existing_subject_condition_set_id - description: | + description: |+ Either of the following: Reuse existing SubjectConditionSet (NOTE: prioritized over new_subject_condition_set) - optional_uuid_format // Optional field must be a valid UUID + Optional field must be a valid UUID: + ``` + size(this) == 0 || this.matches('[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}') + ``` + newSubjectConditionSet: title: new_subject_condition_set description: 'Create new SubjectConditionSet (NOTE: ignored if existing_subject_condition_set_id is provided)' @@ -1716,20 +1673,6 @@ components: title: subject_mappings title: MatchSubjectMappingsResponse additionalProperties: false - policy.subjectmapping.SortSubjectConditionSetsType: - type: string - title: SortSubjectConditionSetsType - enum: - - SORT_SUBJECT_CONDITION_SETS_TYPE_UNSPECIFIED - - SORT_SUBJECT_CONDITION_SETS_TYPE_CREATED_AT - - SORT_SUBJECT_CONDITION_SETS_TYPE_UPDATED_AT - policy.subjectmapping.SortSubjectMappingsType: - type: string - title: SortSubjectMappingsType - enum: - - SORT_SUBJECT_MAPPINGS_TYPE_UNSPECIFIED - - SORT_SUBJECT_MAPPINGS_TYPE_CREATED_AT - - SORT_SUBJECT_MAPPINGS_TYPE_UPDATED_AT policy.subjectmapping.SubjectConditionSetCreate: type: object properties: @@ -1815,19 +1758,27 @@ components: subjectConditionSetId: type: string title: subject_condition_set_id - description: | + description: |+ Optional Replaces the existing SubjectConditionSet id with a new one - optional_uuid_format // Optional field must be a valid UUID + Optional field must be a valid UUID: + ``` + size(this) == 0 || this.matches('[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}') + ``` + actions: type: array items: $ref: '#/components/schemas/policy.Action' title: actions - description: | + description: |+ Optional Replaces entire list of actions permitted by subjects - action_name_or_id_not_empty // Action name or ID must not be empty if provided + Action name or ID must not be empty if provided: + ``` + this.size() == 0 || this.all(item, item.name != '' || item.id != '') + ``` + metadata: title: metadata description: Common metadata @@ -1846,6 +1797,63 @@ components: $ref: '#/components/schemas/policy.SubjectMapping' title: UpdateSubjectMappingResponse additionalProperties: false + connect-protocol-version: + type: number + title: Connect-Protocol-Version + enum: + - 1 + description: Define the version of the Connect protocol + const: 1 + connect-timeout-header: + type: number + title: Connect-Timeout-Ms + description: Define the timeout, in ms + connect.error: + type: object + properties: + code: + type: string + examples: + - not_found + enum: + - canceled + - unknown + - invalid_argument + - deadline_exceeded + - not_found + - already_exists + - permission_denied + - resource_exhausted + - failed_precondition + - aborted + - out_of_range + - unimplemented + - internal + - unavailable + - data_loss + - unauthenticated + description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. + message: + type: string + description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. + detail: + $ref: '#/components/schemas/google.protobuf.Any' + title: Connect Error + additionalProperties: true + description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' + google.protobuf.Any: + type: object + properties: + type: + type: string + value: + type: string + format: binary + debug: + type: object + additionalProperties: true + additionalProperties: true + description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. security: [] tags: - name: policy.subjectmapping.SubjectMappingService diff --git a/docs/openapi/policy/unsafe/unsafe.openapi.yaml b/docs/openapi/policy/unsafe/unsafe.openapi.yaml index 37d771cec2..09ebdf2e85 100644 --- a/docs/openapi/policy/unsafe/unsafe.openapi.yaml +++ b/docs/openapi/policy/unsafe/unsafe.openapi.yaml @@ -2,12 +2,16 @@ openapi: 3.1.0 info: title: policy.unsafe paths: - /policy.unsafe.UnsafeService/UnsafeDeleteAttribute: + /policy.unsafe.UnsafeService/UnsafeUpdateNamespace: post: tags: - policy.unsafe.UnsafeService - summary: UnsafeDeleteAttribute - operationId: policy.unsafe.UnsafeService.UnsafeDeleteAttribute + summary: UnsafeUpdateNamespace + description: |- + --------------------------------------* + Namespace RPCs + --------------------------------------- + operationId: policy.unsafe.UnsafeService.UnsafeUpdateNamespace parameters: - name: Connect-Protocol-Version in: header @@ -22,7 +26,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.unsafe.UnsafeDeleteAttributeRequest' + $ref: '#/components/schemas/policy.unsafe.UnsafeUpdateNamespaceRequest' required: true responses: default: @@ -36,13 +40,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.unsafe.UnsafeDeleteAttributeResponse' - /policy.unsafe.UnsafeService/UnsafeDeleteAttributeValue: + $ref: '#/components/schemas/policy.unsafe.UnsafeUpdateNamespaceResponse' + /policy.unsafe.UnsafeService/UnsafeReactivateNamespace: post: tags: - policy.unsafe.UnsafeService - summary: UnsafeDeleteAttributeValue - operationId: policy.unsafe.UnsafeService.UnsafeDeleteAttributeValue + summary: UnsafeReactivateNamespace + operationId: policy.unsafe.UnsafeService.UnsafeReactivateNamespace parameters: - name: Connect-Protocol-Version in: header @@ -57,7 +61,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.unsafe.UnsafeDeleteAttributeValueRequest' + $ref: '#/components/schemas/policy.unsafe.UnsafeReactivateNamespaceRequest' required: true responses: default: @@ -71,17 +75,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.unsafe.UnsafeDeleteAttributeValueResponse' - /policy.unsafe.UnsafeService/UnsafeDeleteKasKey: + $ref: '#/components/schemas/policy.unsafe.UnsafeReactivateNamespaceResponse' + /policy.unsafe.UnsafeService/UnsafeDeleteNamespace: post: tags: - policy.unsafe.UnsafeService - summary: UnsafeDeleteKasKey - description: |- - --------------------------------------* - Kas Key RPCs - --------------------------------------- - operationId: policy.unsafe.UnsafeService.UnsafeDeleteKasKey + summary: UnsafeDeleteNamespace + operationId: policy.unsafe.UnsafeService.UnsafeDeleteNamespace parameters: - name: Connect-Protocol-Version in: header @@ -96,7 +96,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.unsafe.UnsafeDeleteKasKeyRequest' + $ref: '#/components/schemas/policy.unsafe.UnsafeDeleteNamespaceRequest' required: true responses: default: @@ -110,13 +110,17 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.unsafe.UnsafeDeleteKasKeyResponse' - /policy.unsafe.UnsafeService/UnsafeDeleteNamespace: + $ref: '#/components/schemas/policy.unsafe.UnsafeDeleteNamespaceResponse' + /policy.unsafe.UnsafeService/UnsafeUpdateAttribute: post: tags: - policy.unsafe.UnsafeService - summary: UnsafeDeleteNamespace - operationId: policy.unsafe.UnsafeService.UnsafeDeleteNamespace + summary: UnsafeUpdateAttribute + description: |- + --------------------------------------* + Attribute RPCs + --------------------------------------- + operationId: policy.unsafe.UnsafeService.UnsafeUpdateAttribute parameters: - name: Connect-Protocol-Version in: header @@ -131,7 +135,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.unsafe.UnsafeDeleteNamespaceRequest' + $ref: '#/components/schemas/policy.unsafe.UnsafeUpdateAttributeRequest' required: true responses: default: @@ -145,7 +149,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.unsafe.UnsafeDeleteNamespaceResponse' + $ref: '#/components/schemas/policy.unsafe.UnsafeUpdateAttributeResponse' /policy.unsafe.UnsafeService/UnsafeReactivateAttribute: post: tags: @@ -181,12 +185,12 @@ paths: application/json: schema: $ref: '#/components/schemas/policy.unsafe.UnsafeReactivateAttributeResponse' - /policy.unsafe.UnsafeService/UnsafeReactivateAttributeValue: + /policy.unsafe.UnsafeService/UnsafeDeleteAttribute: post: tags: - policy.unsafe.UnsafeService - summary: UnsafeReactivateAttributeValue - operationId: policy.unsafe.UnsafeService.UnsafeReactivateAttributeValue + summary: UnsafeDeleteAttribute + operationId: policy.unsafe.UnsafeService.UnsafeDeleteAttribute parameters: - name: Connect-Protocol-Version in: header @@ -201,7 +205,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.unsafe.UnsafeReactivateAttributeValueRequest' + $ref: '#/components/schemas/policy.unsafe.UnsafeDeleteAttributeRequest' required: true responses: default: @@ -215,13 +219,17 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.unsafe.UnsafeReactivateAttributeValueResponse' - /policy.unsafe.UnsafeService/UnsafeReactivateNamespace: + $ref: '#/components/schemas/policy.unsafe.UnsafeDeleteAttributeResponse' + /policy.unsafe.UnsafeService/UnsafeUpdateAttributeValue: post: tags: - policy.unsafe.UnsafeService - summary: UnsafeReactivateNamespace - operationId: policy.unsafe.UnsafeService.UnsafeReactivateNamespace + summary: UnsafeUpdateAttributeValue + description: |- + --------------------------------------* + Value RPCs + --------------------------------------- + operationId: policy.unsafe.UnsafeService.UnsafeUpdateAttributeValue parameters: - name: Connect-Protocol-Version in: header @@ -236,7 +244,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.unsafe.UnsafeReactivateNamespaceRequest' + $ref: '#/components/schemas/policy.unsafe.UnsafeUpdateAttributeValueRequest' required: true responses: default: @@ -250,17 +258,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.unsafe.UnsafeReactivateNamespaceResponse' - /policy.unsafe.UnsafeService/UnsafeUpdateAttribute: + $ref: '#/components/schemas/policy.unsafe.UnsafeUpdateAttributeValueResponse' + /policy.unsafe.UnsafeService/UnsafeReactivateAttributeValue: post: tags: - policy.unsafe.UnsafeService - summary: UnsafeUpdateAttribute - description: |- - --------------------------------------* - Attribute RPCs - --------------------------------------- - operationId: policy.unsafe.UnsafeService.UnsafeUpdateAttribute + summary: UnsafeReactivateAttributeValue + operationId: policy.unsafe.UnsafeService.UnsafeReactivateAttributeValue parameters: - name: Connect-Protocol-Version in: header @@ -275,7 +279,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.unsafe.UnsafeUpdateAttributeRequest' + $ref: '#/components/schemas/policy.unsafe.UnsafeReactivateAttributeValueRequest' required: true responses: default: @@ -289,17 +293,13 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.unsafe.UnsafeUpdateAttributeResponse' - /policy.unsafe.UnsafeService/UnsafeUpdateAttributeValue: + $ref: '#/components/schemas/policy.unsafe.UnsafeReactivateAttributeValueResponse' + /policy.unsafe.UnsafeService/UnsafeDeleteAttributeValue: post: tags: - policy.unsafe.UnsafeService - summary: UnsafeUpdateAttributeValue - description: |- - --------------------------------------* - Value RPCs - --------------------------------------- - operationId: policy.unsafe.UnsafeService.UnsafeUpdateAttributeValue + summary: UnsafeDeleteAttributeValue + operationId: policy.unsafe.UnsafeService.UnsafeDeleteAttributeValue parameters: - name: Connect-Protocol-Version in: header @@ -314,7 +314,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.unsafe.UnsafeUpdateAttributeValueRequest' + $ref: '#/components/schemas/policy.unsafe.UnsafeDeleteAttributeValueRequest' required: true responses: default: @@ -328,17 +328,17 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.unsafe.UnsafeUpdateAttributeValueResponse' - /policy.unsafe.UnsafeService/UnsafeUpdateNamespace: + $ref: '#/components/schemas/policy.unsafe.UnsafeDeleteAttributeValueResponse' + /policy.unsafe.UnsafeService/UnsafeDeleteKasKey: post: tags: - policy.unsafe.UnsafeService - summary: UnsafeUpdateNamespace + summary: UnsafeDeleteKasKey description: |- --------------------------------------* - Namespace RPCs + Kas Key RPCs --------------------------------------- - operationId: policy.unsafe.UnsafeService.UnsafeUpdateNamespace + operationId: policy.unsafe.UnsafeService.UnsafeDeleteKasKey parameters: - name: Connect-Protocol-Version in: header @@ -353,7 +353,7 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.unsafe.UnsafeUpdateNamespaceRequest' + $ref: '#/components/schemas/policy.unsafe.UnsafeDeleteKasKeyRequest' required: true responses: default: @@ -367,9 +367,95 @@ paths: content: application/json: schema: - $ref: '#/components/schemas/policy.unsafe.UnsafeUpdateNamespaceResponse' + $ref: '#/components/schemas/policy.unsafe.UnsafeDeleteKasKeyResponse' components: schemas: + policy.Action.StandardAction: + type: string + title: StandardAction + enum: + - STANDARD_ACTION_UNSPECIFIED + - STANDARD_ACTION_DECRYPT + - STANDARD_ACTION_TRANSMIT + policy.Algorithm: + type: string + title: Algorithm + enum: + - ALGORITHM_UNSPECIFIED + - ALGORITHM_RSA_2048 + - ALGORITHM_RSA_4096 + - ALGORITHM_EC_P256 + - ALGORITHM_EC_P384 + - ALGORITHM_EC_P521 + - ALGORITHM_HPQT_XWING + - ALGORITHM_HPQT_SECP256R1_MLKEM768 + - ALGORITHM_HPQT_SECP384R1_MLKEM1024 + description: Supported key algorithms. + policy.AttributeRuleTypeEnum: + type: string + title: AttributeRuleTypeEnum + enum: + - ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED + - ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF + - ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF + - ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY + policy.ConditionBooleanTypeEnum: + type: string + title: ConditionBooleanTypeEnum + enum: + - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED + - CONDITION_BOOLEAN_TYPE_ENUM_AND + - CONDITION_BOOLEAN_TYPE_ENUM_OR + policy.KasPublicKeyAlgEnum: + type: string + title: KasPublicKeyAlgEnum + enum: + - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 + - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 + - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 + - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 + policy.KeyMode: + type: string + title: KeyMode + enum: + - KEY_MODE_UNSPECIFIED + - KEY_MODE_CONFIG_ROOT_KEY + - KEY_MODE_PROVIDER_ROOT_KEY + - KEY_MODE_REMOTE + - KEY_MODE_PUBLIC_KEY_ONLY + description: Describes the management and operational mode of a cryptographic key. + policy.KeyStatus: + type: string + title: KeyStatus + enum: + - KEY_STATUS_UNSPECIFIED + - KEY_STATUS_ACTIVE + - KEY_STATUS_ROTATED + description: The status of the key + policy.SourceType: + type: string + title: SourceType + enum: + - SOURCE_TYPE_UNSPECIFIED + - SOURCE_TYPE_INTERNAL + - SOURCE_TYPE_EXTERNAL + description: |- + Describes whether this kas is managed by the organization or if they imported + the kas information from an external party. These two modes are necessary in order + to encrypt a tdf dek with an external parties kas public key. + policy.SubjectMappingOperatorEnum: + type: string + title: SubjectMappingOperatorEnum + enum: + - SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED + - SUBJECT_MAPPING_OPERATOR_ENUM_IN + - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN + - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS common.Metadata: type: object properties: @@ -402,75 +488,6 @@ components: title: value title: LabelsEntry additionalProperties: false - connect-protocol-version: - type: number - title: Connect-Protocol-Version - enum: - - 1 - description: Define the version of the Connect protocol - const: 1 - connect-timeout-header: - type: number - title: Connect-Timeout-Ms - description: Define the timeout, in ms - connect.error: - type: object - properties: - code: - type: string - examples: - - not_found - enum: - - canceled - - unknown - - invalid_argument - - deadline_exceeded - - not_found - - already_exists - - permission_denied - - resource_exhausted - - failed_precondition - - aborted - - out_of_range - - unimplemented - - internal - - unavailable - - data_loss - - unauthenticated - description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. - message: - type: string - description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. - details: - type: array - items: - $ref: '#/components/schemas/connect.error_details.Any' - description: A list of messages that carry the error details. There is no limit on the number of messages. - title: Connect Error - additionalProperties: true - description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' - connect.error_details.Any: - type: object - properties: - type: - type: string - description: 'A URL that acts as a globally unique identifier for the type of the serialized message. For example: `type.googleapis.com/google.rpc.ErrorInfo`. This is used to determine the schema of the data in the `value` field and is the discriminator for the `debug` field.' - value: - type: string - format: binary - description: The Protobuf message, serialized as bytes and base64-encoded. The specific message type is identified by the `type` field. - debug: - oneOf: - - type: object - title: Any - additionalProperties: true - description: Detailed error information. - discriminator: - propertyName: type - title: Debug - description: Deserialized error detail payload. The 'type' field indicates the schema. This field is for easier debugging and should not be relied upon for application logic. - additionalProperties: true - description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message, with an additional debug field for ConnectRPC error details. google.protobuf.BoolValue: type: boolean description: |- @@ -483,8 +500,8 @@ components: google.protobuf.Timestamp: type: string examples: - - "2023-01-15T01:30:15.01Z" - - "2024-12-25T12:00:00Z" + - 1s + - 1.000340012s format: date-time description: |- A Timestamp represents a point in time independent of any time zone or local @@ -578,65 +595,41 @@ components: ) to obtain a formatter capable of generating timestamps in this format. policy.Action: type: object - allOf: + oneOf: - properties: - id: + custom: type: string - title: id - description: Generated uuid in database - name: - type: string - title: name - namespace: - title: namespace - description: Namespace context for this action - $ref: '#/components/schemas/policy.Namespace' - metadata: - title: metadata - $ref: '#/components/schemas/common.Metadata' - - oneOf: - - type: object - properties: - custom: - type: string - title: custom - description: Deprecated title: custom - required: - - custom - - type: object - properties: - standard: - title: standard - description: Deprecated - $ref: '#/components/schemas/policy.Action.StandardAction' + description: Deprecated + title: custom + required: + - custom + - properties: + standard: title: standard - required: - - standard + description: Deprecated + $ref: '#/components/schemas/policy.Action.StandardAction' + title: standard + required: + - standard + properties: + id: + type: string + title: id + description: Generated uuid in database + name: + type: string + title: name + namespace: + title: namespace + description: Namespace context for this action + $ref: '#/components/schemas/policy.Namespace' + metadata: + title: metadata + $ref: '#/components/schemas/common.Metadata' title: Action additionalProperties: false description: An action an entity can take - policy.Action.StandardAction: - type: string - title: StandardAction - enum: - - STANDARD_ACTION_UNSPECIFIED - - STANDARD_ACTION_DECRYPT - - STANDARD_ACTION_TRANSMIT - policy.Algorithm: - type: string - title: Algorithm - enum: - - ALGORITHM_UNSPECIFIED - - ALGORITHM_RSA_2048 - - ALGORITHM_RSA_4096 - - ALGORITHM_EC_P256 - - ALGORITHM_EC_P384 - - ALGORITHM_EC_P521 - - ALGORITHM_HPQT_XWING - - ALGORITHM_HPQT_SECP256R1_MLKEM768 - - ALGORITHM_HPQT_SECP384R1_MLKEM1024 - description: Supported key algorithms. policy.AsymmetricKey: type: object properties: @@ -738,14 +731,6 @@ components: required: - rule additionalProperties: false - policy.AttributeRuleTypeEnum: - type: string - title: AttributeRuleTypeEnum - enum: - - ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED - - ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF - - ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF - - ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY policy.Condition: type: object properties: @@ -763,6 +748,7 @@ components: type: array items: type: string + minItems: 1 title: subject_external_values minItems: 1 description: |- @@ -778,13 +764,6 @@ components: * A Condition defines a rule of - policy.ConditionBooleanTypeEnum: - type: string - title: ConditionBooleanTypeEnum - enum: - - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED - - CONDITION_BOOLEAN_TYPE_ENUM_AND - - CONDITION_BOOLEAN_TYPE_ENUM_OR policy.ConditionGroup: type: object properties: @@ -835,7 +814,7 @@ components: alg: not: enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED + - 0 title: alg description: |- A known algorithm type with any additional parameters encoded. @@ -847,19 +826,6 @@ components: description: |- Deprecated A KAS public key and some associated metadata for further identifcation - policy.KasPublicKeyAlgEnum: - type: string - title: KasPublicKeyAlgEnum - enum: - - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048 - - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1 - - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768 - - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024 policy.KasPublicKeySet: type: object properties: @@ -882,9 +848,13 @@ components: uri: type: string title: uri - description: | + description: |+ Address of a KAS instance - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https?://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(:[0-9]+)?(/.*)?$') + ``` + publicKey: title: public_key description: 'Deprecated: KAS can have multiple key pairs' @@ -912,16 +882,6 @@ components: title: KeyAccessServer additionalProperties: false description: Key Access Server Registry - policy.KeyMode: - type: string - title: KeyMode - enum: - - KEY_MODE_UNSPECIFIED - - KEY_MODE_CONFIG_ROOT_KEY - - KEY_MODE_PROVIDER_ROOT_KEY - - KEY_MODE_REMOTE - - KEY_MODE_PUBLIC_KEY_ONLY - description: Describes the management and operational mode of a cryptographic key. policy.KeyProviderConfig: type: object properties: @@ -944,14 +904,6 @@ components: $ref: '#/components/schemas/common.Metadata' title: KeyProviderConfig additionalProperties: false - policy.KeyStatus: - type: string - title: KeyStatus - enum: - - KEY_STATUS_UNSPECIFIED - - KEY_STATUS_ACTIVE - - KEY_STATUS_ROTATED - description: The status of the key policy.Namespace: type: object properties: @@ -1094,8 +1046,7 @@ components: policy.PublicKey: type: object oneOf: - - type: object - properties: + - properties: cached: title: cached description: public key with additional information. Current preferred version @@ -1103,14 +1054,17 @@ components: title: cached required: - cached - - type: object - properties: + - properties: remote: type: string title: remote - description: | + description: |+ kas public key url - optional since can also be retrieved via public key - uri_format // URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes. + URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.: + ``` + this.matches('^https://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(/.*)?$') + ``` + title: remote required: - remote @@ -1235,17 +1189,6 @@ components: title: pem title: SimpleKasPublicKey additionalProperties: false - policy.SourceType: - type: string - title: SourceType - enum: - - SOURCE_TYPE_UNSPECIFIED - - SOURCE_TYPE_INTERNAL - - SOURCE_TYPE_EXTERNAL - description: |- - Describes whether this kas is managed by the organization or if they imported - the kas information from an external party. These two modes are necessary in order - to encrypt a tdf dek with an external parties kas public key. policy.SubjectConditionSet: type: object properties: @@ -1311,14 +1254,6 @@ components: description: |- Subject Mapping: A Policy assigning Subject Set(s) to a permitted attribute value + action(s) combination - policy.SubjectMappingOperatorEnum: - type: string - title: SubjectMappingOperatorEnum - enum: - - SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED - - SUBJECT_MAPPING_OPERATOR_ENUM_IN - - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN - - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS policy.SubjectSet: type: object properties: @@ -1597,11 +1532,15 @@ components: type: string title: name maxLength: 253 - description: | + description: |+ Optional WARNING!! Updating the name of an Attribute will retroactively alter access to existing TDFs of the old and new Attribute name. - attribute_name_format // Attribute name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored attribute name will be normalized to lower case. + Attribute name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored attribute name will be normalized to lower case.: + ``` + size(this) > 0 ? this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') : true + ``` + rule: title: rule description: |- @@ -1654,9 +1593,13 @@ components: type: string title: value maxLength: 253 - description: | + description: |+ Required - value_format // Attribute Value must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored attribute value will be normalized to lower case. + Attribute Value must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored attribute value will be normalized to lower case.: + ``` + this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') + ``` + title: UnsafeUpdateAttributeValueRequest additionalProperties: false description: |- @@ -1682,9 +1625,13 @@ components: type: string title: name maxLength: 253 - description: | + description: |+ Required - namespace_name_format // Namespace must be a valid hostname. It should include at least one dot, with each segment (label) starting and ending with an alphanumeric character. Each label must be 1 to 63 characters long, allowing hyphens but not as the first or last character. The top-level domain (the last segment after the final dot) must consist of at least two alphabetic characters. The stored namespace will be normalized to lower case. + Namespace must be a valid hostname. It should include at least one dot, with each segment (label) starting and ending with an alphanumeric character. Each label must be 1 to 63 characters long, allowing hyphens but not as the first or last character. The top-level domain (the last segment after the final dot) must consist of at least two alphabetic characters. The stored namespace will be normalized to lower case.: + ``` + this.matches('^([a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?\\.)+[a-zA-Z]{2,}$') + ``` + title: UnsafeUpdateNamespaceRequest additionalProperties: false description: |- @@ -1699,6 +1646,63 @@ components: $ref: '#/components/schemas/policy.Namespace' title: UnsafeUpdateNamespaceResponse additionalProperties: false + connect-protocol-version: + type: number + title: Connect-Protocol-Version + enum: + - 1 + description: Define the version of the Connect protocol + const: 1 + connect-timeout-header: + type: number + title: Connect-Timeout-Ms + description: Define the timeout, in ms + connect.error: + type: object + properties: + code: + type: string + examples: + - not_found + enum: + - canceled + - unknown + - invalid_argument + - deadline_exceeded + - not_found + - already_exists + - permission_denied + - resource_exhausted + - failed_precondition + - aborted + - out_of_range + - unimplemented + - internal + - unavailable + - data_loss + - unauthenticated + description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. + message: + type: string + description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. + detail: + $ref: '#/components/schemas/google.protobuf.Any' + title: Connect Error + additionalProperties: true + description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' + google.protobuf.Any: + type: object + properties: + type: + type: string + value: + type: string + format: binary + debug: + type: object + additionalProperties: true + additionalProperties: true + description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. security: [] tags: - name: policy.unsafe.UnsafeService diff --git a/docs/openapi/wellknownconfiguration/wellknown_configuration.openapi.yaml b/docs/openapi/wellknownconfiguration/wellknown_configuration.openapi.yaml index 203cf0b27e..ad18ddfa64 100644 --- a/docs/openapi/wellknownconfiguration/wellknown_configuration.openapi.yaml +++ b/docs/openapi/wellknownconfiguration/wellknown_configuration.openapi.yaml @@ -39,75 +39,16 @@ paths: $ref: '#/components/schemas/wellknownconfiguration.GetWellKnownConfigurationResponse' components: schemas: - connect-protocol-version: - type: number - title: Connect-Protocol-Version + google.protobuf.NullValue: + type: string + title: NullValue enum: - - 1 - description: Define the version of the Connect protocol - const: 1 - connect-timeout-header: - type: number - title: Connect-Timeout-Ms - description: Define the timeout, in ms - connect.error: - type: object - properties: - code: - type: string - examples: - - not_found - enum: - - canceled - - unknown - - invalid_argument - - deadline_exceeded - - not_found - - already_exists - - permission_denied - - resource_exhausted - - failed_precondition - - aborted - - out_of_range - - unimplemented - - internal - - unavailable - - data_loss - - unauthenticated - description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. - message: - type: string - description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. - details: - type: array - items: - $ref: '#/components/schemas/connect.error_details.Any' - description: A list of messages that carry the error details. There is no limit on the number of messages. - title: Connect Error - additionalProperties: true - description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' - connect.error_details.Any: - type: object - properties: - type: - type: string - description: 'A URL that acts as a globally unique identifier for the type of the serialized message. For example: `type.googleapis.com/google.rpc.ErrorInfo`. This is used to determine the schema of the data in the `value` field and is the discriminator for the `debug` field.' - value: - type: string - format: binary - description: The Protobuf message, serialized as bytes and base64-encoded. The specific message type is identified by the `type` field. - debug: - oneOf: - - type: object - title: Any - additionalProperties: true - description: Detailed error information. - discriminator: - propertyName: type - title: Debug - description: Deserialized error detail payload. The 'type' field indicates the schema. This field is for easier debugging and should not be relied upon for application