diff --git a/.claude/rules/bff-go.md b/.claude/rules/bff-go.md index 5eb104a..c76bf4c 100644 --- a/.claude/rules/bff-go.md +++ b/.claude/rules/bff-go.md @@ -17,16 +17,9 @@ backend/ │ │ ├── *_handler.go # Per-resource handlers │ │ └── middleware.go # Auth, CORS, logging │ ├── auth/ # OIDC middleware -│ ├── gateway/ # Thin gRPC wrapper -│ │ ├── client.go # Connection, per-RPC OIDC auth -│ │ ├── sandboxes.go # Sandbox CRUD + logs -│ │ ├── workspaces.go # Workspace + member CRUD -│ │ ├── providers.go # Provider + profile CRUD -│ │ ├── policies.go # Policy + draft policy -│ │ └── inference.go # Inference route CRUD -│ └── models/ # Response DTOs -├── proto/ # Copied from NVIDIA/OpenShell/proto/ -├── gen/ # protoc-generated Go stubs (committed) +│ ├── sdkclient/ # SDK auth provider (per-request JWT forwarding) +│ │ └── auth.go # ContextAuthProvider +│ └── models/ # Response DTOs and SDK type converters ├── go.mod └── go.sum ``` @@ -41,30 +34,22 @@ func (app *App) ListSandboxes(w http.ResponseWriter, r *http.Request) URL params via `chi.URLParam(r, "workspace")`. -## Gateway client +## SDK client -The `internal/gateway/` package wraps protoc-generated gRPC stubs. Each method is 5-10 lines: +The BFF uses `openshell-sdk-go` via a single shared `openshell.ClientInterface`. Handlers access sub-clients directly: ```go -func (c *Client) ListSandboxes(ctx context.Context, workspace string) ([]*pb.Sandbox, error) { - resp, err := c.openshell.ListSandboxes(ctx, &pb.ListSandboxesRequest{ - Workspace: workspace, - }) - if err != nil { - return nil, err - } - return resp.Sandboxes, nil -} +sandboxes, err := app.client.Sandboxes().List(r.Context(), workspace) ``` -Only wrap user-facing RPCs (~30). Skip supervisor/internal RPCs. +Per-request JWT forwarding is handled by `ContextAuthProvider` in `internal/sdkclient/auth.go`, which reads the token from the request context on every gRPC call. ## Auth OIDC via `go-oidc` v3. Per-request flow: 1. Extract JWT from `Authorization: Bearer` header or HTTP-only cookie 2. Validate against gateway's OIDC issuer JWKS -3. Forward same JWT to gateway on every gRPC call via `grpc.PerRPCCredentials` +3. Forward same JWT to gateway on every SDK call via `ContextAuthProvider` 4. Gateway enforces RBAC (admin/user roles) and workspace membership ## Configuration @@ -96,10 +81,6 @@ type ErrorResponse struct { - `httptest.NewRecorder()` + `http.NewRequest()` for handler tests - `slog` for structured logging -## Proto regeneration - -```bash -make proto # runs protoc on backend/proto/*.proto → backend/gen/ -``` +## SDK dependency -Proto files are copied from `NVIDIA/OpenShell/proto/`. Keep them in sync manually or via CI check. +The BFF depends on `github.com/rhuss/openshell-sdk-go`. Update with `go get -u` in `backend/`. diff --git a/.claude/settings.json b/.claude/settings.json new file mode 100644 index 0000000..3d17061 --- /dev/null +++ b/.claude/settings.json @@ -0,0 +1,6 @@ +{ + "enabledPlugins": { + "design-audit@patternfly-ai-helpers": true, + "patternfly-mcp@patternfly-ai-helpers": true + } +} diff --git a/.gitignore b/.gitignore index 73da34f..674576c 100644 --- a/.gitignore +++ b/.gitignore @@ -11,9 +11,10 @@ backend/bin/ .idea/ .vscode/ -# Dev environment state (generated certs, runtime artifacts) +# Dev environment state (generated certs, runtime artifacts, env config) scripts/.pki/ scripts/.state/ +scripts/.env.dev # Env files are never committed .env diff --git a/CLAUDE.md b/CLAUDE.md index 1a21d18..c63dbee 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -15,16 +15,14 @@ backend/ Go BFF cmd/ Entry point internal/api/ REST handlers internal/auth/ OIDC middleware - internal/gateway/ Thin gRPC wrapper (~30 RPCs) - proto/ Copied from NVIDIA/OpenShell/proto/ - gen/ protoc-generated Go stubs + internal/sdkclient/ SDK auth provider (per-request JWT forwarding) + internal/models/ Response DTOs and SDK type converters ``` ## Build and run ```bash make setup # install frontend + go deps -make proto # regenerate Go stubs from proto files make dev # start frontend dev server + BFF with hot reload make build # produce container image make test # frontend unit tests + go tests @@ -36,17 +34,17 @@ Requires a running OpenShell gateway: `openshell gateway start` (Podman) or poin ## Architecture rules -- **Proto is source of truth.** `backend/proto/` defines what exists. Before implementing anything API-adjacent, read the actual proto definitions. Never invent RPCs, fields, or lifecycle states (see `.claude/rules/openshell-api.md` for the list of things that famously don't exist: sandbox stop/start, workspace policy library, OCSF events API, member role update). +- **SDK is source of truth.** `openshell-sdk-go` defines what exists. Before implementing anything API-adjacent, check the SDK interfaces. Never invent RPCs, fields, or lifecycle states (see `.claude/rules/openshell-api.md` for the list of things that famously don't exist: sandbox stop/start, workspace policy library, OCSF events API, member role update). - **Zero `@odh-dashboard/*` imports.** This repo has no knowledge of odh-dashboard. Downstream consumption happens via a separate package that imports our components. - **OIDC only for auth.** No mTLS, no OpenShift OAuth, no edge tokens. -- **gRPC via protoc-generated stubs**, not any SDK. The `internal/gateway/` package wraps ~30 user-facing RPCs. Skip internal/supervisor RPCs. +- **gRPC via openshell-sdk-go.** The SDK client wraps ~30 user-facing RPCs with sub-clients (Sandboxes, Workspaces, Providers, Policy, Config, Inference, Services, Exec, Files). Skip internal/supervisor RPCs. - **No WebSockets.** Downstream federation proxy can't handle them. Use polling for status, polling for logs. - **PatternFly 6 only.** No MUI, no custom design system. - **Page components must be self-contained and exportable.** Each page takes props and uses internal API hooks. No dashboard-specific wrappers baked in. ## OpenShell API reference -The gateway exposes 60+ gRPC RPCs across 4 services. We surface ~30 user-facing ones. Proto files are in `backend/proto/`. See the full API surface map in the `brain/openshell-dashboard/api-surface.md` planning doc. +The gateway exposes 60+ gRPC RPCs across 4 services. We surface ~30 user-facing ones via the `openshell-sdk-go` Go SDK. See the full API surface map in the `brain/openshell-dashboard/api-surface.md` planning doc. ## Personas diff --git a/Makefile b/Makefile index 5c5db3f..886d020 100644 --- a/Makefile +++ b/Makefile @@ -1,38 +1,16 @@ GO_MODULE := github.com/Gkrumbach07/openshell-dashboard/backend -PROTO_DIR := backend/proto -GEN_DIR := backend/gen -PROTO_FILES := options.proto datamodel.proto sandbox.proto inference.proto openshell.proto -# Map each proto file to its generated Go package import path. -PROTO_GO_OPTS := \ - --go_opt=Moptions.proto=$(GO_MODULE)/gen/optionsv1 \ - --go_opt=Mdatamodel.proto=$(GO_MODULE)/gen/datamodelv1 \ - --go_opt=Msandbox.proto=$(GO_MODULE)/gen/sandboxv1 \ - --go_opt=Minference.proto=$(GO_MODULE)/gen/inferencev1 \ - --go_opt=Mopenshell.proto=$(GO_MODULE)/gen/openshellv1 -PROTO_GRPC_OPTS := \ - --go-grpc_opt=Moptions.proto=$(GO_MODULE)/gen/optionsv1 \ - --go-grpc_opt=Mdatamodel.proto=$(GO_MODULE)/gen/datamodelv1 \ - --go-grpc_opt=Msandbox.proto=$(GO_MODULE)/gen/sandboxv1 \ - --go-grpc_opt=Minference.proto=$(GO_MODULE)/gen/inferencev1 \ - --go-grpc_opt=Mopenshell.proto=$(GO_MODULE)/gen/openshellv1 +# Auto-source dev environment config if available (written by scripts/dev-env.sh) +-include scripts/.env.dev +export -.PHONY: setup proto dev dev-full dev-backend dev-frontend build build-frontend build-backend test lint typecheck clean +.PHONY: setup dev dev-full dev-backend dev-frontend build build-frontend build-backend test lint typecheck clean setup: ## Install frontend deps and Go deps cd frontend && npm install cd backend && go mod download -proto: ## Regenerate Go stubs from backend/proto/*.proto into backend/gen/ - rm -rf $(GEN_DIR) - mkdir -p $(GEN_DIR) - protoc -I $(PROTO_DIR) \ - --go_out=$(GEN_DIR) --go_opt=module=$(GO_MODULE)/gen $(PROTO_GO_OPTS) \ - --go-grpc_out=$(GEN_DIR) --go-grpc_opt=module=$(GO_MODULE)/gen $(PROTO_GRPC_OPTS) \ - $(addprefix $(PROTO_DIR)/,$(PROTO_FILES)) - cd backend && go mod tidy - -dev-full: ## Start dev infrastructure (Keycloak + gateway) then frontend + BFF +dev-full: ## Start Keycloak + gateway, then frontend + BFF (one command) ./scripts/dev-env.sh start @$(MAKE) dev @@ -40,7 +18,7 @@ dev: ## Start frontend dev server (:3000) and Go BFF (:8080) @$(MAKE) -j2 dev-backend dev-frontend dev-backend: - cd backend && AUTH_DISABLED=$${AUTH_DISABLED:-true} go run ./cmd/server + cd backend && go run ./cmd/server dev-frontend: cd frontend && npm start diff --git a/README.md b/README.md index c0a1593..c3750f9 100644 --- a/README.md +++ b/README.md @@ -36,21 +36,13 @@ To test with real OIDC authentication against a local Keycloak and OpenShell gat ```bash make setup +export OPENSHELL_DIR=~/path/to/openshell # your OpenShell checkout +make dev-full # starts infra + dashboard +``` -# Point at your OpenShell source checkout -export OPENSHELL_DIR=~/path/to/openshell +That's it. `dev-full` starts Keycloak and the gateway (if not already running), writes a `scripts/.env.dev` config file, and launches the dashboard. On subsequent runs, `make dev` picks up the config automatically (no env vars needed). -# Start the infrastructure (Keycloak + gateway) -./scripts/dev-env.sh start - -# Run the dashboard with the printed env vars -export OPENSHELL_GATEWAY_URL=grpcs://localhost:17670 -export OIDC_ISSUER=http://localhost:8180/realms/openshell -export OIDC_CLIENT_ID=openshell-dashboard -export GATEWAY_CA_CERT=$(pwd)/scripts/.pki/ca.crt -export AUTH_DISABLED=false -make dev -``` +If `OPENSHELL_DIR` is not set, the script prompts interactively and offers to clone the repo for you. The chosen path is saved to `scripts/.env.dev` so you only configure it once. Open http://localhost:3000 and log in via Keycloak with one of the test users: @@ -60,7 +52,22 @@ Open http://localhost:3000 and log in via Keycloak with one of the test users: | `user@test` | `user` | Workspace member | | `user-b@test` | `user-b` | Workspace member | -The script is idempotent. Run `./scripts/dev-env.sh status` to check components, `stop` to tear down, or `rebuild-gateway` after pulling upstream changes. +### What `dev-full` starts + +| Component | How | Lifecycle | +|-----------|-----|-----------| +| Keycloak | Podman container (`openshell-keycloak`) on port 8180 | Runs until `dev-env.sh stop` | +| OpenShell gateway | Background process built from source, port 17670 (gRPCs) + 17671 (health) | Runs until `dev-env.sh stop` | +| Dashboard BFF | `go run` on port 8080 | Runs with `make dev`, Ctrl+C to stop | +| Dashboard frontend | Webpack dev server on port 3000 | Runs with `make dev`, Ctrl+C to stop | + +Keycloak and the gateway survive across `make dev` restarts. Stop them explicitly: + +```bash +./scripts/dev-env.sh stop # stops gateway + keycloak, cleans up orphans +./scripts/dev-env.sh status # check what's running +./scripts/dev-env.sh rebuild-gateway # rebuild after upstream changes +``` ## Configuration diff --git a/backend/cmd/server/main.go b/backend/cmd/server/main.go index c723f6a..2c1b521 100644 --- a/backend/cmd/server/main.go +++ b/backend/cmd/server/main.go @@ -12,9 +12,11 @@ import ( "strings" "time" + openshell "github.com/rhuss/openshell-sdk-go/openshell/v1" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/api" "github.com/Gkrumbach07/openshell-dashboard/backend/internal/auth" - "github.com/Gkrumbach07/openshell-dashboard/backend/internal/gateway" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/sdkclient" ) // envOr returns the environment variable value or a default. @@ -68,17 +70,27 @@ func main() { CredentialRefresh: envOr("FEATURE_CREDENTIAL_REFRESH", "true") == "true", Services: envOr("FEATURE_SERVICES", "true") == "true", DraftPolicy: envOr("FEATURE_DRAFT_POLICY", "true") == "true", + DeploymentContext: envOr("DEPLOYMENT_CONTEXT", "standalone"), + WorkspaceBinding: envOr("FEATURE_WORKSPACE_BINDING", "false") == "true", + ResourceLinks: envOr("FEATURE_RESOURCE_LINKS", "false") == "true", }, }) - gatewayClient, err := gateway.New(*gatewayURL, *gatewayCACert) + cfg := openshell.Config{ + Address: *gatewayURL, + Auth: sdkclient.ContextAuthProvider{}, + } + if *gatewayCACert != "" { + cfg.TLS = &openshell.TLSConfig{CAFile: *gatewayCACert} + } + sdkClient, err := openshell.NewClient(cfg) if err != nil { - slog.Error("gateway client setup failed", "error", err) + slog.Error("SDK client setup failed", "error", err) os.Exit(1) } - defer gatewayClient.Close() + defer sdkClient.Close() - app := api.NewApp(gatewayClient, authMiddleware, *staticDir, strings.Split(*origins, ",")) + app := api.NewApp(sdkClient, authMiddleware, *staticDir, strings.Split(*origins, ",")) addr := ":" + *port slog.Info("openshell-dashboard BFF listening", diff --git a/backend/gen/datamodelv1/datamodel.pb.go b/backend/gen/datamodelv1/datamodel.pb.go deleted file mode 100644 index 9a88dbd..0000000 --- a/backend/gen/datamodelv1/datamodel.pb.go +++ /dev/null @@ -1,507 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -// Code generated by protoc-gen-go. DO NOT EDIT. -// versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 -// source: datamodel.proto - -package datamodelv1 - -import ( - _ "github.com/Gkrumbach07/openshell-dashboard/backend/gen/optionsv1" - protoreflect "google.golang.org/protobuf/reflect/protoreflect" - protoimpl "google.golang.org/protobuf/runtime/protoimpl" - reflect "reflect" - sync "sync" - unsafe "unsafe" -) - -const ( - // Verify that this generated code is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) - // Verify that runtime/protoimpl is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) -) - -// Phase of a workspace's lifecycle. -type WorkspacePhase int32 - -const ( - WorkspacePhase_WORKSPACE_PHASE_UNSPECIFIED WorkspacePhase = 0 - WorkspacePhase_WORKSPACE_PHASE_ACTIVE WorkspacePhase = 1 - WorkspacePhase_WORKSPACE_PHASE_TERMINATING WorkspacePhase = 2 -) - -// Enum value maps for WorkspacePhase. -var ( - WorkspacePhase_name = map[int32]string{ - 0: "WORKSPACE_PHASE_UNSPECIFIED", - 1: "WORKSPACE_PHASE_ACTIVE", - 2: "WORKSPACE_PHASE_TERMINATING", - } - WorkspacePhase_value = map[string]int32{ - "WORKSPACE_PHASE_UNSPECIFIED": 0, - "WORKSPACE_PHASE_ACTIVE": 1, - "WORKSPACE_PHASE_TERMINATING": 2, - } -) - -func (x WorkspacePhase) Enum() *WorkspacePhase { - p := new(WorkspacePhase) - *p = x - return p -} - -func (x WorkspacePhase) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (WorkspacePhase) Descriptor() protoreflect.EnumDescriptor { - return file_datamodel_proto_enumTypes[0].Descriptor() -} - -func (WorkspacePhase) Type() protoreflect.EnumType { - return &file_datamodel_proto_enumTypes[0] -} - -func (x WorkspacePhase) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use WorkspacePhase.Descriptor instead. -func (WorkspacePhase) EnumDescriptor() ([]byte, []int) { - return file_datamodel_proto_rawDescGZIP(), []int{0} -} - -// Kubernetes-style metadata shared by all top-level OpenShell domain objects. -// -// This structure provides consistent metadata (identity, labels, annotations, -// timestamps, resource versioning) across Sandbox, Provider, SshSession, and -// other resources. -type ObjectMeta struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Stable object ID generated by the gateway. - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` - // Human-readable object name (unique per object type). - Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` - // Milliseconds since Unix epoch when the object was created. - CreatedAtMs int64 `protobuf:"varint,3,opt,name=created_at_ms,json=createdAtMs,proto3" json:"created_at_ms,omitempty"` - // Key-value labels for filtering and organization. - // Labels must follow Kubernetes conventions: alphanumeric + `-._/`, max 63 chars per segment. - Labels map[string]string `protobuf:"bytes,4,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Optimistic concurrency control version. - // Incremented by the gateway on each update. Clients can use this for compare-and-swap operations. - ResourceVersion uint64 `protobuf:"varint,5,opt,name=resource_version,json=resourceVersion,proto3" json:"resource_version,omitempty"` - // Opaque key-value metadata that is not used for selectors. - // Annotation keys use the same qualified-key shape as labels, but values may be longer. - Annotations map[string]string `protobuf:"bytes,6,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Workspace that owns this resource. Empty is normalized to "default" by the - // gateway. Immutable after creation. - Workspace string `protobuf:"bytes,7,opt,name=workspace,proto3" json:"workspace,omitempty"` - // Milliseconds since Unix epoch when graceful deletion was initiated. - // Zero means the object is not being deleted. Once set, this field is - // immutable — the only path forward is completing deletion. - DeletionTimestampMs int64 `protobuf:"varint,8,opt,name=deletion_timestamp_ms,json=deletionTimestampMs,proto3" json:"deletion_timestamp_ms,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ObjectMeta) Reset() { - *x = ObjectMeta{} - mi := &file_datamodel_proto_msgTypes[0] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ObjectMeta) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ObjectMeta) ProtoMessage() {} - -func (x *ObjectMeta) ProtoReflect() protoreflect.Message { - mi := &file_datamodel_proto_msgTypes[0] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ObjectMeta.ProtoReflect.Descriptor instead. -func (*ObjectMeta) Descriptor() ([]byte, []int) { - return file_datamodel_proto_rawDescGZIP(), []int{0} -} - -func (x *ObjectMeta) GetId() string { - if x != nil { - return x.Id - } - return "" -} - -func (x *ObjectMeta) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *ObjectMeta) GetCreatedAtMs() int64 { - if x != nil { - return x.CreatedAtMs - } - return 0 -} - -func (x *ObjectMeta) GetLabels() map[string]string { - if x != nil { - return x.Labels - } - return nil -} - -func (x *ObjectMeta) GetResourceVersion() uint64 { - if x != nil { - return x.ResourceVersion - } - return 0 -} - -func (x *ObjectMeta) GetAnnotations() map[string]string { - if x != nil { - return x.Annotations - } - return nil -} - -func (x *ObjectMeta) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -func (x *ObjectMeta) GetDeletionTimestampMs() int64 { - if x != nil { - return x.DeletionTimestampMs - } - return 0 -} - -// Status of a workspace. -type WorkspaceStatus struct { - state protoimpl.MessageState `protogen:"open.v1"` - Phase WorkspacePhase `protobuf:"varint,1,opt,name=phase,proto3,enum=openshell.datamodel.v1.WorkspacePhase" json:"phase,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *WorkspaceStatus) Reset() { - *x = WorkspaceStatus{} - mi := &file_datamodel_proto_msgTypes[1] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *WorkspaceStatus) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*WorkspaceStatus) ProtoMessage() {} - -func (x *WorkspaceStatus) ProtoReflect() protoreflect.Message { - mi := &file_datamodel_proto_msgTypes[1] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use WorkspaceStatus.ProtoReflect.Descriptor instead. -func (*WorkspaceStatus) Descriptor() ([]byte, []int) { - return file_datamodel_proto_rawDescGZIP(), []int{1} -} - -func (x *WorkspaceStatus) GetPhase() WorkspacePhase { - if x != nil { - return x.Phase - } - return WorkspacePhase_WORKSPACE_PHASE_UNSPECIFIED -} - -// Workspace resource. A hard isolation boundary for sandboxes, providers, and -// other workspace-scoped resources. -type Workspace struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Kubernetes-style metadata (id, name, labels, timestamps, resource version). - // The workspace field in this ObjectMeta is unused (a workspace does not - // belong to another workspace). - Metadata *ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` - // Current lifecycle status. - Status *WorkspaceStatus `protobuf:"bytes,2,opt,name=status,proto3" json:"status,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *Workspace) Reset() { - *x = Workspace{} - mi := &file_datamodel_proto_msgTypes[2] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *Workspace) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*Workspace) ProtoMessage() {} - -func (x *Workspace) ProtoReflect() protoreflect.Message { - mi := &file_datamodel_proto_msgTypes[2] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use Workspace.ProtoReflect.Descriptor instead. -func (*Workspace) Descriptor() ([]byte, []int) { - return file_datamodel_proto_rawDescGZIP(), []int{2} -} - -func (x *Workspace) GetMetadata() *ObjectMeta { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *Workspace) GetStatus() *WorkspaceStatus { - if x != nil { - return x.Status - } - return nil -} - -// Provider model stored by OpenShell. -type Provider struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Kubernetes-style metadata (id, name, labels, timestamps, resource version). - Metadata *ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` - // Canonical provider type slug (for example: "claude", "gitlab"). - Type string `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"` - // Secret values used for authentication. - Credentials map[string]string `protobuf:"bytes,3,rep,name=credentials,proto3" json:"credentials,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Non-secret provider configuration. - Config map[string]string `protobuf:"bytes,4,rep,name=config,proto3" json:"config,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Expiration timestamps for credential values, keyed by credential/env var - // name. A zero or missing value means the credential does not expire. - CredentialExpiresAtMs map[string]int64 `protobuf:"bytes,5,rep,name=credential_expires_at_ms,json=credentialExpiresAtMs,proto3" json:"credential_expires_at_ms,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value"` - // Workspace where this provider's type profile is stored. - // Empty string = platform/global scope. Must be empty or match - // metadata.workspace; cross-workspace references are rejected. - ProfileWorkspace string `protobuf:"bytes,6,opt,name=profile_workspace,json=profileWorkspace,proto3" json:"profile_workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *Provider) Reset() { - *x = Provider{} - mi := &file_datamodel_proto_msgTypes[3] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *Provider) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*Provider) ProtoMessage() {} - -func (x *Provider) ProtoReflect() protoreflect.Message { - mi := &file_datamodel_proto_msgTypes[3] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use Provider.ProtoReflect.Descriptor instead. -func (*Provider) Descriptor() ([]byte, []int) { - return file_datamodel_proto_rawDescGZIP(), []int{3} -} - -func (x *Provider) GetMetadata() *ObjectMeta { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *Provider) GetType() string { - if x != nil { - return x.Type - } - return "" -} - -func (x *Provider) GetCredentials() map[string]string { - if x != nil { - return x.Credentials - } - return nil -} - -func (x *Provider) GetConfig() map[string]string { - if x != nil { - return x.Config - } - return nil -} - -func (x *Provider) GetCredentialExpiresAtMs() map[string]int64 { - if x != nil { - return x.CredentialExpiresAtMs - } - return nil -} - -func (x *Provider) GetProfileWorkspace() string { - if x != nil { - return x.ProfileWorkspace - } - return "" -} - -var File_datamodel_proto protoreflect.FileDescriptor - -const file_datamodel_proto_rawDesc = "" + - "\n" + - "\x0fdatamodel.proto\x12\x16openshell.datamodel.v1\x1a\roptions.proto\"\xeb\x03\n" + - "\n" + - "ObjectMeta\x12\x0e\n" + - "\x02id\x18\x01 \x01(\tR\x02id\x12\x12\n" + - "\x04name\x18\x02 \x01(\tR\x04name\x12\"\n" + - "\rcreated_at_ms\x18\x03 \x01(\x03R\vcreatedAtMs\x12F\n" + - "\x06labels\x18\x04 \x03(\v2..openshell.datamodel.v1.ObjectMeta.LabelsEntryR\x06labels\x12)\n" + - "\x10resource_version\x18\x05 \x01(\x04R\x0fresourceVersion\x12U\n" + - "\vannotations\x18\x06 \x03(\v23.openshell.datamodel.v1.ObjectMeta.AnnotationsEntryR\vannotations\x12\x1c\n" + - "\tworkspace\x18\a \x01(\tR\tworkspace\x122\n" + - "\x15deletion_timestamp_ms\x18\b \x01(\x03R\x13deletionTimestampMs\x1a9\n" + - "\vLabelsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" + - "\x10AnnotationsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"O\n" + - "\x0fWorkspaceStatus\x12<\n" + - "\x05phase\x18\x01 \x01(\x0e2&.openshell.datamodel.v1.WorkspacePhaseR\x05phase\"\x8c\x01\n" + - "\tWorkspace\x12>\n" + - "\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12?\n" + - "\x06status\x18\x02 \x01(\v2'.openshell.datamodel.v1.WorkspaceStatusR\x06status\"\xe7\x04\n" + - "\bProvider\x12>\n" + - "\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12\x12\n" + - "\x04type\x18\x02 \x01(\tR\x04type\x12Y\n" + - "\vcredentials\x18\x03 \x03(\v21.openshell.datamodel.v1.Provider.CredentialsEntryB\x04\x88\xb5\x18\x01R\vcredentials\x12D\n" + - "\x06config\x18\x04 \x03(\v2,.openshell.datamodel.v1.Provider.ConfigEntryR\x06config\x12t\n" + - "\x18credential_expires_at_ms\x18\x05 \x03(\v2;.openshell.datamodel.v1.Provider.CredentialExpiresAtMsEntryR\x15credentialExpiresAtMs\x12+\n" + - "\x11profile_workspace\x18\x06 \x01(\tR\x10profileWorkspace\x1a>\n" + - "\x10CredentialsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a9\n" + - "\vConfigEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1aH\n" + - "\x1aCredentialExpiresAtMsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\x03R\x05value:\x028\x01*n\n" + - "\x0eWorkspacePhase\x12\x1f\n" + - "\x1bWORKSPACE_PHASE_UNSPECIFIED\x10\x00\x12\x1a\n" + - "\x16WORKSPACE_PHASE_ACTIVE\x10\x01\x12\x1f\n" + - "\x1bWORKSPACE_PHASE_TERMINATING\x10\x02b\x06proto3" - -var ( - file_datamodel_proto_rawDescOnce sync.Once - file_datamodel_proto_rawDescData []byte -) - -func file_datamodel_proto_rawDescGZIP() []byte { - file_datamodel_proto_rawDescOnce.Do(func() { - file_datamodel_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_datamodel_proto_rawDesc), len(file_datamodel_proto_rawDesc))) - }) - return file_datamodel_proto_rawDescData -} - -var file_datamodel_proto_enumTypes = make([]protoimpl.EnumInfo, 1) -var file_datamodel_proto_msgTypes = make([]protoimpl.MessageInfo, 9) -var file_datamodel_proto_goTypes = []any{ - (WorkspacePhase)(0), // 0: openshell.datamodel.v1.WorkspacePhase - (*ObjectMeta)(nil), // 1: openshell.datamodel.v1.ObjectMeta - (*WorkspaceStatus)(nil), // 2: openshell.datamodel.v1.WorkspaceStatus - (*Workspace)(nil), // 3: openshell.datamodel.v1.Workspace - (*Provider)(nil), // 4: openshell.datamodel.v1.Provider - nil, // 5: openshell.datamodel.v1.ObjectMeta.LabelsEntry - nil, // 6: openshell.datamodel.v1.ObjectMeta.AnnotationsEntry - nil, // 7: openshell.datamodel.v1.Provider.CredentialsEntry - nil, // 8: openshell.datamodel.v1.Provider.ConfigEntry - nil, // 9: openshell.datamodel.v1.Provider.CredentialExpiresAtMsEntry -} -var file_datamodel_proto_depIdxs = []int32{ - 5, // 0: openshell.datamodel.v1.ObjectMeta.labels:type_name -> openshell.datamodel.v1.ObjectMeta.LabelsEntry - 6, // 1: openshell.datamodel.v1.ObjectMeta.annotations:type_name -> openshell.datamodel.v1.ObjectMeta.AnnotationsEntry - 0, // 2: openshell.datamodel.v1.WorkspaceStatus.phase:type_name -> openshell.datamodel.v1.WorkspacePhase - 1, // 3: openshell.datamodel.v1.Workspace.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 2, // 4: openshell.datamodel.v1.Workspace.status:type_name -> openshell.datamodel.v1.WorkspaceStatus - 1, // 5: openshell.datamodel.v1.Provider.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 7, // 6: openshell.datamodel.v1.Provider.credentials:type_name -> openshell.datamodel.v1.Provider.CredentialsEntry - 8, // 7: openshell.datamodel.v1.Provider.config:type_name -> openshell.datamodel.v1.Provider.ConfigEntry - 9, // 8: openshell.datamodel.v1.Provider.credential_expires_at_ms:type_name -> openshell.datamodel.v1.Provider.CredentialExpiresAtMsEntry - 9, // [9:9] is the sub-list for method output_type - 9, // [9:9] is the sub-list for method input_type - 9, // [9:9] is the sub-list for extension type_name - 9, // [9:9] is the sub-list for extension extendee - 0, // [0:9] is the sub-list for field type_name -} - -func init() { file_datamodel_proto_init() } -func file_datamodel_proto_init() { - if File_datamodel_proto != nil { - return - } - type x struct{} - out := protoimpl.TypeBuilder{ - File: protoimpl.DescBuilder{ - GoPackagePath: reflect.TypeOf(x{}).PkgPath(), - RawDescriptor: unsafe.Slice(unsafe.StringData(file_datamodel_proto_rawDesc), len(file_datamodel_proto_rawDesc)), - NumEnums: 1, - NumMessages: 9, - NumExtensions: 0, - NumServices: 0, - }, - GoTypes: file_datamodel_proto_goTypes, - DependencyIndexes: file_datamodel_proto_depIdxs, - EnumInfos: file_datamodel_proto_enumTypes, - MessageInfos: file_datamodel_proto_msgTypes, - }.Build() - File_datamodel_proto = out.File - file_datamodel_proto_goTypes = nil - file_datamodel_proto_depIdxs = nil -} diff --git a/backend/gen/inferencev1/inference.pb.go b/backend/gen/inferencev1/inference.pb.go deleted file mode 100644 index e1b7021..0000000 --- a/backend/gen/inferencev1/inference.pb.go +++ /dev/null @@ -1,1018 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -// Code generated by protoc-gen-go. DO NOT EDIT. -// versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 -// source: inference.proto - -package inferencev1 - -import ( - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - _ "github.com/Gkrumbach07/openshell-dashboard/backend/gen/optionsv1" - protoreflect "google.golang.org/protobuf/reflect/protoreflect" - protoimpl "google.golang.org/protobuf/runtime/protoimpl" - reflect "reflect" - sync "sync" - unsafe "unsafe" -) - -const ( - // Verify that this generated code is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) - // Verify that runtime/protoimpl is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) -) - -// Persisted inference route configuration. -// -// Only `provider_name` and `model_id` are stored; endpoint, protocols, -// credentials, and auth style are resolved from the provider at bundle time. -type InferenceRouteConfig struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Provider record name backing this route. - ProviderName string `protobuf:"bytes,1,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"` - // Model identifier to force on generation calls. - ModelId string `protobuf:"bytes,2,opt,name=model_id,json=modelId,proto3" json:"model_id,omitempty"` - // Per-route request timeout in seconds. 0 means use default (60s). - TimeoutSecs uint64 `protobuf:"varint,3,opt,name=timeout_secs,json=timeoutSecs,proto3" json:"timeout_secs,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *InferenceRouteConfig) Reset() { - *x = InferenceRouteConfig{} - mi := &file_inference_proto_msgTypes[0] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *InferenceRouteConfig) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*InferenceRouteConfig) ProtoMessage() {} - -func (x *InferenceRouteConfig) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[0] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use InferenceRouteConfig.ProtoReflect.Descriptor instead. -func (*InferenceRouteConfig) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{0} -} - -func (x *InferenceRouteConfig) GetProviderName() string { - if x != nil { - return x.ProviderName - } - return "" -} - -func (x *InferenceRouteConfig) GetModelId() string { - if x != nil { - return x.ModelId - } - return "" -} - -func (x *InferenceRouteConfig) GetTimeoutSecs() uint64 { - if x != nil { - return x.TimeoutSecs - } - return 0 -} - -// Storage envelope for a workspace-scoped inference route. -type InferenceRoute struct { - state protoimpl.MessageState `protogen:"open.v1"` - Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` - Config *InferenceRouteConfig `protobuf:"bytes,2,opt,name=config,proto3" json:"config,omitempty"` - // Monotonic version incremented on every update. - Version uint64 `protobuf:"varint,3,opt,name=version,proto3" json:"version,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *InferenceRoute) Reset() { - *x = InferenceRoute{} - mi := &file_inference_proto_msgTypes[1] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *InferenceRoute) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*InferenceRoute) ProtoMessage() {} - -func (x *InferenceRoute) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[1] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use InferenceRoute.ProtoReflect.Descriptor instead. -func (*InferenceRoute) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{1} -} - -func (x *InferenceRoute) GetMetadata() *datamodelv1.ObjectMeta { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *InferenceRoute) GetConfig() *InferenceRouteConfig { - if x != nil { - return x.Config - } - return nil -} - -func (x *InferenceRoute) GetVersion() uint64 { - if x != nil { - return x.Version - } - return 0 -} - -type SetInferenceRouteRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Provider record name to use for credentials + endpoint mapping. - ProviderName string `protobuf:"bytes,1,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"` - // Model identifier to force on generation calls. - ModelId string `protobuf:"bytes,2,opt,name=model_id,json=modelId,proto3" json:"model_id,omitempty"` - // Route name to target. Empty string defaults to "inference.local" (user-facing). - // Use "sandbox-system" for the sandbox system-level inference route. - RouteName string `protobuf:"bytes,3,opt,name=route_name,json=routeName,proto3" json:"route_name,omitempty"` - // Verify the resolved upstream endpoint synchronously before persistence. - Verify bool `protobuf:"varint,4,opt,name=verify,proto3" json:"verify,omitempty"` - // Skip synchronous endpoint validation before persistence. - NoVerify bool `protobuf:"varint,5,opt,name=no_verify,json=noVerify,proto3" json:"no_verify,omitempty"` - // Per-route request timeout in seconds. 0 means use default (60s). - TimeoutSecs uint64 `protobuf:"varint,6,opt,name=timeout_secs,json=timeoutSecs,proto3" json:"timeout_secs,omitempty"` - // Target workspace. Empty string defaults to "default". - Workspace string `protobuf:"bytes,7,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SetInferenceRouteRequest) Reset() { - *x = SetInferenceRouteRequest{} - mi := &file_inference_proto_msgTypes[2] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SetInferenceRouteRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SetInferenceRouteRequest) ProtoMessage() {} - -func (x *SetInferenceRouteRequest) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[2] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SetInferenceRouteRequest.ProtoReflect.Descriptor instead. -func (*SetInferenceRouteRequest) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{2} -} - -func (x *SetInferenceRouteRequest) GetProviderName() string { - if x != nil { - return x.ProviderName - } - return "" -} - -func (x *SetInferenceRouteRequest) GetModelId() string { - if x != nil { - return x.ModelId - } - return "" -} - -func (x *SetInferenceRouteRequest) GetRouteName() string { - if x != nil { - return x.RouteName - } - return "" -} - -func (x *SetInferenceRouteRequest) GetVerify() bool { - if x != nil { - return x.Verify - } - return false -} - -func (x *SetInferenceRouteRequest) GetNoVerify() bool { - if x != nil { - return x.NoVerify - } - return false -} - -func (x *SetInferenceRouteRequest) GetTimeoutSecs() uint64 { - if x != nil { - return x.TimeoutSecs - } - return 0 -} - -func (x *SetInferenceRouteRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type ValidatedEndpoint struct { - state protoimpl.MessageState `protogen:"open.v1"` - Url string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"` - Protocol string `protobuf:"bytes,2,opt,name=protocol,proto3" json:"protocol,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ValidatedEndpoint) Reset() { - *x = ValidatedEndpoint{} - mi := &file_inference_proto_msgTypes[3] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ValidatedEndpoint) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ValidatedEndpoint) ProtoMessage() {} - -func (x *ValidatedEndpoint) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[3] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ValidatedEndpoint.ProtoReflect.Descriptor instead. -func (*ValidatedEndpoint) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{3} -} - -func (x *ValidatedEndpoint) GetUrl() string { - if x != nil { - return x.Url - } - return "" -} - -func (x *ValidatedEndpoint) GetProtocol() string { - if x != nil { - return x.Protocol - } - return "" -} - -type SetInferenceRouteResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - ProviderName string `protobuf:"bytes,1,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"` - ModelId string `protobuf:"bytes,2,opt,name=model_id,json=modelId,proto3" json:"model_id,omitempty"` - Version uint64 `protobuf:"varint,3,opt,name=version,proto3" json:"version,omitempty"` - // Route name that was configured. - RouteName string `protobuf:"bytes,4,opt,name=route_name,json=routeName,proto3" json:"route_name,omitempty"` - // Whether endpoint verification ran as part of this request. - ValidationPerformed bool `protobuf:"varint,5,opt,name=validation_performed,json=validationPerformed,proto3" json:"validation_performed,omitempty"` - // The concrete endpoints that were probed during validation, when available. - ValidatedEndpoints []*ValidatedEndpoint `protobuf:"bytes,6,rep,name=validated_endpoints,json=validatedEndpoints,proto3" json:"validated_endpoints,omitempty"` - // Per-route request timeout in seconds that was persisted. - TimeoutSecs uint64 `protobuf:"varint,7,opt,name=timeout_secs,json=timeoutSecs,proto3" json:"timeout_secs,omitempty"` - // Workspace the route was configured in. - Workspace string `protobuf:"bytes,8,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SetInferenceRouteResponse) Reset() { - *x = SetInferenceRouteResponse{} - mi := &file_inference_proto_msgTypes[4] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SetInferenceRouteResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SetInferenceRouteResponse) ProtoMessage() {} - -func (x *SetInferenceRouteResponse) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[4] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SetInferenceRouteResponse.ProtoReflect.Descriptor instead. -func (*SetInferenceRouteResponse) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{4} -} - -func (x *SetInferenceRouteResponse) GetProviderName() string { - if x != nil { - return x.ProviderName - } - return "" -} - -func (x *SetInferenceRouteResponse) GetModelId() string { - if x != nil { - return x.ModelId - } - return "" -} - -func (x *SetInferenceRouteResponse) GetVersion() uint64 { - if x != nil { - return x.Version - } - return 0 -} - -func (x *SetInferenceRouteResponse) GetRouteName() string { - if x != nil { - return x.RouteName - } - return "" -} - -func (x *SetInferenceRouteResponse) GetValidationPerformed() bool { - if x != nil { - return x.ValidationPerformed - } - return false -} - -func (x *SetInferenceRouteResponse) GetValidatedEndpoints() []*ValidatedEndpoint { - if x != nil { - return x.ValidatedEndpoints - } - return nil -} - -func (x *SetInferenceRouteResponse) GetTimeoutSecs() uint64 { - if x != nil { - return x.TimeoutSecs - } - return 0 -} - -func (x *SetInferenceRouteResponse) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type GetInferenceRouteRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Route name to query. Empty string defaults to "inference.local" (user-facing). - // Use "sandbox-system" for the sandbox system-level inference route. - RouteName string `protobuf:"bytes,1,opt,name=route_name,json=routeName,proto3" json:"route_name,omitempty"` - // Target workspace. Empty string defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetInferenceRouteRequest) Reset() { - *x = GetInferenceRouteRequest{} - mi := &file_inference_proto_msgTypes[5] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetInferenceRouteRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetInferenceRouteRequest) ProtoMessage() {} - -func (x *GetInferenceRouteRequest) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[5] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetInferenceRouteRequest.ProtoReflect.Descriptor instead. -func (*GetInferenceRouteRequest) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{5} -} - -func (x *GetInferenceRouteRequest) GetRouteName() string { - if x != nil { - return x.RouteName - } - return "" -} - -func (x *GetInferenceRouteRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type GetInferenceRouteResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - ProviderName string `protobuf:"bytes,1,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"` - ModelId string `protobuf:"bytes,2,opt,name=model_id,json=modelId,proto3" json:"model_id,omitempty"` - Version uint64 `protobuf:"varint,3,opt,name=version,proto3" json:"version,omitempty"` - // Route name that was queried. - RouteName string `protobuf:"bytes,4,opt,name=route_name,json=routeName,proto3" json:"route_name,omitempty"` - // Per-route request timeout in seconds. 0 means default (60s). - TimeoutSecs uint64 `protobuf:"varint,5,opt,name=timeout_secs,json=timeoutSecs,proto3" json:"timeout_secs,omitempty"` - // Workspace the route belongs to. - Workspace string `protobuf:"bytes,6,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetInferenceRouteResponse) Reset() { - *x = GetInferenceRouteResponse{} - mi := &file_inference_proto_msgTypes[6] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetInferenceRouteResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetInferenceRouteResponse) ProtoMessage() {} - -func (x *GetInferenceRouteResponse) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[6] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetInferenceRouteResponse.ProtoReflect.Descriptor instead. -func (*GetInferenceRouteResponse) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{6} -} - -func (x *GetInferenceRouteResponse) GetProviderName() string { - if x != nil { - return x.ProviderName - } - return "" -} - -func (x *GetInferenceRouteResponse) GetModelId() string { - if x != nil { - return x.ModelId - } - return "" -} - -func (x *GetInferenceRouteResponse) GetVersion() uint64 { - if x != nil { - return x.Version - } - return 0 -} - -func (x *GetInferenceRouteResponse) GetRouteName() string { - if x != nil { - return x.RouteName - } - return "" -} - -func (x *GetInferenceRouteResponse) GetTimeoutSecs() uint64 { - if x != nil { - return x.TimeoutSecs - } - return 0 -} - -func (x *GetInferenceRouteResponse) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type DeleteInferenceRouteRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Route name to delete. Empty string defaults to "inference.local" (user-facing). - // Use "sandbox-system" for the sandbox system-level inference route. - RouteName string `protobuf:"bytes,1,opt,name=route_name,json=routeName,proto3" json:"route_name,omitempty"` - // Target workspace. Empty string defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteInferenceRouteRequest) Reset() { - *x = DeleteInferenceRouteRequest{} - mi := &file_inference_proto_msgTypes[7] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteInferenceRouteRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteInferenceRouteRequest) ProtoMessage() {} - -func (x *DeleteInferenceRouteRequest) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[7] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteInferenceRouteRequest.ProtoReflect.Descriptor instead. -func (*DeleteInferenceRouteRequest) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{7} -} - -func (x *DeleteInferenceRouteRequest) GetRouteName() string { - if x != nil { - return x.RouteName - } - return "" -} - -func (x *DeleteInferenceRouteRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type DeleteInferenceRouteResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Whether a route was actually deleted. - Deleted bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteInferenceRouteResponse) Reset() { - *x = DeleteInferenceRouteResponse{} - mi := &file_inference_proto_msgTypes[8] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteInferenceRouteResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteInferenceRouteResponse) ProtoMessage() {} - -func (x *DeleteInferenceRouteResponse) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[8] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteInferenceRouteResponse.ProtoReflect.Descriptor instead. -func (*DeleteInferenceRouteResponse) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{8} -} - -func (x *DeleteInferenceRouteResponse) GetDeleted() bool { - if x != nil { - return x.Deleted - } - return false -} - -type GetInferenceBundleRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetInferenceBundleRequest) Reset() { - *x = GetInferenceBundleRequest{} - mi := &file_inference_proto_msgTypes[9] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetInferenceBundleRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetInferenceBundleRequest) ProtoMessage() {} - -func (x *GetInferenceBundleRequest) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[9] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetInferenceBundleRequest.ProtoReflect.Descriptor instead. -func (*GetInferenceBundleRequest) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{9} -} - -// A single resolved route ready for sandbox-local execution. -type ResolvedRoute struct { - state protoimpl.MessageState `protogen:"open.v1"` - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - BaseUrl string `protobuf:"bytes,2,opt,name=base_url,json=baseUrl,proto3" json:"base_url,omitempty"` - Protocols []string `protobuf:"bytes,3,rep,name=protocols,proto3" json:"protocols,omitempty"` - ApiKey string `protobuf:"bytes,4,opt,name=api_key,json=apiKey,proto3" json:"api_key,omitempty"` - ModelId string `protobuf:"bytes,5,opt,name=model_id,json=modelId,proto3" json:"model_id,omitempty"` - ProviderType string `protobuf:"bytes,6,opt,name=provider_type,json=providerType,proto3" json:"provider_type,omitempty"` - // Per-route request timeout in seconds. 0 means use default (60s). - TimeoutSecs uint64 `protobuf:"varint,7,opt,name=timeout_secs,json=timeoutSecs,proto3" json:"timeout_secs,omitempty"` - // When true, the model identifier is embedded in the URL path (e.g. Vertex AI). - ModelInPath bool `protobuf:"varint,8,opt,name=model_in_path,json=modelInPath,proto3" json:"model_in_path,omitempty"` - // Optional override for the request path. When set, replaces the protocol-derived path. - // An empty string means POST directly to base_url/model_id with no additional path. - RequestPathOverride *string `protobuf:"bytes,9,opt,name=request_path_override,json=requestPathOverride,proto3,oneof" json:"request_path_override,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ResolvedRoute) Reset() { - *x = ResolvedRoute{} - mi := &file_inference_proto_msgTypes[10] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ResolvedRoute) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ResolvedRoute) ProtoMessage() {} - -func (x *ResolvedRoute) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[10] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ResolvedRoute.ProtoReflect.Descriptor instead. -func (*ResolvedRoute) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{10} -} - -func (x *ResolvedRoute) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *ResolvedRoute) GetBaseUrl() string { - if x != nil { - return x.BaseUrl - } - return "" -} - -func (x *ResolvedRoute) GetProtocols() []string { - if x != nil { - return x.Protocols - } - return nil -} - -func (x *ResolvedRoute) GetApiKey() string { - if x != nil { - return x.ApiKey - } - return "" -} - -func (x *ResolvedRoute) GetModelId() string { - if x != nil { - return x.ModelId - } - return "" -} - -func (x *ResolvedRoute) GetProviderType() string { - if x != nil { - return x.ProviderType - } - return "" -} - -func (x *ResolvedRoute) GetTimeoutSecs() uint64 { - if x != nil { - return x.TimeoutSecs - } - return 0 -} - -func (x *ResolvedRoute) GetModelInPath() bool { - if x != nil { - return x.ModelInPath - } - return false -} - -func (x *ResolvedRoute) GetRequestPathOverride() string { - if x != nil && x.RequestPathOverride != nil { - return *x.RequestPathOverride - } - return "" -} - -type GetInferenceBundleResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Routes []*ResolvedRoute `protobuf:"bytes,1,rep,name=routes,proto3" json:"routes,omitempty"` - // Opaque revision tag for cache freshness checks. - Revision string `protobuf:"bytes,2,opt,name=revision,proto3" json:"revision,omitempty"` - // Timestamp (epoch ms) when this bundle was generated. - GeneratedAtMs int64 `protobuf:"varint,3,opt,name=generated_at_ms,json=generatedAtMs,proto3" json:"generated_at_ms,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetInferenceBundleResponse) Reset() { - *x = GetInferenceBundleResponse{} - mi := &file_inference_proto_msgTypes[11] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetInferenceBundleResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetInferenceBundleResponse) ProtoMessage() {} - -func (x *GetInferenceBundleResponse) ProtoReflect() protoreflect.Message { - mi := &file_inference_proto_msgTypes[11] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetInferenceBundleResponse.ProtoReflect.Descriptor instead. -func (*GetInferenceBundleResponse) Descriptor() ([]byte, []int) { - return file_inference_proto_rawDescGZIP(), []int{11} -} - -func (x *GetInferenceBundleResponse) GetRoutes() []*ResolvedRoute { - if x != nil { - return x.Routes - } - return nil -} - -func (x *GetInferenceBundleResponse) GetRevision() string { - if x != nil { - return x.Revision - } - return "" -} - -func (x *GetInferenceBundleResponse) GetGeneratedAtMs() int64 { - if x != nil { - return x.GeneratedAtMs - } - return 0 -} - -var File_inference_proto protoreflect.FileDescriptor - -const file_inference_proto_rawDesc = "" + - "\n" + - "\x0finference.proto\x12\x16openshell.inference.v1\x1a\x0fdatamodel.proto\x1a\roptions.proto\"y\n" + - "\x14InferenceRouteConfig\x12#\n" + - "\rprovider_name\x18\x01 \x01(\tR\fproviderName\x12\x19\n" + - "\bmodel_id\x18\x02 \x01(\tR\amodelId\x12!\n" + - "\ftimeout_secs\x18\x03 \x01(\x04R\vtimeoutSecs\"\xb0\x01\n" + - "\x0eInferenceRoute\x12>\n" + - "\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12D\n" + - "\x06config\x18\x02 \x01(\v2,.openshell.inference.v1.InferenceRouteConfigR\x06config\x12\x18\n" + - "\aversion\x18\x03 \x01(\x04R\aversion\"\xef\x01\n" + - "\x18SetInferenceRouteRequest\x12#\n" + - "\rprovider_name\x18\x01 \x01(\tR\fproviderName\x12\x19\n" + - "\bmodel_id\x18\x02 \x01(\tR\amodelId\x12\x1d\n" + - "\n" + - "route_name\x18\x03 \x01(\tR\trouteName\x12\x16\n" + - "\x06verify\x18\x04 \x01(\bR\x06verify\x12\x1b\n" + - "\tno_verify\x18\x05 \x01(\bR\bnoVerify\x12!\n" + - "\ftimeout_secs\x18\x06 \x01(\x04R\vtimeoutSecs\x12\x1c\n" + - "\tworkspace\x18\a \x01(\tR\tworkspace\"A\n" + - "\x11ValidatedEndpoint\x12\x10\n" + - "\x03url\x18\x01 \x01(\tR\x03url\x12\x1a\n" + - "\bprotocol\x18\x02 \x01(\tR\bprotocol\"\xe4\x02\n" + - "\x19SetInferenceRouteResponse\x12#\n" + - "\rprovider_name\x18\x01 \x01(\tR\fproviderName\x12\x19\n" + - "\bmodel_id\x18\x02 \x01(\tR\amodelId\x12\x18\n" + - "\aversion\x18\x03 \x01(\x04R\aversion\x12\x1d\n" + - "\n" + - "route_name\x18\x04 \x01(\tR\trouteName\x121\n" + - "\x14validation_performed\x18\x05 \x01(\bR\x13validationPerformed\x12Z\n" + - "\x13validated_endpoints\x18\x06 \x03(\v2).openshell.inference.v1.ValidatedEndpointR\x12validatedEndpoints\x12!\n" + - "\ftimeout_secs\x18\a \x01(\x04R\vtimeoutSecs\x12\x1c\n" + - "\tworkspace\x18\b \x01(\tR\tworkspace\"W\n" + - "\x18GetInferenceRouteRequest\x12\x1d\n" + - "\n" + - "route_name\x18\x01 \x01(\tR\trouteName\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"\xd5\x01\n" + - "\x19GetInferenceRouteResponse\x12#\n" + - "\rprovider_name\x18\x01 \x01(\tR\fproviderName\x12\x19\n" + - "\bmodel_id\x18\x02 \x01(\tR\amodelId\x12\x18\n" + - "\aversion\x18\x03 \x01(\x04R\aversion\x12\x1d\n" + - "\n" + - "route_name\x18\x04 \x01(\tR\trouteName\x12!\n" + - "\ftimeout_secs\x18\x05 \x01(\x04R\vtimeoutSecs\x12\x1c\n" + - "\tworkspace\x18\x06 \x01(\tR\tworkspace\"Z\n" + - "\x1bDeleteInferenceRouteRequest\x12\x1d\n" + - "\n" + - "route_name\x18\x01 \x01(\tR\trouteName\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"8\n" + - "\x1cDeleteInferenceRouteResponse\x12\x18\n" + - "\adeleted\x18\x01 \x01(\bR\adeleted\"\x1b\n" + - "\x19GetInferenceBundleRequest\"\xd5\x02\n" + - "\rResolvedRoute\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x19\n" + - "\bbase_url\x18\x02 \x01(\tR\abaseUrl\x12\x1c\n" + - "\tprotocols\x18\x03 \x03(\tR\tprotocols\x12\x1d\n" + - "\aapi_key\x18\x04 \x01(\tB\x04\x88\xb5\x18\x01R\x06apiKey\x12\x19\n" + - "\bmodel_id\x18\x05 \x01(\tR\amodelId\x12#\n" + - "\rprovider_type\x18\x06 \x01(\tR\fproviderType\x12!\n" + - "\ftimeout_secs\x18\a \x01(\x04R\vtimeoutSecs\x12\"\n" + - "\rmodel_in_path\x18\b \x01(\bR\vmodelInPath\x127\n" + - "\x15request_path_override\x18\t \x01(\tH\x00R\x13requestPathOverride\x88\x01\x01B\x18\n" + - "\x16_request_path_override\"\x9f\x01\n" + - "\x1aGetInferenceBundleResponse\x12=\n" + - "\x06routes\x18\x01 \x03(\v2%.openshell.inference.v1.ResolvedRouteR\x06routes\x12\x1a\n" + - "\brevision\x18\x02 \x01(\tR\brevision\x12&\n" + - "\x0fgenerated_at_ms\x18\x03 \x01(\x03R\rgeneratedAtMs2\x82\x05\n" + - "\tInference\x12\x8a\x01\n" + - "\x12GetInferenceBundle\x121.openshell.inference.v1.GetInferenceBundleRequest\x1a2.openshell.inference.v1.GetInferenceBundleResponse\"\r\x82\xb5\x18\t\n" + - "\asandbox\x12\x9e\x01\n" + - "\x11SetInferenceRoute\x120.openshell.inference.v1.SetInferenceRouteRequest\x1a1.openshell.inference.v1.SetInferenceRouteResponse\"$\x82\xb5\x18 \n" + - "\x06bearer\x12\x05admin\"\x0finference:write\x12\x9c\x01\n" + - "\x11GetInferenceRoute\x120.openshell.inference.v1.GetInferenceRouteRequest\x1a1.openshell.inference.v1.GetInferenceRouteResponse\"\"\x82\xb5\x18\x1e\n" + - "\x06bearer\x12\x04user\"\x0einference:read\x12\xa7\x01\n" + - "\x14DeleteInferenceRoute\x123.openshell.inference.v1.DeleteInferenceRouteRequest\x1a4.openshell.inference.v1.DeleteInferenceRouteResponse\"$\x82\xb5\x18 \n" + - "\x06bearer\x12\x05admin\"\x0finference:writeb\x06proto3" - -var ( - file_inference_proto_rawDescOnce sync.Once - file_inference_proto_rawDescData []byte -) - -func file_inference_proto_rawDescGZIP() []byte { - file_inference_proto_rawDescOnce.Do(func() { - file_inference_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_inference_proto_rawDesc), len(file_inference_proto_rawDesc))) - }) - return file_inference_proto_rawDescData -} - -var file_inference_proto_msgTypes = make([]protoimpl.MessageInfo, 12) -var file_inference_proto_goTypes = []any{ - (*InferenceRouteConfig)(nil), // 0: openshell.inference.v1.InferenceRouteConfig - (*InferenceRoute)(nil), // 1: openshell.inference.v1.InferenceRoute - (*SetInferenceRouteRequest)(nil), // 2: openshell.inference.v1.SetInferenceRouteRequest - (*ValidatedEndpoint)(nil), // 3: openshell.inference.v1.ValidatedEndpoint - (*SetInferenceRouteResponse)(nil), // 4: openshell.inference.v1.SetInferenceRouteResponse - (*GetInferenceRouteRequest)(nil), // 5: openshell.inference.v1.GetInferenceRouteRequest - (*GetInferenceRouteResponse)(nil), // 6: openshell.inference.v1.GetInferenceRouteResponse - (*DeleteInferenceRouteRequest)(nil), // 7: openshell.inference.v1.DeleteInferenceRouteRequest - (*DeleteInferenceRouteResponse)(nil), // 8: openshell.inference.v1.DeleteInferenceRouteResponse - (*GetInferenceBundleRequest)(nil), // 9: openshell.inference.v1.GetInferenceBundleRequest - (*ResolvedRoute)(nil), // 10: openshell.inference.v1.ResolvedRoute - (*GetInferenceBundleResponse)(nil), // 11: openshell.inference.v1.GetInferenceBundleResponse - (*datamodelv1.ObjectMeta)(nil), // 12: openshell.datamodel.v1.ObjectMeta -} -var file_inference_proto_depIdxs = []int32{ - 12, // 0: openshell.inference.v1.InferenceRoute.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 0, // 1: openshell.inference.v1.InferenceRoute.config:type_name -> openshell.inference.v1.InferenceRouteConfig - 3, // 2: openshell.inference.v1.SetInferenceRouteResponse.validated_endpoints:type_name -> openshell.inference.v1.ValidatedEndpoint - 10, // 3: openshell.inference.v1.GetInferenceBundleResponse.routes:type_name -> openshell.inference.v1.ResolvedRoute - 9, // 4: openshell.inference.v1.Inference.GetInferenceBundle:input_type -> openshell.inference.v1.GetInferenceBundleRequest - 2, // 5: openshell.inference.v1.Inference.SetInferenceRoute:input_type -> openshell.inference.v1.SetInferenceRouteRequest - 5, // 6: openshell.inference.v1.Inference.GetInferenceRoute:input_type -> openshell.inference.v1.GetInferenceRouteRequest - 7, // 7: openshell.inference.v1.Inference.DeleteInferenceRoute:input_type -> openshell.inference.v1.DeleteInferenceRouteRequest - 11, // 8: openshell.inference.v1.Inference.GetInferenceBundle:output_type -> openshell.inference.v1.GetInferenceBundleResponse - 4, // 9: openshell.inference.v1.Inference.SetInferenceRoute:output_type -> openshell.inference.v1.SetInferenceRouteResponse - 6, // 10: openshell.inference.v1.Inference.GetInferenceRoute:output_type -> openshell.inference.v1.GetInferenceRouteResponse - 8, // 11: openshell.inference.v1.Inference.DeleteInferenceRoute:output_type -> openshell.inference.v1.DeleteInferenceRouteResponse - 8, // [8:12] is the sub-list for method output_type - 4, // [4:8] is the sub-list for method input_type - 4, // [4:4] is the sub-list for extension type_name - 4, // [4:4] is the sub-list for extension extendee - 0, // [0:4] is the sub-list for field type_name -} - -func init() { file_inference_proto_init() } -func file_inference_proto_init() { - if File_inference_proto != nil { - return - } - file_inference_proto_msgTypes[10].OneofWrappers = []any{} - type x struct{} - out := protoimpl.TypeBuilder{ - File: protoimpl.DescBuilder{ - GoPackagePath: reflect.TypeOf(x{}).PkgPath(), - RawDescriptor: unsafe.Slice(unsafe.StringData(file_inference_proto_rawDesc), len(file_inference_proto_rawDesc)), - NumEnums: 0, - NumMessages: 12, - NumExtensions: 0, - NumServices: 1, - }, - GoTypes: file_inference_proto_goTypes, - DependencyIndexes: file_inference_proto_depIdxs, - MessageInfos: file_inference_proto_msgTypes, - }.Build() - File_inference_proto = out.File - file_inference_proto_goTypes = nil - file_inference_proto_depIdxs = nil -} diff --git a/backend/gen/inferencev1/inference_grpc.pb.go b/backend/gen/inferencev1/inference_grpc.pb.go deleted file mode 100644 index db95449..0000000 --- a/backend/gen/inferencev1/inference_grpc.pb.go +++ /dev/null @@ -1,256 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -// Code generated by protoc-gen-go-grpc. DO NOT EDIT. -// versions: -// - protoc-gen-go-grpc v1.6.2 -// - protoc v6.33.2 -// source: inference.proto - -package inferencev1 - -import ( - context "context" - grpc "google.golang.org/grpc" - codes "google.golang.org/grpc/codes" - status "google.golang.org/grpc/status" -) - -// This is a compile-time assertion to ensure that this generated file -// is compatible with the grpc package it is being compiled against. -// Requires gRPC-Go v1.64.0 or later. -const _ = grpc.SupportPackageIsVersion9 - -const ( - Inference_GetInferenceBundle_FullMethodName = "/openshell.inference.v1.Inference/GetInferenceBundle" - Inference_SetInferenceRoute_FullMethodName = "/openshell.inference.v1.Inference/SetInferenceRoute" - Inference_GetInferenceRoute_FullMethodName = "/openshell.inference.v1.Inference/GetInferenceRoute" - Inference_DeleteInferenceRoute_FullMethodName = "/openshell.inference.v1.Inference/DeleteInferenceRoute" -) - -// InferenceClient is the client API for Inference service. -// -// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream. -// -// Inference service provides workspace-scoped inference route configuration and bundle delivery. -type InferenceClient interface { - // Return the resolved inference route bundle for sandbox-local execution. - GetInferenceBundle(ctx context.Context, in *GetInferenceBundleRequest, opts ...grpc.CallOption) (*GetInferenceBundleResponse, error) - // Set the inference route for a workspace. - // - // This controls how requests sent to `inference.local` are routed - // for sandboxes in the specified workspace. - SetInferenceRoute(ctx context.Context, in *SetInferenceRouteRequest, opts ...grpc.CallOption) (*SetInferenceRouteResponse, error) - // Get the inference route for a workspace. - GetInferenceRoute(ctx context.Context, in *GetInferenceRouteRequest, opts ...grpc.CallOption) (*GetInferenceRouteResponse, error) - // Delete an inference route from a workspace. - DeleteInferenceRoute(ctx context.Context, in *DeleteInferenceRouteRequest, opts ...grpc.CallOption) (*DeleteInferenceRouteResponse, error) -} - -type inferenceClient struct { - cc grpc.ClientConnInterface -} - -func NewInferenceClient(cc grpc.ClientConnInterface) InferenceClient { - return &inferenceClient{cc} -} - -func (c *inferenceClient) GetInferenceBundle(ctx context.Context, in *GetInferenceBundleRequest, opts ...grpc.CallOption) (*GetInferenceBundleResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetInferenceBundleResponse) - err := c.cc.Invoke(ctx, Inference_GetInferenceBundle_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *inferenceClient) SetInferenceRoute(ctx context.Context, in *SetInferenceRouteRequest, opts ...grpc.CallOption) (*SetInferenceRouteResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(SetInferenceRouteResponse) - err := c.cc.Invoke(ctx, Inference_SetInferenceRoute_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *inferenceClient) GetInferenceRoute(ctx context.Context, in *GetInferenceRouteRequest, opts ...grpc.CallOption) (*GetInferenceRouteResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetInferenceRouteResponse) - err := c.cc.Invoke(ctx, Inference_GetInferenceRoute_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *inferenceClient) DeleteInferenceRoute(ctx context.Context, in *DeleteInferenceRouteRequest, opts ...grpc.CallOption) (*DeleteInferenceRouteResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(DeleteInferenceRouteResponse) - err := c.cc.Invoke(ctx, Inference_DeleteInferenceRoute_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -// InferenceServer is the server API for Inference service. -// All implementations must embed UnimplementedInferenceServer -// for forward compatibility. -// -// Inference service provides workspace-scoped inference route configuration and bundle delivery. -type InferenceServer interface { - // Return the resolved inference route bundle for sandbox-local execution. - GetInferenceBundle(context.Context, *GetInferenceBundleRequest) (*GetInferenceBundleResponse, error) - // Set the inference route for a workspace. - // - // This controls how requests sent to `inference.local` are routed - // for sandboxes in the specified workspace. - SetInferenceRoute(context.Context, *SetInferenceRouteRequest) (*SetInferenceRouteResponse, error) - // Get the inference route for a workspace. - GetInferenceRoute(context.Context, *GetInferenceRouteRequest) (*GetInferenceRouteResponse, error) - // Delete an inference route from a workspace. - DeleteInferenceRoute(context.Context, *DeleteInferenceRouteRequest) (*DeleteInferenceRouteResponse, error) - mustEmbedUnimplementedInferenceServer() -} - -// UnimplementedInferenceServer must be embedded to have -// forward compatible implementations. -// -// NOTE: this should be embedded by value instead of pointer to avoid a nil -// pointer dereference when methods are called. -type UnimplementedInferenceServer struct{} - -func (UnimplementedInferenceServer) GetInferenceBundle(context.Context, *GetInferenceBundleRequest) (*GetInferenceBundleResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetInferenceBundle not implemented") -} -func (UnimplementedInferenceServer) SetInferenceRoute(context.Context, *SetInferenceRouteRequest) (*SetInferenceRouteResponse, error) { - return nil, status.Error(codes.Unimplemented, "method SetInferenceRoute not implemented") -} -func (UnimplementedInferenceServer) GetInferenceRoute(context.Context, *GetInferenceRouteRequest) (*GetInferenceRouteResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetInferenceRoute not implemented") -} -func (UnimplementedInferenceServer) DeleteInferenceRoute(context.Context, *DeleteInferenceRouteRequest) (*DeleteInferenceRouteResponse, error) { - return nil, status.Error(codes.Unimplemented, "method DeleteInferenceRoute not implemented") -} -func (UnimplementedInferenceServer) mustEmbedUnimplementedInferenceServer() {} -func (UnimplementedInferenceServer) testEmbeddedByValue() {} - -// UnsafeInferenceServer may be embedded to opt out of forward compatibility for this service. -// Use of this interface is not recommended, as added methods to InferenceServer will -// result in compilation errors. -type UnsafeInferenceServer interface { - mustEmbedUnimplementedInferenceServer() -} - -func RegisterInferenceServer(s grpc.ServiceRegistrar, srv InferenceServer) { - // If the following call panics, it indicates UnimplementedInferenceServer was - // embedded by pointer and is nil. This will cause panics if an - // unimplemented method is ever invoked, so we test this at initialization - // time to prevent it from happening at runtime later due to I/O. - if t, ok := srv.(interface{ testEmbeddedByValue() }); ok { - t.testEmbeddedByValue() - } - s.RegisterService(&Inference_ServiceDesc, srv) -} - -func _Inference_GetInferenceBundle_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetInferenceBundleRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(InferenceServer).GetInferenceBundle(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: Inference_GetInferenceBundle_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(InferenceServer).GetInferenceBundle(ctx, req.(*GetInferenceBundleRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _Inference_SetInferenceRoute_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(SetInferenceRouteRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(InferenceServer).SetInferenceRoute(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: Inference_SetInferenceRoute_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(InferenceServer).SetInferenceRoute(ctx, req.(*SetInferenceRouteRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _Inference_GetInferenceRoute_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetInferenceRouteRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(InferenceServer).GetInferenceRoute(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: Inference_GetInferenceRoute_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(InferenceServer).GetInferenceRoute(ctx, req.(*GetInferenceRouteRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _Inference_DeleteInferenceRoute_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(DeleteInferenceRouteRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(InferenceServer).DeleteInferenceRoute(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: Inference_DeleteInferenceRoute_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(InferenceServer).DeleteInferenceRoute(ctx, req.