logic. - additionalProperties: true - description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message, with an additional debug field for ConnectRPC error details. + - NULL_VALUE + description: |- + `NullValue` is a singleton enumeration to represent the null value for the + `Value` type union. + + The JSON representation for `NullValue` is JSON `null`. google.protobuf.ListValue: type: object properties: @@ -123,16 +64,6 @@ components: `ListValue` is a wrapper around a repeated field of values. The JSON representation for `ListValue` is JSON array. - google.protobuf.NullValue: - type: string - title: NullValue - enum: - - NULL_VALUE - description: |- - `NullValue` is a singleton enumeration to represent the null value for the - `Value` type union. - - The JSON representation for `NullValue` is JSON `null`. google.protobuf.Struct: type: object additionalProperties: @@ -207,6 +138,63 @@ components: $ref: '#/components/schemas/google.protobuf.Struct' title: ConfigurationEntry additionalProperties: false + connect-protocol-version: + type: number + title: Connect-Protocol-Version + enum: + - 1 + description: Define the version of the Connect protocol + const: 1 + connect-timeout-header: + type: number + title: Connect-Timeout-Ms + description: Define the timeout, in ms + connect.error: + type: object + properties: + code: + type: string + examples: + - not_found + enum: + - canceled + - unknown + - invalid_argument + - deadline_exceeded + - not_found + - already_exists + - permission_denied + - resource_exhausted + - failed_precondition + - aborted + - out_of_range + - unimplemented + - internal + - unavailable + - data_loss + - unauthenticated + description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. + message: + type: string + description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. + detail: + $ref: '#/components/schemas/google.protobuf.Any' + title: Connect Error + additionalProperties: true + description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation' + google.protobuf.Any: + type: object + properties: + type: + type: string + value: + type: string + format: binary + debug: + type: object + additionalProperties: true + additionalProperties: true + description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. security: [] tags: - name: wellknownconfiguration.WellKnownService diff --git a/protocol/go/authorization/v2/authorization.pb.go b/protocol/go/authorization/v2/authorization.pb.go index 5adec7b3ca..9c1aac68c4 100644 --- a/protocol/go/authorization/v2/authorization.pb.go +++ b/protocol/go/authorization/v2/authorization.pb.go @@ -162,7 +162,7 @@ type isEntityIdentifier_Identifier interface { } type EntityIdentifier_EntityChain struct { - // chain of one or more entities and at most 10 + // chain of one or more entities EntityChain *entity.EntityChain `protobuf:"bytes,1,opt,name=entity_chain,json=entityChain,proto3,oneof"` } @@ -327,7 +327,7 @@ type isResource_Resource interface { } type Resource_AttributeValues_ struct { - // a set of attribute value FQNs, such as those on a TDF, between 1 and 20 in count + // a set of attribute value FQNs, such as those on a TDF, containing at least 1 value AttributeValues *Resource_AttributeValues `protobuf:"bytes,2,opt,name=attribute_values,json=attributeValues,proto3,oneof"` } @@ -543,7 +543,7 @@ func (x *GetDecisionResponse) GetDecision() *ResourceDecision { // // If entitled, checks obligation policy: fulfillable obligations must satisfy all triggered. // -// Note: this is a more performant bulk request for multiple resource decisions, up to 1000 per request +// Note: this is a more performant bulk request for multiple resource decisions type GetDecisionMultiResourceRequest struct { state protoimpl.MessageState sizeCache protoimpl.SizeCache @@ -990,291 +990,280 @@ var file_authorization_v2_authorization_proto_rawDesc = []byte{ 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x77, 0x72, 0x61, 0x70, 0x70, 0x65, 0x72, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x14, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, - 0x22, 0x87, 0x05, 0x0a, 0x10, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x49, 0x64, 0x65, 0x6e, 0x74, - 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0xe1, 0x01, 0x0a, 0x0c, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, + 0x22, 0xe9, 0x04, 0x0a, 0x10, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x49, 0x64, 0x65, 0x6e, 0x74, + 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0xc3, 0x01, 0x0a, 0x0c, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x2e, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x43, 0x68, 0x61, 0x69, - 0x6e, 0x42, 0xa6, 0x01, 0xba, 0x48, 0xa2, 0x01, 0xba, 0x01, 0x9e, 0x01, 0x0a, 0x15, 0x65, 0x6e, + 0x6e, 0x42, 0x88, 0x01, 0xba, 0x48, 0x84, 0x01, 0xba, 0x01, 0x80, 0x01, 0x0a, 0x15, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x12, 0x37, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x69, 0x65, 0x73, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x20, 0x61, - 0x6e, 0x64, 0x20, 0x62, 0x65, 0x74, 0x77, 0x65, 0x65, 0x6e, 0x20, 0x31, 0x20, 0x61, 0x6e, 0x64, - 0x20, 0x31, 0x30, 0x20, 0x69, 0x6e, 0x20, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x1a, 0x4c, 0x68, 0x61, + 0x6e, 0x64, 0x20, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x61, 0x74, 0x20, 0x6c, 0x65, + 0x61, 0x73, 0x74, 0x20, 0x31, 0x20, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x1a, 0x2e, 0x68, 0x61, 0x73, 0x28, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x69, 0x65, 0x73, 0x29, 0x20, 0x26, 0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x69, 0x65, - 0x73, 0x2e, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x29, 0x20, 0x3e, 0x20, 0x30, 0x20, 0x26, 0x26, 0x20, - 0x74, 0x68, 0x69, 0x73, 0x2e, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x69, 0x65, 0x73, 0x2e, 0x73, 0x69, - 0x7a, 0x65, 0x28, 0x29, 0x20, 0x3c, 0x3d, 0x20, 0x31, 0x30, 0x48, 0x00, 0x52, 0x0b, 0x65, 0x6e, - 0x74, 0x69, 0x74, 0x79, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x12, 0x4f, 0x0a, 0x1d, 0x72, 0x65, 0x67, - 0x69, 0x73, 0x74, 0x65, 0x72, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, - 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x66, 0x71, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, - 0x42, 0x0a, 0xba, 0x48, 0x07, 0x72, 0x05, 0x10, 0x01, 0x88, 0x01, 0x01, 0x48, 0x00, 0x52, 0x1a, - 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, - 0x63, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x46, 0x71, 0x6e, 0x12, 0x7b, 0x0a, 0x05, 0x74, 0x6f, - 0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x65, 0x6e, 0x74, 0x69, - 0x74, 0x79, 0x2e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x42, 0x54, 0xba, 0x48, 0x51, 0xba, 0x01, 0x4e, - 0x0a, 0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, - 0x12, 0x16, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, - 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x1a, 0x24, 0x68, 0x61, 0x73, 0x28, 0x74, 0x68, - 0x69, 0x73, 0x2e, 0x6a, 0x77, 0x74, 0x29, 0x20, 0x26, 0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, - 0x6a, 0x77, 0x74, 0x2e, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x29, 0x20, 0x3e, 0x20, 0x30, 0x48, 0x00, - 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0xab, 0x01, 0x0a, 0x12, 0x77, 0x69, 0x74, 0x68, - 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x04, - 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, - 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, - 0x42, 0x5f, 0xba, 0x48, 0x5c, 0xba, 0x01, 0x59, 0x0a, 0x1f, 0x77, 0x69, 0x74, 0x68, 0x5f, 0x72, - 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x6d, 0x75, 0x73, - 0x74, 0x5f, 0x62, 0x65, 0x5f, 0x74, 0x72, 0x75, 0x65, 0x12, 0x28, 0x77, 0x69, 0x74, 0x68, 0x5f, - 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x20, 0x6d, 0x75, - 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x74, 0x72, 0x75, 0x65, 0x20, 0x77, 0x68, 0x65, 0x6e, 0x20, - 0x73, 0x65, 0x74, 0x1a, 0x0c, 0x74, 0x68, 0x69, 0x73, 0x20, 0x3d, 0x3d, 0x20, 0x74, 0x72, 0x75, - 0x65, 0x48, 0x00, 0x52, 0x10, 0x77, 0x69, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, - 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x42, 0x13, 0x0a, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, - 0x69, 0x65, 0x72, 0x12, 0x05, 0xba, 0x48, 0x02, 0x08, 0x01, 0x22, 0x81, 0x03, 0x0a, 0x12, 0x45, - 0x6e, 0x74, 0x69, 0x74, 0x79, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, - 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x5f, 0x69, - 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, - 0x61, 0x6c, 0x49, 0x64, 0x12, 0x8b, 0x01, 0x0a, 0x1f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, - 0x5f, 0x70, 0x65, 0x72, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, - 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x66, 0x71, 0x6e, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x45, - 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, - 0x32, 0x2e, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, - 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x65, 0x72, 0x41, - 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x46, 0x71, 0x6e, - 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x1b, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x65, + 0x73, 0x2e, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x29, 0x20, 0x3e, 0x20, 0x30, 0x48, 0x00, 0x52, 0x0b, + 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x12, 0x4f, 0x0a, 0x1d, 0x72, + 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, + 0x63, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x66, 0x71, 0x6e, 0x18, 0x02, 0x20, 0x01, + 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x72, 0x05, 0x10, 0x01, 0x88, 0x01, 0x01, 0x48, 0x00, + 0x52, 0x1a, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, + 0x75, 0x72, 0x63, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x46, 0x71, 0x6e, 0x12, 0x7b, 0x0a, 0x05, + 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x65, 0x6e, + 0x74, 0x69, 0x74, 0x79, 0x2e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x42, 0x54, 0xba, 0x48, 0x51, 0xba, + 0x01, 0x4e, 0x0a, 0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, + 0x65, 0x64, 0x12, 0x16, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, + 0x65, 0x20, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x1a, 0x24, 0x68, 0x61, 0x73, 0x28, + 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6a, 0x77, 0x74, 0x29, 0x20, 0x26, 0x26, 0x20, 0x74, 0x68, 0x69, + 0x73, 0x2e, 0x6a, 0x77, 0x74, 0x2e, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x29, 0x20, 0x3e, 0x20, 0x30, + 0x48, 0x00, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0xab, 0x01, 0x0a, 0x12, 0x77, 0x69, + 0x74, 0x68, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, + 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, + 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, + 0x75, 0x65, 0x42, 0x5f, 0xba, 0x48, 0x5c, 0xba, 0x01, 0x59, 0x0a, 0x1f, 0x77, 0x69, 0x74, 0x68, + 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x6d, + 0x75, 0x73, 0x74, 0x5f, 0x62, 0x65, 0x5f, 0x74, 0x72, 0x75, 0x65, 0x12, 0x28, 0x77, 0x69, 0x74, + 0x68, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x20, + 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x74, 0x72, 0x75, 0x65, 0x20, 0x77, 0x68, 0x65, + 0x6e, 0x20, 0x73, 0x65, 0x74, 0x1a, 0x0c, 0x74, 0x68, 0x69, 0x73, 0x20, 0x3d, 0x3d, 0x20, 0x74, + 0x72, 0x75, 0x65, 0x48, 0x00, 0x52, 0x10, 0x77, 0x69, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, + 0x73, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x42, 0x13, 0x0a, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, + 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x05, 0xba, 0x48, 0x02, 0x08, 0x01, 0x22, 0x81, 0x03, 0x0a, + 0x12, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65, + 0x6e, 0x74, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, + 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x65, 0x70, 0x68, 0x65, 0x6d, + 0x65, 0x72, 0x61, 0x6c, 0x49, 0x64, 0x12, 0x8b, 0x01, 0x0a, 0x1f, 0x61, 0x63, 0x74, 0x69, 0x6f, + 0x6e, 0x73, 0x5f, 0x70, 0x65, 0x72, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, + 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x66, 0x71, 0x6e, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, + 0x32, 0x45, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, + 0x2e, 0x76, 0x32, 0x2e, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x6c, + 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x65, 0x72, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x46, - 0x71, 0x6e, 0x1a, 0x37, 0x0a, 0x0b, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x4c, 0x69, 0x73, - 0x74, 0x12, 0x28, 0x0a, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, - 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, - 0x6f, 0x6e, 0x52, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x80, 0x01, 0x0a, 0x20, - 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x65, 0x72, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, - 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x46, 0x71, 0x6e, 0x45, 0x6e, 0x74, 0x72, 0x79, - 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, - 0x65, 0x79, 0x12, 0x46, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, - 0x0b, 0x32, 0x30, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, - 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x45, 0x6e, 0x74, 0x69, 0x74, - 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x4c, - 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xe4, - 0x03, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x65, - 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, - 0x09, 0x52, 0x0b, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x49, 0x64, 0x12, 0xb0, - 0x02, 0x0a, 0x10, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, - 0x75, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x61, 0x75, 0x74, 0x68, - 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x52, 0x65, 0x73, - 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, - 0x61, 0x6c, 0x75, 0x65, 0x73, 0x42, 0xd6, 0x01, 0xba, 0x48, 0xd2, 0x01, 0xba, 0x01, 0xce, 0x01, - 0x0a, 0x19, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, - 0x65, 0x73, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x12, 0x5c, 0x69, 0x66, 0x20, - 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x2c, 0x20, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, - 0x63, 0x65, 0x2e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, - 0x75, 0x65, 0x73, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x62, 0x65, 0x74, 0x77, - 0x65, 0x65, 0x6e, 0x20, 0x31, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x32, 0x30, 0x20, 0x69, 0x6e, 0x20, - 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x6c, 0x6c, 0x20, 0x76, - 0x61, 0x6c, 0x69, 0x64, 0x20, 0x46, 0x51, 0x4e, 0x73, 0x1a, 0x53, 0x74, 0x68, 0x69, 0x73, 0x2e, - 0x66, 0x71, 0x6e, 0x73, 0x2e, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x29, 0x20, 0x3e, 0x20, 0x30, 0x20, - 0x26, 0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x66, 0x71, 0x6e, 0x73, 0x2e, 0x73, 0x69, 0x7a, - 0x65, 0x28, 0x29, 0x20, 0x3c, 0x3d, 0x20, 0x32, 0x30, 0x20, 0x26, 0x26, 0x20, 0x74, 0x68, 0x69, - 0x73, 0x2e, 0x66, 0x71, 0x6e, 0x73, 0x2e, 0x61, 0x6c, 0x6c, 0x28, 0x69, 0x74, 0x65, 0x6d, 0x2c, - 0x20, 0x69, 0x74, 0x65, 0x6d, 0x2e, 0x69, 0x73, 0x55, 0x72, 0x69, 0x28, 0x29, 0x29, 0x48, 0x00, - 0x52, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, - 0x73, 0x12, 0x4f, 0x0a, 0x1d, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x65, 0x64, 0x5f, - 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x66, - 0x71, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x72, 0x05, 0x10, - 0x01, 0x88, 0x01, 0x01, 0x48, 0x00, 0x52, 0x1a, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, - 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x46, - 0x71, 0x6e, 0x1a, 0x25, 0x0a, 0x0f, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, - 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x71, 0x6e, 0x73, 0x18, 0x01, 0x20, - 0x03, 0x28, 0x09, 0x52, 0x04, 0x66, 0x71, 0x6e, 0x73, 0x42, 0x0a, 0x0a, 0x08, 0x72, 0x65, 0x73, - 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0xb1, 0x01, 0x0a, 0x10, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, - 0x63, 0x65, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x32, 0x0a, 0x15, 0x65, 0x70, - 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, - 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x65, 0x70, 0x68, 0x65, 0x6d, - 0x65, 0x72, 0x61, 0x6c, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x64, 0x12, 0x36, - 0x0a, 0x08, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, - 0x32, 0x1a, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, - 0x2e, 0x76, 0x32, 0x2e, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x08, 0x64, 0x65, - 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x31, 0x0a, 0x14, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, - 0x65, 0x64, 0x5f, 0x6f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, - 0x20, 0x03, 0x28, 0x09, 0x52, 0x13, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x4f, 0x62, - 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0xd6, 0x04, 0x0a, 0x12, 0x47, 0x65, - 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, - 0x12, 0x57, 0x0a, 0x11, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x69, 0x64, 0x65, 0x6e, 0x74, - 0x69, 0x66, 0x69, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x61, 0x75, - 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x45, - 0x6e, 0x74, 0x69, 0x74, 0x79, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x42, - 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x10, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x49, - 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x2e, 0x0a, 0x06, 0x61, 0x63, 0x74, - 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, - 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, - 0x01, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3e, 0x0a, 0x08, 0x72, 0x65, 0x73, - 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x61, 0x75, + 0x71, 0x6e, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x1b, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, + 0x50, 0x65, 0x72, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c, 0x75, + 0x65, 0x46, 0x71, 0x6e, 0x1a, 0x37, 0x0a, 0x0b, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x4c, + 0x69, 0x73, 0x74, 0x12, 0x28, 0x0a, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, + 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, + 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x80, 0x01, + 0x0a, 0x20, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x65, 0x72, 0x41, 0x74, 0x74, 0x72, + 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x46, 0x71, 0x6e, 0x45, 0x6e, 0x74, + 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, + 0x03, 0x6b, 0x65, 0x79, 0x12, 0x46, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, + 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, + 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x45, 0x6e, 0x74, + 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, + 0x73, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, + 0x22, 0xb6, 0x03, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x21, 0x0a, + 0x0c, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, + 0x01, 0x28, 0x09, 0x52, 0x0b, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x49, 0x64, + 0x12, 0x82, 0x02, 0x0a, 0x10, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, + 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x52, - 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, - 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x8f, 0x02, 0x0a, 0x1b, 0x66, 0x75, - 0x6c, 0x66, 0x69, 0x6c, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x6f, 0x62, 0x6c, 0x69, 0x67, 0x61, - 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x66, 0x71, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x42, - 0xce, 0x01, 0xba, 0x48, 0xca, 0x01, 0xba, 0x01, 0xc6, 0x01, 0x0a, 0x1b, 0x6f, 0x62, 0x6c, 0x69, - 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x66, 0x71, 0x6e, - 0x73, 0x5f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x12, 0x5e, 0x69, 0x66, 0x20, 0x70, 0x72, 0x6f, 0x76, - 0x69, 0x64, 0x65, 0x64, 0x2c, 0x20, 0x66, 0x75, 0x6c, 0x66, 0x69, 0x6c, 0x6c, 0x61, 0x62, 0x6c, - 0x65, 0x5f, 0x6f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x66, 0x71, 0x6e, - 0x73, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x62, 0x65, 0x74, 0x77, 0x65, 0x65, - 0x6e, 0x20, 0x31, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x35, 0x30, 0x20, 0x69, 0x6e, 0x20, 0x63, 0x6f, - 0x75, 0x6e, 0x74, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x6c, 0x6c, 0x20, 0x76, 0x61, 0x6c, - 0x69, 0x64, 0x20, 0x46, 0x51, 0x4e, 0x73, 0x1a, 0x47, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x73, 0x69, - 0x7a, 0x65, 0x28, 0x29, 0x20, 0x3d, 0x3d, 0x20, 0x30, 0x20, 0x7c, 0x7c, 0x20, 0x28, 0x74, 0x68, - 0x69, 0x73, 0x2e, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x29, 0x20, 0x3c, 0x3d, 0x20, 0x35, 0x30, 0x20, - 0x26, 0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x61, 0x6c, 0x6c, 0x28, 0x69, 0x74, 0x65, 0x6d, - 0x2c, 0x20, 0x69, 0x74, 0x65, 0x6d, 0x2e, 0x69, 0x73, 0x55, 0x72, 0x69, 0x28, 0x29, 0x29, 0x29, - 0x52, 0x19, 0x66, 0x75, 0x6c, 0x66, 0x69, 0x6c, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x4f, 0x62, 0x6c, - 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x71, 0x6e, 0x73, 0x3a, 0x65, 0xba, 0x48, 0x62, - 0x1a, 0x60, 0x0a, 0x29, 0x67, 0x65, 0x74, 0x5f, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, - 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, - 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x12, 0x1c, 0x61, - 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, - 0x62, 0x65, 0x20, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x1a, 0x15, 0x68, 0x61, 0x73, - 0x28, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x6e, 0x61, 0x6d, - 0x65, 0x29, 0x22, 0x55, 0x0a, 0x13, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, - 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3e, 0x0a, 0x08, 0x64, 0x65, 0x63, - 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x61, 0x75, - 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x52, - 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x52, - 0x08, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0xf0, 0x04, 0x0a, 0x1f, 0x47, 0x65, - 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x75, 0x6c, 0x74, 0x69, 0x52, 0x65, - 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x57, 0x0a, - 0x11, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, - 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, - 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x45, 0x6e, 0x74, 0x69, - 0x74, 0x79, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x42, 0x06, 0xba, 0x48, - 0x03, 0xc8, 0x01, 0x01, 0x52, 0x10, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x49, 0x64, 0x65, 0x6e, - 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x2e, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, - 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, - 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x06, - 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x45, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, - 0x63, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x61, 0x75, 0x74, 0x68, - 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x52, 0x65, 0x73, - 0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x0b, 0xba, 0x48, 0x08, 0x92, 0x01, 0x05, 0x08, 0x01, 0x10, - 0xe8, 0x07, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x8f, 0x02, + 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, + 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x42, 0xa8, 0x01, 0xba, 0x48, 0xa4, 0x01, 0xba, 0x01, + 0xa0, 0x01, 0x0a, 0x19, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, 0x61, + 0x6c, 0x75, 0x65, 0x73, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x12, 0x48, 0x69, + 0x66, 0x20, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x2c, 0x20, 0x72, 0x65, 0x73, 0x6f, + 0x75, 0x72, 0x63, 0x65, 0x2e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, + 0x61, 0x6c, 0x75, 0x65, 0x73, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x63, 0x6f, 0x6e, 0x74, 0x61, + 0x69, 0x6e, 0x20, 0x61, 0x74, 0x20, 0x6c, 0x65, 0x61, 0x73, 0x74, 0x20, 0x31, 0x20, 0x76, 0x61, + 0x6c, 0x69, 0x64, 0x20, 0x46, 0x51, 0x4e, 0x1a, 0x39, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x66, 0x71, + 0x6e, 0x73, 0x2e, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x29, 0x20, 0x3e, 0x20, 0x30, 0x20, 0x26, 0x26, + 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x66, 0x71, 0x6e, 0x73, 0x2e, 0x61, 0x6c, 0x6c, 0x28, 0x69, + 0x74, 0x65, 0x6d, 0x2c, 0x20, 0x69, 0x74, 0x65, 0x6d, 0x2e, 0x69, 0x73, 0x55, 0x72, 0x69, 0x28, + 0x29, 0x29, 0x48, 0x00, 0x52, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, + 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x4f, 0x0a, 0x1d, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, + 0x72, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x76, 0x61, 0x6c, + 0x75, 0x65, 0x5f, 0x66, 0x71, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, + 0x07, 0x72, 0x05, 0x10, 0x01, 0x88, 0x01, 0x01, 0x48, 0x00, 0x52, 0x1a, 0x72, 0x65, 0x67, 0x69, + 0x73, 0x74, 0x65, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x56, 0x61, + 0x6c, 0x75, 0x65, 0x46, 0x71, 0x6e, 0x1a, 0x25, 0x0a, 0x0f, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, + 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x71, 0x6e, + 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x66, 0x71, 0x6e, 0x73, 0x42, 0x0a, 0x0a, + 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0xb1, 0x01, 0x0a, 0x10, 0x52, 0x65, + 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x32, + 0x0a, 0x15, 0x65, 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x5f, 0x72, 0x65, 0x73, 0x6f, + 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x65, + 0x70, 0x68, 0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, + 0x49, 0x64, 0x12, 0x36, 0x0a, 0x08, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, + 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, + 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, + 0x52, 0x08, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x31, 0x0a, 0x14, 0x72, 0x65, + 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x5f, 0x6f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, + 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x13, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, + 0x65, 0x64, 0x4f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0xa6, 0x04, + 0x0a, 0x12, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, + 0x75, 0x65, 0x73, 0x74, 0x12, 0x57, 0x0a, 0x11, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x69, + 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, + 0x22, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, + 0x76, 0x32, 0x2e, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, + 0x69, 0x65, 0x72, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x10, 0x65, 0x6e, 0x74, + 0x69, 0x74, 0x79, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x2e, 0x0a, + 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, + 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x06, 0xba, + 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3e, 0x0a, + 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, + 0x1a, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, + 0x76, 0x32, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x06, 0xba, 0x48, 0x03, + 0xc8, 0x01, 0x01, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0xdf, 0x01, 0x0a, 0x1b, 0x66, 0x75, 0x6c, 0x66, 0x69, 0x6c, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x6f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x66, 0x71, 0x6e, 0x73, 0x18, 0x04, 0x20, - 0x03, 0x28, 0x09, 0x42, 0xce, 0x01, 0xba, 0x48, 0xca, 0x01, 0xba, 0x01, 0xc6, 0x01, 0x0a, 0x1b, + 0x03, 0x28, 0x09, 0x42, 0x9e, 0x01, 0xba, 0x48, 0x9a, 0x01, 0xba, 0x01, 0x96, 0x01, 0x0a, 0x1b, 0x6f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, - 0x5f, 0x66, 0x71, 0x6e, 0x73, 0x5f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x12, 0x5e, 0x69, 0x66, 0x20, + 0x5f, 0x66, 0x71, 0x6e, 0x73, 0x5f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x12, 0x45, 0x69, 0x66, 0x20, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x2c, 0x20, 0x66, 0x75, 0x6c, 0x66, 0x69, 0x6c, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x6f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, - 0x5f, 0x66, 0x71, 0x6e, 0x73, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x62, 0x65, - 0x74, 0x77, 0x65, 0x65, 0x6e, 0x20, 0x31, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x35, 0x30, 0x20, 0x69, - 0x6e, 0x20, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x6c, 0x6c, - 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x46, 0x51, 0x4e, 0x73, 0x1a, 0x47, 0x74, 0x68, 0x69, - 0x73, 0x2e, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x29, 0x20, 0x3d, 0x3d, 0x20, 0x30, 0x20, 0x7c, 0x7c, - 0x20, 0x28, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x29, 0x20, 0x3c, 0x3d, - 0x20, 0x35, 0x30, 0x20, 0x26, 0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x61, 0x6c, 0x6c, 0x28, - 0x69, 0x74, 0x65, 0x6d, 0x2c, 0x20, 0x69, 0x74, 0x65, 0x6d, 0x2e, 0x69, 0x73, 0x55, 0x72, 0x69, - 0x28, 0x29, 0x29, 0x29, 0x52, 0x19, 0x66, 0x75, 0x6c, 0x66, 0x69, 0x6c, 0x6c, 0x61, 0x62, 0x6c, + 0x5f, 0x66, 0x71, 0x6e, 0x73, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x63, 0x6f, 0x6e, 0x74, 0x61, + 0x69, 0x6e, 0x20, 0x6f, 0x6e, 0x6c, 0x79, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x46, 0x51, + 0x4e, 0x73, 0x1a, 0x30, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x29, 0x20, + 0x3d, 0x3d, 0x20, 0x30, 0x20, 0x7c, 0x7c, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x61, 0x6c, 0x6c, + 0x28, 0x69, 0x74, 0x65, 0x6d, 0x2c, 0x20, 0x69, 0x74, 0x65, 0x6d, 0x2e, 0x69, 0x73, 0x55, 0x72, + 0x69, 0x28, 0x29, 0x29, 0x52, 0x19, 0x66, 0x75, 0x6c, 0x66, 0x69, 0x6c, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x4f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x71, 0x6e, 0x73, 0x3a, - 0x6b, 0xba, 0x48, 0x68, 0x1a, 0x66, 0x0a, 0x2f, 0x67, 0x65, 0x74, 0x5f, 0x64, 0x65, 0x63, 0x69, - 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x75, 0x6c, 0x74, 0x69, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, - 0x73, 