(*DeleteInferenceRouteRequest)) - } - return interceptor(ctx, in, info, handler) -} - -// Inference_ServiceDesc is the grpc.ServiceDesc for Inference service. -// It's only intended for direct use with grpc.RegisterService, -// and not to be introspected or modified (even as a copy) -var Inference_ServiceDesc = grpc.ServiceDesc{ - ServiceName: "openshell.inference.v1.Inference", - HandlerType: (*InferenceServer)(nil), - Methods: []grpc.MethodDesc{ - { - MethodName: "GetInferenceBundle", - Handler: _Inference_GetInferenceBundle_Handler, - }, - { - MethodName: "SetInferenceRoute", - Handler: _Inference_SetInferenceRoute_Handler, - }, - { - MethodName: "GetInferenceRoute", - Handler: _Inference_GetInferenceRoute_Handler, - }, - { - MethodName: "DeleteInferenceRoute", - Handler: _Inference_DeleteInferenceRoute_Handler, - }, - }, - Streams: []grpc.StreamDesc{}, - Metadata: "inference.proto", -} diff --git a/backend/gen/openshellv1/openshell.pb.go b/backend/gen/openshellv1/openshell.pb.go deleted file mode 100644 index 4037daf..0000000 --- a/backend/gen/openshellv1/openshell.pb.go +++ /dev/null @@ -1,14464 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -// Code generated by protoc-gen-go. DO NOT EDIT. -// versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 -// source: openshell.proto - -package openshellv1 - -import ( - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - _ "github.com/Gkrumbach07/openshell-dashboard/backend/gen/optionsv1" - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" - protoreflect "google.golang.org/protobuf/reflect/protoreflect" - protoimpl "google.golang.org/protobuf/runtime/protoimpl" - structpb "google.golang.org/protobuf/types/known/structpb" - reflect "reflect" - sync "sync" - unsafe "unsafe" -) - -const ( - // Verify that this generated code is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) - // Verify that runtime/protoimpl is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) -) - -// High-level sandbox lifecycle phase derived by the gateway. -// -// Clients should rely on this normalized lifecycle summary for readiness and -// deletion decisions instead of interpreting raw conditions. -type SandboxPhase int32 - -const ( - SandboxPhase_SANDBOX_PHASE_UNSPECIFIED SandboxPhase = 0 - SandboxPhase_SANDBOX_PHASE_PROVISIONING SandboxPhase = 1 - SandboxPhase_SANDBOX_PHASE_READY SandboxPhase = 2 - SandboxPhase_SANDBOX_PHASE_ERROR SandboxPhase = 3 - SandboxPhase_SANDBOX_PHASE_DELETING SandboxPhase = 4 - SandboxPhase_SANDBOX_PHASE_UNKNOWN SandboxPhase = 5 -) - -// Enum value maps for SandboxPhase. -var ( - SandboxPhase_name = map[int32]string{ - 0: "SANDBOX_PHASE_UNSPECIFIED", - 1: "SANDBOX_PHASE_PROVISIONING", - 2: "SANDBOX_PHASE_READY", - 3: "SANDBOX_PHASE_ERROR", - 4: "SANDBOX_PHASE_DELETING", - 5: "SANDBOX_PHASE_UNKNOWN", - } - SandboxPhase_value = map[string]int32{ - "SANDBOX_PHASE_UNSPECIFIED": 0, - "SANDBOX_PHASE_PROVISIONING": 1, - "SANDBOX_PHASE_READY": 2, - "SANDBOX_PHASE_ERROR": 3, - "SANDBOX_PHASE_DELETING": 4, - "SANDBOX_PHASE_UNKNOWN": 5, - } -) - -func (x SandboxPhase) Enum() *SandboxPhase { - p := new(SandboxPhase) - *p = x - return p -} - -func (x SandboxPhase) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (SandboxPhase) Descriptor() protoreflect.EnumDescriptor { - return file_openshell_proto_enumTypes[0].Descriptor() -} - -func (SandboxPhase) Type() protoreflect.EnumType { - return &file_openshell_proto_enumTypes[0] -} - -func (x SandboxPhase) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use SandboxPhase.Descriptor instead. -func (SandboxPhase) EnumDescriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{0} -} - -type ProviderCredentialRefreshStrategy int32 - -const ( - ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED ProviderCredentialRefreshStrategy = 0 - ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC ProviderCredentialRefreshStrategy = 1 - ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL ProviderCredentialRefreshStrategy = 2 - ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN ProviderCredentialRefreshStrategy = 3 - ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS ProviderCredentialRefreshStrategy = 4 - ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT ProviderCredentialRefreshStrategy = 5 - ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE ProviderCredentialRefreshStrategy = 6 -) - -// Enum value maps for ProviderCredentialRefreshStrategy. -var ( - ProviderCredentialRefreshStrategy_name = map[int32]string{ - 0: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED", - 1: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC", - 2: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL", - 3: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN", - 4: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS", - 5: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT", - 6: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE", - } - ProviderCredentialRefreshStrategy_value = map[string]int32{ - "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED": 0, - "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC": 1, - "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL": 2, - "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN": 3, - "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS": 4, - "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT": 5, - "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE": 6, - } -) - -func (x ProviderCredentialRefreshStrategy) Enum() *ProviderCredentialRefreshStrategy { - p := new(ProviderCredentialRefreshStrategy) - *p = x - return p -} - -func (x ProviderCredentialRefreshStrategy) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (ProviderCredentialRefreshStrategy) Descriptor() protoreflect.EnumDescriptor { - return file_openshell_proto_enumTypes[1].Descriptor() -} - -func (ProviderCredentialRefreshStrategy) Type() protoreflect.EnumType { - return &file_openshell_proto_enumTypes[1] -} - -func (x ProviderCredentialRefreshStrategy) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use ProviderCredentialRefreshStrategy.Descriptor instead. -func (ProviderCredentialRefreshStrategy) EnumDescriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{1} -} - -// Stable provider profile categories used by clients for grouping and filtering. -type ProviderProfileCategory int32 - -const ( - ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_UNSPECIFIED ProviderProfileCategory = 0 - ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_OTHER ProviderProfileCategory = 1 - ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_INFERENCE ProviderProfileCategory = 2 - ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_AGENT ProviderProfileCategory = 3 - ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL ProviderProfileCategory = 4 - ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_MESSAGING ProviderProfileCategory = 5 - ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_DATA ProviderProfileCategory = 6 - ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_KNOWLEDGE ProviderProfileCategory = 7 -) - -// Enum value maps for ProviderProfileCategory. -var ( - ProviderProfileCategory_name = map[int32]string{ - 0: "PROVIDER_PROFILE_CATEGORY_UNSPECIFIED", - 1: "PROVIDER_PROFILE_CATEGORY_OTHER", - 2: "PROVIDER_PROFILE_CATEGORY_INFERENCE", - 3: "PROVIDER_PROFILE_CATEGORY_AGENT", - 4: "PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL", - 5: "PROVIDER_PROFILE_CATEGORY_MESSAGING", - 6: "PROVIDER_PROFILE_CATEGORY_DATA", - 7: "PROVIDER_PROFILE_CATEGORY_KNOWLEDGE", - } - ProviderProfileCategory_value = map[string]int32{ - "PROVIDER_PROFILE_CATEGORY_UNSPECIFIED": 0, - "PROVIDER_PROFILE_CATEGORY_OTHER": 1, - "PROVIDER_PROFILE_CATEGORY_INFERENCE": 2, - "PROVIDER_PROFILE_CATEGORY_AGENT": 3, - "PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL": 4, - "PROVIDER_PROFILE_CATEGORY_MESSAGING": 5, - "PROVIDER_PROFILE_CATEGORY_DATA": 6, - "PROVIDER_PROFILE_CATEGORY_KNOWLEDGE": 7, - } -) - -func (x ProviderProfileCategory) Enum() *ProviderProfileCategory { - p := new(ProviderProfileCategory) - *p = x - return p -} - -func (x ProviderProfileCategory) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (ProviderProfileCategory) Descriptor() protoreflect.EnumDescriptor { - return file_openshell_proto_enumTypes[2].Descriptor() -} - -func (ProviderProfileCategory) Type() protoreflect.EnumType { - return &file_openshell_proto_enumTypes[2] -} - -func (x ProviderProfileCategory) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use ProviderProfileCategory.Descriptor instead. -func (ProviderProfileCategory) EnumDescriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{2} -} - -// Policy load status. -type PolicyStatus int32 - -const ( - PolicyStatus_POLICY_STATUS_UNSPECIFIED PolicyStatus = 0 - // Server received the update; sandbox has not yet loaded it. - PolicyStatus_POLICY_STATUS_PENDING PolicyStatus = 1 - // Sandbox successfully applied this policy version. - PolicyStatus_POLICY_STATUS_LOADED PolicyStatus = 2 - // Sandbox attempted to apply but failed; LKG policy remains active. - PolicyStatus_POLICY_STATUS_FAILED PolicyStatus = 3 - // A newer version was persisted before the sandbox loaded this one. - PolicyStatus_POLICY_STATUS_SUPERSEDED PolicyStatus = 4 -) - -// Enum value maps for PolicyStatus. -var ( - PolicyStatus_name = map[int32]string{ - 0: "POLICY_STATUS_UNSPECIFIED", - 1: "POLICY_STATUS_PENDING", - 2: "POLICY_STATUS_LOADED", - 3: "POLICY_STATUS_FAILED", - 4: "POLICY_STATUS_SUPERSEDED", - } - PolicyStatus_value = map[string]int32{ - "POLICY_STATUS_UNSPECIFIED": 0, - "POLICY_STATUS_PENDING": 1, - "POLICY_STATUS_LOADED": 2, - "POLICY_STATUS_FAILED": 3, - "POLICY_STATUS_SUPERSEDED": 4, - } -) - -func (x PolicyStatus) Enum() *PolicyStatus { - p := new(PolicyStatus) - *p = x - return p -} - -func (x PolicyStatus) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (PolicyStatus) Descriptor() protoreflect.EnumDescriptor { - return file_openshell_proto_enumTypes[3].Descriptor() -} - -func (PolicyStatus) Type() protoreflect.EnumType { - return &file_openshell_proto_enumTypes[3] -} - -func (x PolicyStatus) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use PolicyStatus.Descriptor instead. -func (PolicyStatus) EnumDescriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{3} -} - -// Service status enum. -type ServiceStatus int32 - -const ( - ServiceStatus_SERVICE_STATUS_UNSPECIFIED ServiceStatus = 0 - ServiceStatus_SERVICE_STATUS_HEALTHY ServiceStatus = 1 - ServiceStatus_SERVICE_STATUS_DEGRADED ServiceStatus = 2 - ServiceStatus_SERVICE_STATUS_UNHEALTHY ServiceStatus = 3 -) - -// Enum value maps for ServiceStatus. -var ( - ServiceStatus_name = map[int32]string{ - 0: "SERVICE_STATUS_UNSPECIFIED", - 1: "SERVICE_STATUS_HEALTHY", - 2: "SERVICE_STATUS_DEGRADED", - 3: "SERVICE_STATUS_UNHEALTHY", - } - ServiceStatus_value = map[string]int32{ - "SERVICE_STATUS_UNSPECIFIED": 0, - "SERVICE_STATUS_HEALTHY": 1, - "SERVICE_STATUS_DEGRADED": 2, - "SERVICE_STATUS_UNHEALTHY": 3, - } -) - -func (x ServiceStatus) Enum() *ServiceStatus { - p := new(ServiceStatus) - *p = x - return p -} - -func (x ServiceStatus) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (ServiceStatus) Descriptor() protoreflect.EnumDescriptor { - return file_openshell_proto_enumTypes[4].Descriptor() -} - -func (ServiceStatus) Type() protoreflect.EnumType { - return &file_openshell_proto_enumTypes[4] -} - -func (x ServiceStatus) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use ServiceStatus.Descriptor instead. -func (ServiceStatus) EnumDescriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{4} -} - -// Workspace-scoped role for members. -type WorkspaceRole int32 - -const ( - WorkspaceRole_WORKSPACE_ROLE_UNSPECIFIED WorkspaceRole = 0 - WorkspaceRole_WORKSPACE_ROLE_USER WorkspaceRole = 1 - WorkspaceRole_WORKSPACE_ROLE_ADMIN WorkspaceRole = 2 -) - -// Enum value maps for WorkspaceRole. -var ( - WorkspaceRole_name = map[int32]string{ - 0: "WORKSPACE_ROLE_UNSPECIFIED", - 1: "WORKSPACE_ROLE_USER", - 2: "WORKSPACE_ROLE_ADMIN", - } - WorkspaceRole_value = map[string]int32{ - "WORKSPACE_ROLE_UNSPECIFIED": 0, - "WORKSPACE_ROLE_USER": 1, - "WORKSPACE_ROLE_ADMIN": 2, - } -) - -func (x WorkspaceRole) Enum() *WorkspaceRole { - p := new(WorkspaceRole) - *p = x - return p -} - -func (x WorkspaceRole) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (WorkspaceRole) Descriptor() protoreflect.EnumDescriptor { - return file_openshell_proto_enumTypes[5].Descriptor() -} - -func (WorkspaceRole) Type() protoreflect.EnumType { - return &file_openshell_proto_enumTypes[5] -} - -func (x WorkspaceRole) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use WorkspaceRole.Descriptor instead. -func (WorkspaceRole) EnumDescriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{5} -} - -// IssueSandboxToken request. Empty body; identity is established by the -// authentication credentials carried in the request headers (a projected -// Kubernetes ServiceAccount JWT in the K8s driver path). -type IssueSandboxTokenRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *IssueSandboxTokenRequest) Reset() { - *x = IssueSandboxTokenRequest{} - mi := &file_openshell_proto_msgTypes[0] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *IssueSandboxTokenRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*IssueSandboxTokenRequest) ProtoMessage() {} - -func (x *IssueSandboxTokenRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[0] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use IssueSandboxTokenRequest.ProtoReflect.Descriptor instead. -func (*IssueSandboxTokenRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{0} -} - -// IssueSandboxToken response. The supervisor caches the returned token in -// memory and presents it as `Authorization: Bearer` on every subsequent -// gateway RPC. -type IssueSandboxTokenResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Gateway-minted JWT bound to the calling sandbox's UUID. - Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"` - // Absolute expiry of the issued token, milliseconds since the epoch. 0 means - // the token is non-expiring. - ExpiresAtMs int64 `protobuf:"varint,2,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *IssueSandboxTokenResponse) Reset() { - *x = IssueSandboxTokenResponse{} - mi := &file_openshell_proto_msgTypes[1] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *IssueSandboxTokenResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*IssueSandboxTokenResponse) ProtoMessage() {} - -func (x *IssueSandboxTokenResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[1] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use IssueSandboxTokenResponse.ProtoReflect.Descriptor instead. -func (*IssueSandboxTokenResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{1} -} - -func (x *IssueSandboxTokenResponse) GetToken() string { - if x != nil { - return x.Token - } - return "" -} - -func (x *IssueSandboxTokenResponse) GetExpiresAtMs() int64 { - if x != nil { - return x.ExpiresAtMs - } - return 0 -} - -// RefreshSandboxToken request. Empty body; the calling principal must -// already be a sandbox principal (i.e. the request carries a still-valid -// gateway-minted JWT in its Authorization header). -type RefreshSandboxTokenRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RefreshSandboxTokenRequest) Reset() { - *x = RefreshSandboxTokenRequest{} - mi := &file_openshell_proto_msgTypes[2] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RefreshSandboxTokenRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RefreshSandboxTokenRequest) ProtoMessage() {} - -func (x *RefreshSandboxTokenRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[2] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RefreshSandboxTokenRequest.ProtoReflect.Descriptor instead. -func (*RefreshSandboxTokenRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{2} -} - -// RefreshSandboxToken response. The new token replaces the supervisor's -// in-memory bearer credential. -type RefreshSandboxTokenResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Fresh gateway-minted JWT bound to the same sandbox UUID. - Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"` - // Absolute expiry of the new token, milliseconds since the epoch. 0 means - // the token is non-expiring. - ExpiresAtMs int64 `protobuf:"varint,2,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RefreshSandboxTokenResponse) Reset() { - *x = RefreshSandboxTokenResponse{} - mi := &file_openshell_proto_msgTypes[3] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RefreshSandboxTokenResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RefreshSandboxTokenResponse) ProtoMessage() {} - -func (x *RefreshSandboxTokenResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[3] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RefreshSandboxTokenResponse.ProtoReflect.Descriptor instead. -func (*RefreshSandboxTokenResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{3} -} - -func (x *RefreshSandboxTokenResponse) GetToken() string { - if x != nil { - return x.Token - } - return "" -} - -func (x *RefreshSandboxTokenResponse) GetExpiresAtMs() int64 { - if x != nil { - return x.ExpiresAtMs - } - return 0 -} - -// Health check request. -type HealthRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *HealthRequest) Reset() { - *x = HealthRequest{} - mi := &file_openshell_proto_msgTypes[4] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *HealthRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*HealthRequest) ProtoMessage() {} - -func (x *HealthRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[4] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use HealthRequest.ProtoReflect.Descriptor instead. -func (*HealthRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{4} -} - -// Health check response. -type HealthResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Service status. - Status ServiceStatus `protobuf:"varint,1,opt,name=status,proto3,enum=openshell.v1.ServiceStatus" json:"status,omitempty"` - // Service version. - Version string `protobuf:"bytes,2,opt,name=version,proto3" json:"version,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *HealthResponse) Reset() { - *x = HealthResponse{} - mi := &file_openshell_proto_msgTypes[5] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *HealthResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*HealthResponse) ProtoMessage() {} - -func (x *HealthResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[5] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use HealthResponse.ProtoReflect.Descriptor instead. -func (*HealthResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{5} -} - -func (x *HealthResponse) GetStatus() ServiceStatus { - if x != nil { - return x.Status - } - return ServiceStatus_SERVICE_STATUS_UNSPECIFIED -} - -func (x *HealthResponse) GetVersion() string { - if x != nil { - return x.Version - } - return "" -} - -// Current-user request. The identity comes from the authenticated request. -type GetCurrentUserRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetCurrentUserRequest) Reset() { - *x = GetCurrentUserRequest{} - mi := &file_openshell_proto_msgTypes[6] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetCurrentUserRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetCurrentUserRequest) ProtoMessage() {} - -func (x *GetCurrentUserRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[6] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetCurrentUserRequest.ProtoReflect.Descriptor instead. -func (*GetCurrentUserRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{6} -} - -// Authenticated user identity as validated by the gateway. -type GetCurrentUserResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Stable identity subject (for example, the OIDC `sub` claim). - Subject string `protobuf:"bytes,1,opt,name=subject,proto3" json:"subject,omitempty"` - // Human-readable identity name when supplied by the authentication provider. - DisplayName string `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"` - // Roles granted to the authenticated identity. - Roles []string `protobuf:"bytes,3,rep,name=roles,proto3" json:"roles,omitempty"` - // OAuth2 scopes granted to the authenticated identity. - Scopes []string `protobuf:"bytes,4,rep,name=scopes,proto3" json:"scopes,omitempty"` - // Authentication provider that established the identity. - IdentityProvider string `protobuf:"bytes,5,opt,name=identity_provider,json=identityProvider,proto3" json:"identity_provider,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetCurrentUserResponse) Reset() { - *x = GetCurrentUserResponse{} - mi := &file_openshell_proto_msgTypes[7] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetCurrentUserResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetCurrentUserResponse) ProtoMessage() {} - -func (x *GetCurrentUserResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[7] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetCurrentUserResponse.ProtoReflect.Descriptor instead. -func (*GetCurrentUserResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{7} -} - -func (x *GetCurrentUserResponse) GetSubject() string { - if x != nil { - return x.Subject - } - return "" -} - -func (x *GetCurrentUserResponse) GetDisplayName() string { - if x != nil { - return x.DisplayName - } - return "" -} - -func (x *GetCurrentUserResponse) GetRoles() []string { - if x != nil { - return x.Roles - } - return nil -} - -func (x *GetCurrentUserResponse) GetScopes() []string { - if x != nil { - return x.Scopes - } - return nil -} - -func (x *GetCurrentUserResponse) GetIdentityProvider() string { - if x != nil { - return x.IdentityProvider - } - return "" -} - -// Gateway info request. -type GetGatewayInfoRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetGatewayInfoRequest) Reset() { - *x = GetGatewayInfoRequest{} - mi := &file_openshell_proto_msgTypes[8] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetGatewayInfoRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetGatewayInfoRequest) ProtoMessage() {} - -func (x *GetGatewayInfoRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[8] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetGatewayInfoRequest.ProtoReflect.Descriptor instead. -func (*GetGatewayInfoRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{8} -} - -// Gateway info response. -type GetGatewayInfoResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Service status. - Status ServiceStatus `protobuf:"varint,1,opt,name=status,proto3,enum=openshell.v1.ServiceStatus" json:"status,omitempty"` - // OpenShell gateway binary version. - GatewayVersion string `protobuf:"bytes,2,opt,name=gateway_version,json=gatewayVersion,proto3" json:"gateway_version,omitempty"` - // Compute driver runtimes initialized by this gateway. Current gateways - // return exactly one entry. - ComputeDrivers []*ComputeDriverInfo `protobuf:"bytes,3,rep,name=compute_drivers,json=computeDrivers,proto3" json:"compute_drivers,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetGatewayInfoResponse) Reset() { - *x = GetGatewayInfoResponse{} - mi := &file_openshell_proto_msgTypes[9] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetGatewayInfoResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetGatewayInfoResponse) ProtoMessage() {} - -func (x *GetGatewayInfoResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[9] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetGatewayInfoResponse.ProtoReflect.Descriptor instead. -func (*GetGatewayInfoResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{9} -} - -func (x *GetGatewayInfoResponse) GetStatus() ServiceStatus { - if x != nil { - return x.Status - } - return ServiceStatus_SERVICE_STATUS_UNSPECIFIED -} - -func (x *GetGatewayInfoResponse) GetGatewayVersion() string { - if x != nil { - return x.GatewayVersion - } - return "" -} - -func (x *GetGatewayInfoResponse) GetComputeDrivers() []*ComputeDriverInfo { - if x != nil { - return x.ComputeDrivers - } - return nil -} - -// Info for one initialized compute driver runtime. -type ComputeDriverInfo struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Gateway-selected driver name used for routing and driver_config keys. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Capabilities reported by the driver during gateway runtime initialization. - Capabilities *ComputeDriverCapabilities `protobuf:"bytes,2,opt,name=capabilities,proto3" json:"capabilities,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ComputeDriverInfo) Reset() { - *x = ComputeDriverInfo{} - mi := &file_openshell_proto_msgTypes[10] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ComputeDriverInfo) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ComputeDriverInfo) ProtoMessage() {} - -func (x *ComputeDriverInfo) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[10] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ComputeDriverInfo.ProtoReflect.Descriptor instead. -func (*ComputeDriverInfo) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{10} -} - -func (x *ComputeDriverInfo) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *ComputeDriverInfo) GetCapabilities() *ComputeDriverCapabilities { - if x != nil { - return x.Capabilities - } - return nil -} - -// Public compute driver capability snapshot. -type ComputeDriverCapabilities struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Driver-reported human-readable name from the startup capability snapshot. - DriverName string `protobuf:"bytes,1,opt,name=driver_name,json=driverName,proto3" json:"driver_name,omitempty"` - // Driver-reported implementation version from the startup capability snapshot. - DriverVersion string `protobuf:"bytes,2,opt,name=driver_version,json=driverVersion,proto3" json:"driver_version,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ComputeDriverCapabilities) Reset() { - *x = ComputeDriverCapabilities{} - mi := &file_openshell_proto_msgTypes[11] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ComputeDriverCapabilities) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ComputeDriverCapabilities) ProtoMessage() {} - -func (x *ComputeDriverCapabilities) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[11] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ComputeDriverCapabilities.ProtoReflect.Descriptor instead. -func (*ComputeDriverCapabilities) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{11} -} - -func (x *ComputeDriverCapabilities) GetDriverName() string { - if x != nil { - return x.DriverName - } - return "" -} - -func (x *ComputeDriverCapabilities) GetDriverVersion() string { - if x != nil { - return x.DriverVersion - } - return "" -} - -// Public sandbox resource exposed by the OpenShell API. -// -// This is the canonical gateway-owned view of a sandbox. It merges user intent -// (`spec`) with gateway-managed metadata and status derived from internal -// compute-driver observations. -// -// Note: The `namespace` field has been removed from the public API. It remains -// in the internal `DriverSandbox` message as a compute-driver implementation detail. -type Sandbox struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Kubernetes-style metadata (id, name, labels, timestamps, resource version). - Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` - // Desired sandbox configuration submitted through the API. - Spec *SandboxSpec `protobuf:"bytes,2,opt,name=spec,proto3" json:"spec,omitempty"` - // Latest user-facing observed status derived by the gateway. - Status *SandboxStatus `protobuf:"bytes,3,opt,name=status,proto3" json:"status,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *Sandbox) Reset() { - *x = Sandbox{} - mi := &file_openshell_proto_msgTypes[12] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *Sandbox) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*Sandbox) ProtoMessage() {} - -func (x *Sandbox) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[12] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use Sandbox.ProtoReflect.Descriptor instead. -func (*Sandbox) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{12} -} - -func (x *Sandbox) GetMetadata() *datamodelv1.ObjectMeta { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *Sandbox) GetSpec() *SandboxSpec { - if x != nil { - return x.Spec - } - return nil -} - -func (x *Sandbox) GetStatus() *SandboxStatus { - if x != nil { - return x.Status - } - return nil -} - -// Desired sandbox configuration provided through the public API. -type SandboxSpec struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Log level exposed to processes running inside the sandbox. - LogLevel string `protobuf:"bytes,1,opt,name=log_level,json=logLevel,proto3" json:"log_level,omitempty"` - // Environment variables injected into the sandbox runtime. - Environment map[string]string `protobuf:"bytes,5,rep,name=environment,proto3" json:"environment,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Container or VM template used to provision the sandbox. - Template *SandboxTemplate `protobuf:"bytes,6,opt,name=template,proto3" json:"template,omitempty"` - // Required sandbox policy configuration. - Policy *sandboxv1.SandboxPolicy `protobuf:"bytes,7,opt,name=policy,proto3" json:"policy,omitempty"` - // Provider names to attach to this sandbox. - Providers []string `protobuf:"bytes,8,rep,name=providers,proto3" json:"providers,omitempty"` - // Portable resource requirements used by the gateway for driver selection - // and by drivers for provisioning. - ResourceRequirements *ResourceRequirements `protobuf:"bytes,9,opt,name=resource_requirements,json=resourceRequirements,proto3" json:"resource_requirements,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxSpec) Reset() { - *x = SandboxSpec{} - mi := &file_openshell_proto_msgTypes[13] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxSpec) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxSpec) ProtoMessage() {} - -func (x *SandboxSpec) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[13] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxSpec.ProtoReflect.Descriptor instead. -func (*SandboxSpec) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{13} -} - -func (x *SandboxSpec) GetLogLevel() string { - if x != nil { - return x.LogLevel - } - return "" -} - -func (x *SandboxSpec) GetEnvironment() map[string]string { - if x != nil { - return x.Environment - } - return nil -} - -func (x *SandboxSpec) GetTemplate() *SandboxTemplate { - if x != nil { - return x.Template - } - return nil -} - -func (x *SandboxSpec) GetPolicy() *sandboxv1.SandboxPolicy { - if x != nil { - return x.Policy - } - return nil -} - -func (x *SandboxSpec) GetProviders() []string { - if x != nil { - return x.Providers - } - return nil -} - -func (x *SandboxSpec) GetResourceRequirements() *ResourceRequirements { - if x != nil { - return x.ResourceRequirements - } - return nil -} - -type ResourceRequirements struct { - state protoimpl.MessageState `protogen:"open.v1"` - // GPU requirements for the sandbox. Presence indicates a GPU request. - Gpu *GpuResourceRequirements `protobuf:"bytes,1,opt,name=gpu,proto3" json:"gpu,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ResourceRequirements) Reset() { - *x = ResourceRequirements{} - mi := &file_openshell_proto_msgTypes[14] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ResourceRequirements) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ResourceRequirements) ProtoMessage() {} - -func (x *ResourceRequirements) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[14] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ResourceRequirements.ProtoReflect.Descriptor instead. -func (*ResourceRequirements) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{14} -} - -func (x *ResourceRequirements) GetGpu() *GpuResourceRequirements { - if x != nil { - return x.Gpu - } - return nil -} - -// Public GPU resource requirements. -type GpuResourceRequirements struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Optional number of GPUs requested. When omitted, the request is for one - // GPU using the selected driver's default assignment behavior. - Count *uint32 `protobuf:"varint,1,opt,name=count,proto3,oneof" json:"count,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GpuResourceRequirements) Reset() { - *x = GpuResourceRequirements{} - mi := &file_openshell_proto_msgTypes[15] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GpuResourceRequirements) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GpuResourceRequirements) ProtoMessage() {} - -func (x *GpuResourceRequirements) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[15] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GpuResourceRequirements.ProtoReflect.Descriptor instead. -func (*GpuResourceRequirements) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{15} -} - -func (x *GpuResourceRequirements) GetCount() uint32 { - if x != nil && x.Count != nil { - return *x.Count - } - return 0 -} - -// Public sandbox template mapped onto compute-driver template inputs. -type SandboxTemplate struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Fully-qualified OCI image reference used to boot the sandbox. - Image string `protobuf:"bytes,1,opt,name=image,proto3" json:"image,omitempty"` - // Optional runtime class name requested from the compute platform. - RuntimeClassName string `protobuf:"bytes,2,opt,name=runtime_class_name,json=runtimeClassName,proto3" json:"runtime_class_name,omitempty"` - // Optional agent socket path exposed to the workload. - AgentSocket string `protobuf:"bytes,3,opt,name=agent_socket,json=agentSocket,proto3" json:"agent_socket,omitempty"` - // Labels applied to compute-platform resources for this sandbox. - Labels map[string]string `protobuf:"bytes,4,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Annotations applied to compute-platform resources for this sandbox. - Annotations map[string]string `protobuf:"bytes,5,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Additional environment variables injected by the template. - Environment map[string]string `protobuf:"bytes,6,rep,name=environment,proto3" json:"environment,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Platform-specific compute resource requirements and limits. - Resources *structpb.Struct `protobuf:"bytes,7,opt,name=resources,proto3" json:"resources,omitempty"` - // Enable Kubernetes user namespace isolation (hostUsers: false). - // When true, container UID 0 maps to a non-root host UID and capabilities - // become namespaced. Requires Kubernetes 1.33+ with user namespace support - // available (beta through 1.35, GA in 1.36+) and a supporting runtime. - // When unset, the cluster-wide default is used. - UserNamespaces *bool `protobuf:"varint,10,opt,name=user_namespaces,json=userNamespaces,proto3,oneof" json:"user_namespaces,omitempty"` - // Driver-keyed opaque config envelope supplied by the caller. - // The gateway selects the block matching the active compute driver and - // forwards only that inner Struct to DriverSandboxTemplate.driver_config. - // The selected driver owns nested schema validation. - DriverConfig *structpb.Struct `protobuf:"bytes,11,opt,name=driver_config,json=driverConfig,proto3" json:"driver_config,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxTemplate) Reset() { - *x = SandboxTemplate{} - mi := &file_openshell_proto_msgTypes[16] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxTemplate) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxTemplate) ProtoMessage() {} - -func (x *SandboxTemplate) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[16] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxTemplate.ProtoReflect.Descriptor instead. -func (*SandboxTemplate) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{16} -} - -func (x *SandboxTemplate) GetImage() string { - if x != nil { - return x.Image - } - return "" -} - -func (x *SandboxTemplate) GetRuntimeClassName() string { - if x != nil { - return x.RuntimeClassName - } - return "" -} - -func (x *SandboxTemplate) GetAgentSocket() string { - if x != nil { - return x.AgentSocket - } - return "" -} - -func (x *SandboxTemplate) GetLabels() map[string]string { - if x != nil { - return x.Labels - } - return nil -} - -func (x *SandboxTemplate) GetAnnotations() map[string]string { - if x != nil { - return x.Annotations - } - return nil -} - -func (x *SandboxTemplate) GetEnvironment() map[string]string { - if x != nil { - return x.Environment - } - return nil -} - -func (x *SandboxTemplate) GetResources() *structpb.Struct { - if x != nil { - return x.Resources - } - return nil -} - -func (x *SandboxTemplate) GetUserNamespaces() bool { - if x != nil && x.UserNamespaces != nil { - return *x.UserNamespaces - } - return false -} - -func (x *SandboxTemplate) GetDriverConfig() *structpb.Struct { - if x != nil { - return x.DriverConfig - } - return nil -} - -// User-facing sandbox status derived by the gateway from compute-driver observations. -// -// Public status does not embed driver-only flags such as `deleting`. -type SandboxStatus struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Compute-platform sandbox object name. - SandboxName string `protobuf:"bytes,1,opt,name=sandbox_name,json=sandboxName,proto3" json:"sandbox_name,omitempty"` - // Name of the agent pod or equivalent runtime instance. - AgentPod string `protobuf:"bytes,2,opt,name=agent_pod,json=agentPod,proto3" json:"agent_pod,omitempty"` - // File descriptor or endpoint for reaching the agent service, when available. - AgentFd string `protobuf:"bytes,3,opt,name=agent_fd,json=agentFd,proto3" json:"agent_fd,omitempty"` - // File descriptor or endpoint for reaching the sandbox service, when available. - SandboxFd string `protobuf:"bytes,4,opt,name=sandbox_fd,json=sandboxFd,proto3" json:"sandbox_fd,omitempty"` - // Latest user-facing readiness and lifecycle conditions. - Conditions []*SandboxCondition `protobuf:"bytes,5,rep,name=conditions,proto3" json:"conditions,omitempty"` - // Gateway-derived lifecycle summary. - Phase SandboxPhase `protobuf:"varint,6,opt,name=phase,proto3,enum=openshell.v1.SandboxPhase" json:"phase,omitempty"` - // Currently active policy version (updated when sandbox reports loaded). - CurrentPolicyVersion uint32 `protobuf:"varint,7,opt,name=current_policy_version,json=currentPolicyVersion,proto3" json:"current_policy_version,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxStatus) Reset() { - *x = SandboxStatus{} - mi := &file_openshell_proto_msgTypes[17] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxStatus) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxStatus) ProtoMessage() {} - -func (x *SandboxStatus) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[17] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxStatus.ProtoReflect.Descriptor instead. -func (*SandboxStatus) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{17} -} - -func (x *SandboxStatus) GetSandboxName() string { - if x != nil { - return x.SandboxName - } - return "" -} - -func (x *SandboxStatus) GetAgentPod() string { - if x != nil { - return x.AgentPod - } - return "" -} - -func (x *SandboxStatus) GetAgentFd() string { - if x != nil { - return x.AgentFd - } - return "" -} - -func (x *SandboxStatus) GetSandboxFd() string { - if x != nil { - return x.SandboxFd - } - return "" -} - -func (x *SandboxStatus) GetConditions() []*SandboxCondition { - if x != nil { - return x.Conditions - } - return nil -} - -func (x *SandboxStatus) GetPhase() SandboxPhase { - if x != nil { - return x.Phase - } - return SandboxPhase_SANDBOX_PHASE_UNSPECIFIED -} - -func (x *SandboxStatus) GetCurrentPolicyVersion() uint32 { - if x != nil { - return x.CurrentPolicyVersion - } - return 0 -} - -// User-facing sandbox condition derived from driver-native conditions. -type SandboxCondition struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Condition class, typically mirroring the underlying platform condition type. - Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"` - // Condition status value such as `True`, `False`, or `Unknown`. - Status string `protobuf:"bytes,2,opt,name=status,proto3" json:"status,omitempty"` - // Short machine-readable reason associated with the condition. - Reason string `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"` - // Human-readable condition message. - Message string `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"` - // Timestamp reported by the underlying platform for the last transition. - LastTransitionTime string `protobuf:"bytes,5,opt,name=last_transition_time,json=lastTransitionTime,proto3" json:"last_transition_time,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxCondition) Reset() { - *x = SandboxCondition{} - mi := &file_openshell_proto_msgTypes[18] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxCondition) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxCondition) ProtoMessage() {} - -func (x *SandboxCondition) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[18] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxCondition.ProtoReflect.Descriptor instead. -func (*SandboxCondition) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{18} -} - -func (x *SandboxCondition) GetType() string { - if x != nil { - return x.Type - } - return "" -} - -func (x *SandboxCondition) GetStatus() string { - if x != nil { - return x.Status - } - return "" -} - -func (x *SandboxCondition) GetReason() string { - if x != nil { - return x.Reason - } - return "" -} - -func (x *SandboxCondition) GetMessage() string { - if x != nil { - return x.Message - } - return "" -} - -func (x *SandboxCondition) GetLastTransitionTime() string { - if x != nil { - return x.LastTransitionTime - } - return "" -} - -// Public platform event exposed on the sandbox watch stream. -type PlatformEvent struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Event timestamp in milliseconds since epoch. - TimestampMs int64 `protobuf:"varint,1,opt,name=timestamp_ms,json=timestampMs,proto3" json:"timestamp_ms,omitempty"` - // Event source (e.g. "kubernetes", "docker", "process"). - Source string `protobuf:"bytes,2,opt,name=source,proto3" json:"source,omitempty"` - // Event type/severity (e.g. "Normal", "Warning"). - Type string `protobuf:"bytes,3,opt,name=type,proto3" json:"type,omitempty"` - // Short reason code (e.g. "Started", "Pulled", "Failed"). - Reason string `protobuf:"bytes,4,opt,name=reason,proto3" json:"reason,omitempty"` - // Human-readable event message. - Message string `protobuf:"bytes,5,opt,name=message,proto3" json:"message,omitempty"` - // Optional metadata as key-value pairs. - Metadata map[string]string `protobuf:"bytes,6,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *PlatformEvent) Reset() { - *x = PlatformEvent{} - mi := &file_openshell_proto_msgTypes[19] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *PlatformEvent) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*PlatformEvent) ProtoMessage() {} - -func (x *PlatformEvent) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[19] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use PlatformEvent.ProtoReflect.Descriptor instead. -func (*PlatformEvent) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{19} -} - -func (x *PlatformEvent) GetTimestampMs() int64 { - if x != nil { - return x.TimestampMs - } - return 0 -} - -func (x *PlatformEvent) GetSource() string { - if x != nil { - return x.Source - } - return "" -} - -func (x *PlatformEvent) GetType() string { - if x != nil { - return x.Type - } - return "" -} - -func (x *PlatformEvent) GetReason() string { - if x != nil { - return x.Reason - } - return "" -} - -func (x *PlatformEvent) GetMessage() string { - if x != nil { - return x.Message - } - return "" -} - -func (x *PlatformEvent) GetMetadata() map[string]string { - if x != nil { - return x.Metadata - } - return nil -} - -// Create sandbox request. -type CreateSandboxRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Spec *SandboxSpec `protobuf:"bytes,1,opt,name=spec,proto3" json:"spec,omitempty"` - // Optional user-supplied sandbox name. When empty the server generates one. - Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` - // Optional labels for the sandbox (key-value metadata). - Labels map[string]string `protobuf:"bytes,3,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Optional annotations for the sandbox (non-selector metadata). - Annotations map[string]string `protobuf:"bytes,4,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Workspace for the sandbox. Empty defaults to "default". - Workspace string `protobuf:"bytes,5,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *CreateSandboxRequest) Reset() { - *x = CreateSandboxRequest{} - mi := &file_openshell_proto_msgTypes[20] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *CreateSandboxRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*CreateSandboxRequest) ProtoMessage() {} - -func (x *CreateSandboxRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[20] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use CreateSandboxRequest.ProtoReflect.Descriptor instead. -func (*CreateSandboxRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{20} -} - -func (x *CreateSandboxRequest) GetSpec() *SandboxSpec { - if x != nil { - return x.Spec - } - return nil -} - -func (x *CreateSandboxRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *CreateSandboxRequest) GetLabels() map[string]string { - if x != nil { - return x.Labels - } - return nil -} - -func (x *CreateSandboxRequest) GetAnnotations() map[string]string { - if x != nil { - return x.Annotations - } - return nil -} - -func (x *CreateSandboxRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Get sandbox request. -type GetSandboxRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name (canonical lookup key). - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetSandboxRequest) Reset() { - *x = GetSandboxRequest{} - mi := &file_openshell_proto_msgTypes[21] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetSandboxRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetSandboxRequest) ProtoMessage() {} - -func (x *GetSandboxRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[21] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetSandboxRequest.ProtoReflect.Descriptor instead. -func (*GetSandboxRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{21} -} - -func (x *GetSandboxRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *GetSandboxRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// List sandboxes request. -type ListSandboxesRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Limit uint32 `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"` - Offset uint32 `protobuf:"varint,2,opt,name=offset,proto3" json:"offset,omitempty"` - // Optional label selector for filtering (format: "key1=value1,key2=value2"). - LabelSelector string `protobuf:"bytes,3,opt,name=label_selector,json=labelSelector,proto3" json:"label_selector,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"` - // List across all workspaces. Mutually exclusive with workspace. - AllWorkspaces bool `protobuf:"varint,5,opt,name=all_workspaces,json=allWorkspaces,proto3" json:"all_workspaces,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListSandboxesRequest) Reset() { - *x = ListSandboxesRequest{} - mi := &file_openshell_proto_msgTypes[22] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListSandboxesRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListSandboxesRequest) ProtoMessage() {} - -func (x *ListSandboxesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[22] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListSandboxesRequest.ProtoReflect.Descriptor instead. -func (*ListSandboxesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{22} -} - -func (x *ListSandboxesRequest) GetLimit() uint32 { - if x != nil { - return x.Limit - } - return 0 -} - -func (x *ListSandboxesRequest) GetOffset() uint32 { - if x != nil { - return x.Offset - } - return 0 -} - -func (x *ListSandboxesRequest) GetLabelSelector() string { - if x != nil { - return x.LabelSelector - } - return "" -} - -func (x *ListSandboxesRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -func (x *ListSandboxesRequest) GetAllWorkspaces() bool { - if x != nil { - return x.AllWorkspaces - } - return false -} - -// List providers attached to a sandbox request. -type ListSandboxProvidersRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name (canonical lookup key). - SandboxName string `protobuf:"bytes,1,opt,name=sandbox_name,json=sandboxName,proto3" json:"sandbox_name,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListSandboxProvidersRequest) Reset() { - *x = ListSandboxProvidersRequest{} - mi := &file_openshell_proto_msgTypes[23] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListSandboxProvidersRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListSandboxProvidersRequest) ProtoMessage() {} - -func (x *ListSandboxProvidersRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[23] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListSandboxProvidersRequest.ProtoReflect.Descriptor instead. -func (*ListSandboxProvidersRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{23} -} - -func (x *ListSandboxProvidersRequest) GetSandboxName() string { - if x != nil { - return x.SandboxName - } - return "" -} - -func (x *ListSandboxProvidersRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Attach provider to sandbox request. -type AttachSandboxProviderRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name (canonical lookup key). - SandboxName string `protobuf:"bytes,1,opt,name=sandbox_name,json=sandboxName,proto3" json:"sandbox_name,omitempty"` - // Provider name to attach. - ProviderName string `protobuf:"bytes,2,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"` - // Expected resource version for optimistic concurrency control. - // If 0, the server uses the current version (backward compatibility). - // If non-zero, the server validates that the sandbox's current resource_version - // matches this value before applying the mutation, returning ABORTED on mismatch. - ExpectedResourceVersion uint64 `protobuf:"varint,3,opt,name=expected_resource_version,json=expectedResourceVersion,proto3" json:"expected_resource_version,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *AttachSandboxProviderRequest) Reset() { - *x = AttachSandboxProviderRequest{} - mi := &file_openshell_proto_msgTypes[24] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *AttachSandboxProviderRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*AttachSandboxProviderRequest) ProtoMessage() {} - -func (x *AttachSandboxProviderRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[24] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use AttachSandboxProviderRequest.ProtoReflect.Descriptor instead. -func (*AttachSandboxProviderRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{24} -} - -func (x *AttachSandboxProviderRequest) GetSandboxName() string { - if x != nil { - return x.SandboxName - } - return "" -} - -func (x *AttachSandboxProviderRequest) GetProviderName() string { - if x != nil { - return x.ProviderName - } - return "" -} - -func (x *AttachSandboxProviderRequest) GetExpectedResourceVersion() uint64 { - if x != nil { - return x.ExpectedResourceVersion - } - return 0 -} - -func (x *AttachSandboxProviderRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Detach provider from sandbox request. -type DetachSandboxProviderRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name (canonical lookup key). - SandboxName string `protobuf:"bytes,1,opt,name=sandbox_name,json=sandboxName,proto3" json:"sandbox_name,omitempty"` - // Provider name to detach. - ProviderName string `protobuf:"bytes,2,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"` - // Expected resource version for optimistic concurrency control. - // If 0, the server uses the current version (backward compatibility). - // If non-zero, the server validates that the sandbox's current resource_version - // matches this value before applying the mutation, returning ABORTED on mismatch. - ExpectedResourceVersion uint64 `protobuf:"varint,3,opt,name=expected_resource_version,json=expectedResourceVersion,proto3" json:"expected_resource_version,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DetachSandboxProviderRequest) Reset() { - *x = DetachSandboxProviderRequest{} - mi := &file_openshell_proto_msgTypes[25] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DetachSandboxProviderRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DetachSandboxProviderRequest) ProtoMessage() {} - -func (x *DetachSandboxProviderRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[25] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DetachSandboxProviderRequest.ProtoReflect.Descriptor instead. -func (*DetachSandboxProviderRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{25} -} - -func (x *DetachSandboxProviderRequest) GetSandboxName() string { - if x != nil { - return x.SandboxName - } - return "" -} - -func (x *DetachSandboxProviderRequest) GetProviderName() string { - if x != nil { - return x.ProviderName - } - return "" -} - -func (x *DetachSandboxProviderRequest) GetExpectedResourceVersion() uint64 { - if x != nil { - return x.ExpectedResourceVersion - } - return 0 -} - -func (x *DetachSandboxProviderRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Delete sandbox request. -type DeleteSandboxRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name (canonical lookup key). - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteSandboxRequest) Reset() { - *x = DeleteSandboxRequest{} - mi := &file_openshell_proto_msgTypes[26] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteSandboxRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteSandboxRequest) ProtoMessage() {} - -func (x *DeleteSandboxRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[26] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteSandboxRequest.ProtoReflect.Descriptor instead. -func (*DeleteSandboxRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{26} -} - -func (x *DeleteSandboxRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *DeleteSandboxRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Sandbox response. -type SandboxResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Sandbox *Sandbox `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxResponse) Reset() { - *x = SandboxResponse{} - mi := &file_openshell_proto_msgTypes[27] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxResponse) ProtoMessage() {} - -func (x *SandboxResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[27] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxResponse.ProtoReflect.Descriptor instead. -func (*SandboxResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{27} -} - -func (x *SandboxResponse) GetSandbox() *Sandbox { - if x != nil { - return x.Sandbox - } - return nil -} - -// List sandboxes response. -type ListSandboxesResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Sandboxes []*Sandbox `protobuf:"bytes,1,rep,name=sandboxes,proto3" json:"sandboxes,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListSandboxesResponse) Reset() { - *x = ListSandboxesResponse{} - mi := &file_openshell_proto_msgTypes[28] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListSandboxesResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListSandboxesResponse) ProtoMessage() {} - -func (x *ListSandboxesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[28] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListSandboxesResponse.ProtoReflect.Descriptor instead. -func (*ListSandboxesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{28} -} - -func (x *ListSandboxesResponse) GetSandboxes() []*Sandbox { - if x != nil { - return x.Sandboxes - } - return nil -} - -// List providers attached to a sandbox response. -type ListSandboxProvidersResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Providers []*datamodelv1.Provider `protobuf:"bytes,1,rep,name=providers,proto3" json:"providers,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListSandboxProvidersResponse) Reset() { - *x = ListSandboxProvidersResponse{} - mi := &file_openshell_proto_msgTypes[29] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListSandboxProvidersResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListSandboxProvidersResponse) ProtoMessage() {} - -func (x *ListSandboxProvidersResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[29] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListSandboxProvidersResponse.ProtoReflect.Descriptor instead. -func (*ListSandboxProvidersResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{29} -} - -func (x *ListSandboxProvidersResponse) GetProviders() []*datamodelv1.Provider { - if x != nil { - return x.Providers - } - return nil -} - -// Attach provider to sandbox response. -type AttachSandboxProviderResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Sandbox *Sandbox `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"` - // True when the provider was newly attached. False means it was already attached. - Attached bool `protobuf:"varint,2,opt,name=attached,proto3" json:"attached,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *AttachSandboxProviderResponse) Reset() { - *x = AttachSandboxProviderResponse{} - mi := &file_openshell_proto_msgTypes[30] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *AttachSandboxProviderResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*AttachSandboxProviderResponse) ProtoMessage() {} - -func (x *AttachSandboxProviderResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[30] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use AttachSandboxProviderResponse.ProtoReflect.Descriptor instead. -func (*AttachSandboxProviderResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{30} -} - -func (x *AttachSandboxProviderResponse) GetSandbox() *Sandbox { - if x != nil { - return x.Sandbox - } - return nil -} - -func (x *AttachSandboxProviderResponse) GetAttached() bool { - if x != nil { - return x.Attached - } - return false -} - -// Detach provider from sandbox response. -type DetachSandboxProviderResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Sandbox *Sandbox `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"` - // True when the provider was removed. False means it was not attached. - Detached bool `protobuf:"varint,2,opt,name=detached,proto3" json:"detached,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DetachSandboxProviderResponse) Reset() { - *x = DetachSandboxProviderResponse{} - mi := &file_openshell_proto_msgTypes[31] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DetachSandboxProviderResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DetachSandboxProviderResponse) ProtoMessage() {} - -func (x *DetachSandboxProviderResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[31] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DetachSandboxProviderResponse.ProtoReflect.Descriptor instead. -func (*DetachSandboxProviderResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{31} -} - -func (x *DetachSandboxProviderResponse) GetSandbox() *Sandbox { - if x != nil { - return x.Sandbox - } - return nil -} - -func (x *DetachSandboxProviderResponse) GetDetached() bool { - if x != nil { - return x.Detached - } - return false -} - -// Delete sandbox response. -type DeleteSandboxResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Deleted bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteSandboxResponse) Reset() { - *x = DeleteSandboxResponse{} - mi := &file_openshell_proto_msgTypes[32] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteSandboxResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteSandboxResponse) ProtoMessage() {} - -func (x *DeleteSandboxResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[32] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteSandboxResponse.ProtoReflect.Descriptor instead. -func (*DeleteSandboxResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{32} -} - -func (x *DeleteSandboxResponse) GetDeleted() bool { - if x != nil { - return x.Deleted - } - return false -} - -// Create SSH session request. -type CreateSshSessionRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox id. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *CreateSshSessionRequest) Reset() { - *x = CreateSshSessionRequest{} - mi := &file_openshell_proto_msgTypes[33] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *CreateSshSessionRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*CreateSshSessionRequest) ProtoMessage() {} - -func (x *CreateSshSessionRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[33] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use CreateSshSessionRequest.ProtoReflect.Descriptor instead. -func (*CreateSshSessionRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{33} -} - -func (x *CreateSshSessionRequest) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -// Create SSH session response. -// -// Fields are interpolated into an SSH `ProxyCommand` string that OpenSSH -// executes through `/bin/sh -c` on the caller's workstation. Servers MUST -// uphold the charset contract below; clients MUST reject responses that -// violate it. The client's own escaping provides defense-in-depth, but -// narrow charsets close injection vectors at the trust boundary. -type CreateSshSessionResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox id. [A-Za-z0-9._-]{1,128}. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // Session token for the gateway tunnel. URL-safe ASCII - // ([A-Za-z0-9._~+/=-]) up to 4096 bytes. No shell metacharacters or - // whitespace. - Token string `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"` - // Gateway host for SSH proxy connection. IPv4 address, bracketed IPv6 - // address, or DNS hostname (Punycode-encoded for IDN). Alphanumeric plus - // `.-:[]` only, up to 253 bytes. - GatewayHost string `protobuf:"bytes,3,opt,name=gateway_host,json=gatewayHost,proto3" json:"gateway_host,omitempty"` - // Gateway port for SSH proxy connection. Must be in range 1..=65535. - GatewayPort uint32 `protobuf:"varint,4,opt,name=gateway_port,json=gatewayPort,proto3" json:"gateway_port,omitempty"` - // Gateway scheme. Must be exactly "http" or "https". - GatewayScheme string `protobuf:"bytes,5,opt,name=gateway_scheme,json=gatewayScheme,proto3" json:"gateway_scheme,omitempty"` - // Optional host key fingerprint. If non-empty, [A-Za-z0-9:+/=-] only. - HostKeyFingerprint string `protobuf:"bytes,7,opt,name=host_key_fingerprint,json=hostKeyFingerprint,proto3" json:"host_key_fingerprint,omitempty"` - // Expiry timestamp in milliseconds since epoch. 0 means no expiry. - ExpiresAtMs int64 `protobuf:"varint,8,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *CreateSshSessionResponse) Reset() { - *x = CreateSshSessionResponse{} - mi := &file_openshell_proto_msgTypes[34] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *CreateSshSessionResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*CreateSshSessionResponse) ProtoMessage() {} - -func (x *CreateSshSessionResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[34] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use CreateSshSessionResponse.ProtoReflect.Descriptor instead. -func (*CreateSshSessionResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{34} -} - -func (x *CreateSshSessionResponse) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *CreateSshSessionResponse) GetToken() string { - if x != nil { - return x.Token - } - return "" -} - -func (x *CreateSshSessionResponse) GetGatewayHost() string { - if x != nil { - return x.GatewayHost - } - return "" -} - -func (x *CreateSshSessionResponse) GetGatewayPort() uint32 { - if x != nil { - return x.GatewayPort - } - return 0 -} - -func (x *CreateSshSessionResponse) GetGatewayScheme() string { - if x != nil { - return x.GatewayScheme - } - return "" -} - -func (x *CreateSshSessionResponse) GetHostKeyFingerprint() string { - if x != nil { - return x.HostKeyFingerprint - } - return "" -} - -func (x *CreateSshSessionResponse) GetExpiresAtMs() int64 { - if x != nil { - return x.ExpiresAtMs - } - return 0 -} - -// Request to expose an HTTP service running inside a sandbox. -type ExposeServiceRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"` - // Service name within the sandbox. - Service string `protobuf:"bytes,2,opt,name=service,proto3" json:"service,omitempty"` - // Loopback TCP port inside the sandbox. - TargetPort uint32 `protobuf:"varint,3,opt,name=target_port,json=targetPort,proto3" json:"target_port,omitempty"` - // Whether to print/use the browser-facing service URL. - Domain bool `protobuf:"varint,4,opt,name=domain,proto3" json:"domain,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,5,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ExposeServiceRequest) Reset() { - *x = ExposeServiceRequest{} - mi := &file_openshell_proto_msgTypes[35] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ExposeServiceRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ExposeServiceRequest) ProtoMessage() {} - -func (x *ExposeServiceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[35] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ExposeServiceRequest.ProtoReflect.Descriptor instead. -func (*ExposeServiceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{35} -} - -func (x *ExposeServiceRequest) GetSandbox() string { - if x != nil { - return x.Sandbox - } - return "" -} - -func (x *ExposeServiceRequest) GetService() string { - if x != nil { - return x.Service - } - return "" -} - -func (x *ExposeServiceRequest) GetTargetPort() uint32 { - if x != nil { - return x.TargetPort - } - return 0 -} - -func (x *ExposeServiceRequest) GetDomain() bool { - if x != nil { - return x.Domain - } - return false -} - -func (x *ExposeServiceRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Request to fetch an exposed sandbox service endpoint. -type GetServiceRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"` - // Service name within the sandbox. Empty selects the unnamed endpoint. - Service string `protobuf:"bytes,2,opt,name=service,proto3" json:"service,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetServiceRequest) Reset() { - *x = GetServiceRequest{} - mi := &file_openshell_proto_msgTypes[36] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetServiceRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetServiceRequest) ProtoMessage() {} - -func (x *GetServiceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[36] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetServiceRequest.ProtoReflect.Descriptor instead. -func (*GetServiceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{36} -} - -func (x *GetServiceRequest) GetSandbox() string { - if x != nil { - return x.Sandbox - } - return "" -} - -func (x *GetServiceRequest) GetService() string { - if x != nil { - return x.Service - } - return "" -} - -func (x *GetServiceRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Request to list exposed sandbox service endpoints. -type ListServicesRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Optional sandbox name. Empty lists endpoints for all sandboxes. - Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"` - // Page size. Zero uses the server default. - Limit uint32 `protobuf:"varint,2,opt,name=limit,proto3" json:"limit,omitempty"` - // Page offset. - Offset uint32 `protobuf:"varint,3,opt,name=offset,proto3" json:"offset,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"` - // List across all workspaces. Mutually exclusive with workspace. - AllWorkspaces bool `protobuf:"varint,5,opt,name=all_workspaces,json=allWorkspaces,proto3" json:"all_workspaces,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListServicesRequest) Reset() { - *x = ListServicesRequest{} - mi := &file_openshell_proto_msgTypes[37] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListServicesRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListServicesRequest) ProtoMessage() {} - -func (x *ListServicesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[37] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListServicesRequest.ProtoReflect.Descriptor instead. -func (*ListServicesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{37} -} - -func (x *ListServicesRequest) GetSandbox() string { - if x != nil { - return x.Sandbox - } - return "" -} - -func (x *ListServicesRequest) GetLimit() uint32 { - if x != nil { - return x.Limit - } - return 0 -} - -func (x *ListServicesRequest) GetOffset() uint32 { - if x != nil { - return x.Offset - } - return 0 -} - -func (x *ListServicesRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -func (x *ListServicesRequest) GetAllWorkspaces() bool { - if x != nil { - return x.AllWorkspaces - } - return false -} - -// Response containing exposed sandbox service endpoints. -type ListServicesResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Services []*ServiceEndpointResponse `protobuf:"bytes,1,rep,name=services,proto3" json:"services,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListServicesResponse) Reset() { - *x = ListServicesResponse{} - mi := &file_openshell_proto_msgTypes[38] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListServicesResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListServicesResponse) ProtoMessage() {} - -func (x *ListServicesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[38] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListServicesResponse.ProtoReflect.Descriptor instead. -func (*ListServicesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{38} -} - -func (x *ListServicesResponse) GetServices() []*ServiceEndpointResponse { - if x != nil { - return x.Services - } - return nil -} - -// Request to delete an exposed sandbox service endpoint. -type DeleteServiceRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"` - // Service name within the sandbox. Empty selects the unnamed endpoint. - Service string `protobuf:"bytes,2,opt,name=service,proto3" json:"service,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteServiceRequest) Reset() { - *x = DeleteServiceRequest{} - mi := &file_openshell_proto_msgTypes[39] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteServiceRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteServiceRequest) ProtoMessage() {} - -func (x *DeleteServiceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[39] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteServiceRequest.ProtoReflect.Descriptor instead. -func (*DeleteServiceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{39} -} - -func (x *DeleteServiceRequest) GetSandbox() string { - if x != nil { - return x.Sandbox - } - return "" -} - -func (x *DeleteServiceRequest) GetService() string { - if x != nil { - return x.Service - } - return "" -} - -func (x *DeleteServiceRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Response for deleting an exposed sandbox service endpoint. -type DeleteServiceResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // True when an endpoint existed and was deleted. - Deleted bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteServiceResponse) Reset() { - *x = DeleteServiceResponse{} - mi := &file_openshell_proto_msgTypes[40] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteServiceResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteServiceResponse) ProtoMessage() {} - -func (x *DeleteServiceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[40] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteServiceResponse.ProtoReflect.Descriptor instead. -func (*DeleteServiceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{40} -} - -func (x *DeleteServiceResponse) GetDeleted() bool { - if x != nil { - return x.Deleted - } - return false -} - -// Persisted sandbox service endpoint. -type ServiceEndpoint struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Kubernetes-style metadata. - Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` - // Sandbox object ID. - SandboxId string `protobuf:"bytes,2,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // Sandbox name. - SandboxName string `protobuf:"bytes,3,opt,name=sandbox_name,json=sandboxName,proto3" json:"sandbox_name,omitempty"` - // Service name within the sandbox. - ServiceName string `protobuf:"bytes,4,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"` - // Loopback TCP port inside the sandbox. - TargetPort uint32 `protobuf:"varint,5,opt,name=target_port,json=targetPort,proto3" json:"target_port,omitempty"` - // Whether browser-facing service routing is enabled for this endpoint. - Domain bool `protobuf:"varint,6,opt,name=domain,proto3" json:"domain,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ServiceEndpoint) Reset() { - *x = ServiceEndpoint{} - mi := &file_openshell_proto_msgTypes[41] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ServiceEndpoint) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ServiceEndpoint) ProtoMessage() {} - -func (x *ServiceEndpoint) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[41] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ServiceEndpoint.ProtoReflect.Descriptor instead. -func (*ServiceEndpoint) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{41} -} - -func (x *ServiceEndpoint) GetMetadata() *datamodelv1.ObjectMeta { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *ServiceEndpoint) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *ServiceEndpoint) GetSandboxName() string { - if x != nil { - return x.SandboxName - } - return "" -} - -func (x *ServiceEndpoint) GetServiceName() string { - if x != nil { - return x.ServiceName - } - return "" -} - -func (x *ServiceEndpoint) GetTargetPort() uint32 { - if x != nil { - return x.TargetPort - } - return 0 -} - -func (x *ServiceEndpoint) GetDomain() bool { - if x != nil { - return x.Domain - } - return false -} - -// Response containing a service endpoint and, when available, its local URL. -type ServiceEndpointResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Endpoint *ServiceEndpoint `protobuf:"bytes,1,opt,name=endpoint,proto3" json:"endpoint,omitempty"` - Url string `protobuf:"bytes,2,opt,name=url,proto3" json:"url,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ServiceEndpointResponse) Reset() { - *x = ServiceEndpointResponse{} - mi := &file_openshell_proto_msgTypes[42] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ServiceEndpointResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ServiceEndpointResponse) ProtoMessage() {} - -func (x *ServiceEndpointResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[42] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ServiceEndpointResponse.ProtoReflect.Descriptor instead. -func (*ServiceEndpointResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{42} -} - -func (x *ServiceEndpointResponse) GetEndpoint() *ServiceEndpoint { - if x != nil { - return x.Endpoint - } - return nil -} - -func (x *ServiceEndpointResponse) GetUrl() string { - if x != nil { - return x.Url - } - return "" -} - -// Revoke SSH session request. -type RevokeSshSessionRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Session token to revoke. - Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RevokeSshSessionRequest) Reset() { - *x = RevokeSshSessionRequest{} - mi := &file_openshell_proto_msgTypes[43] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RevokeSshSessionRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RevokeSshSessionRequest) ProtoMessage() {} - -func (x *RevokeSshSessionRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[43] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RevokeSshSessionRequest.ProtoReflect.Descriptor instead. -func (*RevokeSshSessionRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{43} -} - -func (x *RevokeSshSessionRequest) GetToken() string { - if x != nil { - return x.Token - } - return "" -} - -// Revoke SSH session response. -type RevokeSshSessionResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // True when a session was revoked. - Revoked bool `protobuf:"varint,1,opt,name=revoked,proto3" json:"revoked,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RevokeSshSessionResponse) Reset() { - *x = RevokeSshSessionResponse{} - mi := &file_openshell_proto_msgTypes[44] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RevokeSshSessionResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RevokeSshSessionResponse) ProtoMessage() {} - -func (x *RevokeSshSessionResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[44] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RevokeSshSessionResponse.ProtoReflect.Descriptor instead. -func (*RevokeSshSessionResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{44} -} - -func (x *RevokeSshSessionResponse) GetRevoked() bool { - if x != nil { - return x.Revoked - } - return false -} - -// Execute command request. -type ExecSandboxRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox id. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // Command and arguments. - Command []string `protobuf:"bytes,2,rep,name=command,proto3" json:"command,omitempty"` - // Optional working directory. - Workdir string `protobuf:"bytes,3,opt,name=workdir,proto3" json:"workdir,omitempty"` - // Optional environment overrides. - Environment map[string]string `protobuf:"bytes,4,rep,name=environment,proto3" json:"environment,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Optional timeout in seconds. 0 means no timeout. - TimeoutSeconds uint32 `protobuf:"varint,5,opt,name=timeout_seconds,json=timeoutSeconds,proto3" json:"timeout_seconds,omitempty"` - // Optional stdin payload passed to the command. - Stdin []byte `protobuf:"bytes,6,opt,name=stdin,proto3" json:"stdin,omitempty"` - // Request a pseudo-terminal for the remote command. - Tty bool `protobuf:"varint,7,opt,name=tty,proto3" json:"tty,omitempty"` - // Initial terminal columns (used when tty=true, 0 = use default). - Cols uint32 `protobuf:"varint,8,opt,name=cols,proto3" json:"cols,omitempty"` - // Initial terminal rows (used when tty=true, 0 = use default). - Rows uint32 `protobuf:"varint,9,opt,name=rows,proto3" json:"rows,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ExecSandboxRequest) Reset() { - *x = ExecSandboxRequest{} - mi := &file_openshell_proto_msgTypes[45] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ExecSandboxRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ExecSandboxRequest) ProtoMessage() {} - -func (x *ExecSandboxRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[45] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ExecSandboxRequest.ProtoReflect.Descriptor instead. -func (*ExecSandboxRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{45} -} - -func (x *ExecSandboxRequest) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *ExecSandboxRequest) GetCommand() []string { - if x != nil { - return x.Command - } - return nil -} - -func (x *ExecSandboxRequest) GetWorkdir() string { - if x != nil { - return x.Workdir - } - return "" -} - -func (x *ExecSandboxRequest) GetEnvironment() map[string]string { - if x != nil { - return x.Environment - } - return nil -} - -func (x *ExecSandboxRequest) GetTimeoutSeconds() uint32 { - if x != nil { - return x.TimeoutSeconds - } - return 0 -} - -func (x *ExecSandboxRequest) GetStdin() []byte { - if x != nil { - return x.Stdin - } - return nil -} - -func (x *ExecSandboxRequest) GetTty() bool { - if x != nil { - return x.Tty - } - return false -} - -func (x *ExecSandboxRequest) GetCols() uint32 { - if x != nil { - return x.Cols - } - return 0 -} - -func (x *ExecSandboxRequest) GetRows() uint32 { - if x != nil { - return x.Rows - } - return 0 -} - -// One stdout chunk from a sandbox exec. -type ExecSandboxStdout struct { - state protoimpl.MessageState `protogen:"open.v1"` - Data []byte `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ExecSandboxStdout) Reset() { - *x = ExecSandboxStdout{} - mi := &file_openshell_proto_msgTypes[46] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ExecSandboxStdout) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ExecSandboxStdout) ProtoMessage() {} - -func (x *ExecSandboxStdout) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[46] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ExecSandboxStdout.ProtoReflect.Descriptor instead. -func (*ExecSandboxStdout) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{46} -} - -func (x *ExecSandboxStdout) GetData() []byte { - if x != nil { - return x.Data - } - return nil -} - -// One stderr chunk from a sandbox exec. -type ExecSandboxStderr struct { - state protoimpl.MessageState `protogen:"open.v1"` - Data []byte `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ExecSandboxStderr) Reset() { - *x = ExecSandboxStderr{} - mi := &file_openshell_proto_msgTypes[47] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ExecSandboxStderr) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ExecSandboxStderr) ProtoMessage() {} - -func (x *ExecSandboxStderr) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[47] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ExecSandboxStderr.ProtoReflect.Descriptor instead. -func (*ExecSandboxStderr) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{47} -} - -func (x *ExecSandboxStderr) GetData() []byte { - if x != nil { - return x.Data - } - return nil -} - -// Final exit status for a sandbox exec. -type ExecSandboxExit struct { - state protoimpl.MessageState `protogen:"open.v1"` - ExitCode int32 `protobuf:"varint,1,opt,name=exit_code,json=exitCode,proto3" json:"exit_code,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ExecSandboxExit) Reset() { - *x = ExecSandboxExit{} - mi := &file_openshell_proto_msgTypes[48] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ExecSandboxExit) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ExecSandboxExit) ProtoMessage() {} - -func (x *ExecSandboxExit) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[48] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ExecSandboxExit.ProtoReflect.Descriptor instead. -func (*ExecSandboxExit) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{48} -} - -func (x *ExecSandboxExit) GetExitCode() int32 { - if x != nil { - return x.ExitCode - } - return 0 -} - -// One event in a sandbox exec stream. -type ExecSandboxEvent struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Payload: - // - // *ExecSandboxEvent_Stdout - // *ExecSandboxEvent_Stderr - // *ExecSandboxEvent_Exit - Payload isExecSandboxEvent_Payload `protobuf_oneof:"payload"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ExecSandboxEvent) Reset() { - *x = ExecSandboxEvent{} - mi := &file_openshell_proto_msgTypes[49] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ExecSandboxEvent) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ExecSandboxEvent) ProtoMessage() {} - -func (x *ExecSandboxEvent) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[49] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ExecSandboxEvent.ProtoReflect.Descriptor instead. -func (*ExecSandboxEvent) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{49} -} - -func (x *ExecSandboxEvent) GetPayload() isExecSandboxEvent_Payload { - if x != nil { - return x.Payload - } - return nil -} - -func (x *ExecSandboxEvent) GetStdout() *ExecSandboxStdout { - if x != nil { - if x, ok := x.Payload.(*ExecSandboxEvent_Stdout); ok { - return x.Stdout - } - } - return nil -} - -func (x *ExecSandboxEvent) GetStderr() *ExecSandboxStderr { - if x != nil { - if x, ok := x.Payload.(*ExecSandboxEvent_Stderr); ok { - return x.Stderr - } - } - return nil -} - -func (x *ExecSandboxEvent) GetExit() *ExecSandboxExit { - if x != nil { - if x, ok := x.Payload.(*ExecSandboxEvent_Exit); ok { - return x.Exit - } - } - return nil -} - -type isExecSandboxEvent_Payload interface { - isExecSandboxEvent_Payload() -} - -type ExecSandboxEvent_Stdout struct { - Stdout *ExecSandboxStdout `protobuf:"bytes,1,opt,name=stdout,proto3,oneof"` -} - -type ExecSandboxEvent_Stderr struct { - Stderr *ExecSandboxStderr `protobuf:"bytes,2,opt,name=stderr,proto3,oneof"` -} - -type ExecSandboxEvent_Exit struct { - Exit *ExecSandboxExit `protobuf:"bytes,3,opt,name=exit,proto3,oneof"` -} - -func (*ExecSandboxEvent_Stdout) isExecSandboxEvent_Payload() {} - -func (*ExecSandboxEvent_Stderr) isExecSandboxEvent_Payload() {} - -func (*ExecSandboxEvent_Exit) isExecSandboxEvent_Payload() {} - -// Initial frame for one TCP forward stream. -type TcpForwardInit struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox id. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // Optional service identifier for audit/correlation. - ServiceId string `protobuf:"bytes,4,opt,name=service_id,json=serviceId,proto3" json:"service_id,omitempty"` - // Target the gateway should request from the supervisor. - // - // Types that are valid to be assigned to Target: - // - // *TcpForwardInit_Ssh - // *TcpForwardInit_Tcp - Target isTcpForwardInit_Target `protobuf_oneof:"target"` - // Optional target-specific authorization token. SSH targets use this as the - // short-lived SSH session token issued by CreateSshSession. - AuthorizationToken string `protobuf:"bytes,7,opt,name=authorization_token,json=authorizationToken,proto3" json:"authorization_token,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *TcpForwardInit) Reset() { - *x = TcpForwardInit{} - mi := &file_openshell_proto_msgTypes[50] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *TcpForwardInit) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*TcpForwardInit) ProtoMessage() {} - -func (x *TcpForwardInit) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[50] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use TcpForwardInit.ProtoReflect.Descriptor instead. -func (*TcpForwardInit) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{50} -} - -func (x *TcpForwardInit) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *TcpForwardInit) GetServiceId() string { - if x != nil { - return x.ServiceId - } - return "" -} - -func (x *TcpForwardInit) GetTarget() isTcpForwardInit_Target { - if x != nil { - return x.Target - } - return nil -} - -func (x *TcpForwardInit) GetSsh() *SshRelayTarget { - if x != nil { - if x, ok := x.Target.(*TcpForwardInit_Ssh); ok { - return x.Ssh - } - } - return nil -} - -func (x *TcpForwardInit) GetTcp() *TcpRelayTarget { - if x != nil { - if x, ok := x.Target.(*TcpForwardInit_Tcp); ok { - return x.Tcp - } - } - return nil -} - -func (x *TcpForwardInit) GetAuthorizationToken() string { - if x != nil { - return x.AuthorizationToken - } - return "" -} - -type isTcpForwardInit_Target interface { - isTcpForwardInit_Target() -} - -type TcpForwardInit_Ssh struct { - Ssh *SshRelayTarget `protobuf:"bytes,5,opt,name=ssh,proto3,oneof"` -} - -type TcpForwardInit_Tcp struct { - Tcp *TcpRelayTarget `protobuf:"bytes,6,opt,name=tcp,proto3,oneof"` -} - -func (*TcpForwardInit_Ssh) isTcpForwardInit_Target() {} - -func (*TcpForwardInit_Tcp) isTcpForwardInit_Target() {} - -// A single frame on the CLI-to-gateway TCP forward stream. -type TcpForwardFrame struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Payload: - // - // *TcpForwardFrame_Init - // *TcpForwardFrame_Data - Payload isTcpForwardFrame_Payload `protobuf_oneof:"payload"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *TcpForwardFrame) Reset() { - *x = TcpForwardFrame{} - mi := &file_openshell_proto_msgTypes[51] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *TcpForwardFrame) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*TcpForwardFrame) ProtoMessage() {} - -func (x *TcpForwardFrame) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[51] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use TcpForwardFrame.ProtoReflect.Descriptor instead. -func (*TcpForwardFrame) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{51} -} - -func (x *TcpForwardFrame) GetPayload() isTcpForwardFrame_Payload { - if x != nil { - return x.Payload - } - return nil -} - -func (x *TcpForwardFrame) GetInit() *TcpForwardInit { - if x != nil { - if x, ok := x.Payload.(*TcpForwardFrame_Init); ok { - return x.Init - } - } - return nil -} - -func (x *TcpForwardFrame) GetData() []byte { - if x != nil { - if x, ok := x.Payload.(*TcpForwardFrame_Data); ok { - return x.Data - } - } - return nil -} - -type isTcpForwardFrame_Payload interface { - isTcpForwardFrame_Payload() -} - -type TcpForwardFrame_Init struct { - Init *TcpForwardInit `protobuf:"bytes,1,opt,name=init,proto3,oneof"` -} - -type TcpForwardFrame_Data struct { - Data []byte `protobuf:"bytes,2,opt,name=data,proto3,oneof"` -} - -func (*TcpForwardFrame_Init) isTcpForwardFrame_Payload() {} - -func (*TcpForwardFrame_Data) isTcpForwardFrame_Payload() {} - -// Client-to-server message for interactive exec. -type ExecSandboxInput struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Payload: - // - // *ExecSandboxInput_Start - // *ExecSandboxInput_Stdin - // *ExecSandboxInput_Resize - Payload isExecSandboxInput_Payload `protobuf_oneof:"payload"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ExecSandboxInput) Reset() { - *x = ExecSandboxInput{} - mi := &file_openshell_proto_msgTypes[52] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ExecSandboxInput) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ExecSandboxInput) ProtoMessage() {} - -func (x *ExecSandboxInput) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[52] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ExecSandboxInput.ProtoReflect.Descriptor instead. -func (*ExecSandboxInput) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{52} -} - -func (x *ExecSandboxInput) GetPayload() isExecSandboxInput_Payload { - if x != nil { - return x.Payload - } - return nil -} - -func (x *ExecSandboxInput) GetStart() *ExecSandboxRequest { - if x != nil { - if x, ok := x.Payload.(*ExecSandboxInput_Start); ok { - return x.Start - } - } - return nil -} - -func (x *ExecSandboxInput) GetStdin() []byte { - if x != nil { - if x, ok := x.Payload.(*ExecSandboxInput_Stdin); ok { - return x.Stdin - } - } - return nil -} - -func (x *ExecSandboxInput) GetResize() *ExecSandboxWindowResize { - if x != nil { - if x, ok := x.Payload.(*ExecSandboxInput_Resize); ok { - return x.Resize - } - } - return nil -} - -type isExecSandboxInput_Payload interface { - isExecSandboxInput_Payload() -} - -type ExecSandboxInput_Start struct { - // First message: exec request metadata. - Start *ExecSandboxRequest `protobuf:"bytes,1,opt,name=start,proto3,oneof"` -} - -type ExecSandboxInput_Stdin struct { - // Subsequent messages: raw stdin bytes. - Stdin []byte `protobuf:"bytes,2,opt,name=stdin,proto3,oneof"` -} - -type ExecSandboxInput_Resize struct { - // Terminal window size change. - Resize *ExecSandboxWindowResize `protobuf:"bytes,3,opt,name=resize,proto3,oneof"` -} - -func (*ExecSandboxInput_Start) isExecSandboxInput_Payload() {} - -func (*ExecSandboxInput_Stdin) isExecSandboxInput_Payload() {} - -func (*ExecSandboxInput_Resize) isExecSandboxInput_Payload() {} - -// Terminal window resize event for interactive exec. -type ExecSandboxWindowResize struct { - state protoimpl.MessageState `protogen:"open.v1"` - Cols uint32 `protobuf:"varint,1,opt,name=cols,proto3" json:"cols,omitempty"` - Rows uint32 `protobuf:"varint,2,opt,name=rows,proto3" json:"rows,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ExecSandboxWindowResize) Reset() { - *x = ExecSandboxWindowResize{} - mi := &file_openshell_proto_msgTypes[53] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ExecSandboxWindowResize) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ExecSandboxWindowResize) ProtoMessage() {} - -func (x *ExecSandboxWindowResize) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[53] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ExecSandboxWindowResize.ProtoReflect.Descriptor instead. -func (*ExecSandboxWindowResize) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{53} -} - -func (x *ExecSandboxWindowResize) GetCols() uint32 { - if x != nil { - return x.Cols - } - return 0 -} - -func (x *ExecSandboxWindowResize) GetRows() uint32 { - if x != nil { - return x.Rows - } - return 0 -} - -// SSH session record stored in persistence. -type SshSession struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Kubernetes-style metadata (id, name, labels, timestamps, resource version). - Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` - // Sandbox id. - SandboxId string `protobuf:"bytes,2,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // Session token. - Token string `protobuf:"bytes,3,opt,name=token,proto3" json:"token,omitempty"` - // Expiry timestamp in milliseconds since epoch. 0 means no expiry - // (backward-compatible default for sessions created before this field existed). - ExpiresAtMs int64 `protobuf:"varint,4,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"` - // Revoked flag. - Revoked bool `protobuf:"varint,5,opt,name=revoked,proto3" json:"revoked,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SshSession) Reset() { - *x = SshSession{} - mi := &file_openshell_proto_msgTypes[54] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SshSession) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SshSession) ProtoMessage() {} - -func (x *SshSession) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[54] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SshSession.ProtoReflect.Descriptor instead. -func (*SshSession) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{54} -} - -func (x *SshSession) GetMetadata() *datamodelv1.ObjectMeta { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *SshSession) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *SshSession) GetToken() string { - if x != nil { - return x.Token - } - return "" -} - -func (x *SshSession) GetExpiresAtMs() int64 { - if x != nil { - return x.ExpiresAtMs - } - return 0 -} - -func (x *SshSession) GetRevoked() bool { - if x != nil { - return x.Revoked - } - return false -} - -// Watch sandbox request. -type WatchSandboxRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox id. - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` - // Stream sandbox status snapshots. - FollowStatus bool `protobuf:"varint,2,opt,name=follow_status,json=followStatus,proto3" json:"follow_status,omitempty"` - // Stream openshell-server process logs correlated to this sandbox. - FollowLogs bool `protobuf:"varint,3,opt,name=follow_logs,json=followLogs,proto3" json:"follow_logs,omitempty"` - // Stream platform events correlated to this sandbox. - FollowEvents bool `protobuf:"varint,4,opt,name=follow_events,json=followEvents,proto3" json:"follow_events,omitempty"` - // Replay the last N log lines (best-effort) before following. - LogTailLines uint32 `protobuf:"varint,5,opt,name=log_tail_lines,json=logTailLines,proto3" json:"log_tail_lines,omitempty"` - // Replay the last N platform events (best-effort) before following. - EventTail uint32 `protobuf:"varint,6,opt,name=event_tail,json=eventTail,proto3" json:"event_tail,omitempty"` - // Stop streaming once the sandbox reaches a terminal phase (READY or ERROR). - StopOnTerminal bool `protobuf:"varint,7,opt,name=stop_on_terminal,json=stopOnTerminal,proto3" json:"stop_on_terminal,omitempty"` - // Only include log lines with timestamp >= this value (milliseconds since epoch). - // 0 means no time filter. Applies to both tail replay and live streaming. - LogSinceMs int64 `protobuf:"varint,8,opt,name=log_since_ms,json=logSinceMs,proto3" json:"log_since_ms,omitempty"` - // Filter by log source (e.g. "gateway", "sandbox"). Empty means all sources. - LogSources []string `protobuf:"bytes,9,rep,name=log_sources,json=logSources,proto3" json:"log_sources,omitempty"` - // Minimum log level to include (e.g. "INFO", "WARN", "ERROR"). Empty means all levels. - LogMinLevel string `protobuf:"bytes,10,opt,name=log_min_level,json=logMinLevel,proto3" json:"log_min_level,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *WatchSandboxRequest) Reset() { - *x = WatchSandboxRequest{} - mi := &file_openshell_proto_msgTypes[55] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *WatchSandboxRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*WatchSandboxRequest) ProtoMessage() {} - -func (x *WatchSandboxRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[55] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use WatchSandboxRequest.ProtoReflect.Descriptor instead. -func (*WatchSandboxRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{55} -} - -func (x *WatchSandboxRequest) GetId() string { - if x != nil { - return x.Id - } - return "" -} - -func (x *WatchSandboxRequest) GetFollowStatus() bool { - if x != nil { - return x.FollowStatus - } - return false -} - -func (x *WatchSandboxRequest) GetFollowLogs() bool { - if x != nil { - return x.FollowLogs - } - return false -} - -func (x *WatchSandboxRequest) GetFollowEvents() bool { - if x != nil { - return x.FollowEvents - } - return false -} - -func (x *WatchSandboxRequest) GetLogTailLines() uint32 { - if x != nil { - return x.LogTailLines - } - return 0 -} - -func (x *WatchSandboxRequest) GetEventTail() uint32 { - if x != nil { - return x.EventTail - } - return 0 -} - -func (x *WatchSandboxRequest) GetStopOnTerminal() bool { - if x != nil { - return x.StopOnTerminal - } - return false -} - -func (x *WatchSandboxRequest) GetLogSinceMs() int64 { - if x != nil { - return x.LogSinceMs - } - return 0 -} - -func (x *WatchSandboxRequest) GetLogSources() []string { - if x != nil { - return x.LogSources - } - return nil -} - -func (x *WatchSandboxRequest) GetLogMinLevel() string { - if x != nil { - return x.LogMinLevel - } - return "" -} - -// One event in a sandbox watch stream. -type SandboxStreamEvent struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Payload: - // - // *SandboxStreamEvent_Sandbox - // *SandboxStreamEvent_Log - // *SandboxStreamEvent_Event - // *SandboxStreamEvent_Warning - // *SandboxStreamEvent_DraftPolicyUpdate - Payload isSandboxStreamEvent_Payload `protobuf_oneof:"payload"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxStreamEvent) Reset() { - *x = SandboxStreamEvent{} - mi := &file_openshell_proto_msgTypes[56] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxStreamEvent) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxStreamEvent) ProtoMessage() {} - -func (x *SandboxStreamEvent) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[56] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxStreamEvent.ProtoReflect.Descriptor instead. -func (*SandboxStreamEvent) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{56} -} - -func (x *SandboxStreamEvent) GetPayload() isSandboxStreamEvent_Payload { - if x != nil { - return x.Payload - } - return nil -} - -func (x *SandboxStreamEvent) GetSandbox() *Sandbox { - if x != nil { - if x, ok := x.Payload.(*SandboxStreamEvent_Sandbox); ok { - return x.Sandbox - } - } - return nil -} - -func (x *SandboxStreamEvent) GetLog() *SandboxLogLine { - if x != nil { - if x, ok := x.Payload.(*SandboxStreamEvent_Log); ok { - return x.Log - } - } - return nil -} - -func (x *SandboxStreamEvent) GetEvent() *PlatformEvent { - if x != nil { - if x, ok := x.Payload.(*SandboxStreamEvent_Event); ok { - return x.Event - } - } - return nil -} - -func (x *SandboxStreamEvent) GetWarning() *SandboxStreamWarning { - if x != nil { - if x, ok := x.Payload.(*SandboxStreamEvent_Warning); ok { - return x.Warning - } - } - return nil -} - -func (x *SandboxStreamEvent) GetDraftPolicyUpdate() *DraftPolicyUpdate { - if x != nil { - if x, ok := x.Payload.(*SandboxStreamEvent_DraftPolicyUpdate); ok { - return x.DraftPolicyUpdate - } - } - return nil -} - -type isSandboxStreamEvent_Payload interface { - isSandboxStreamEvent_Payload() -} - -type SandboxStreamEvent_Sandbox struct { - // Latest sandbox snapshot. - Sandbox *Sandbox `protobuf:"bytes,1,opt,name=sandbox,proto3,oneof"` -} - -type SandboxStreamEvent_Log struct { - // One server log line/event. - Log *SandboxLogLine `protobuf:"bytes,2,opt,name=log,proto3,oneof"` -} - -type SandboxStreamEvent_Event struct { - // One platform event. - Event *PlatformEvent `protobuf:"bytes,3,opt,name=event,proto3,oneof"` -} - -type SandboxStreamEvent_Warning struct { - // Warning from the server (e.g. missed messages due to lag). - Warning *SandboxStreamWarning `protobuf:"bytes,4,opt,name=warning,proto3,oneof"` -} - -type SandboxStreamEvent_DraftPolicyUpdate struct { - // Draft policy update notification. - DraftPolicyUpdate *DraftPolicyUpdate `protobuf:"bytes,5,opt,name=draft_policy_update,json=draftPolicyUpdate,proto3,oneof"` -} - -func (*SandboxStreamEvent_Sandbox) isSandboxStreamEvent_Payload() {} - -func (*SandboxStreamEvent_Log) isSandboxStreamEvent_Payload() {} - -func (*SandboxStreamEvent_Event) isSandboxStreamEvent_Payload() {} - -func (*SandboxStreamEvent_Warning) isSandboxStreamEvent_Payload() {} - -func (*SandboxStreamEvent_DraftPolicyUpdate) isSandboxStreamEvent_Payload() {} - -// Log line correlated to a sandbox. -type SandboxLogLine struct { - state protoimpl.MessageState `protogen:"open.v1"` - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - TimestampMs int64 `protobuf:"varint,2,opt,name=timestamp_ms,json=timestampMs,proto3" json:"timestamp_ms,omitempty"` - Level string `protobuf:"bytes,3,opt,name=level,proto3" json:"level,omitempty"` - Target string `protobuf:"bytes,4,opt,name=target,proto3" json:"target,omitempty"` - Message string `protobuf:"bytes,5,opt,name=message,proto3" json:"message,omitempty"` - // Log source: "gateway" (server-side) or "sandbox" (supervisor). - // Empty is treated as "gateway" for backward compatibility. - Source string `protobuf:"bytes,6,opt,name=source,proto3" json:"source,omitempty"` - // Structured key-value fields from the tracing event (e.g. dst_host, action). - Fields map[string]string `protobuf:"bytes,7,rep,name=fields,proto3" json:"fields,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxLogLine) Reset() { - *x = SandboxLogLine{} - mi := &file_openshell_proto_msgTypes[57] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxLogLine) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxLogLine) ProtoMessage() {} - -func (x *SandboxLogLine) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[57] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxLogLine.ProtoReflect.Descriptor instead. -func (*SandboxLogLine) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{57} -} - -func (x *SandboxLogLine) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *SandboxLogLine) GetTimestampMs() int64 { - if x != nil { - return x.TimestampMs - } - return 0 -} - -func (x *SandboxLogLine) GetLevel() string { - if x != nil { - return x.Level - } - return "" -} - -func (x *SandboxLogLine) GetTarget() string { - if x != nil { - return x.Target - } - return "" -} - -func (x *SandboxLogLine) GetMessage() string { - if x != nil { - return x.Message - } - return "" -} - -func (x *SandboxLogLine) GetSource() string { - if x != nil { - return x.Source - } - return "" -} - -func (x *SandboxLogLine) GetFields() map[string]string { - if x != nil { - return x.Fields - } - return nil -} - -type SandboxStreamWarning struct { - state protoimpl.MessageState `protogen:"open.v1"` - Message string `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxStreamWarning) Reset() { - *x = SandboxStreamWarning{} - mi := &file_openshell_proto_msgTypes[58] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxStreamWarning) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxStreamWarning) ProtoMessage() {} - -func (x *SandboxStreamWarning) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[58] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxStreamWarning.ProtoReflect.Descriptor instead. -func (*SandboxStreamWarning) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{58} -} - -func (x *SandboxStreamWarning) GetMessage() string { - if x != nil { - return x.Message - } - return "" -} - -// Create provider request. -type CreateProviderRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Provider *datamodelv1.Provider `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"` - // Workspace for the provider. Empty defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *CreateProviderRequest) Reset() { - *x = CreateProviderRequest{} - mi := &file_openshell_proto_msgTypes[59] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *CreateProviderRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*CreateProviderRequest) ProtoMessage() {} - -func (x *CreateProviderRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[59] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use CreateProviderRequest.ProtoReflect.Descriptor instead. -func (*CreateProviderRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{59} -} - -func (x *CreateProviderRequest) GetProvider() *datamodelv1.Provider { - if x != nil { - return x.Provider - } - return nil -} - -func (x *CreateProviderRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Get provider request. -type GetProviderRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetProviderRequest) Reset() { - *x = GetProviderRequest{} - mi := &file_openshell_proto_msgTypes[60] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetProviderRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetProviderRequest) ProtoMessage() {} - -func (x *GetProviderRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[60] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetProviderRequest.ProtoReflect.Descriptor instead. -func (*GetProviderRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{60} -} - -func (x *GetProviderRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *GetProviderRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// List providers request. -type ListProvidersRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Limit uint32 `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"` - Offset uint32 `protobuf:"varint,2,opt,name=offset,proto3" json:"offset,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - // List across all workspaces. Mutually exclusive with workspace. - AllWorkspaces bool `protobuf:"varint,4,opt,name=all_workspaces,json=allWorkspaces,proto3" json:"all_workspaces,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListProvidersRequest) Reset() { - *x = ListProvidersRequest{} - mi := &file_openshell_proto_msgTypes[61] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListProvidersRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListProvidersRequest) ProtoMessage() {} - -func (x *ListProvidersRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[61] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListProvidersRequest.ProtoReflect.Descriptor instead. -func (*ListProvidersRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{61} -} - -func (x *ListProvidersRequest) GetLimit() uint32 { - if x != nil { - return x.Limit - } - return 0 -} - -func (x *ListProvidersRequest) GetOffset() uint32 { - if x != nil { - return x.Offset - } - return 0 -} - -func (x *ListProvidersRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -func (x *ListProvidersRequest) GetAllWorkspaces() bool { - if x != nil { - return x.AllWorkspaces - } - return false -} - -// Update provider request. -type UpdateProviderRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Provider *datamodelv1.Provider `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"` - // Optional per-credential expiry timestamps to merge into the provider. - // A zero value removes the expiry for that credential. - CredentialExpiresAtMs map[string]int64 `protobuf:"bytes,2,rep,name=credential_expires_at_ms,json=credentialExpiresAtMs,proto3" json:"credential_expires_at_ms,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *UpdateProviderRequest) Reset() { - *x = UpdateProviderRequest{} - mi := &file_openshell_proto_msgTypes[62] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *UpdateProviderRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*UpdateProviderRequest) ProtoMessage() {} - -func (x *UpdateProviderRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[62] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use UpdateProviderRequest.ProtoReflect.Descriptor instead. -func (*UpdateProviderRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{62} -} - -func (x *UpdateProviderRequest) GetProvider() *datamodelv1.Provider { - if x != nil { - return x.Provider - } - return nil -} - -func (x *UpdateProviderRequest) GetCredentialExpiresAtMs() map[string]int64 { - if x != nil { - return x.CredentialExpiresAtMs - } - return nil -} - -func (x *UpdateProviderRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Delete provider request. -type DeleteProviderRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteProviderRequest) Reset() { - *x = DeleteProviderRequest{} - mi := &file_openshell_proto_msgTypes[63] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteProviderRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteProviderRequest) ProtoMessage() {} - -func (x *DeleteProviderRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[63] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteProviderRequest.ProtoReflect.Descriptor instead. -func (*DeleteProviderRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{63} -} - -func (x *DeleteProviderRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *DeleteProviderRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Provider response. -type ProviderResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Provider *datamodelv1.Provider `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderResponse) Reset() { - *x = ProviderResponse{} - mi := &file_openshell_proto_msgTypes[64] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderResponse) ProtoMessage() {} - -func (x *ProviderResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[64] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderResponse.ProtoReflect.Descriptor instead. -func (*ProviderResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{64} -} - -func (x *ProviderResponse) GetProvider() *datamodelv1.Provider { - if x != nil { - return x.Provider - } - return nil -} - -// List providers response. -type ListProvidersResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Providers []*datamodelv1.Provider `protobuf:"bytes,1,rep,name=providers,proto3" json:"providers,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListProvidersResponse) Reset() { - *x = ListProvidersResponse{} - mi := &file_openshell_proto_msgTypes[65] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListProvidersResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListProvidersResponse) ProtoMessage() {} - -func (x *ListProvidersResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[65] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListProvidersResponse.ProtoReflect.Descriptor instead. -func (*ListProvidersResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{65} -} - -func (x *ListProvidersResponse) GetProviders() []*datamodelv1.Provider { - if x != nil { - return x.Providers - } - return nil -} - -// List provider type profiles request. -type ListProviderProfilesRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Limit uint32 `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"` - Offset uint32 `protobuf:"varint,2,opt,name=offset,proto3" json:"offset,omitempty"` - // Workspace scope. When set, returns workspace-scoped + built-in profiles. - // When empty, returns platform-scoped + built-in only. - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListProviderProfilesRequest) Reset() { - *x = ListProviderProfilesRequest{} - mi := &file_openshell_proto_msgTypes[66] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListProviderProfilesRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListProviderProfilesRequest) ProtoMessage() {} - -func (x *ListProviderProfilesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[66] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListProviderProfilesRequest.ProtoReflect.Descriptor instead. -func (*ListProviderProfilesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{66} -} - -func (x *ListProviderProfilesRequest) GetLimit() uint32 { - if x != nil { - return x.Limit - } - return 0 -} - -func (x *ListProviderProfilesRequest) GetOffset() uint32 { - if x != nil { - return x.Offset - } - return 0 -} - -func (x *ListProviderProfilesRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Fetch provider type profile request. -type GetProviderProfileRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` - // Workspace scope for two-tier profile resolution. When set, checks - // workspace-scoped profiles first, then platform-scoped, then built-in. - // When empty, checks platform-scoped then built-in only. - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetProviderProfileRequest) Reset() { - *x = GetProviderProfileRequest{} - mi := &file_openshell_proto_msgTypes[67] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetProviderProfileRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetProviderProfileRequest) ProtoMessage() {} - -func (x *GetProviderProfileRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[67] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetProviderProfileRequest.ProtoReflect.Descriptor instead. -func (*GetProviderProfileRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{67} -} - -func (x *GetProviderProfileRequest) GetId() string { - if x != nil { - return x.Id - } - return "" -} - -func (x *GetProviderProfileRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Provider profile payload with optional source metadata for diagnostics. -type ProviderProfileImportItem struct { - state protoimpl.MessageState `protogen:"open.v1"` - Profile *ProviderProfile `protobuf:"bytes,1,opt,name=profile,proto3" json:"profile,omitempty"` - Source string `protobuf:"bytes,2,opt,name=source,proto3" json:"source,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderProfileImportItem) Reset() { - *x = ProviderProfileImportItem{} - mi := &file_openshell_proto_msgTypes[68] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderProfileImportItem) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderProfileImportItem) ProtoMessage() {} - -func (x *ProviderProfileImportItem) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[68] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderProfileImportItem.ProtoReflect.Descriptor instead. -func (*ProviderProfileImportItem) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{68} -} - -func (x *ProviderProfileImportItem) GetProfile() *ProviderProfile { - if x != nil { - return x.Profile - } - return nil -} - -func (x *ProviderProfileImportItem) GetSource() string { - if x != nil { - return x.Source - } - return "" -} - -// Provider profile validation diagnostic. -type ProviderProfileDiagnostic struct { - state protoimpl.MessageState `protogen:"open.v1"` - Source string `protobuf:"bytes,1,opt,name=source,proto3" json:"source,omitempty"` - ProfileId string `protobuf:"bytes,2,opt,name=profile_id,json=profileId,proto3" json:"profile_id,omitempty"` - Field string `protobuf:"bytes,3,opt,name=field,proto3" json:"field,omitempty"` - Message string `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"` - Severity string `protobuf:"bytes,5,opt,name=severity,proto3" json:"severity,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderProfileDiagnostic) Reset() { - *x = ProviderProfileDiagnostic{} - mi := &file_openshell_proto_msgTypes[69] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderProfileDiagnostic) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderProfileDiagnostic) ProtoMessage() {} - -func (x *ProviderProfileDiagnostic) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[69] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderProfileDiagnostic.ProtoReflect.Descriptor instead. -func (*ProviderProfileDiagnostic) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{69} -} - -func (x *ProviderProfileDiagnostic) GetSource() string { - if x != nil { - return x.Source - } - return "" -} - -func (x *ProviderProfileDiagnostic) GetProfileId() string { - if x != nil { - return x.ProfileId - } - return "" -} - -func (x *ProviderProfileDiagnostic) GetField() string { - if x != nil { - return x.Field - } - return "" -} - -func (x *ProviderProfileDiagnostic) GetMessage() string { - if x != nil { - return x.Message - } - return "" -} - -func (x *ProviderProfileDiagnostic) GetSeverity() string { - if x != nil { - return x.Severity - } - return "" -} - -// Endpoint selector for token grant audience overrides. -type ProviderCredentialTokenGrantAudienceOverride struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Optional: endpoint host selector. If omitted, inherits the profile endpoint host. - Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"` - // Optional: endpoint port selector. If omitted, matches the expanded profile endpoint port. - Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"` - // Optional: endpoint path selector. If omitted, inherits the profile endpoint path. - Path string `protobuf:"bytes,3,opt,name=path,proto3" json:"path,omitempty"` - // Resource audience to request for matching endpoints. - Audience string `protobuf:"bytes,4,opt,name=audience,proto3" json:"audience,omitempty"` - // Optional: OAuth2 scopes to request. If omitted, inherits the token grant scopes. - Scopes []string `protobuf:"bytes,5,rep,name=scopes,proto3" json:"scopes,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderCredentialTokenGrantAudienceOverride) Reset() { - *x = ProviderCredentialTokenGrantAudienceOverride{} - mi := &file_openshell_proto_msgTypes[70] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderCredentialTokenGrantAudienceOverride) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderCredentialTokenGrantAudienceOverride) ProtoMessage() {} - -func (x *ProviderCredentialTokenGrantAudienceOverride) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[70] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderCredentialTokenGrantAudienceOverride.ProtoReflect.Descriptor instead. -func (*ProviderCredentialTokenGrantAudienceOverride) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{70} -} - -func (x *ProviderCredentialTokenGrantAudienceOverride) GetHost() string { - if x != nil { - return x.Host - } - return "" -} - -func (x *ProviderCredentialTokenGrantAudienceOverride) GetPort() uint32 { - if x != nil { - return x.Port - } - return 0 -} - -func (x *ProviderCredentialTokenGrantAudienceOverride) GetPath() string { - if x != nil { - return x.Path - } - return "" -} - -func (x *ProviderCredentialTokenGrantAudienceOverride) GetAudience() string { - if x != nil { - return x.Audience - } - return "" -} - -func (x *ProviderCredentialTokenGrantAudienceOverride) GetScopes() []string { - if x != nil { - return x.Scopes - } - return nil -} - -// Provider credential token grant configuration. -// When present, the credential is obtained dynamically via OAuth2 grant when needed. -type ProviderCredentialTokenGrant struct { - state protoimpl.MessageState `protogen:"open.v1"` - // OAuth2 token endpoint URL (e.g., https://keycloak.example.com/realms/my-realm/protocol/openid-connect/token) - TokenEndpoint string `protobuf:"bytes,1,opt,name=token_endpoint,json=tokenEndpoint,proto3" json:"token_endpoint,omitempty"` - // Optional: default resource audience to request from the token service - Audience string `protobuf:"bytes,2,opt,name=audience,proto3" json:"audience,omitempty"` - // Optional: audience to request when fetching the JWT-SVID from SPIRE. - // If omitted, the sandbox derives this from token_endpoint. - JwtSvidAudience string `protobuf:"bytes,6,opt,name=jwt_svid_audience,json=jwtSvidAudience,proto3" json:"jwt_svid_audience,omitempty"` - // Optional: OAuth2 scopes to request - Scopes []string `protobuf:"bytes,3,rep,name=scopes,proto3" json:"scopes,omitempty"` - // Optional: override token cache TTL (seconds) - // If 0 or omitted, use expires_in from token response - CacheTtlSeconds int64 `protobuf:"varint,4,opt,name=cache_ttl_seconds,json=cacheTtlSeconds,proto3" json:"cache_ttl_seconds,omitempty"` - // Optional: endpoint-specific resource audience overrides. - AudienceOverrides []*ProviderCredentialTokenGrantAudienceOverride `protobuf:"bytes,5,rep,name=audience_overrides,json=audienceOverrides,proto3" json:"audience_overrides,omitempty"` - // Optional: OAuth2 client_assertion_type value. If omitted, OpenShell uses - // urn:ietf:params:oauth:client-assertion-type:jwt-bearer. - ClientAssertionType string `protobuf:"bytes,7,opt,name=client_assertion_type,json=clientAssertionType,proto3" json:"client_assertion_type,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderCredentialTokenGrant) Reset() { - *x = ProviderCredentialTokenGrant{} - mi := &file_openshell_proto_msgTypes[71] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderCredentialTokenGrant) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderCredentialTokenGrant) ProtoMessage() {} - -func (x *ProviderCredentialTokenGrant) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[71] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderCredentialTokenGrant.ProtoReflect.Descriptor instead. -func (*ProviderCredentialTokenGrant) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{71} -} - -func (x *ProviderCredentialTokenGrant) GetTokenEndpoint() string { - if x != nil { - return x.TokenEndpoint - } - return "" -} - -func (x *ProviderCredentialTokenGrant) GetAudience() string { - if x != nil { - return x.Audience - } - return "" -} - -func (x *ProviderCredentialTokenGrant) GetJwtSvidAudience() string { - if x != nil { - return x.JwtSvidAudience - } - return "" -} - -func (x *ProviderCredentialTokenGrant) GetScopes() []string { - if x != nil { - return x.Scopes - } - return nil -} - -func (x *ProviderCredentialTokenGrant) GetCacheTtlSeconds() int64 { - if x != nil { - return x.CacheTtlSeconds - } - return 0 -} - -func (x *ProviderCredentialTokenGrant) GetAudienceOverrides() []*ProviderCredentialTokenGrantAudienceOverride { - if x != nil { - return x.AudienceOverrides - } - return nil -} - -func (x *ProviderCredentialTokenGrant) GetClientAssertionType() string { - if x != nil { - return x.ClientAssertionType - } - return "" -} - -// Provider credential declaration. -type ProviderProfileCredential struct { - state protoimpl.MessageState `protogen:"open.v1"` - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - Description string `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"` - EnvVars []string `protobuf:"bytes,3,rep,name=env_vars,json=envVars,proto3" json:"env_vars,omitempty"` - Required bool `protobuf:"varint,4,opt,name=required,proto3" json:"required,omitempty"` - AuthStyle string `protobuf:"bytes,5,opt,name=auth_style,json=authStyle,proto3" json:"auth_style,omitempty"` - HeaderName string `protobuf:"bytes,6,opt,name=header_name,json=headerName,proto3" json:"header_name,omitempty"` - QueryParam string `protobuf:"bytes,7,opt,name=query_param,json=queryParam,proto3" json:"query_param,omitempty"` - Refresh *ProviderCredentialRefresh `protobuf:"bytes,8,opt,name=refresh,proto3" json:"refresh,omitempty"` - PathTemplate string `protobuf:"bytes,9,opt,name=path_template,json=pathTemplate,proto3" json:"path_template,omitempty"` - TokenGrant *ProviderCredentialTokenGrant `protobuf:"bytes,10,opt,name=token_grant,json=tokenGrant,proto3" json:"token_grant,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderProfileCredential) Reset() { - *x = ProviderProfileCredential{} - mi := &file_openshell_proto_msgTypes[72] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderProfileCredential) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderProfileCredential) ProtoMessage() {} - -func (x *ProviderProfileCredential) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[72] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderProfileCredential.ProtoReflect.Descriptor instead. -func (*ProviderProfileCredential) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{72} -} - -func (x *ProviderProfileCredential) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *ProviderProfileCredential) GetDescription() string { - if x != nil { - return x.Description - } - return "" -} - -func (x *ProviderProfileCredential) GetEnvVars() []string { - if x != nil { - return x.EnvVars - } - return nil -} - -func (x *ProviderProfileCredential) GetRequired() bool { - if x != nil { - return x.Required - } - return false -} - -func (x *ProviderProfileCredential) GetAuthStyle() string { - if x != nil { - return x.AuthStyle - } - return "" -} - -func (x *ProviderProfileCredential) GetHeaderName() string { - if x != nil { - return x.HeaderName - } - return "" -} - -func (x *ProviderProfileCredential) GetQueryParam() string { - if x != nil { - return x.QueryParam - } - return "" -} - -func (x *ProviderProfileCredential) GetRefresh() *ProviderCredentialRefresh { - if x != nil { - return x.Refresh - } - return nil -} - -func (x *ProviderProfileCredential) GetPathTemplate() string { - if x != nil { - return x.PathTemplate - } - return "" -} - -func (x *ProviderProfileCredential) GetTokenGrant() *ProviderCredentialTokenGrant { - if x != nil { - return x.TokenGrant - } - return nil -} - -type ProviderCredentialRefreshMaterial struct { - state protoimpl.MessageState `protogen:"open.v1"` - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - Description string `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"` - Required bool `protobuf:"varint,3,opt,name=required,proto3" json:"required,omitempty"` - Secret bool `protobuf:"varint,4,opt,name=secret,proto3" json:"secret,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderCredentialRefreshMaterial) Reset() { - *x = ProviderCredentialRefreshMaterial{} - mi := &file_openshell_proto_msgTypes[73] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderCredentialRefreshMaterial) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderCredentialRefreshMaterial) ProtoMessage() {} - -func (x *ProviderCredentialRefreshMaterial) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[73] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderCredentialRefreshMaterial.ProtoReflect.Descriptor instead. -func (*ProviderCredentialRefreshMaterial) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{73} -} - -func (x *ProviderCredentialRefreshMaterial) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *ProviderCredentialRefreshMaterial) GetDescription() string { - if x != nil { - return x.Description - } - return "" -} - -func (x *ProviderCredentialRefreshMaterial) GetRequired() bool { - if x != nil { - return x.Required - } - return false -} - -func (x *ProviderCredentialRefreshMaterial) GetSecret() bool { - if x != nil { - return x.Secret - } - return false -} - -// Declares that a single refresh operation mints more than one credential. -// The refresh is attached to a primary credential; each additional output -// maps a strategy-defined semantic output id to a sibling credential whose -// env_vars receive the minted value. -type ProviderCredentialRefreshOutput struct { - state protoimpl.MessageState `protogen:"open.v1"` - Output string `protobuf:"bytes,1,opt,name=output,proto3" json:"output,omitempty"` // strategy-defined semantic output id (e.g. "session_token") - Credential string `protobuf:"bytes,2,opt,name=credential,proto3" json:"credential,omitempty"` // sibling credential name whose env_vars receive this output - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderCredentialRefreshOutput) Reset() { - *x = ProviderCredentialRefreshOutput{} - mi := &file_openshell_proto_msgTypes[74] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderCredentialRefreshOutput) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderCredentialRefreshOutput) ProtoMessage() {} - -func (x *ProviderCredentialRefreshOutput) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[74] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderCredentialRefreshOutput.ProtoReflect.Descriptor instead. -func (*ProviderCredentialRefreshOutput) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{74} -} - -func (x *ProviderCredentialRefreshOutput) GetOutput() string { - if x != nil { - return x.Output - } - return "" -} - -func (x *ProviderCredentialRefreshOutput) GetCredential() string { - if x != nil { - return x.Credential - } - return "" -} - -type ProviderCredentialRefresh struct { - state protoimpl.MessageState `protogen:"open.v1"` - Strategy ProviderCredentialRefreshStrategy `protobuf:"varint,1,opt,name=strategy,proto3,enum=openshell.v1.ProviderCredentialRefreshStrategy" json:"strategy,omitempty"` - TokenUrl string `protobuf:"bytes,2,opt,name=token_url,json=tokenUrl,proto3" json:"token_url,omitempty"` - Scopes []string `protobuf:"bytes,3,rep,name=scopes,proto3" json:"scopes,omitempty"` - RefreshBeforeSeconds int64 `protobuf:"varint,4,opt,name=refresh_before_seconds,json=refreshBeforeSeconds,proto3" json:"refresh_before_seconds,omitempty"` - MaxLifetimeSeconds int64 `protobuf:"varint,5,opt,name=max_lifetime_seconds,json=maxLifetimeSeconds,proto3" json:"max_lifetime_seconds,omitempty"` - Material []*ProviderCredentialRefreshMaterial `protobuf:"bytes,6,rep,name=material,proto3" json:"material,omitempty"` - AdditionalOutputs []*ProviderCredentialRefreshOutput `protobuf:"bytes,7,rep,name=additional_outputs,json=additionalOutputs,proto3" json:"additional_outputs,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderCredentialRefresh) Reset() { - *x = ProviderCredentialRefresh{} - mi := &file_openshell_proto_msgTypes[75] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderCredentialRefresh) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderCredentialRefresh) ProtoMessage() {} - -func (x *ProviderCredentialRefresh) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[75] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderCredentialRefresh.ProtoReflect.Descriptor instead. -func (*ProviderCredentialRefresh) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{75} -} - -func (x *ProviderCredentialRefresh) GetStrategy() ProviderCredentialRefreshStrategy { - if x != nil { - return x.Strategy - } - return ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED -} - -func (x *ProviderCredentialRefresh) GetTokenUrl() string { - if x != nil { - return x.TokenUrl - } - return "" -} - -func (x *ProviderCredentialRefresh) GetScopes() []string { - if x != nil { - return x.Scopes - } - return nil -} - -func (x *ProviderCredentialRefresh) GetRefreshBeforeSeconds() int64 { - if x != nil { - return x.RefreshBeforeSeconds - } - return 0 -} - -func (x *ProviderCredentialRefresh) GetMaxLifetimeSeconds() int64 { - if x != nil { - return x.MaxLifetimeSeconds - } - return 0 -} - -func (x *ProviderCredentialRefresh) GetMaterial() []*ProviderCredentialRefreshMaterial { - if x != nil { - return x.Material - } - return nil -} - -func (x *ProviderCredentialRefresh) GetAdditionalOutputs() []*ProviderCredentialRefreshOutput { - if x != nil { - return x.AdditionalOutputs - } - return nil -} - -type ProviderCredentialRefreshStatus struct { - state protoimpl.MessageState `protogen:"open.v1"` - ProviderName string `protobuf:"bytes,1,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"` - ProviderId string `protobuf:"bytes,2,opt,name=provider_id,json=providerId,proto3" json:"provider_id,omitempty"` - CredentialKey string `protobuf:"bytes,3,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"` - Strategy ProviderCredentialRefreshStrategy `protobuf:"varint,4,opt,name=strategy,proto3,enum=openshell.v1.ProviderCredentialRefreshStrategy" json:"strategy,omitempty"` - Status string `protobuf:"bytes,5,opt,name=status,proto3" json:"status,omitempty"` - ExpiresAtMs int64 `protobuf:"varint,6,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"` - NextRefreshAtMs int64 `protobuf:"varint,7,opt,name=next_refresh_at_ms,json=nextRefreshAtMs,proto3" json:"next_refresh_at_ms,omitempty"` - LastRefreshAtMs int64 `protobuf:"varint,8,opt,name=last_refresh_at_ms,json=lastRefreshAtMs,proto3" json:"last_refresh_at_ms,omitempty"` - LastError string `protobuf:"bytes,9,opt,name=last_error,json=lastError,proto3" json:"last_error,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderCredentialRefreshStatus) Reset() { - *x = ProviderCredentialRefreshStatus{} - mi := &file_openshell_proto_msgTypes[76] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderCredentialRefreshStatus) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderCredentialRefreshStatus) ProtoMessage() {} - -func (x *ProviderCredentialRefreshStatus) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[76] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderCredentialRefreshStatus.ProtoReflect.Descriptor instead. -func (*ProviderCredentialRefreshStatus) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{76} -} - -func (x *ProviderCredentialRefreshStatus) GetProviderName() string { - if x != nil { - return x.ProviderName - } - return "" -} - -func (x *ProviderCredentialRefreshStatus) GetProviderId() string { - if x != nil { - return x.ProviderId - } - return "" -} - -func (x *ProviderCredentialRefreshStatus) GetCredentialKey() string { - if x != nil { - return x.CredentialKey - } - return "" -} - -func (x *ProviderCredentialRefreshStatus) GetStrategy() ProviderCredentialRefreshStrategy { - if x != nil { - return x.Strategy - } - return ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED -} - -func (x *ProviderCredentialRefreshStatus) GetStatus() string { - if x != nil { - return x.Status - } - return "" -} - -func (x *ProviderCredentialRefreshStatus) GetExpiresAtMs() int64 { - if x != nil { - return x.ExpiresAtMs - } - return 0 -} - -func (x *ProviderCredentialRefreshStatus) GetNextRefreshAtMs() int64 { - if x != nil { - return x.NextRefreshAtMs - } - return 0 -} - -func (x *ProviderCredentialRefreshStatus) GetLastRefreshAtMs() int64 { - if x != nil { - return x.LastRefreshAtMs - } - return 0 -} - -func (x *ProviderCredentialRefreshStatus) GetLastError() string { - if x != nil { - return x.LastError - } - return "" -} - -// Provider profile local discovery declaration. -type ProviderProfileDiscovery struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Credential names from ProviderProfile.credentials eligible for local discovery. - Credentials []string `protobuf:"bytes,1,rep,name=credentials,proto3" json:"credentials,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderProfileDiscovery) Reset() { - *x = ProviderProfileDiscovery{} - mi := &file_openshell_proto_msgTypes[77] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderProfileDiscovery) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderProfileDiscovery) ProtoMessage() {} - -func (x *ProviderProfileDiscovery) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[77] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderProfileDiscovery.ProtoReflect.Descriptor instead. -func (*ProviderProfileDiscovery) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{77} -} - -func (x *ProviderProfileDiscovery) GetCredentials() []string { - if x != nil { - return x.Credentials - } - return nil -} - -type StoredProviderCredentialRefreshState struct { - state protoimpl.MessageState `protogen:"open.v1"` - Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` - ProviderId string `protobuf:"bytes,2,opt,name=provider_id,json=providerId,proto3" json:"provider_id,omitempty"` - ProviderName string `protobuf:"bytes,3,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"` - CredentialKey string `protobuf:"bytes,4,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"` - Strategy ProviderCredentialRefreshStrategy `protobuf:"varint,5,opt,name=strategy,proto3,enum=openshell.v1.ProviderCredentialRefreshStrategy" json:"strategy,omitempty"` - Material map[string]string `protobuf:"bytes,6,rep,name=material,proto3" json:"material,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - SecretMaterialKeys []string `protobuf:"bytes,7,rep,name=secret_material_keys,json=secretMaterialKeys,proto3" json:"secret_material_keys,omitempty"` - ExpiresAtMs int64 `protobuf:"varint,8,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"` - NextRefreshAtMs int64 `protobuf:"varint,9,opt,name=next_refresh_at_ms,json=nextRefreshAtMs,proto3" json:"next_refresh_at_ms,omitempty"` - LastRefreshAtMs int64 `protobuf:"varint,10,opt,name=last_refresh_at_ms,json=lastRefreshAtMs,proto3" json:"last_refresh_at_ms,omitempty"` - Status string `protobuf:"bytes,11,opt,name=status,proto3" json:"status,omitempty"` - LastError string `protobuf:"bytes,12,opt,name=last_error,json=lastError,proto3" json:"last_error,omitempty"` - TokenUrl string `protobuf:"bytes,13,opt,name=token_url,json=tokenUrl,proto3" json:"token_url,omitempty"` - Scopes []string `protobuf:"bytes,14,rep,name=scopes,proto3" json:"scopes,omitempty"` - RefreshBeforeSeconds int64 `protobuf:"varint,15,opt,name=refresh_before_seconds,json=refreshBeforeSeconds,proto3" json:"refresh_before_seconds,omitempty"` - MaxLifetimeSeconds int64 `protobuf:"varint,16,opt,name=max_lifetime_seconds,json=maxLifetimeSeconds,proto3" json:"max_lifetime_seconds,omitempty"` - // Resolved mapping of strategy-defined output id -> concrete env key, pinned - // at configure time from the profile's additional_outputs. Read by minting, - // collision reservation, and env-key surfacing so later profile edits cannot - // silently redirect writes. - AdditionalOutputKeys map[string]string `protobuf:"bytes,17,rep,name=additional_output_keys,json=additionalOutputKeys,proto3" json:"additional_output_keys,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *StoredProviderCredentialRefreshState) Reset() { - *x = StoredProviderCredentialRefreshState{} - mi := &file_openshell_proto_msgTypes[78] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *StoredProviderCredentialRefreshState) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*StoredProviderCredentialRefreshState) ProtoMessage() {} - -func (x *StoredProviderCredentialRefreshState) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[78] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use StoredProviderCredentialRefreshState.ProtoReflect.Descriptor instead. -func (*StoredProviderCredentialRefreshState) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{78} -} - -func (x *StoredProviderCredentialRefreshState) GetMetadata() *datamodelv1.ObjectMeta { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *StoredProviderCredentialRefreshState) GetProviderId() string { - if x != nil { - return x.ProviderId - } - return "" -} - -func (x *StoredProviderCredentialRefreshState) GetProviderName() string { - if x != nil { - return x.ProviderName - } - return "" -} - -func (x *StoredProviderCredentialRefreshState) GetCredentialKey() string { - if x != nil { - return x.CredentialKey - } - return "" -} - -func (x *StoredProviderCredentialRefreshState) GetStrategy() ProviderCredentialRefreshStrategy { - if x != nil { - return x.Strategy - } - return ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED -} - -func (x *StoredProviderCredentialRefreshState) GetMaterial() map[string]string { - if x != nil { - return x.Material - } - return nil -} - -func (x *StoredProviderCredentialRefreshState) GetSecretMaterialKeys() []string { - if x != nil { - return x.SecretMaterialKeys - } - return nil -} - -func (x *StoredProviderCredentialRefreshState) GetExpiresAtMs() int64 { - if x != nil { - return x.ExpiresAtMs - } - return 0 -} - -func (x *StoredProviderCredentialRefreshState) GetNextRefreshAtMs() int64 { - if x != nil { - return x.NextRefreshAtMs - } - return 0 -} - -func (x *StoredProviderCredentialRefreshState) GetLastRefreshAtMs() int64 { - if x != nil { - return x.LastRefreshAtMs - } - return 0 -} - -func (x *StoredProviderCredentialRefreshState) GetStatus() string { - if x != nil { - return x.Status - } - return "" -} - -func (x *StoredProviderCredentialRefreshState) GetLastError() string { - if x != nil { - return x.LastError - } - return "" -} - -func (x *StoredProviderCredentialRefreshState) GetTokenUrl() string { - if x != nil { - return x.TokenUrl - } - return "" -} - -func (x *StoredProviderCredentialRefreshState) GetScopes() []string { - if x != nil { - return x.Scopes - } - return nil -} - -func (x *StoredProviderCredentialRefreshState) GetRefreshBeforeSeconds() int64 { - if x != nil { - return x.RefreshBeforeSeconds - } - return 0 -} - -func (x *StoredProviderCredentialRefreshState) GetMaxLifetimeSeconds() int64 { - if x != nil { - return x.MaxLifetimeSeconds - } - return 0 -} - -func (x *StoredProviderCredentialRefreshState) GetAdditionalOutputKeys() map[string]string { - if x != nil { - return x.AdditionalOutputKeys - } - return nil -} - -type GetProviderRefreshStatusRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Provider string `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"` - CredentialKey string `protobuf:"bytes,2,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetProviderRefreshStatusRequest) Reset() { - *x = GetProviderRefreshStatusRequest{} - mi := &file_openshell_proto_msgTypes[79] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetProviderRefreshStatusRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetProviderRefreshStatusRequest) ProtoMessage() {} - -func (x *GetProviderRefreshStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[79] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetProviderRefreshStatusRequest.ProtoReflect.Descriptor instead. -func (*GetProviderRefreshStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{79} -} - -func (x *GetProviderRefreshStatusRequest) GetProvider() string { - if x != nil { - return x.Provider - } - return "" -} - -func (x *GetProviderRefreshStatusRequest) GetCredentialKey() string { - if x != nil { - return x.CredentialKey - } - return "" -} - -func (x *GetProviderRefreshStatusRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type GetProviderRefreshStatusResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Credentials []*ProviderCredentialRefreshStatus `protobuf:"bytes,1,rep,name=credentials,proto3" json:"credentials,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetProviderRefreshStatusResponse) Reset() { - *x = GetProviderRefreshStatusResponse{} - mi := &file_openshell_proto_msgTypes[80] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetProviderRefreshStatusResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetProviderRefreshStatusResponse) ProtoMessage() {} - -func (x *GetProviderRefreshStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[80] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetProviderRefreshStatusResponse.ProtoReflect.Descriptor instead. -func (*GetProviderRefreshStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{80} -} - -func (x *GetProviderRefreshStatusResponse) GetCredentials() []*ProviderCredentialRefreshStatus { - if x != nil { - return x.Credentials - } - return nil -} - -type ConfigureProviderRefreshRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Provider string `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"` - CredentialKey string `protobuf:"bytes,2,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"` - Strategy ProviderCredentialRefreshStrategy `protobuf:"varint,3,opt,name=strategy,proto3,enum=openshell.v1.ProviderCredentialRefreshStrategy" json:"strategy,omitempty"` - Material map[string]string `protobuf:"bytes,4,rep,name=material,proto3" json:"material,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - SecretMaterialKeys []string `protobuf:"bytes,5,rep,name=secret_material_keys,json=secretMaterialKeys,proto3" json:"secret_material_keys,omitempty"` - ExpiresAtMs *int64 `protobuf:"varint,6,opt,name=expires_at_ms,json=expiresAtMs,proto3,oneof" json:"expires_at_ms,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,7,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ConfigureProviderRefreshRequest) Reset() { - *x = ConfigureProviderRefreshRequest{} - mi := &file_openshell_proto_msgTypes[81] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ConfigureProviderRefreshRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ConfigureProviderRefreshRequest) ProtoMessage() {} - -func (x *ConfigureProviderRefreshRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[81] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ConfigureProviderRefreshRequest.ProtoReflect.Descriptor instead. -func (*ConfigureProviderRefreshRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{81} -} - -func (x *ConfigureProviderRefreshRequest) GetProvider() string { - if x != nil { - return x.Provider - } - return "" -} - -func (x *ConfigureProviderRefreshRequest) GetCredentialKey() string { - if x != nil { - return x.CredentialKey - } - return "" -} - -func (x *ConfigureProviderRefreshRequest) GetStrategy() ProviderCredentialRefreshStrategy { - if x != nil { - return x.Strategy - } - return ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED -} - -func (x *ConfigureProviderRefreshRequest) GetMaterial() map[string]string { - if x != nil { - return x.Material - } - return nil -} - -func (x *ConfigureProviderRefreshRequest) GetSecretMaterialKeys() []string { - if x != nil { - return x.SecretMaterialKeys - } - return nil -} - -func (x *ConfigureProviderRefreshRequest) GetExpiresAtMs() int64 { - if x != nil && x.ExpiresAtMs != nil { - return *x.ExpiresAtMs - } - return 0 -} - -func (x *ConfigureProviderRefreshRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type ConfigureProviderRefreshResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Status *ProviderCredentialRefreshStatus `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ConfigureProviderRefreshResponse) Reset() { - *x = ConfigureProviderRefreshResponse{} - mi := &file_openshell_proto_msgTypes[82] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ConfigureProviderRefreshResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ConfigureProviderRefreshResponse) ProtoMessage() {} - -func (x *ConfigureProviderRefreshResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[82] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ConfigureProviderRefreshResponse.ProtoReflect.Descriptor instead. -func (*ConfigureProviderRefreshResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{82} -} - -func (x *ConfigureProviderRefreshResponse) GetStatus() *ProviderCredentialRefreshStatus { - if x != nil { - return x.Status - } - return nil -} - -type RotateProviderCredentialRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Provider string `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"` - CredentialKey string `protobuf:"bytes,2,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RotateProviderCredentialRequest) Reset() { - *x = RotateProviderCredentialRequest{} - mi := &file_openshell_proto_msgTypes[83] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RotateProviderCredentialRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RotateProviderCredentialRequest) ProtoMessage() {} - -func (x *RotateProviderCredentialRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[83] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RotateProviderCredentialRequest.ProtoReflect.Descriptor instead. -func (*RotateProviderCredentialRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{83} -} - -func (x *RotateProviderCredentialRequest) GetProvider() string { - if x != nil { - return x.Provider - } - return "" -} - -func (x *RotateProviderCredentialRequest) GetCredentialKey() string { - if x != nil { - return x.CredentialKey - } - return "" -} - -func (x *RotateProviderCredentialRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type RotateProviderCredentialResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Status *ProviderCredentialRefreshStatus `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RotateProviderCredentialResponse) Reset() { - *x = RotateProviderCredentialResponse{} - mi := &file_openshell_proto_msgTypes[84] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RotateProviderCredentialResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RotateProviderCredentialResponse) ProtoMessage() {} - -func (x *RotateProviderCredentialResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[84] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RotateProviderCredentialResponse.ProtoReflect.Descriptor instead. -func (*RotateProviderCredentialResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{84} -} - -func (x *RotateProviderCredentialResponse) GetStatus() *ProviderCredentialRefreshStatus { - if x != nil { - return x.Status - } - return nil -} - -type DeleteProviderRefreshRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Provider string `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"` - CredentialKey string `protobuf:"bytes,2,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteProviderRefreshRequest) Reset() { - *x = DeleteProviderRefreshRequest{} - mi := &file_openshell_proto_msgTypes[85] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteProviderRefreshRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteProviderRefreshRequest) ProtoMessage() {} - -func (x *DeleteProviderRefreshRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[85] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteProviderRefreshRequest.ProtoReflect.Descriptor instead. -func (*DeleteProviderRefreshRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{85} -} - -func (x *DeleteProviderRefreshRequest) GetProvider() string { - if x != nil { - return x.Provider - } - return "" -} - -func (x *DeleteProviderRefreshRequest) GetCredentialKey() string { - if x != nil { - return x.CredentialKey - } - return "" -} - -func (x *DeleteProviderRefreshRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type DeleteProviderRefreshResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Deleted bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteProviderRefreshResponse) Reset() { - *x = DeleteProviderRefreshResponse{} - mi := &file_openshell_proto_msgTypes[86] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteProviderRefreshResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteProviderRefreshResponse) ProtoMessage() {} - -func (x *DeleteProviderRefreshResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[86] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteProviderRefreshResponse.ProtoReflect.Descriptor instead. -func (*DeleteProviderRefreshResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{86} -} - -func (x *DeleteProviderRefreshResponse) GetDeleted() bool { - if x != nil { - return x.Deleted - } - return false -} - -// Provider type profile metadata exposed to clients. -type ProviderProfile struct { - state protoimpl.MessageState `protogen:"open.v1"` - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` - DisplayName string `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"` - Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"` - Category ProviderProfileCategory `protobuf:"varint,4,opt,name=category,proto3,enum=openshell.v1.ProviderProfileCategory" json:"category,omitempty"` - Credentials []*ProviderProfileCredential `protobuf:"bytes,5,rep,name=credentials,proto3" json:"credentials,omitempty"` - Endpoints []*sandboxv1.NetworkEndpoint `protobuf:"bytes,6,rep,name=endpoints,proto3" json:"endpoints,omitempty"` - Binaries []*sandboxv1.NetworkBinary `protobuf:"bytes,7,rep,name=binaries,proto3" json:"binaries,omitempty"` - InferenceCapable bool `protobuf:"varint,8,opt,name=inference_capable,json=inferenceCapable,proto3" json:"inference_capable,omitempty"` - Discovery *ProviderProfileDiscovery `protobuf:"bytes,9,opt,name=discovery,proto3" json:"discovery,omitempty"` - // Storage resource version for custom profiles. Built-in profiles and new - // profile files use 0. Gateway responses set this for stored custom profiles. - // Update calls use this for optimistic concurrency. - ResourceVersion uint64 `protobuf:"varint,10,opt,name=resource_version,json=resourceVersion,proto3" json:"resource_version,omitempty"` - // Optional non-secret annotations attached by profile sources or importers. - Annotations map[string]string `protobuf:"bytes,11,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Server-set provenance: "builtin", "user", or "interceptor/{name}". - // Ignored on import/update payloads. - Source string `protobuf:"bytes,12,opt,name=source,proto3" json:"source,omitempty"` - // Server-set visibility: "platform", "workspace", or empty for - // non-scoped sources. Ignored on import/update payloads. - Scope string `protobuf:"bytes,13,opt,name=scope,proto3" json:"scope,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderProfile) Reset() { - *x = ProviderProfile{} - mi := &file_openshell_proto_msgTypes[87] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderProfile) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderProfile) ProtoMessage() {} - -func (x *ProviderProfile) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[87] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderProfile.ProtoReflect.Descriptor instead. -func (*ProviderProfile) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{87} -} - -func (x *ProviderProfile) GetId() string { - if x != nil { - return x.Id - } - return "" -} - -func (x *ProviderProfile) GetDisplayName() string { - if x != nil { - return x.DisplayName - } - return "" -} - -func (x *ProviderProfile) GetDescription() string { - if x != nil { - return x.Description - } - return "" -} - -func (x *ProviderProfile) GetCategory() ProviderProfileCategory { - if x != nil { - return x.Category - } - return ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_UNSPECIFIED -} - -func (x *ProviderProfile) GetCredentials() []*ProviderProfileCredential { - if x != nil { - return x.Credentials - } - return nil -} - -func (x *ProviderProfile) GetEndpoints() []*sandboxv1.NetworkEndpoint { - if x != nil { - return x.Endpoints - } - return nil -} - -func (x *ProviderProfile) GetBinaries() []*sandboxv1.NetworkBinary { - if x != nil { - return x.Binaries - } - return nil -} - -func (x *ProviderProfile) GetInferenceCapable() bool { - if x != nil { - return x.InferenceCapable - } - return false -} - -func (x *ProviderProfile) GetDiscovery() *ProviderProfileDiscovery { - if x != nil { - return x.Discovery - } - return nil -} - -func (x *ProviderProfile) GetResourceVersion() uint64 { - if x != nil { - return x.ResourceVersion - } - return 0 -} - -func (x *ProviderProfile) GetAnnotations() map[string]string { - if x != nil { - return x.Annotations - } - return nil -} - -func (x *ProviderProfile) GetSource() string { - if x != nil { - return x.Source - } - return "" -} - -func (x *ProviderProfile) GetScope() string { - if x != nil { - return x.Scope - } - return "" -} - -// Stored custom provider profile object. -type StoredProviderProfile struct { - state protoimpl.MessageState `protogen:"open.v1"` - Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` - Profile *ProviderProfile `protobuf:"bytes,2,opt,name=profile,proto3" json:"profile,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *StoredProviderProfile) Reset() { - *x = StoredProviderProfile{} - mi := &file_openshell_proto_msgTypes[88] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *StoredProviderProfile) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*StoredProviderProfile) ProtoMessage() {} - -func (x *StoredProviderProfile) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[88] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use StoredProviderProfile.ProtoReflect.Descriptor instead. -func (*StoredProviderProfile) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{88} -} - -func (x *StoredProviderProfile) GetMetadata() *datamodelv1.ObjectMeta { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *StoredProviderProfile) GetProfile() *ProviderProfile { - if x != nil { - return x.Profile - } - return nil -} - -// Provider profile response. -type ProviderProfileResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Profile *ProviderProfile `protobuf:"bytes,1,opt,name=profile,proto3" json:"profile,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProviderProfileResponse) Reset() { - *x = ProviderProfileResponse{} - mi := &file_openshell_proto_msgTypes[89] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProviderProfileResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProviderProfileResponse) ProtoMessage() {} - -func (x *ProviderProfileResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[89] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProviderProfileResponse.ProtoReflect.Descriptor instead. -func (*ProviderProfileResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{89} -} - -func (x *ProviderProfileResponse) GetProfile() *ProviderProfile { - if x != nil { - return x.Profile - } - return nil -} - -// List provider profiles response. -type ListProviderProfilesResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Profiles []*ProviderProfile `protobuf:"bytes,1,rep,name=profiles,proto3" json:"profiles,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListProviderProfilesResponse) Reset() { - *x = ListProviderProfilesResponse{} - mi := &file_openshell_proto_msgTypes[90] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListProviderProfilesResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListProviderProfilesResponse) ProtoMessage() {} - -func (x *ListProviderProfilesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[90] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListProviderProfilesResponse.ProtoReflect.Descriptor instead. -func (*ListProviderProfilesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{90} -} - -func (x *ListProviderProfilesResponse) GetProfiles() []*ProviderProfile { - if x != nil { - return x.Profiles - } - return nil -} - -// Import custom provider profiles request. -type ImportProviderProfilesRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Profiles []*ProviderProfileImportItem `protobuf:"bytes,1,rep,name=profiles,proto3" json:"profiles,omitempty"` - // Workspace scope. When set, profiles are workspace-scoped (Workspace Admin). - // When empty, profiles are platform-scoped (Platform Admin). - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ImportProviderProfilesRequest) Reset() { - *x = ImportProviderProfilesRequest{} - mi := &file_openshell_proto_msgTypes[91] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ImportProviderProfilesRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ImportProviderProfilesRequest) ProtoMessage() {} - -func (x *ImportProviderProfilesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[91] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ImportProviderProfilesRequest.ProtoReflect.Descriptor instead. -func (*ImportProviderProfilesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{91} -} - -func (x *ImportProviderProfilesRequest) GetProfiles() []*ProviderProfileImportItem { - if x != nil { - return x.Profiles - } - return nil -} - -func (x *ImportProviderProfilesRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Import custom provider profiles response. -type ImportProviderProfilesResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Diagnostics []*ProviderProfileDiagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"` - Profiles []*ProviderProfile `protobuf:"bytes,2,rep,name=profiles,proto3" json:"profiles,omitempty"` - Imported bool `protobuf:"varint,3,opt,name=imported,proto3" json:"imported,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ImportProviderProfilesResponse) Reset() { - *x = ImportProviderProfilesResponse{} - mi := &file_openshell_proto_msgTypes[92] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ImportProviderProfilesResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ImportProviderProfilesResponse) ProtoMessage() {} - -func (x *ImportProviderProfilesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[92] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ImportProviderProfilesResponse.ProtoReflect.Descriptor instead. -func (*ImportProviderProfilesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{92} -} - -func (x *ImportProviderProfilesResponse) GetDiagnostics() []*ProviderProfileDiagnostic { - if x != nil { - return x.Diagnostics - } - return nil -} - -func (x *ImportProviderProfilesResponse) GetProfiles() []*ProviderProfile { - if x != nil { - return x.Profiles - } - return nil -} - -func (x *ImportProviderProfilesResponse) GetImported() bool { - if x != nil { - return x.Imported - } - return false -} - -// Update one custom provider profile request. -type UpdateProviderProfilesRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Profile *ProviderProfileImportItem `protobuf:"bytes,1,opt,name=profile,proto3" json:"profile,omitempty"` - // Expected storage resource version for optimistic concurrency control. - // If 0, the server uses the resource_version embedded in profile.profile. - // Updates without a non-zero version are rejected to prevent stale files from - // silently overwriting newer profile definitions. - ExpectedResourceVersion uint64 `protobuf:"varint,2,opt,name=expected_resource_version,json=expectedResourceVersion,proto3" json:"expected_resource_version,omitempty"` - // Existing custom provider profile ID to update. The payload ID must match. - Id string `protobuf:"bytes,3,opt,name=id,proto3" json:"id,omitempty"` - // Workspace scope. When set, targets workspace-scoped profile. When empty, - // targets platform-scoped profile. - Workspace string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *UpdateProviderProfilesRequest) Reset() { - *x = UpdateProviderProfilesRequest{} - mi := &file_openshell_proto_msgTypes[93] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *UpdateProviderProfilesRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*UpdateProviderProfilesRequest) ProtoMessage() {} - -func (x *UpdateProviderProfilesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[93] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use UpdateProviderProfilesRequest.ProtoReflect.Descriptor instead. -func (*UpdateProviderProfilesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{93} -} - -func (x *UpdateProviderProfilesRequest) GetProfile() *ProviderProfileImportItem { - if x != nil { - return x.Profile - } - return nil -} - -func (x *UpdateProviderProfilesRequest) GetExpectedResourceVersion() uint64 { - if x != nil { - return x.ExpectedResourceVersion - } - return 0 -} - -func (x *UpdateProviderProfilesRequest) GetId() string { - if x != nil { - return x.Id - } - return "" -} - -func (x *UpdateProviderProfilesRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Update one custom provider profile response. -type UpdateProviderProfilesResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Diagnostics []*ProviderProfileDiagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"` - Profile *ProviderProfile `protobuf:"bytes,2,opt,name=profile,proto3" json:"profile,omitempty"` - Updated bool `protobuf:"varint,3,opt,name=updated,proto3" json:"updated,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *UpdateProviderProfilesResponse) Reset() { - *x = UpdateProviderProfilesResponse{} - mi := &file_openshell_proto_msgTypes[94] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *UpdateProviderProfilesResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*UpdateProviderProfilesResponse) ProtoMessage() {} - -func (x *UpdateProviderProfilesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[94] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use UpdateProviderProfilesResponse.ProtoReflect.Descriptor instead. -func (*UpdateProviderProfilesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{94} -} - -func (x *UpdateProviderProfilesResponse) GetDiagnostics() []*ProviderProfileDiagnostic { - if x != nil { - return x.Diagnostics - } - return nil -} - -func (x *UpdateProviderProfilesResponse) GetProfile() *ProviderProfile { - if x != nil { - return x.Profile - } - return nil -} - -func (x *UpdateProviderProfilesResponse) GetUpdated() bool { - if x != nil { - return x.Updated - } - return false -} - -// Lint provider profiles request. -type LintProviderProfilesRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Profiles []*ProviderProfileImportItem `protobuf:"bytes,1,rep,name=profiles,proto3" json:"profiles,omitempty"` - // Workspace scope. Used to check for conflicts against existing profiles - // in the target workspace. - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *LintProviderProfilesRequest) Reset() { - *x = LintProviderProfilesRequest{} - mi := &file_openshell_proto_msgTypes[95] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *LintProviderProfilesRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*LintProviderProfilesRequest) ProtoMessage() {} - -func (x *LintProviderProfilesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[95] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use LintProviderProfilesRequest.ProtoReflect.Descriptor instead. -func (*LintProviderProfilesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{95} -} - -func (x *LintProviderProfilesRequest) GetProfiles() []*ProviderProfileImportItem { - if x != nil { - return x.Profiles - } - return nil -} - -func (x *LintProviderProfilesRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Lint provider profiles response. -type LintProviderProfilesResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Diagnostics []*ProviderProfileDiagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"` - Valid bool `protobuf:"varint,2,opt,name=valid,proto3" json:"valid,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *LintProviderProfilesResponse) Reset() { - *x = LintProviderProfilesResponse{} - mi := &file_openshell_proto_msgTypes[96] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *LintProviderProfilesResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*LintProviderProfilesResponse) ProtoMessage() {} - -func (x *LintProviderProfilesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[96] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use LintProviderProfilesResponse.ProtoReflect.Descriptor instead. -func (*LintProviderProfilesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{96} -} - -func (x *LintProviderProfilesResponse) GetDiagnostics() []*ProviderProfileDiagnostic { - if x != nil { - return x.Diagnostics - } - return nil -} - -func (x *LintProviderProfilesResponse) GetValid() bool { - if x != nil { - return x.Valid - } - return false -} - -// Delete provider response. -type DeleteProviderResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Deleted bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteProviderResponse) Reset() { - *x = DeleteProviderResponse{} - mi := &file_openshell_proto_msgTypes[97] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteProviderResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteProviderResponse) ProtoMessage() {} - -func (x *DeleteProviderResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[97] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteProviderResponse.ProtoReflect.Descriptor instead. -func (*DeleteProviderResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{97} -} - -func (x *DeleteProviderResponse) GetDeleted() bool { - if x != nil { - return x.Deleted - } - return false -} - -// Delete custom provider profile request. -type DeleteProviderProfileRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` - // Workspace scope. When set, targets workspace-scoped profile. When empty, - // targets platform-scoped profile. - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteProviderProfileRequest) Reset() { - *x = DeleteProviderProfileRequest{} - mi := &file_openshell_proto_msgTypes[98] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteProviderProfileRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteProviderProfileRequest) ProtoMessage() {} - -func (x *DeleteProviderProfileRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[98] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteProviderProfileRequest.ProtoReflect.Descriptor instead. -func (*DeleteProviderProfileRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{98} -} - -func (x *DeleteProviderProfileRequest) GetId() string { - if x != nil { - return x.Id - } - return "" -} - -func (x *DeleteProviderProfileRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Delete custom provider profile response. -type DeleteProviderProfileResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Deleted bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteProviderProfileResponse) Reset() { - *x = DeleteProviderProfileResponse{} - mi := &file_openshell_proto_msgTypes[99] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteProviderProfileResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteProviderProfileResponse) ProtoMessage() {} - -func (x *DeleteProviderProfileResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[99] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteProviderProfileResponse.ProtoReflect.Descriptor instead. -func (*DeleteProviderProfileResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{99} -} - -func (x *DeleteProviderProfileResponse) GetDeleted() bool { - if x != nil { - return x.Deleted - } - return false -} - -// Get sandbox provider environment request. -type GetSandboxProviderEnvironmentRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // The sandbox ID. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetSandboxProviderEnvironmentRequest) Reset() { - *x = GetSandboxProviderEnvironmentRequest{} - mi := &file_openshell_proto_msgTypes[100] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetSandboxProviderEnvironmentRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetSandboxProviderEnvironmentRequest) ProtoMessage() {} - -func (x *GetSandboxProviderEnvironmentRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[100] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetSandboxProviderEnvironmentRequest.ProtoReflect.Descriptor instead. -func (*GetSandboxProviderEnvironmentRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{100} -} - -func (x *GetSandboxProviderEnvironmentRequest) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -// Get sandbox provider environment response. -type GetSandboxProviderEnvironmentResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Provider credential environment variables. - Environment map[string]string `protobuf:"bytes,1,rep,name=environment,proto3" json:"environment,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Fingerprint for the provider credential inputs that produced environment. - ProviderEnvRevision uint64 `protobuf:"varint,2,opt,name=provider_env_revision,json=providerEnvRevision,proto3" json:"provider_env_revision,omitempty"` - // Expiration timestamps for returned environment variables. - CredentialExpiresAtMs map[string]int64 `protobuf:"bytes,3,rep,name=credential_expires_at_ms,json=credentialExpiresAtMs,proto3" json:"credential_expires_at_ms,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value"` - // Dynamic credentials that require token grants or other runtime injection. - // Maps endpoint-bound provider metadata to credential metadata. - // Supervisor uses this to inject Authorization headers for token grant credentials. - DynamicCredentials map[string]*ProviderProfileCredential `protobuf:"bytes,4,rep,name=dynamic_credentials,json=dynamicCredentials,proto3" json:"dynamic_credentials,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetSandboxProviderEnvironmentResponse) Reset() { - *x = GetSandboxProviderEnvironmentResponse{} - mi := &file_openshell_proto_msgTypes[101] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetSandboxProviderEnvironmentResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetSandboxProviderEnvironmentResponse) ProtoMessage() {} - -func (x *GetSandboxProviderEnvironmentResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[101] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetSandboxProviderEnvironmentResponse.ProtoReflect.Descriptor instead. -func (*GetSandboxProviderEnvironmentResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{101} -} - -func (x *GetSandboxProviderEnvironmentResponse) GetEnvironment() map[string]string { - if x != nil { - return x.Environment - } - return nil -} - -func (x *GetSandboxProviderEnvironmentResponse) GetProviderEnvRevision() uint64 { - if x != nil { - return x.ProviderEnvRevision - } - return 0 -} - -func (x *GetSandboxProviderEnvironmentResponse) GetCredentialExpiresAtMs() map[string]int64 { - if x != nil { - return x.CredentialExpiresAtMs - } - return nil -} - -func (x *GetSandboxProviderEnvironmentResponse) GetDynamicCredentials() map[string]*ProviderProfileCredential { - if x != nil { - return x.DynamicCredentials - } - return nil -} - -// Update sandbox policy request. -type UpdateConfigRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name (canonical lookup key). Required for sandbox-scoped updates. - // Not required when `global=true`. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // The new policy to apply. - // - // Sandbox scope (`global=false`): - // - only network_policies and inference fields may differ from create-time - // policy; static fields must match version 1. - // - // Global scope (`global=true`): - // - applies to all sandboxes in full (no merge). - Policy *sandboxv1.SandboxPolicy `protobuf:"bytes,2,opt,name=policy,proto3" json:"policy,omitempty"` - // Optional single setting key to mutate. - SettingKey string `protobuf:"bytes,3,opt,name=setting_key,json=settingKey,proto3" json:"setting_key,omitempty"` - // Setting value for upsert operations. - SettingValue *sandboxv1.SettingValue `protobuf:"bytes,4,opt,name=setting_value,json=settingValue,proto3" json:"setting_value,omitempty"` - // Delete the setting key from scope. - // Sandbox-scoped deletes are rejected; only global delete is supported. - DeleteSetting bool `protobuf:"varint,5,opt,name=delete_setting,json=deleteSetting,proto3" json:"delete_setting,omitempty"` - // Apply mutation at gateway-global scope. - Global bool `protobuf:"varint,6,opt,name=global,proto3" json:"global,omitempty"` - // Batched incremental policy merge operations. Sandbox-scoped only. - MergeOperations []*PolicyMergeOperation `protobuf:"bytes,7,rep,name=merge_operations,json=mergeOperations,proto3" json:"merge_operations,omitempty"` - // Expected resource version for optimistic concurrency control (sandbox-scoped only). - // If 0, the server uses the current version (backward compatibility). - // If non-zero, the server validates that the sandbox's current resource_version - // matches this value before applying the mutation, returning ABORTED on mismatch. - // Ignored for global-scoped updates. - ExpectedResourceVersion uint64 `protobuf:"varint,8,opt,name=expected_resource_version,json=expectedResourceVersion,proto3" json:"expected_resource_version,omitempty"` - // Caller-provided annotations associated with a sandbox-scoped update. Values - // must not contain secrets; the gateway treats them as opaque metadata and does - // not interpret or verify their semantics. For policy updates, the gateway - // stores the annotations immutably with the revision and merges them into - // sandbox metadata as a convenience projection. For setting-only updates, it - // only merges them into sandbox metadata. - Annotations map[string]string `protobuf:"bytes,9,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Workspace scope. Empty defaults to "default". Ignored for global-scoped updates. - Workspace string `protobuf:"bytes,10,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *UpdateConfigRequest) Reset() { - *x = UpdateConfigRequest{} - mi := &file_openshell_proto_msgTypes[102] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *UpdateConfigRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*UpdateConfigRequest) ProtoMessage() {} - -func (x *UpdateConfigRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[102] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use UpdateConfigRequest.ProtoReflect.Descriptor instead. -func (*UpdateConfigRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{102} -} - -func (x *UpdateConfigRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *UpdateConfigRequest) GetPolicy() *sandboxv1.SandboxPolicy { - if x != nil { - return x.Policy - } - return nil -} - -func (x *UpdateConfigRequest) GetSettingKey() string { - if x != nil { - return x.SettingKey - } - return "" -} - -func (x *UpdateConfigRequest) GetSettingValue() *sandboxv1.SettingValue { - if x != nil { - return x.SettingValue - } - return nil -} - -func (x *UpdateConfigRequest) GetDeleteSetting() bool { - if x != nil { - return x.DeleteSetting - } - return false -} - -func (x *UpdateConfigRequest) GetGlobal() bool { - if x != nil { - return x.Global - } - return false -} - -func (x *UpdateConfigRequest) GetMergeOperations() []*PolicyMergeOperation { - if x != nil { - return x.MergeOperations - } - return nil -} - -func (x *UpdateConfigRequest) GetExpectedResourceVersion() uint64 { - if x != nil { - return x.ExpectedResourceVersion - } - return 0 -} - -func (x *UpdateConfigRequest) GetAnnotations() map[string]string { - if x != nil { - return x.Annotations - } - return nil -} - -func (x *UpdateConfigRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type PolicyMergeOperation struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Operation: - // - // *PolicyMergeOperation_AddRule - // *PolicyMergeOperation_RemoveEndpoint - // *PolicyMergeOperation_RemoveRule - // *PolicyMergeOperation_AddDenyRules - // *PolicyMergeOperation_AddAllowRules - // *PolicyMergeOperation_RemoveBinary - Operation isPolicyMergeOperation_Operation `protobuf_oneof:"operation"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *PolicyMergeOperation) Reset() { - *x = PolicyMergeOperation{} - mi := &file_openshell_proto_msgTypes[103] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *PolicyMergeOperation) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*PolicyMergeOperation) ProtoMessage() {} - -func (x *PolicyMergeOperation) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[103] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use PolicyMergeOperation.ProtoReflect.Descriptor instead. -func (*PolicyMergeOperation) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{103} -} - -func (x *PolicyMergeOperation) GetOperation() isPolicyMergeOperation_Operation { - if x != nil { - return x.Operation - } - return nil -} - -func (x *PolicyMergeOperation) GetAddRule() *AddNetworkRule { - if x != nil { - if x, ok := x.Operation.(*PolicyMergeOperation_AddRule); ok { - return x.AddRule - } - } - return nil -} - -func (x *PolicyMergeOperation) GetRemoveEndpoint() *RemoveNetworkEndpoint { - if x != nil { - if x, ok := x.Operation.(*PolicyMergeOperation_RemoveEndpoint); ok { - return x.RemoveEndpoint - } - } - return nil -} - -func (x *PolicyMergeOperation) GetRemoveRule() *RemoveNetworkRule { - if x != nil { - if x, ok := x.Operation.(*PolicyMergeOperation_RemoveRule); ok { - return x.RemoveRule - } - } - return nil -} - -func (x *PolicyMergeOperation) GetAddDenyRules() *AddDenyRules { - if x != nil { - if x, ok := x.Operation.(*PolicyMergeOperation_AddDenyRules); ok { - return x.AddDenyRules - } - } - return nil -} - -func (x *PolicyMergeOperation) GetAddAllowRules() *AddAllowRules { - if x != nil { - if x, ok := x.Operation.(*PolicyMergeOperation_AddAllowRules); ok { - return x.AddAllowRules - } - } - return nil -} - -func (x *PolicyMergeOperation) GetRemoveBinary() *RemoveNetworkBinary { - if x != nil { - if x, ok := x.Operation.