0x74, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x72, - 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x12, 0x1c, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, - 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x70, 0x72, 0x6f, - 0x76, 0x69, 0x64, 0x65, 0x64, 0x1a, 0x15, 0x68, 0x61, 0x73, 0x28, 0x74, 0x68, 0x69, 0x73, 0x2e, - 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x6e, 0x61, 0x6d, 0x65, 0x29, 0x22, 0xb6, 0x01, 0x0a, - 0x20, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x75, 0x6c, 0x74, - 0x69, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, - 0x65, 0x12, 0x3f, 0x0a, 0x0d, 0x61, 0x6c, 0x6c, 0x5f, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x74, 0x74, - 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, - 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56, - 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x61, 0x6c, 0x6c, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x74, 0x74, - 0x65, 0x64, 0x12, 0x51, 0x0a, 0x12, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x64, - 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, - 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, - 0x32, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, - 0x6f, 0x6e, 0x52, 0x11, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x44, 0x65, 0x63, 0x69, - 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x85, 0x01, 0x0a, 0x16, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, - 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x42, 0x75, 0x6c, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, - 0x12, 0x6b, 0x0a, 0x11, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x72, 0x65, 0x71, - 0x75, 0x65, 0x73, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x61, 0x75, - 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x47, - 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x75, 0x6c, 0x74, 0x69, 0x52, - 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x42, 0x0b, - 0xba, 0x48, 0x08, 0x92, 0x01, 0x05, 0x08, 0x01, 0x10, 0xc8, 0x01, 0x52, 0x10, 0x64, 0x65, 0x63, - 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x22, 0x7c, 0x0a, - 0x17, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x42, 0x75, 0x6c, 0x6b, - 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x61, 0x0a, 0x12, 0x64, 0x65, 0x63, 0x69, - 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x73, 0x18, 0x01, - 0x20, 0x03, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, - 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, - 0x69, 0x6f, 0x6e, 0x4d, 0x75, 0x6c, 0x74, 0x69, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, - 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x52, 0x11, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, - 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x73, 0x22, 0xd9, 0x01, 0x0a, 0x16, - 0x47, 0x65, 0x74, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x52, - 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x57, 0x0a, 0x11, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, - 0x5f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, - 0x0b, 0x32, 0x22, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, - 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x49, 0x64, 0x65, 0x6e, 0x74, - 0x69, 0x66, 0x69, 0x65, 0x72, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x10, 0x65, - 0x6e, 0x74, 0x69, 0x74, 0x79, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, - 0x45, 0x0a, 0x1c, 0x77, 0x69, 0x74, 0x68, 0x5f, 0x63, 0x6f, 0x6d, 0x70, 0x72, 0x65, 0x68, 0x65, - 0x6e, 0x73, 0x69, 0x76, 0x65, 0x5f, 0x68, 0x69, 0x65, 0x72, 0x61, 0x72, 0x63, 0x68, 0x79, 0x18, - 0x02, 0x20, 0x01, 0x28, 0x08, 0x48, 0x00, 0x52, 0x1a, 0x77, 0x69, 0x74, 0x68, 0x43, 0x6f, 0x6d, - 0x70, 0x72, 0x65, 0x68, 0x65, 0x6e, 0x73, 0x69, 0x76, 0x65, 0x48, 0x69, 0x65, 0x72, 0x61, 0x72, - 0x63, 0x68, 0x79, 0x88, 0x01, 0x01, 0x42, 0x1f, 0x0a, 0x1d, 0x5f, 0x77, 0x69, 0x74, 0x68, 0x5f, - 0x63, 0x6f, 0x6d, 0x70, 0x72, 0x65, 0x68, 0x65, 0x6e, 0x73, 0x69, 0x76, 0x65, 0x5f, 0x68, 0x69, - 0x65, 0x72, 0x61, 0x72, 0x63, 0x68, 0x79, 0x22, 0x63, 0x0a, 0x17, 0x47, 0x65, 0x74, 0x45, 0x6e, - 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, - 0x73, 0x65, 0x12, 0x48, 0x0a, 0x0c, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65, 0x6e, - 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, - 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x45, 0x6e, 0x74, 0x69, - 0x74, 0x79, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x52, 0x0c, - 0x65, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2a, 0x4c, 0x0a, 0x08, - 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x18, 0x0a, 0x14, 0x44, 0x45, 0x43, 0x49, - 0x53, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, - 0x10, 0x00, 0x12, 0x11, 0x0a, 0x0d, 0x44, 0x45, 0x43, 0x49, 0x53, 0x49, 0x4f, 0x4e, 0x5f, 0x44, - 0x45, 0x4e, 0x59, 0x10, 0x01, 0x12, 0x13, 0x0a, 0x0f, 0x44, 0x45, 0x43, 0x49, 0x53, 0x49, 0x4f, - 0x4e, 0x5f, 0x50, 0x45, 0x52, 0x4d, 0x49, 0x54, 0x10, 0x02, 0x32, 0xce, 0x03, 0x0a, 0x14, 0x41, - 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76, - 0x69, 0x63, 0x65, 0x12, 0x5c, 0x0a, 0x0b, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, - 0x6f, 0x6e, 0x12, 0x24, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, + 0x65, 0xba, 0x48, 0x62, 0x1a, 0x60, 0x0a, 0x29, 0x67, 0x65, 0x74, 0x5f, 0x64, 0x65, 0x63, 0x69, + 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x61, 0x63, 0x74, + 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, + 0x64, 0x12, 0x1c, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, + 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x1a, + 0x15, 0x68, 0x61, 0x73, 0x28, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, + 0x2e, 0x6e, 0x61, 0x6d, 0x65, 0x29, 0x22, 0x55, 0x0a, 0x13, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, + 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3e, 0x0a, + 0x08, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, + 0x22, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, + 0x76, 0x32, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x44, 0x65, 0x63, 0x69, 0x73, + 0x69, 0x6f, 0x6e, 0x52, 0x08, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0xbd, 0x04, + 0x0a, 0x1f, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x75, 0x6c, + 0x74, 0x69, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, + 0x74, 0x12, 0x57, 0x0a, 0x11, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x69, 0x64, 0x65, 0x6e, + 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x61, + 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, + 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, + 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x10, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, + 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x2e, 0x0a, 0x06, 0x61, 0x63, + 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, + 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, + 0x01, 0x01, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x42, 0x0a, 0x09, 0x72, 0x65, + 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, + 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, + 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, + 0x02, 0x08, 0x01, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0xdf, + 0x01, 0x0a, 0x1b, 0x66, 0x75, 0x6c, 0x66, 0x69, 0x6c, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x6f, + 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x66, 0x71, 0x6e, 0x73, 0x18, 0x04, + 0x20, 0x03, 0x28, 0x09, 0x42, 0x9e, 0x01, 0xba, 0x48, 0x9a, 0x01, 0xba, 0x01, 0x96, 0x01, 0x0a, + 0x1b, 0x6f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x76, 0x61, 0x6c, 0x75, + 0x65, 0x5f, 0x66, 0x71, 0x6e, 0x73, 0x5f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x12, 0x45, 0x69, 0x66, + 0x20, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x2c, 0x20, 0x66, 0x75, 0x6c, 0x66, 0x69, + 0x6c, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x6f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, + 0x6e, 0x5f, 0x66, 0x71, 0x6e, 0x73, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x63, 0x6f, 0x6e, 0x74, + 0x61, 0x69, 0x6e, 0x20, 0x6f, 0x6e, 0x6c, 0x79, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x46, + 0x51, 0x4e, 0x73, 0x1a, 0x30, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x29, + 0x20, 0x3d, 0x3d, 0x20, 0x30, 0x20, 0x7c, 0x7c, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x61, 0x6c, + 0x6c, 0x28, 0x69, 0x74, 0x65, 0x6d, 0x2c, 0x20, 0x69, 0x74, 0x65, 0x6d, 0x2e, 0x69, 0x73, 0x55, + 0x72, 0x69, 0x28, 0x29, 0x29, 0x52, 0x19, 0x66, 0x75, 0x6c, 0x66, 0x69, 0x6c, 0x6c, 0x61, 0x62, + 0x6c, 0x65, 0x4f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x71, 0x6e, 0x73, + 0x3a, 0x6b, 0xba, 0x48, 0x68, 0x1a, 0x66, 0x0a, 0x2f, 0x67, 0x65, 0x74, 0x5f, 0x64, 0x65, 0x63, + 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x75, 0x6c, 0x74, 0x69, 0x5f, 0x72, 0x65, 0x71, 0x75, + 0x65, 0x73, 0x74, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, + 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x12, 0x1c, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, + 0x2e, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x70, 0x72, + 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x1a, 0x15, 0x68, 0x61, 0x73, 0x28, 0x74, 0x68, 0x69, 0x73, + 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x6e, 0x61, 0x6d, 0x65, 0x29, 0x22, 0xb6, 0x01, + 0x0a, 0x20, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x75, 0x6c, + 0x74, 0x69, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, + 0x73, 0x65, 0x12, 0x3f, 0x0a, 0x0d, 0x61, 0x6c, 0x6c, 0x5f, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x74, + 0x74, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, + 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, + 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0c, 0x61, 0x6c, 0x6c, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x74, + 0x74, 0x65, 0x64, 0x12, 0x51, 0x0a, 0x12, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, + 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, + 0x22, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, + 0x76, 0x32, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x44, 0x65, 0x63, 0x69, 0x73, + 0x69, 0x6f, 0x6e, 0x52, 0x11, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x44, 0x65, 0x63, + 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x82, 0x01, 0x0a, 0x16, 0x47, 0x65, 0x74, 0x44, 0x65, + 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x42, 0x75, 0x6c, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, + 0x74, 0x12, 0x68, 0x0a, 0x11, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x72, 0x65, + 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x61, + 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, + 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x75, 0x6c, 0x74, 0x69, + 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x42, + 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x10, 0x64, 0x65, 0x63, 0x69, 0x73, + 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x22, 0x7c, 0x0a, 0x17, 0x47, + 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x42, 0x75, 0x6c, 0x6b, 0x52, 0x65, + 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x61, 0x0a, 0x12, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, + 0x6f, 0x6e, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, + 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, - 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, + 0x6e, 0x4d, 0x75, 0x6c, 0x74, 0x69, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, + 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x52, 0x11, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, + 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x73, 0x22, 0xd9, 0x01, 0x0a, 0x16, 0x47, 0x65, + 0x74, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x52, 0x65, 0x71, + 0x75, 0x65, 0x73, 0x74, 0x12, 0x57, 0x0a, 0x11, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x69, + 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, + 0x22, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, + 0x76, 0x32, 0x2e, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, + 0x69, 0x65, 0x72, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x10, 0x65, 0x6e, 0x74, + 0x69, 0x74, 0x79, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x45, 0x0a, + 0x1c, 0x77, 0x69, 0x74, 0x68, 0x5f, 0x63, 0x6f, 0x6d, 0x70, 0x72, 0x65, 0x68, 0x65, 0x6e, 0x73, + 0x69, 0x76, 0x65, 0x5f, 0x68, 0x69, 0x65, 0x72, 0x61, 0x72, 0x63, 0x68, 0x79, 0x18, 0x02, 0x20, + 0x01, 0x28, 0x08, 0x48, 0x00, 0x52, 0x1a, 0x77, 0x69, 0x74, 0x68, 0x43, 0x6f, 0x6d, 0x70, 0x72, + 0x65, 0x68, 0x65, 0x6e, 0x73, 0x69, 0x76, 0x65, 0x48, 0x69, 0x65, 0x72, 0x61, 0x72, 0x63, 0x68, + 0x79, 0x88, 0x01, 0x01, 0x42, 0x1f, 0x0a, 0x1d, 0x5f, 0x77, 0x69, 0x74, 0x68, 0x5f, 0x63, 0x6f, + 0x6d, 0x70, 0x72, 0x65, 0x68, 0x65, 0x6e, 0x73, 0x69, 0x76, 0x65, 0x5f, 0x68, 0x69, 0x65, 0x72, + 0x61, 0x72, 0x63, 0x68, 0x79, 0x22, 0x63, 0x0a, 0x17, 0x47, 0x65, 0x74, 0x45, 0x6e, 0x74, 0x69, + 0x74, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, + 0x12, 0x48, 0x0a, 0x0c, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, + 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, + 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, + 0x45, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x52, 0x0c, 0x65, 0x6e, + 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2a, 0x4c, 0x0a, 0x08, 0x44, 0x65, + 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x18, 0x0a, 0x14, 0x44, 0x45, 0x43, 0x49, 0x53, 0x49, + 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, + 0x12, 0x11, 0x0a, 0x0d, 0x44, 0x45, 0x43, 0x49, 0x53, 0x49, 0x4f, 0x4e, 0x5f, 0x44, 0x45, 0x4e, + 0x59, 0x10, 0x01, 0x12, 0x13, 0x0a, 0x0f, 0x44, 0x45, 0x43, 0x49, 0x53, 0x49, 0x4f, 0x4e, 0x5f, + 0x50, 0x45, 0x52, 0x4d, 0x49, 0x54, 0x10, 0x02, 0x32, 0xce, 0x03, 0x0a, 0x14, 0x41, 0x75, 0x74, + 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, + 0x65, 0x12, 0x5c, 0x0a, 0x0b, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, + 0x12, 0x24, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, + 0x2e, 0x76, 0x32, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x52, + 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, + 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, + 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, + 0x83, 0x01, 0x0a, 0x18, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x4d, + 0x75, 0x6c, 0x74, 0x69, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x31, 0x2e, 0x61, + 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, + 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x75, 0x6c, 0x74, 0x69, + 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, + 0x32, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, + 0x76, 0x32, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x75, + 0x6c, 0x74, 0x69, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, + 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x68, 0x0a, 0x0f, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, + 0x73, 0x69, 0x6f, 0x6e, 0x42, 0x75, 0x6c, 0x6b, 0x12, 0x28, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x47, 0x65, 0x74, 0x44, - 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, - 0x00, 0x12, 0x83, 0x01, 0x0a, 0x18, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, - 0x6e, 0x4d, 0x75, 0x6c, 0x74, 0x69, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x31, - 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, - 0x32, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x75, 0x6c, - 0x74, 0x69, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, - 0x74, 0x1a, 0x32, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, - 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, - 0x4d, 0x75, 0x6c, 0x74, 0x69, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x73, - 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x68, 0x0a, 0x0f, 0x47, 0x65, 0x74, 0x44, 0x65, - 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x42, 0x75, 0x6c, 0x6b, 0x12, 0x28, 0x2e, 0x61, 0x75, 0x74, - 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x47, 0x65, - 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x42, 0x75, 0x6c, 0x6b, 0x52, 0x65, 0x71, - 0x75, 0x65, 0x73, 0x74, 0x1a, 0x29, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, - 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, - 0x69, 0x6f, 0x6e, 0x42, 0x75, 0x6c, 0x6b, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, - 0x00, 0x12, 0x68, 0x0a, 0x0f, 0x47, 0x65, 0x74, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, - 0x65, 0x6e, 0x74, 0x73, 0x12, 0x28, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, - 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x47, 0x65, 0x74, 0x45, 0x6e, 0x74, 0x69, 0x74, - 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x29, - 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, - 0x32, 0x2e, 0x47, 0x65, 0x74, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, - 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xd5, 0x01, 0x0a, 0x14, - 0x63, 0x6f, 0x6d, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, - 0x6e, 0x2e, 0x76, 0x32, 0x42, 0x12, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, - 0x69, 0x6f, 0x6e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x48, 0x67, 0x69, 0x74, 0x68, - 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, - 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, - 0x2f, 0x67, 0x6f, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, - 0x6e, 0x2f, 0x76, 0x32, 0x3b, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, - 0x6f, 0x6e, 0x76, 0x32, 0xa2, 0x02, 0x03, 0x41, 0x58, 0x58, 0xaa, 0x02, 0x10, 0x41, 0x75, 0x74, - 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x56, 0x32, 0xca, 0x02, 0x10, - 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5c, 0x56, 0x32, - 0xe2, 0x02, 0x1c, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, - 0x5c, 0x56, 0x32, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, - 0x02, 0x11, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x3a, - 0x3a, 0x56, 0x32, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, + 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x42, 0x75, 0x6c, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, + 0x73, 0x74, 0x1a, 0x29, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, + 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, + 0x6e, 0x42, 0x75, 0x6c, 0x6b, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, + 0x68, 0x0a, 0x0f, 0x47, 0x65, 0x74, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65, 0x6e, + 0x74, 0x73, 0x12, 0x28, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, + 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, 0x47, 0x65, 0x74, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, + 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x29, 0x2e, 0x61, + 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x32, 0x2e, + 0x47, 0x65, 0x74, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x52, + 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xd5, 0x01, 0x0a, 0x14, 0x63, 0x6f, + 0x6d, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, + 0x76, 0x32, 0x42, 0x12, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, + 0x6e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x48, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, + 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, + 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, + 0x6f, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, + 0x76, 0x32, 0x3b, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, + 0x76, 0x32, 0xa2, 0x02, 0x03, 0x41, 0x58, 0x58, 0xaa, 0x02, 0x10, 0x41, 0x75, 0x74, 0x68, 0x6f, + 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x56, 0x32, 0xca, 0x02, 0x10, 0x41, 0x75, + 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5c, 0x56, 0x32, 0xe2, 0x02, + 0x1c, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5c, 0x56, + 0x32, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x11, + 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x3a, 0x56, + 0x32, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, } var ( diff --git a/service/authorization/v2/authorization.go b/service/authorization/v2/authorization.go index b90b56db3d..da5a870ec0 100644 --- a/service/authorization/v2/authorization.go +++ b/service/authorization/v2/authorization.go @@ -139,6 +139,10 @@ func (as *Service) GetEntitlements(ctx context.Context, req *connect.Request[aut ctx, span := as.Start(ctx, "GetEntitlements") defer span.End() + if err := as.validateGetEntitlementsRequest(req.Msg); err != nil { + return nil, err + } + entityIdentifier := req.Msg.GetEntityIdentifier() withComprehensiveHierarchy := req.Msg.GetWithComprehensiveHierarchy() @@ -166,6 +170,10 @@ func (as *Service) GetDecision(ctx context.Context, req *connect.Request[authzV2 ctx, span := as.Start(ctx, "GetDecision") defer span.End() + if err := as.validateGetDecisionRequest(req.Msg); err != nil { + return nil, err + } + pdp, err := access.NewJustInTimePDP(ctx, as.logger, as.sdk, as.cache, as.config.AllowDirectEntitlements, as.config.EnforceNamespacedEntitlements) if err != nil { return nil, statusifyError(ctx, as.logger, errors.Join(ErrFailedToInitPDP, err)) @@ -212,6 +220,10 @@ func (as *Service) GetDecisionMultiResource(ctx context.Context, req *connect.Re ctx, span := as.Start(ctx, "GetDecisionMultiResource") defer span.End() + if err := as.validateGetDecisionMultiResourceRequest(req.Msg, ""); err != nil { + return nil, err + } + pdp, err := access.NewJustInTimePDP(ctx, as.logger, as.sdk, as.cache, as.config.AllowDirectEntitlements, as.config.EnforceNamespacedEntitlements) if err != nil { return nil, statusifyError(ctx, as.logger, errors.Join(ErrFailedToInitPDP, err)) @@ -261,6 +273,10 @@ func (as *Service) GetDecisionBulk(ctx context.Context, req *connect.Request[aut ctx, span := as.Start(ctx, "GetDecisionBulk") defer span.End() + if err := as.validateGetDecisionBulkRequest(req.Msg); err != nil { + return nil, err + } + pdp, err := access.NewJustInTimePDP(ctx, as.logger, as.sdk, as.cache, as.config.AllowDirectEntitlements, as.config.EnforceNamespacedEntitlements) if err != nil { return nil, statusifyError(ctx, as.logger, errors.Join(ErrFailedToInitPDP, err)) diff --git a/service/authorization/v2/authorization.proto b/service/authorization/v2/authorization.proto index 83f9bd3ff9..7c325390a7 100644 --- a/service/authorization/v2/authorization.proto +++ b/service/authorization/v2/authorization.proto @@ -20,11 +20,11 @@ message EntityIdentifier { oneof identifier { option (buf.validate.oneof).required = true; - // chain of one or more entities and at most 10 + // chain of one or more entities entity.EntityChain entity_chain = 1 [(buf.validate.field).cel = { id: "entity_chain_required" - message: "entities must be provided and between 1 and 10 in count" - expression: "has(this.entities) && this.entities.size() > 0 && this.entities.size() <= 10" + message: "entities must be provided and contain at least 1 entity" + expression: "has(this.entities) && this.entities.size() > 0" }]; // fully qualified name of the registered resource value stored in platform policy, where in @@ -71,11 +71,11 @@ message Resource { } oneof resource { - // a set of attribute value FQNs, such as those on a TDF, between 1 and 20 in count + // a set of attribute value FQNs, such as those on a TDF, containing at least 1 value AttributeValues attribute_values = 2 [(buf.validate.field).cel = { id: "attribute_values_required" - message: "if provided, resource.attribute_values must be between 1 and 20 in count with all valid FQNs" - expression: "this.fqns.size() > 0 && this.fqns.size() <= 20 && this.fqns.all(item, item.isUri())" + message: "if provided, resource.attribute_values must contain at least 1 valid FQN" + expression: "this.fqns.size() > 0 && this.fqns.all(item, item.isUri())" }]; // fully qualified name of the registered resource value stored in platform policy string registered_resource_value_fqn = 3 [(buf.validate.field).string = { @@ -112,8 +112,8 @@ message GetDecisionRequest { // i.e. https:///obl//value/ repeated string fulfillable_obligation_fqns = 4 [(buf.validate.field).cel = { id: "obligation_value_fqns_valid" - message: "if provided, fulfillable_obligation_fqns must be between 1 and 50 in count with all valid FQNs" - expression: "this.size() == 0 || (this.size() <= 50 && this.all(item, item.isUri()))" + message: "if provided, fulfillable_obligation_fqns must contain only valid FQNs" + expression: "this.size() == 0 || this.all(item, item.isUri())" }]; option (buf.validate.message).cel = { @@ -134,7 +134,7 @@ message GetDecisionResponse { // // If entitled, checks obligation policy: fulfillable obligations must satisfy all triggered. // -// Note: this is a more performant bulk request for multiple resource decisions, up to 1000 per request +// Note: this is a more performant bulk request for multiple resource decisions message GetDecisionMultiResourceRequest { // an entity must be identified for authorization decisioning EntityIdentifier entity_identifier = 1 [(buf.validate.field).required = true]; @@ -142,15 +142,14 @@ message GetDecisionMultiResourceRequest { policy.Action action = 2 [(buf.validate.field).required = true]; repeated Resource resources = 3 [(buf.validate.field).repeated = { min_items: 1 - max_items: 1000 }]; // obligations (fully qualified values) the requester is capable of fulfilling // i.e. https:///obl//value/ repeated string fulfillable_obligation_fqns = 4 [(buf.validate.field).cel = { id: "obligation_value_fqns_valid" - message: "if provided, fulfillable_obligation_fqns must be between 1 and 50 in count with all valid FQNs" - expression: "this.size() == 0 || (this.size() <= 50 && this.all(item, item.isUri()))" + message: "if provided, fulfillable_obligation_fqns must contain only valid FQNs" + expression: "this.size() == 0 || this.all(item, item.isUri())" }]; option (buf.validate.message).cel = { @@ -173,7 +172,6 @@ message GetDecisionMultiResourceResponse { message GetDecisionBulkRequest { repeated GetDecisionMultiResourceRequest decision_requests = 1 [(buf.validate.field).repeated = { min_items: 1 - max_items: 200 }]; } message GetDecisionBulkResponse { diff --git a/service/authorization/v2/authorization_test.go b/service/authorization/v2/authorization_test.go index 0d0e80259f..cb6075c6cd 100644 --- a/service/authorization/v2/authorization_test.go +++ b/service/authorization/v2/authorization_test.go @@ -376,42 +376,6 @@ var ( }, expectedValidationError: "registered_resource_value_fqn", }, - { - name: "too many obligations", - request: &authzV2.GetDecisionMultiResourceRequest{ - EntityIdentifier: &authzV2.EntityIdentifier{ - Identifier: &authzV2.EntityIdentifier_EntityChain{ - EntityChain: &entity.EntityChain{ - EphemeralId: "1234", - Entities: []*entity.Entity{ - { - EphemeralId: "chained-1", - EntityType: &entity.Entity_EmailAddress{EmailAddress: "test@test.com"}, - Category: entity.Entity_CATEGORY_SUBJECT, - }, - }, - }, - }, - }, - Action: sampleActionCreate, - Resources: []*authzV2.Resource{ - { - Resource: &authzV2.Resource_AttributeValues_{ - AttributeValues: &authzV2.Resource_AttributeValues{ - Fqns: []string{sampleResourceFQN}, - }, - }, - }, - { - Resource: &authzV2.Resource_RegisteredResourceValueFqn{ - RegisteredResourceValueFqn: sampleRegisteredResourceFQN, - }, - }, - }, - FulfillableObligationFqns: getTooManyObligations(), - }, - expectedValidationError: "obligation_value_fqns_valid", - }, { name: "invalid obligation", request: &authzV2.GetDecisionMultiResourceRequest{ @@ -443,7 +407,7 @@ func getValidator() protovalidate.Validator { return v } -func Test_EntityIdentifier_ManyChainedEntities(t *testing.T) { +func Test_EntityIdentifier_ProtoValidationAllowsManyChainedEntities(t *testing.T) { v := getValidator() // many entities in chain entityIdentifier := &authzV2.EntityIdentifier{ @@ -471,10 +435,10 @@ func Test_EntityIdentifier_ManyChainedEntities(t *testing.T) { Category: entity.Entity_CATEGORY_SUBJECT, }) err = v.Validate(entityIdentifier) - require.Error(t, err, "validation should fail for request with 11 entities in chain") + require.NoError(t, err) } -func Test_Resource_ManyAttributeValues(t *testing.T) { +func Test_Resource_ProtoValidationAllowsManyAttributeValues(t *testing.T) { v := getValidator() resource := &authzV2.Resource{ Resource: &authzV2.Resource_AttributeValues_{ @@ -492,7 +456,7 @@ func Test_Resource_ManyAttributeValues(t *testing.T) { // add one more resource.GetAttributeValues().Fqns = append(resource.GetAttributeValues().Fqns, "https://example.com/attr/any_of_attr_name/value/val20") err = v.Validate(resource) - require.Error(t, err, "validation should fail for request with 21 attribute values") + require.NoError(t, err, "validation should allow more than 20 attribute values so the service can enforce configured limits") } func Test_GetDecisionRequest_Succeeds(t *testing.T) { @@ -501,6 +465,7 @@ func Test_GetDecisionRequest_Succeeds(t *testing.T) { for i := range 50 { fiftyObligations[i] = sampleObligationValueFQN } + fiftyOneObligations := append(append([]string{}, fiftyObligations...), sampleObligationValueFQN) cases := []struct { name string @@ -693,6 +658,23 @@ func Test_GetDecisionRequest_Succeeds(t *testing.T) { FulfillableObligationFqns: fiftyObligations, }, }, + { + name: "entity: registered resource, action: create, resource: registered, obligations - 51", + request: &authzV2.GetDecisionRequest{ + EntityIdentifier: &authzV2.EntityIdentifier{ + Identifier: &authzV2.EntityIdentifier_RegisteredResourceValueFqn{ + RegisteredResourceValueFqn: sampleRegisteredResourceFQN, + }, + }, + Action: sampleActionCreate, + Resource: &authzV2.Resource{ + Resource: &authzV2.Resource_RegisteredResourceValueFqn{ + RegisteredResourceValueFqn: sampleRegisteredResourceFQN, + }, + }, + FulfillableObligationFqns: fiftyOneObligations, + }, + }, } for _, tc := range cases { @@ -945,24 +927,6 @@ func Test_GetDecisionRequest_Fails(t *testing.T) { }, expectedValidationError: "entities", }, - { - name: "too many obligations", - request: &authzV2.GetDecisionRequest{ - EntityIdentifier: &authzV2.EntityIdentifier{ - Identifier: &authzV2.EntityIdentifier_RegisteredResourceValueFqn{ - RegisteredResourceValueFqn: sampleRegisteredResourceFQN, - }, - }, - Action: sampleActionCreate, - Resource: &authzV2.Resource{ - Resource: &authzV2.Resource_RegisteredResourceValueFqn{ - RegisteredResourceValueFqn: sampleRegisteredResourceFQN, - }, - }, - FulfillableObligationFqns: getTooManyObligations(), - }, - expectedValidationError: "obligation_value_fqns_valid", - }, { name: "invalid obligation format", request: &authzV2.GetDecisionRequest{ @@ -1009,7 +973,35 @@ func Test_GetDecisionMultiResourceRequest_Succeeds(t *testing.T) { } } -func Test_GetDecisionMultiResourceRequest_ResourceLimit(t *testing.T) { +func Test_GetDecisionMultiResourceRequest_ProtoValidationAllowsManyObligations(t *testing.T) { + v := getValidator() + + fiftyOneObligations := make([]string, 51) + for i := range 51 { + fiftyOneObligations[i] = sampleObligationValueFQN + } + + req := &authzV2.GetDecisionMultiResourceRequest{ + EntityIdentifier: &authzV2.EntityIdentifier{ + Identifier: &authzV2.EntityIdentifier_RegisteredResourceValueFqn{ + RegisteredResourceValueFqn: sampleRegisteredResourceFQN, + }, + }, + Action: sampleActionCreate, + Resources: []*authzV2.Resource{ + { + Resource: &authzV2.Resource_RegisteredResourceValueFqn{ + RegisteredResourceValueFqn: sampleRegisteredResourceFQN, + }, + }, + }, + FulfillableObligationFqns: fiftyOneObligations, + } + err := v.Validate(req) + require.NoError(t, err, "validation should allow more than 50 obligations so the service can enforce configured limits") +} + +func Test_GetDecisionMultiResourceRequest_ProtoValidationAllowsManyResources(t *testing.T) { v := getValidator() upperBoundLimit := 1000 @@ -1046,7 +1038,7 @@ func Test_GetDecisionMultiResourceRequest_ResourceLimit(t *testing.T) { }, }) err = v.Validate(req) - require.Error(t, err, "validation should fail for request with 1001 resources") + require.NoError(t, err, "validation should allow more than 1000 resources so the service can enforce configured limits") } func Test_GetDecisionMultiResourceRequest_Fails(t *testing.T) { @@ -1145,13 +1137,15 @@ func Test_GetDecisionBulkRequest_Fails(t *testing.T) { } } -func Test_GetDecisionBulkRequest_Limits(t *testing.T) { +func Test_GetDecisionBulkRequest_RequiresAtLeastOneDecisionRequest(t *testing.T) { v := getValidator() - // requests must be between 1 and 200 req := &authzV2.GetDecisionBulkRequest{} err := v.Validate(req) require.Error(t, err, "validation should fail for bulk request without any multi resource decision requests") +} +func Test_GetDecisionBulkRequest_ProtoValidationAllowsManyDecisionRequests(t *testing.T) { + v := getValidator() dr := &authzV2.GetDecisionMultiResourceRequest{ EntityIdentifier: &authzV2.EntityIdentifier{ Identifier: &authzV2.EntityIdentifier_Token{ @@ -1172,16 +1166,17 @@ func Test_GetDecisionBulkRequest_Limits(t *testing.T) { }, }, } + req := &authzV2.GetDecisionBulkRequest{} req.DecisionRequests = make([]*authzV2.GetDecisionMultiResourceRequest, 201) for i := range req.GetDecisionRequests() { req.DecisionRequests[i] = dr } - err = v.Validate(req) - require.Error(t, err, "validation should fail for bulk request with more than 200 multi resource decision requests") + err := v.Validate(req) + require.NoError(t, err, "validation should allow more than 200 decision requests so the service can enforce configured limits") req.DecisionRequests = append(req.GetDecisionRequests(), dr) err = v.Validate(req) - require.Error(t, err, "validation should fail for bulk request with more than 200 multi resource decision requests") + require.NoError(t, err, "validation should allow more than 200 decision requests so the service can enforce configured limits") } func Test_GetEntitlementsRequest_Succeeds(t *testing.T) { @@ -1616,14 +1611,6 @@ func getRandomValidObligationValueFQNsList() []string { return randomList } -func getTooManyObligations() []string { - tooMany := make([]string, 51) - for i := range tooMany { - tooMany[i] = getRandomObligationValueFQN() - } - return tooMany -} - const charset = "abcdefghijklmnopqrstuvwxyz" func randString(length int) string { diff --git a/service/authorization/v2/config.go b/service/authorization/v2/config.go index 44e16a8c34..f966681c21 100644 --- a/service/authorization/v2/config.go +++ b/service/authorization/v2/config.go @@ -1,11 +1,14 @@ package authorization import ( + "errors" "fmt" "log/slog" "time" ) +var ErrInvalidRequestLimitConfig = errors.New("invalid request limit configuration") + // Manage config for EntitlementPolicyCache: attributes, subject mappings, and registered resources // Default: caching disabled, and if enabled, refresh interval defaulted to 30 seconds. type EntitlementPolicyCacheConfig struct { @@ -13,8 +16,40 @@ type EntitlementPolicyCacheConfig struct { RefreshInterval string `mapstructure:"refresh_interval" json:"refresh_interval" default:"30s"` } +type RequestLimitsConfig struct { + ResourceAttributeValuesFqnsMax int `mapstructure:"resource_attribute_values_fqns_max" json:"resource_attribute_values_fqns_max" default:"20"` + EntityIdentifierEntityChainEntitiesMax int `mapstructure:"entity_identifier_entity_chain_entities_max" json:"entity_identifier_entity_chain_entities_max" default:"10"` + DecisionRequestFulfillableObligationFqnsMax int `mapstructure:"decision_request_fulfillable_obligation_fqns_max" json:"decision_request_fulfillable_obligation_fqns_max" default:"50"` + GetDecisionMultiResourceResourcesMax int `mapstructure:"get_decision_multi_resource_resources_max" json:"get_decision_multi_resource_resources_max" default:"1000"` + GetDecisionBulkDecisionRequestsMax int `mapstructure:"get_decision_bulk_decision_requests_max" json:"get_decision_bulk_decision_requests_max" default:"200"` +} + +func (c RequestLimitsConfig) Validate() error { + if c.ResourceAttributeValuesFqnsMax < 1 { + return requestLimitConfigError("resource_attribute_values_fqns_max", c.ResourceAttributeValuesFqnsMax) + } + if c.EntityIdentifierEntityChainEntitiesMax < 1 { + return requestLimitConfigError("entity_identifier_entity_chain_entities_max", c.EntityIdentifierEntityChainEntitiesMax) + } + if c.DecisionRequestFulfillableObligationFqnsMax < 1 { + return requestLimitConfigError("decision_request_fulfillable_obligation_fqns_max", c.DecisionRequestFulfillableObligationFqnsMax) + } + if c.GetDecisionMultiResourceResourcesMax < 1 { + return requestLimitConfigError("get_decision_multi_resource_resources_max", c.GetDecisionMultiResourceResourcesMax) + } + if c.GetDecisionBulkDecisionRequestsMax < 1 { + return requestLimitConfigError("get_decision_bulk_decision_requests_max", c.GetDecisionBulkDecisionRequestsMax) + } + return nil +} + +func requestLimitConfigError(name string, value int) error { + return fmt.Errorf("%s [%d] must be greater than 0: %w", name, value, ErrInvalidRequestLimitConfig) +} + type Config struct { - Cache EntitlementPolicyCacheConfig `mapstructure:"entitlement_policy_cache" json:"entitlement_policy_cache"` + Cache EntitlementPolicyCacheConfig `mapstructure:"entitlement_policy_cache" json:"entitlement_policy_cache"` + RequestLimits RequestLimitsConfig `mapstructure:"request_limits" json:"request_limits"` // experimental features @@ -48,6 +83,9 @@ func (c *Config) Validate() error { ) } } + if err := c.RequestLimits.Validate(); err != nil { + return fmt.Errorf("invalid authorization request limits config: %w", err) + } return nil } @@ -59,6 +97,15 @@ func (c *Config) LogValue() slog.Value { slog.String("refresh_interval", c.Cache.RefreshInterval), ), ), + slog.Any("request_limits", + slog.GroupValue( + slog.Int("resource_attribute_values_fqns_max", c.RequestLimits.ResourceAttributeValuesFqnsMax), + slog.Int("entity_identifier_entity_chain_entities_max", c.RequestLimits.EntityIdentifierEntityChainEntitiesMax), + slog.Int("decision_request_fulfillable_obligation_fqns_max", c.RequestLimits.DecisionRequestFulfillableObligationFqnsMax), + slog.Int("get_decision_multi_resource_resources_max", c.RequestLimits.GetDecisionMultiResourceResourcesMax), + slog.Int("get_decision_bulk_decision_requests_max", c.RequestLimits.GetDecisionBulkDecisionRequestsMax), + ), + ), slog.Bool("allow_direct_entitlements", c.AllowDirectEntitlements), slog.Bool("enforce_namespaced_entitlements", c.EnforceNamespacedEntitlements), ) diff --git a/service/authorization/v2/config_test.go b/service/authorization/v2/config_test.go index 2342f1d1d2..54ff96b683 100644 --- a/service/authorization/v2/config_test.go +++ b/service/authorization/v2/config_test.go @@ -3,52 +3,112 @@ package authorization import ( "testing" + "github.com/creasty/defaults" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) func Test_ValidateConfig_ValidConfig(t *testing.T) { - config := &Config{ - Cache: EntitlementPolicyCacheConfig{ - Enabled: true, - RefreshInterval: "30s", - }, - } + config := newConfigWithDefaults(t) + config.Cache.Enabled = true err := config.Validate() assert.NoError(t, err) } func Test_ValidateConfig_InvalidRefreshInterval(t *testing.T) { - config := &Config{ - Cache: EntitlementPolicyCacheConfig{ - Enabled: true, - RefreshInterval: "5ms", // Too short - }, - } + config := newConfigWithDefaults(t) + config.Cache.Enabled = true + config.Cache.RefreshInterval = "5ms" // Too short err := config.Validate() require.Error(t, err) - config = &Config{ - Cache: EntitlementPolicyCacheConfig{ - Enabled: true, - RefreshInterval: "2h", // Too long - }, - } + config = newConfigWithDefaults(t) + config.Cache.Enabled = true + config.Cache.RefreshInterval = "2h" // Too long err = config.Validate() require.Error(t, err) } func Test_ValidateConfig_DisabledCache(t *testing.T) { - config := &Config{ - Cache: EntitlementPolicyCacheConfig{ - Enabled: false, - RefreshInterval: "30s", - }, - } + config := newConfigWithDefaults(t) + config.Cache.Enabled = false err := config.Validate() assert.NoError(t, err) } + +func Test_ValidateConfig_DefaultRequestLimits(t *testing.T) { + config := newConfigWithDefaults(t) + + assert.Equal(t, 20, config.RequestLimits.ResourceAttributeValuesFqnsMax) + assert.Equal(t, 10, config.RequestLimits.EntityIdentifierEntityChainEntitiesMax) + assert.Equal(t, 50, config.RequestLimits.DecisionRequestFulfillableObligationFqnsMax) + assert.Equal(t, 1000, config.RequestLimits.GetDecisionMultiResourceResourcesMax) + assert.Equal(t, 200, config.RequestLimits.GetDecisionBulkDecisionRequestsMax) +} + +func Test_ValidateConfig_InvalidRequestLimits(t *testing.T) { + cases := []struct { + name string + mutate func(*Config) + expectedErr string + }{ + { + name: "resource attribute values max must be positive", + mutate: func(config *Config) { + config.RequestLimits.ResourceAttributeValuesFqnsMax = 0 + }, + expectedErr: "resource_attribute_values_fqns_max [0] must be greater than 0", + }, + { + name: "entity chain entities max must be positive", + mutate: func(config *Config) { + config.RequestLimits.EntityIdentifierEntityChainEntitiesMax = 0 + }, + expectedErr: "entity_identifier_entity_chain_entities_max [0] must be greater than 0", + }, + { + name: "fulfillable obligation fqns max must be positive", + mutate: func(config *Config) { + config.RequestLimits.DecisionRequestFulfillableObligationFqnsMax = 0 + }, + expectedErr: "decision_request_fulfillable_obligation_fqns_max [0] must be greater than 0", + }, + { + name: "multi resource request max must be positive", + mutate: func(config *Config) { + config.RequestLimits.GetDecisionMultiResourceResourcesMax = 0 + }, + expectedErr: "get_decision_multi_resource_resources_max [0] must be greater than 0", + }, + { + name: "bulk decision request max must be positive", + mutate: func(config *Config) { + config.RequestLimits.GetDecisionBulkDecisionRequestsMax = 0 + }, + expectedErr: "get_decision_bulk_decision_requests_max [0] must be greater than 0", + }, + } + + for _, tc := range cases { + t.Run(tc.name, func(t *testing.T) { + config := newConfigWithDefaults(t) + tc.mutate(config) + + err := config.Validate() + require.ErrorIs(t, err, ErrInvalidRequestLimitConfig) + assert.Contains(t, err.Error(), tc.expectedErr) + }) + } +} + +func newConfigWithDefaults(t *testing.T) *Config { + t.Helper() + + config := &Config{} + require.NoError(t, defaults.Set(config)) + return config +} diff --git a/service/authorization/v2/validation.go b/service/authorization/v2/validation.go new file mode 100644 index 0000000000..37e22aef0b --- /dev/null +++ b/service/authorization/v2/validation.go @@ -0,0 +1,95 @@ +package authorization + +import ( + "fmt" + + "connectrpc.com/connect" + authzV2 "github.com/opentdf/platform/protocol/go/authorization/v2" +) + +func (as *Service) validateGetDecisionRequest(request *authzV2.GetDecisionRequest) error { + if err := as.validateEntityIdentifierRequestLimits(request.GetEntityIdentifier(), "entity_identifier"); err != nil { + return err + } + if err := as.validateResourceRequestLimits(request.GetResource(), "resource"); err != nil { + return err + } + return as.validateFulfillableObligationRequestLimits(request.GetFulfillableObligationFqns(), "fulfillable_obligation_fqns") +} + +func (as *Service) validateGetEntitlementsRequest(request *authzV2.GetEntitlementsRequest) error { + return as.validateEntityIdentifierRequestLimits(request.GetEntityIdentifier(), "entity_identifier") +} + +func (as *Service) validateGetDecisionMultiResourceRequest(request *authzV2.GetDecisionMultiResourceRequest, prefix string) error { + if err := as.validateEntityIdentifierRequestLimits(request.GetEntityIdentifier(), prefix+"entity_identifier"); err != nil { + return err + } + + resources := request.GetResources() + if len(resources) > as.config.RequestLimits.GetDecisionMultiResourceResourcesMax { + return limitExceededError(prefix+"resources", len(resources), as.config.RequestLimits.GetDecisionMultiResourceResourcesMax) + } + for idx, resource := range resources { + if err := as.validateResourceRequestLimits(resource, fmt.Sprintf("%sresources[%d]", prefix, idx)); err != nil { + return err + } + } + + return as.validateFulfillableObligationRequestLimits(request.GetFulfillableObligationFqns(), prefix+"fulfillable_obligation_fqns") +} + +func (as *Service) validateGetDecisionBulkRequest(request *authzV2.GetDecisionBulkRequest) error { + decisionRequests := request.GetDecisionRequests() + if len(decisionRequests) > as.config.RequestLimits.GetDecisionBulkDecisionRequestsMax { + return limitExceededError("decision_requests", len(decisionRequests), as.config.RequestLimits.GetDecisionBulkDecisionRequestsMax) + } + + for idx, decisionRequest := range decisionRequests { + if err := as.validateGetDecisionMultiResourceRequest(decisionRequest, fmt.Sprintf("decision_requests[%d].", idx)); err != nil { + return err + } + } + + return nil +} + +func (as *Service) validateEntityIdentifierRequestLimits(entityIdentifier *authzV2.EntityIdentifier, path string) error { + entityChain := entityIdentifier.GetEntityChain() + if entityChain == nil { + return nil + } + + entities := entityChain.GetEntities() + if len(entities) > as.config.RequestLimits.EntityIdentifierEntityChainEntitiesMax { + return limitExceededError(path+".entity_chain.entities", len(entities), as.config.RequestLimits.EntityIdentifierEntityChainEntitiesMax) + } + + return nil +} + +func (as *Service) validateResourceRequestLimits(resource *authzV2.Resource, path string) error { + attributeValues := resource.GetAttributeValues() + if attributeValues == nil { + return nil + } + + fqns := attributeValues.GetFqns() + if len(fqns) > as.config.RequestLimits.ResourceAttributeValuesFqnsMax { + return limitExceededError(path+".attribute_values.fqns", len(fqns), as.config.RequestLimits.ResourceAttributeValuesFqnsMax) + } + + return nil +} + +func (as *Service) validateFulfillableObligationRequestLimits(fqns []string, path string) error { + if len(fqns) > as.config.RequestLimits.DecisionRequestFulfillableObligationFqnsMax { + return limitExceededError(path, len(fqns), as.config.RequestLimits.DecisionRequestFulfillableObligationFqnsMax) + } + + return nil +} + +func limitExceededError(path string, got int, limit int) error { + return connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("%s exceeds maximum count: got %d, max %d", path, got, limit)) +} diff --git a/service/authorization/v2/validation_test.go b/service/authorization/v2/validation_test.go new file mode 100644 index 0000000000..6d102e10fb --- /dev/null +++ b/service/authorization/v2/validation_test.go @@ -0,0 +1,407 @@ +package authorization + +import ( + "strconv" + "testing" + + "connectrpc.com/connect" + authzV2 "github.com/opentdf/platform/protocol/go/authorization/v2" + "github.com/opentdf/platform/protocol/go/entity" + "github.com/opentdf/platform/service/logger" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + "go.opentelemetry.io/otel/trace/noop" +) + +func Test_validateGetDecisionRequest_DefaultRequestLimits(t *testing.T) { + service := newValidationTestService(t, nil) + + cases := []struct { + name string + request *authzV2.GetDecisionRequest + expectedErr string + }{ + { + name: "entity chain entities", + request: newDecisionRequestWithEntityChainCount(11), + expectedErr: "entity_identifier.entity_chain.entities exceeds maximum count: got 11, max 10", + }, + { + name: "resource attribute values", + request: newDecisionRequestWithAttributeValueCount(21), + expectedErr: "resource.attribute_values.fqns exceeds maximum count: got 21, max 20", + }, + { + name: "fulfillable obligation fqns", + request: newDecisionRequestWithObligationCount(51), + expectedErr: "fulfillable_obligation_fqns exceeds maximum count: got 51, max 50", + }, + } + + for _, tc := range cases { + t.Run(tc.name, func(t *testing.T) { + err := service.validateGetDecisionRequest(tc.request) + require.Error(t, err) + assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err)) + assert.Contains(t, err.Error(), tc.expectedErr) + }) + } +} + +func Test_validateGetEntitlementsRequest_DefaultRequestLimit(t *testing.T) { + service := newValidationTestService(t, nil) + + err := service.validateGetEntitlementsRequest(newEntitlementsRequestWithEntityChainCount(11)) + require.Error(t, err) + assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err)) + assert.Contains(t, err.Error(), "entity_identifier.entity_chain.entities exceeds maximum count: got 11, max 10") +} + +func Test_validateGetDecisionMultiResourceRequest_DefaultRequestLimits(t *testing.T) { + service := newValidationTestService(t, nil) + + cases := []struct { + name string + request *authzV2.GetDecisionMultiResourceRequest + expectedErr string + }{ + { + name: "entity chain entities", + request: newDecisionMultiResourceRequestWithEntityChainCount(11), + expectedErr: "entity_identifier.entity_chain.entities exceeds maximum count: got 11, max 10", + }, + { + name: "resources", + request: newDecisionMultiResourceRequestWithResourceCount(1001), + expectedErr: "resources exceeds maximum count: got 1001, max 1000", + }, + { + name: "fulfillable obligation fqns", + request: newDecisionMultiResourceRequestWithObligationCount(51), + expectedErr: "fulfillable_obligation_fqns exceeds maximum count: got 51, max 50", + }, + } + + for _, tc := range cases { + t.Run(tc.name, func(t *testing.T) { + err := service.validateGetDecisionMultiResourceRequest(tc.request, "") + require.Error(t, err) + assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err)) + assert.Contains(t, err.Error(), tc.expectedErr) + }) + } +} + +func Test_validateGetDecisionBulkRequest_DefaultRequestLimit(t *testing.T) { + service := newValidationTestService(t, nil) + + err := service.validateGetDecisionBulkRequest(newDecisionBulkRequestWithDecisionCount(201)) + require.Error(t, err) + assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err)) + assert.Contains(t, err.Error(), "decision_requests exceeds maximum count: got 201, max 200") +} + +func Test_validateGetDecisionBulkRequest_NestedLimitErrorIncludesPath(t *testing.T) { + service := newValidationTestService(t, nil) + + err := service.validateGetDecisionBulkRequest(&authzV2.GetDecisionBulkRequest{ + DecisionRequests: []*authzV2.GetDecisionMultiResourceRequest{ + newDecisionMultiResourceRequestWithAttributeValueCount(21), + }, + }) + require.Error(t, err) + assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err)) + assert.Contains(t, err.Error(), "decision_requests[0].resources[0].attribute_values.fqns exceeds maximum count: got 21, max 20") +} + +func Test_validateGetDecisionRequest_ExactlyAtDefaultLimitPasses(t *testing.T) { + service := newValidationTestService(t, nil) + + require.NoError(t, service.validateGetDecisionRequest(newDecisionRequestWithEntityChainCount(10))) + require.NoError(t, service.validateGetDecisionRequest(newDecisionRequestWithAttributeValueCount(20))) + require.NoError(t, service.validateGetDecisionRequest(newDecisionRequestWithObligationCount(50))) +} + +func Test_validateGetEntitlementsRequest_ExactlyAtDefaultLimitPasses(t *testing.T) { + service := newValidationTestService(t, nil) + + require.NoError(t, service.validateGetEntitlementsRequest(newEntitlementsRequestWithEntityChainCount(10))) +} + +func Test_validateGetDecisionMultiResourceRequest_ExactlyAtDefaultLimitPasses(t *testing.T) { + service := newValidationTestService(t, nil) + + require.NoError(t, service.validateGetDecisionMultiResourceRequest(newDecisionMultiResourceRequestWithEntityChainCount(10), "")) + require.NoError(t, service.validateGetDecisionMultiResourceRequest(newDecisionMultiResourceRequestWithResourceCount(1000), "")) + require.NoError(t, service.validateGetDecisionMultiResourceRequest(newDecisionMultiResourceRequestWithObligationCount(50), "")) +} + +func Test_validateGetDecisionBulkRequest_ExactlyAtDefaultLimitPasses(t *testing.T) { + service := newValidationTestService(t, nil) + + require.NoError(t, service.validateGetDecisionBulkRequest(newDecisionBulkRequestWithDecisionCount(200))) +} + +func Test_validateDecisionRequests_UseCustomRequestLimits(t *testing.T) { + service := newValidationTestService(t, &RequestLimitsConfig{ + ResourceAttributeValuesFqnsMax: 21, + EntityIdentifierEntityChainEntitiesMax: 11, + DecisionRequestFulfillableObligationFqnsMax: 51, + GetDecisionMultiResourceResourcesMax: 1001, + GetDecisionBulkDecisionRequestsMax: 201, + }) + + require.NoError(t, service.validateGetDecisionRequest(newDecisionRequestWithEntityChainCount(11))) + require.NoError(t, service.validateGetDecisionRequest(newDecisionRequestWithAttributeValueCount(21))) + require.NoError(t, service.validateGetDecisionRequest(newDecisionRequestWithObligationCount(51))) + require.NoError(t, service.validateGetDecisionMultiResourceRequest(newDecisionMultiResourceRequestWithResourceCount(1001), "")) + require.NoError(t, service.validateGetDecisionMultiResourceRequest(newDecisionMultiResourceRequestWithObligationCount(51), "")) + require.NoError(t, service.validateGetDecisionBulkRequest(newDecisionBulkRequestWithDecisionCount(201))) +} + +func Test_GetDecision_ReturnsInvalidArgumentForConfiguredLimit(t *testing.T) { + service := newHandlerTestService(t, nil) + + _, err := service.GetDecision(t.Context(), connect.NewRequest(newDecisionRequestWithAttributeValueCount(21))) + require.Error(t, err) + assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err)) + assert.Contains(t, err.Error(), "resource.attribute_values.fqns exceeds maximum count: got 21, max 20") +} + +func Test_GetEntitlements_ReturnsInvalidArgumentForConfiguredLimit(t *testing.T) { + service := newHandlerTestService(t, func(config *Config) { + config.RequestLimits.EntityIdentifierEntityChainEntitiesMax = 1 + }) + + _, err := service.GetEntitlements(t.Context(), connect.NewRequest(newEntitlementsRequestWithEntityChainCount(2))) + require.Error(t, err) + assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err)) + assert.Contains(t, err.Error(), "entity_identifier.entity_chain.entities exceeds maximum count: got 2, max 1") +} + +func Test_GetDecisionMultiResource_UsesCustomConfiguredLimit(t *testing.T) { + service := newHandlerTestService(t, func(config *Config) { + config.RequestLimits.GetDecisionMultiResourceResourcesMax = 2 + }) + + _, err := service.GetDecisionMultiResource(t.Context(), connect.NewRequest(newDecisionMultiResourceRequestWithResourceCount(3))) + require.Error(t, err) + assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err)) + assert.Contains(t, err.Error(), "resources exceeds maximum count: got 3, max 2") +} + +func Test_GetDecisionBulk_ReturnsInvalidArgumentForConfiguredLimit(t *testing.T) { + service := newHandlerTestService(t, func(config *Config) { + config.RequestLimits.GetDecisionBulkDecisionRequestsMax = 1 + }) + + _, err := service.GetDecisionBulk(t.Context(), connect.NewRequest(newDecisionBulkRequestWithDecisionCount(2))) + require.Error(t, err) + assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err)) + assert.Contains(t, err.Error(), "decision_requests exceeds maximum count: got 2, max 1") +} + +func newValidationTestService(t *testing.T, requestLimits *RequestLimitsConfig) *Service { + t.Helper() + + config := newConfigWithDefaults(t) + if requestLimits != nil { + config.RequestLimits = *requestLimits + } + require.NoError(t, config.Validate()) + + return &Service{config: config} +} + +func newHandlerTestService(t *testing.T, mutate func(*Config)) *Service { + t.Helper() + + config := newConfigWithDefaults(t) + if mutate != nil { + mutate(config) + } + require.NoError(t, config.Validate()) + + return &Service{ + config: config, + logger: logger.CreateTestLogger(), + Tracer: noop.NewTracerProvider().Tracer(""), + } +} + +func newDecisionRequestWithEntityChainCount(count int) *authzV2.GetDecisionRequest { + return &authzV2.GetDecisionRequest{ + EntityIdentifier: &authzV2.EntityIdentifier{ + Identifier: &authzV2.EntityIdentifier_EntityChain{ + EntityChain: &entity.EntityChain{ + EphemeralId: "entity-chain", + Entities: newEntities(count), + }, + }, + }, + Action: sampleActionCreate, + Resource: &authzV2.Resource{ + Resource: &authzV2.Resource_RegisteredResourceValueFqn{ + RegisteredResourceValueFqn: sampleRegisteredResourceFQN, + }, + }, + } +} + +func newEntitlementsRequestWithEntityChainCount(count int) *authzV2.GetEntitlementsRequest { + return &authzV2.GetEntitlementsRequest{ + EntityIdentifier: &authzV2.EntityIdentifier{ + Identifier: &authzV2.EntityIdentifier_EntityChain{ + EntityChain: &entity.EntityChain{ + EphemeralId: "entity-chain", + Entities: newEntities(count), + }, + }, + }, + } +} + +func newDecisionRequestWithAttributeValueCount(count int) *authzV2.GetDecisionRequest { + return &authzV2.GetDecisionRequest{ + EntityIdentifier: newTokenEntityIdentifier(), + Action: sampleActionCreate, + Resource: &authzV2.Resource{ + Resource: &authzV2.Resource_AttributeValues_{ + AttributeValues: &authzV2.Resource_AttributeValues{ + Fqns: newAttributeValueFQNs(count), + }, + }, + }, + } +} + +func newDecisionRequestWithObligationCount(count int) *authzV2.GetDecisionRequest { + return &authzV2.GetDecisionRequest{ + EntityIdentifier: newTokenEntityIdentifier(), + Action: sampleActionCreate, + Resource: &authzV2.Resource{ + Resource: &authzV2.Resource_RegisteredResourceValueFqn{ + RegisteredResourceValueFqn: sampleRegisteredResourceFQN, + }, + }, + FulfillableObligationFqns: newObligationFQNs(count), + } +} + +func newDecisionMultiResourceRequestWithEntityChainCount(count int) *authzV2.GetDecisionMultiResourceRequest { + return &authzV2.GetDecisionMultiResourceRequest{ + EntityIdentifier: &authzV2.EntityIdentifier{ + Identifier: &authzV2.EntityIdentifier_EntityChain{ + EntityChain: &entity.EntityChain{ + EphemeralId: "entity-chain", + Entities: newEntities(count), + }, + }, + }, + Action: sampleActionCreate, + Resources: []*authzV2.Resource{ + { + Resource: &authzV2.Resource_RegisteredResourceValueFqn{ + RegisteredResourceValueFqn: sampleRegisteredResourceFQN, + }, + }, + }, + } +} + +func newDecisionMultiResourceRequestWithAttributeValueCount(count int) *authzV2.GetDecisionMultiResourceRequest { + return &authzV2.GetDecisionMultiResourceRequest{ + EntityIdentifier: newTokenEntityIdentifier(), + Action: sampleActionCreate, + Resources: []*authzV2.Resource{ + { + Resource: &authzV2.Resource_AttributeValues_{ + AttributeValues: &authzV2.Resource_AttributeValues{ + Fqns: newAttributeValueFQNs(count), + }, + }, + }, + }, + } +} + +func newDecisionMultiResourceRequestWithObligationCount(count int) *authzV2.GetDecisionMultiResourceRequest { + return &authzV2.GetDecisionMultiResourceRequest{ + EntityIdentifier: newTokenEntityIdentifier(), + Action: sampleActionCreate, + Resources: []*authzV2.Resource{ + { + Resource: &authzV2.Resource_RegisteredResourceValueFqn{ + RegisteredResourceValueFqn: sampleRegisteredResourceFQN, + }, + }, + }, + FulfillableObligationFqns: newObligationFQNs(count), + } +} + +func newDecisionMultiResourceRequestWithResourceCount(count int) *authzV2.GetDecisionMultiResourceRequest { + resources := make([]*authzV2.Resource, count) + for i := range count { + resources[i] = &authzV2.Resource{ + Resource: &authzV2.Resource_AttributeValues_{ + AttributeValues: &authzV2.Resource_AttributeValues{ + Fqns: []string{sampleResourceFQN}, + }, + }, + } + } + + return &authzV2.GetDecisionMultiResourceRequest{ + EntityIdentifier: newTokenEntityIdentifier(), + Action: sampleActionCreate, + Resources: resources, + } +} + +func newDecisionBulkRequestWithDecisionCount(count int) *authzV2.GetDecisionBulkRequest { + requests := make([]*authzV2.GetDecisionMultiResourceRequest, count) + for i := range count { + requests[i] = newDecisionMultiResourceRequestWithResourceCount(1) + } + return &authzV2.GetDecisionBulkRequest{DecisionRequests: requests} +} + +func newTokenEntityIdentifier() *authzV2.EntityIdentifier { + return &authzV2.EntityIdentifier{ + Identifier: &authzV2.EntityIdentifier_Token{ + Token: &entity.Token{ + EphemeralId: "token-entity", + Jwt: "sample-jwt-token", + }, + }, + } +} + +func newEntities(count int) []*entity.Entity { + entities := make([]*entity.Entity, count) + for i := range count { + entities[i] = &entity.Entity{ + EphemeralId: "entity-" + strconv.Itoa(i), + EntityType: &entity.Entity_EmailAddress{EmailAddress: "test@test.com"}, + Category: entity.Entity_CATEGORY_SUBJECT, + } + } + return entities +} + +func newAttributeValueFQNs(count int) []string { + fqns := make([]string, count) + for i := range count { + fqns[i] = "https://example.com/attr/any_of_attr_name/value/val" + strconv.Itoa(i) + } + return fqns +} + +func newObligationFQNs(count int) []string { + fqns := make([]string, count) + for i := range count { + fqns[i] = "https://example.com/obl/drm/value/prevent_print_" + strconv.Itoa(i) + } + return fqns +}
attribute_values Resource.AttributeValues

a set of attribute value FQNs, such as those on a TDF, between 1 and 20 in count

a set of attribute value FQNs, such as those on a TDF, containing at least 1 value