(*PolicyMergeOperation_RemoveBinary); ok { - return x.RemoveBinary - } - } - return nil -} - -type isPolicyMergeOperation_Operation interface { - isPolicyMergeOperation_Operation() -} - -type PolicyMergeOperation_AddRule struct { - AddRule *AddNetworkRule `protobuf:"bytes,1,opt,name=add_rule,json=addRule,proto3,oneof"` -} - -type PolicyMergeOperation_RemoveEndpoint struct { - RemoveEndpoint *RemoveNetworkEndpoint `protobuf:"bytes,2,opt,name=remove_endpoint,json=removeEndpoint,proto3,oneof"` -} - -type PolicyMergeOperation_RemoveRule struct { - RemoveRule *RemoveNetworkRule `protobuf:"bytes,3,opt,name=remove_rule,json=removeRule,proto3,oneof"` -} - -type PolicyMergeOperation_AddDenyRules struct { - AddDenyRules *AddDenyRules `protobuf:"bytes,4,opt,name=add_deny_rules,json=addDenyRules,proto3,oneof"` -} - -type PolicyMergeOperation_AddAllowRules struct { - AddAllowRules *AddAllowRules `protobuf:"bytes,5,opt,name=add_allow_rules,json=addAllowRules,proto3,oneof"` -} - -type PolicyMergeOperation_RemoveBinary struct { - RemoveBinary *RemoveNetworkBinary `protobuf:"bytes,6,opt,name=remove_binary,json=removeBinary,proto3,oneof"` -} - -func (*PolicyMergeOperation_AddRule) isPolicyMergeOperation_Operation() {} - -func (*PolicyMergeOperation_RemoveEndpoint) isPolicyMergeOperation_Operation() {} - -func (*PolicyMergeOperation_RemoveRule) isPolicyMergeOperation_Operation() {} - -func (*PolicyMergeOperation_AddDenyRules) isPolicyMergeOperation_Operation() {} - -func (*PolicyMergeOperation_AddAllowRules) isPolicyMergeOperation_Operation() {} - -func (*PolicyMergeOperation_RemoveBinary) isPolicyMergeOperation_Operation() {} - -type AddNetworkRule struct { - state protoimpl.MessageState `protogen:"open.v1"` - RuleName string `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"` - Rule *sandboxv1.NetworkPolicyRule `protobuf:"bytes,2,opt,name=rule,proto3" json:"rule,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *AddNetworkRule) Reset() { - *x = AddNetworkRule{} - mi := &file_openshell_proto_msgTypes[104] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *AddNetworkRule) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*AddNetworkRule) ProtoMessage() {} - -func (x *AddNetworkRule) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[104] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use AddNetworkRule.ProtoReflect.Descriptor instead. -func (*AddNetworkRule) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{104} -} - -func (x *AddNetworkRule) GetRuleName() string { - if x != nil { - return x.RuleName - } - return "" -} - -func (x *AddNetworkRule) GetRule() *sandboxv1.NetworkPolicyRule { - if x != nil { - return x.Rule - } - return nil -} - -type RemoveNetworkEndpoint struct { - state protoimpl.MessageState `protogen:"open.v1"` - RuleName string `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"` - Host string `protobuf:"bytes,2,opt,name=host,proto3" json:"host,omitempty"` - Port uint32 `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RemoveNetworkEndpoint) Reset() { - *x = RemoveNetworkEndpoint{} - mi := &file_openshell_proto_msgTypes[105] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RemoveNetworkEndpoint) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RemoveNetworkEndpoint) ProtoMessage() {} - -func (x *RemoveNetworkEndpoint) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[105] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RemoveNetworkEndpoint.ProtoReflect.Descriptor instead. -func (*RemoveNetworkEndpoint) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{105} -} - -func (x *RemoveNetworkEndpoint) GetRuleName() string { - if x != nil { - return x.RuleName - } - return "" -} - -func (x *RemoveNetworkEndpoint) GetHost() string { - if x != nil { - return x.Host - } - return "" -} - -func (x *RemoveNetworkEndpoint) GetPort() uint32 { - if x != nil { - return x.Port - } - return 0 -} - -type RemoveNetworkRule struct { - state protoimpl.MessageState `protogen:"open.v1"` - RuleName string `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RemoveNetworkRule) Reset() { - *x = RemoveNetworkRule{} - mi := &file_openshell_proto_msgTypes[106] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RemoveNetworkRule) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RemoveNetworkRule) ProtoMessage() {} - -func (x *RemoveNetworkRule) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[106] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RemoveNetworkRule.ProtoReflect.Descriptor instead. -func (*RemoveNetworkRule) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{106} -} - -func (x *RemoveNetworkRule) GetRuleName() string { - if x != nil { - return x.RuleName - } - return "" -} - -type AddDenyRules struct { - state protoimpl.MessageState `protogen:"open.v1"` - Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"` - Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"` - DenyRules []*sandboxv1.L7DenyRule `protobuf:"bytes,3,rep,name=deny_rules,json=denyRules,proto3" json:"deny_rules,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *AddDenyRules) Reset() { - *x = AddDenyRules{} - mi := &file_openshell_proto_msgTypes[107] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *AddDenyRules) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*AddDenyRules) ProtoMessage() {} - -func (x *AddDenyRules) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[107] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use AddDenyRules.ProtoReflect.Descriptor instead. -func (*AddDenyRules) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{107} -} - -func (x *AddDenyRules) GetHost() string { - if x != nil { - return x.Host - } - return "" -} - -func (x *AddDenyRules) GetPort() uint32 { - if x != nil { - return x.Port - } - return 0 -} - -func (x *AddDenyRules) GetDenyRules() []*sandboxv1.L7DenyRule { - if x != nil { - return x.DenyRules - } - return nil -} - -type AddAllowRules struct { - state protoimpl.MessageState `protogen:"open.v1"` - Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"` - Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"` - Rules []*sandboxv1.L7Rule `protobuf:"bytes,3,rep,name=rules,proto3" json:"rules,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *AddAllowRules) Reset() { - *x = AddAllowRules{} - mi := &file_openshell_proto_msgTypes[108] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *AddAllowRules) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*AddAllowRules) ProtoMessage() {} - -func (x *AddAllowRules) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[108] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use AddAllowRules.ProtoReflect.Descriptor instead. -func (*AddAllowRules) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{108} -} - -func (x *AddAllowRules) GetHost() string { - if x != nil { - return x.Host - } - return "" -} - -func (x *AddAllowRules) GetPort() uint32 { - if x != nil { - return x.Port - } - return 0 -} - -func (x *AddAllowRules) GetRules() []*sandboxv1.L7Rule { - if x != nil { - return x.Rules - } - return nil -} - -type RemoveNetworkBinary struct { - state protoimpl.MessageState `protogen:"open.v1"` - RuleName string `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"` - BinaryPath string `protobuf:"bytes,2,opt,name=binary_path,json=binaryPath,proto3" json:"binary_path,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RemoveNetworkBinary) Reset() { - *x = RemoveNetworkBinary{} - mi := &file_openshell_proto_msgTypes[109] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RemoveNetworkBinary) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RemoveNetworkBinary) ProtoMessage() {} - -func (x *RemoveNetworkBinary) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[109] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RemoveNetworkBinary.ProtoReflect.Descriptor instead. -func (*RemoveNetworkBinary) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{109} -} - -func (x *RemoveNetworkBinary) GetRuleName() string { - if x != nil { - return x.RuleName - } - return "" -} - -func (x *RemoveNetworkBinary) GetBinaryPath() string { - if x != nil { - return x.BinaryPath - } - return "" -} - -// Update sandbox policy response. -type UpdateConfigResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Assigned policy version (monotonically increasing per sandbox). - Version uint32 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"` - // SHA-256 hash of the serialized policy payload. - PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"` - // Settings revision for the scope that was modified. - SettingsRevision uint64 `protobuf:"varint,3,opt,name=settings_revision,json=settingsRevision,proto3" json:"settings_revision,omitempty"` - // True when a setting delete operation removed an existing key. - Deleted bool `protobuf:"varint,4,opt,name=deleted,proto3" json:"deleted,omitempty"` - // Sandbox metadata annotations after the update. Empty for global updates. - Annotations map[string]string `protobuf:"bytes,5,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *UpdateConfigResponse) Reset() { - *x = UpdateConfigResponse{} - mi := &file_openshell_proto_msgTypes[110] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *UpdateConfigResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*UpdateConfigResponse) ProtoMessage() {} - -func (x *UpdateConfigResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[110] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use UpdateConfigResponse.ProtoReflect.Descriptor instead. -func (*UpdateConfigResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{110} -} - -func (x *UpdateConfigResponse) GetVersion() uint32 { - if x != nil { - return x.Version - } - return 0 -} - -func (x *UpdateConfigResponse) GetPolicyHash() string { - if x != nil { - return x.PolicyHash - } - return "" -} - -func (x *UpdateConfigResponse) GetSettingsRevision() uint64 { - if x != nil { - return x.SettingsRevision - } - return 0 -} - -func (x *UpdateConfigResponse) GetDeleted() bool { - if x != nil { - return x.Deleted - } - return false -} - -func (x *UpdateConfigResponse) GetAnnotations() map[string]string { - if x != nil { - return x.Annotations - } - return nil -} - -// Get sandbox policy status request. -type GetSandboxPolicyStatusRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name (canonical lookup key). Ignored when global is true. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // The specific policy version to query. 0 means latest. - Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"` - // Query global policy revisions instead of a sandbox-scoped one. - Global bool `protobuf:"varint,3,opt,name=global,proto3" json:"global,omitempty"` - // Workspace scope. Empty defaults to "default". Ignored when global is true. - Workspace string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetSandboxPolicyStatusRequest) Reset() { - *x = GetSandboxPolicyStatusRequest{} - mi := &file_openshell_proto_msgTypes[111] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetSandboxPolicyStatusRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetSandboxPolicyStatusRequest) ProtoMessage() {} - -func (x *GetSandboxPolicyStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[111] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetSandboxPolicyStatusRequest.ProtoReflect.Descriptor instead. -func (*GetSandboxPolicyStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{111} -} - -func (x *GetSandboxPolicyStatusRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *GetSandboxPolicyStatusRequest) GetVersion() uint32 { - if x != nil { - return x.Version - } - return 0 -} - -func (x *GetSandboxPolicyStatusRequest) GetGlobal() bool { - if x != nil { - return x.Global - } - return false -} - -func (x *GetSandboxPolicyStatusRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Get sandbox policy status response. -type GetSandboxPolicyStatusResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // The queried policy revision. - Revision *SandboxPolicyRevision `protobuf:"bytes,1,opt,name=revision,proto3" json:"revision,omitempty"` - // The currently active (loaded) policy version for this sandbox. - ActiveVersion uint32 `protobuf:"varint,2,opt,name=active_version,json=activeVersion,proto3" json:"active_version,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetSandboxPolicyStatusResponse) Reset() { - *x = GetSandboxPolicyStatusResponse{} - mi := &file_openshell_proto_msgTypes[112] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetSandboxPolicyStatusResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetSandboxPolicyStatusResponse) ProtoMessage() {} - -func (x *GetSandboxPolicyStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[112] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetSandboxPolicyStatusResponse.ProtoReflect.Descriptor instead. -func (*GetSandboxPolicyStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{112} -} - -func (x *GetSandboxPolicyStatusResponse) GetRevision() *SandboxPolicyRevision { - if x != nil { - return x.Revision - } - return nil -} - -func (x *GetSandboxPolicyStatusResponse) GetActiveVersion() uint32 { - if x != nil { - return x.ActiveVersion - } - return 0 -} - -// List sandbox policies request. -type ListSandboxPoliciesRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name (canonical lookup key). Ignored when global is true. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - Limit uint32 `protobuf:"varint,2,opt,name=limit,proto3" json:"limit,omitempty"` - Offset uint32 `protobuf:"varint,3,opt,name=offset,proto3" json:"offset,omitempty"` - // List global policy revisions instead of sandbox-scoped ones. - Global bool `protobuf:"varint,4,opt,name=global,proto3" json:"global,omitempty"` - // Workspace scope. Empty defaults to "default". Ignored when global is true. - Workspace string `protobuf:"bytes,5,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListSandboxPoliciesRequest) Reset() { - *x = ListSandboxPoliciesRequest{} - mi := &file_openshell_proto_msgTypes[113] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListSandboxPoliciesRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListSandboxPoliciesRequest) ProtoMessage() {} - -func (x *ListSandboxPoliciesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[113] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListSandboxPoliciesRequest.ProtoReflect.Descriptor instead. -func (*ListSandboxPoliciesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{113} -} - -func (x *ListSandboxPoliciesRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *ListSandboxPoliciesRequest) GetLimit() uint32 { - if x != nil { - return x.Limit - } - return 0 -} - -func (x *ListSandboxPoliciesRequest) GetOffset() uint32 { - if x != nil { - return x.Offset - } - return 0 -} - -func (x *ListSandboxPoliciesRequest) GetGlobal() bool { - if x != nil { - return x.Global - } - return false -} - -func (x *ListSandboxPoliciesRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// List sandbox policies response. -type ListSandboxPoliciesResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Revisions []*SandboxPolicyRevision `protobuf:"bytes,1,rep,name=revisions,proto3" json:"revisions,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListSandboxPoliciesResponse) Reset() { - *x = ListSandboxPoliciesResponse{} - mi := &file_openshell_proto_msgTypes[114] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListSandboxPoliciesResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListSandboxPoliciesResponse) ProtoMessage() {} - -func (x *ListSandboxPoliciesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[114] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListSandboxPoliciesResponse.ProtoReflect.Descriptor instead. -func (*ListSandboxPoliciesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{114} -} - -func (x *ListSandboxPoliciesResponse) GetRevisions() []*SandboxPolicyRevision { - if x != nil { - return x.Revisions - } - return nil -} - -// Report policy load status (called by sandbox runtime after reload attempt). -type ReportPolicyStatusRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox id. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // The policy version that was attempted. - Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"` - // Load result status. - Status PolicyStatus `protobuf:"varint,3,opt,name=status,proto3,enum=openshell.v1.PolicyStatus" json:"status,omitempty"` - // Error message if status is FAILED. - LoadError string `protobuf:"bytes,4,opt,name=load_error,json=loadError,proto3" json:"load_error,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ReportPolicyStatusRequest) Reset() { - *x = ReportPolicyStatusRequest{} - mi := &file_openshell_proto_msgTypes[115] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ReportPolicyStatusRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ReportPolicyStatusRequest) ProtoMessage() {} - -func (x *ReportPolicyStatusRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[115] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ReportPolicyStatusRequest.ProtoReflect.Descriptor instead. -func (*ReportPolicyStatusRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{115} -} - -func (x *ReportPolicyStatusRequest) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *ReportPolicyStatusRequest) GetVersion() uint32 { - if x != nil { - return x.Version - } - return 0 -} - -func (x *ReportPolicyStatusRequest) GetStatus() PolicyStatus { - if x != nil { - return x.Status - } - return PolicyStatus_POLICY_STATUS_UNSPECIFIED -} - -func (x *ReportPolicyStatusRequest) GetLoadError() string { - if x != nil { - return x.LoadError - } - return "" -} - -// Report policy status response. -type ReportPolicyStatusResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ReportPolicyStatusResponse) Reset() { - *x = ReportPolicyStatusResponse{} - mi := &file_openshell_proto_msgTypes[116] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ReportPolicyStatusResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ReportPolicyStatusResponse) ProtoMessage() {} - -func (x *ReportPolicyStatusResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[116] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ReportPolicyStatusResponse.ProtoReflect.Descriptor instead. -func (*ReportPolicyStatusResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{116} -} - -// A versioned policy revision with metadata. -type SandboxPolicyRevision struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Policy version (monotonically increasing per sandbox). - Version uint32 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"` - // SHA-256 hash of the serialized policy payload. - PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"` - // Load status of this revision. - Status PolicyStatus `protobuf:"varint,3,opt,name=status,proto3,enum=openshell.v1.PolicyStatus" json:"status,omitempty"` - // Error message if status is FAILED. - LoadError string `protobuf:"bytes,4,opt,name=load_error,json=loadError,proto3" json:"load_error,omitempty"` - // Milliseconds since epoch when this revision was created. - CreatedAtMs int64 `protobuf:"varint,5,opt,name=created_at_ms,json=createdAtMs,proto3" json:"created_at_ms,omitempty"` - // Milliseconds since epoch when this revision was loaded by the sandbox. - LoadedAtMs int64 `protobuf:"varint,6,opt,name=loaded_at_ms,json=loadedAtMs,proto3" json:"loaded_at_ms,omitempty"` - // The full policy (only populated when explicitly requested). - Policy *sandboxv1.SandboxPolicy `protobuf:"bytes,7,opt,name=policy,proto3" json:"policy,omitempty"` - // Immutable provenance supplied with this policy revision. - Provenance map[string]string `protobuf:"bytes,8,rep,name=provenance,proto3" json:"provenance,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxPolicyRevision) Reset() { - *x = SandboxPolicyRevision{} - mi := &file_openshell_proto_msgTypes[117] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxPolicyRevision) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxPolicyRevision) ProtoMessage() {} - -func (x *SandboxPolicyRevision) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[117] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxPolicyRevision.ProtoReflect.Descriptor instead. -func (*SandboxPolicyRevision) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{117} -} - -func (x *SandboxPolicyRevision) GetVersion() uint32 { - if x != nil { - return x.Version - } - return 0 -} - -func (x *SandboxPolicyRevision) GetPolicyHash() string { - if x != nil { - return x.PolicyHash - } - return "" -} - -func (x *SandboxPolicyRevision) GetStatus() PolicyStatus { - if x != nil { - return x.Status - } - return PolicyStatus_POLICY_STATUS_UNSPECIFIED -} - -func (x *SandboxPolicyRevision) GetLoadError() string { - if x != nil { - return x.LoadError - } - return "" -} - -func (x *SandboxPolicyRevision) GetCreatedAtMs() int64 { - if x != nil { - return x.CreatedAtMs - } - return 0 -} - -func (x *SandboxPolicyRevision) GetLoadedAtMs() int64 { - if x != nil { - return x.LoadedAtMs - } - return 0 -} - -func (x *SandboxPolicyRevision) GetPolicy() *sandboxv1.SandboxPolicy { - if x != nil { - return x.Policy - } - return nil -} - -func (x *SandboxPolicyRevision) GetProvenance() map[string]string { - if x != nil { - return x.Provenance - } - return nil -} - -// Get sandbox logs request (one-shot fetch). -type GetSandboxLogsRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox id. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // Maximum number of log lines to return. 0 means use default (2000). - Lines uint32 `protobuf:"varint,2,opt,name=lines,proto3" json:"lines,omitempty"` - // Only include logs with timestamp >= this value (ms since epoch). 0 means no filter. - SinceMs int64 `protobuf:"varint,3,opt,name=since_ms,json=sinceMs,proto3" json:"since_ms,omitempty"` - // Filter by log source (e.g. "gateway", "sandbox"). Empty means all sources. - Sources []string `protobuf:"bytes,4,rep,name=sources,proto3" json:"sources,omitempty"` - // Minimum log level to include (e.g. "INFO", "WARN", "ERROR"). Empty means all levels. - MinLevel string `protobuf:"bytes,5,opt,name=min_level,json=minLevel,proto3" json:"min_level,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,6,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetSandboxLogsRequest) Reset() { - *x = GetSandboxLogsRequest{} - mi := &file_openshell_proto_msgTypes[118] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetSandboxLogsRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetSandboxLogsRequest) ProtoMessage() {} - -func (x *GetSandboxLogsRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[118] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetSandboxLogsRequest.ProtoReflect.Descriptor instead. -func (*GetSandboxLogsRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{118} -} - -func (x *GetSandboxLogsRequest) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *GetSandboxLogsRequest) GetLines() uint32 { - if x != nil { - return x.Lines - } - return 0 -} - -func (x *GetSandboxLogsRequest) GetSinceMs() int64 { - if x != nil { - return x.SinceMs - } - return 0 -} - -func (x *GetSandboxLogsRequest) GetSources() []string { - if x != nil { - return x.Sources - } - return nil -} - -func (x *GetSandboxLogsRequest) GetMinLevel() string { - if x != nil { - return x.MinLevel - } - return "" -} - -func (x *GetSandboxLogsRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Batch of log lines pushed from sandbox to server. -type PushSandboxLogsRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // The sandbox ID. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // Log lines to ingest. - Logs []*SandboxLogLine `protobuf:"bytes,2,rep,name=logs,proto3" json:"logs,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *PushSandboxLogsRequest) Reset() { - *x = PushSandboxLogsRequest{} - mi := &file_openshell_proto_msgTypes[119] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *PushSandboxLogsRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*PushSandboxLogsRequest) ProtoMessage() {} - -func (x *PushSandboxLogsRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[119] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use PushSandboxLogsRequest.ProtoReflect.Descriptor instead. -func (*PushSandboxLogsRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{119} -} - -func (x *PushSandboxLogsRequest) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *PushSandboxLogsRequest) GetLogs() []*SandboxLogLine { - if x != nil { - return x.Logs - } - return nil -} - -// Push sandbox logs response. -type PushSandboxLogsResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *PushSandboxLogsResponse) Reset() { - *x = PushSandboxLogsResponse{} - mi := &file_openshell_proto_msgTypes[120] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *PushSandboxLogsResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*PushSandboxLogsResponse) ProtoMessage() {} - -func (x *PushSandboxLogsResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[120] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use PushSandboxLogsResponse.ProtoReflect.Descriptor instead. -func (*PushSandboxLogsResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{120} -} - -// Get sandbox logs response. -type GetSandboxLogsResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Log lines in chronological order. - Logs []*SandboxLogLine `protobuf:"bytes,1,rep,name=logs,proto3" json:"logs,omitempty"` - // Total number of lines in the server's buffer for this sandbox. - BufferTotal uint32 `protobuf:"varint,2,opt,name=buffer_total,json=bufferTotal,proto3" json:"buffer_total,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetSandboxLogsResponse) Reset() { - *x = GetSandboxLogsResponse{} - mi := &file_openshell_proto_msgTypes[121] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetSandboxLogsResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetSandboxLogsResponse) ProtoMessage() {} - -func (x *GetSandboxLogsResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[121] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetSandboxLogsResponse.ProtoReflect.Descriptor instead. -func (*GetSandboxLogsResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{121} -} - -func (x *GetSandboxLogsResponse) GetLogs() []*SandboxLogLine { - if x != nil { - return x.Logs - } - return nil -} - -func (x *GetSandboxLogsResponse) GetBufferTotal() uint32 { - if x != nil { - return x.BufferTotal - } - return 0 -} - -// Envelope for supervisor-to-gateway messages on the ConnectSupervisor stream. -type SupervisorMessage struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Payload: - // - // *SupervisorMessage_Hello - // *SupervisorMessage_Heartbeat - // *SupervisorMessage_RelayOpenResult - // *SupervisorMessage_RelayClose - Payload isSupervisorMessage_Payload `protobuf_oneof:"payload"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SupervisorMessage) Reset() { - *x = SupervisorMessage{} - mi := &file_openshell_proto_msgTypes[122] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SupervisorMessage) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SupervisorMessage) ProtoMessage() {} - -func (x *SupervisorMessage) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[122] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SupervisorMessage.ProtoReflect.Descriptor instead. -func (*SupervisorMessage) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{122} -} - -func (x *SupervisorMessage) GetPayload() isSupervisorMessage_Payload { - if x != nil { - return x.Payload - } - return nil -} - -func (x *SupervisorMessage) GetHello() *SupervisorHello { - if x != nil { - if x, ok := x.Payload.(*SupervisorMessage_Hello); ok { - return x.Hello - } - } - return nil -} - -func (x *SupervisorMessage) GetHeartbeat() *SupervisorHeartbeat { - if x != nil { - if x, ok := x.Payload.(*SupervisorMessage_Heartbeat); ok { - return x.Heartbeat - } - } - return nil -} - -func (x *SupervisorMessage) GetRelayOpenResult() *RelayOpenResult { - if x != nil { - if x, ok := x.Payload.(*SupervisorMessage_RelayOpenResult); ok { - return x.RelayOpenResult - } - } - return nil -} - -func (x *SupervisorMessage) GetRelayClose() *RelayClose { - if x != nil { - if x, ok := x.Payload.(*SupervisorMessage_RelayClose); ok { - return x.RelayClose - } - } - return nil -} - -type isSupervisorMessage_Payload interface { - isSupervisorMessage_Payload() -} - -type SupervisorMessage_Hello struct { - Hello *SupervisorHello `protobuf:"bytes,1,opt,name=hello,proto3,oneof"` -} - -type SupervisorMessage_Heartbeat struct { - Heartbeat *SupervisorHeartbeat `protobuf:"bytes,2,opt,name=heartbeat,proto3,oneof"` -} - -type SupervisorMessage_RelayOpenResult struct { - RelayOpenResult *RelayOpenResult `protobuf:"bytes,3,opt,name=relay_open_result,json=relayOpenResult,proto3,oneof"` -} - -type SupervisorMessage_RelayClose struct { - RelayClose *RelayClose `protobuf:"bytes,4,opt,name=relay_close,json=relayClose,proto3,oneof"` -} - -func (*SupervisorMessage_Hello) isSupervisorMessage_Payload() {} - -func (*SupervisorMessage_Heartbeat) isSupervisorMessage_Payload() {} - -func (*SupervisorMessage_RelayOpenResult) isSupervisorMessage_Payload() {} - -func (*SupervisorMessage_RelayClose) isSupervisorMessage_Payload() {} - -// Envelope for gateway-to-supervisor messages on the ConnectSupervisor stream. -type GatewayMessage struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Payload: - // - // *GatewayMessage_SessionAccepted - // *GatewayMessage_SessionRejected - // *GatewayMessage_Heartbeat - // *GatewayMessage_RelayOpen - // *GatewayMessage_RelayClose - Payload isGatewayMessage_Payload `protobuf_oneof:"payload"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GatewayMessage) Reset() { - *x = GatewayMessage{} - mi := &file_openshell_proto_msgTypes[123] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GatewayMessage) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GatewayMessage) ProtoMessage() {} - -func (x *GatewayMessage) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[123] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GatewayMessage.ProtoReflect.Descriptor instead. -func (*GatewayMessage) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{123} -} - -func (x *GatewayMessage) GetPayload() isGatewayMessage_Payload { - if x != nil { - return x.Payload - } - return nil -} - -func (x *GatewayMessage) GetSessionAccepted() *SessionAccepted { - if x != nil { - if x, ok := x.Payload.(*GatewayMessage_SessionAccepted); ok { - return x.SessionAccepted - } - } - return nil -} - -func (x *GatewayMessage) GetSessionRejected() *SessionRejected { - if x != nil { - if x, ok := x.Payload.(*GatewayMessage_SessionRejected); ok { - return x.SessionRejected - } - } - return nil -} - -func (x *GatewayMessage) GetHeartbeat() *GatewayHeartbeat { - if x != nil { - if x, ok := x.Payload.(*GatewayMessage_Heartbeat); ok { - return x.Heartbeat - } - } - return nil -} - -func (x *GatewayMessage) GetRelayOpen() *RelayOpen { - if x != nil { - if x, ok := x.Payload.(*GatewayMessage_RelayOpen); ok { - return x.RelayOpen - } - } - return nil -} - -func (x *GatewayMessage) GetRelayClose() *RelayClose { - if x != nil { - if x, ok := x.Payload.(*GatewayMessage_RelayClose); ok { - return x.RelayClose - } - } - return nil -} - -type isGatewayMessage_Payload interface { - isGatewayMessage_Payload() -} - -type GatewayMessage_SessionAccepted struct { - SessionAccepted *SessionAccepted `protobuf:"bytes,1,opt,name=session_accepted,json=sessionAccepted,proto3,oneof"` -} - -type GatewayMessage_SessionRejected struct { - SessionRejected *SessionRejected `protobuf:"bytes,2,opt,name=session_rejected,json=sessionRejected,proto3,oneof"` -} - -type GatewayMessage_Heartbeat struct { - Heartbeat *GatewayHeartbeat `protobuf:"bytes,3,opt,name=heartbeat,proto3,oneof"` -} - -type GatewayMessage_RelayOpen struct { - RelayOpen *RelayOpen `protobuf:"bytes,4,opt,name=relay_open,json=relayOpen,proto3,oneof"` -} - -type GatewayMessage_RelayClose struct { - RelayClose *RelayClose `protobuf:"bytes,5,opt,name=relay_close,json=relayClose,proto3,oneof"` -} - -func (*GatewayMessage_SessionAccepted) isGatewayMessage_Payload() {} - -func (*GatewayMessage_SessionRejected) isGatewayMessage_Payload() {} - -func (*GatewayMessage_Heartbeat) isGatewayMessage_Payload() {} - -func (*GatewayMessage_RelayOpen) isGatewayMessage_Payload() {} - -func (*GatewayMessage_RelayClose) isGatewayMessage_Payload() {} - -// Supervisor identifies itself and the sandbox it manages. -type SupervisorHello struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox ID this supervisor manages. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // Supervisor instance ID (e.g. boot id or process epoch). - InstanceId string `protobuf:"bytes,2,opt,name=instance_id,json=instanceId,proto3" json:"instance_id,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SupervisorHello) Reset() { - *x = SupervisorHello{} - mi := &file_openshell_proto_msgTypes[124] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SupervisorHello) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SupervisorHello) ProtoMessage() {} - -func (x *SupervisorHello) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[124] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SupervisorHello.ProtoReflect.Descriptor instead. -func (*SupervisorHello) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{124} -} - -func (x *SupervisorHello) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *SupervisorHello) GetInstanceId() string { - if x != nil { - return x.InstanceId - } - return "" -} - -// Gateway accepts the supervisor session. -type SessionAccepted struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Gateway-assigned session ID for this connection. - SessionId string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"` - // Recommended heartbeat interval in seconds. - HeartbeatIntervalSecs uint32 `protobuf:"varint,2,opt,name=heartbeat_interval_secs,json=heartbeatIntervalSecs,proto3" json:"heartbeat_interval_secs,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SessionAccepted) Reset() { - *x = SessionAccepted{} - mi := &file_openshell_proto_msgTypes[125] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SessionAccepted) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SessionAccepted) ProtoMessage() {} - -func (x *SessionAccepted) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[125] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SessionAccepted.ProtoReflect.Descriptor instead. -func (*SessionAccepted) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{125} -} - -func (x *SessionAccepted) GetSessionId() string { - if x != nil { - return x.SessionId - } - return "" -} - -func (x *SessionAccepted) GetHeartbeatIntervalSecs() uint32 { - if x != nil { - return x.HeartbeatIntervalSecs - } - return 0 -} - -// Gateway rejects the supervisor session. -type SessionRejected struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Human-readable rejection reason. - Reason string `protobuf:"bytes,1,opt,name=reason,proto3" json:"reason,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SessionRejected) Reset() { - *x = SessionRejected{} - mi := &file_openshell_proto_msgTypes[126] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SessionRejected) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SessionRejected) ProtoMessage() {} - -func (x *SessionRejected) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[126] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SessionRejected.ProtoReflect.Descriptor instead. -func (*SessionRejected) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{126} -} - -func (x *SessionRejected) GetReason() string { - if x != nil { - return x.Reason - } - return "" -} - -// Supervisor heartbeat. -type SupervisorHeartbeat struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SupervisorHeartbeat) Reset() { - *x = SupervisorHeartbeat{} - mi := &file_openshell_proto_msgTypes[127] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SupervisorHeartbeat) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SupervisorHeartbeat) ProtoMessage() {} - -func (x *SupervisorHeartbeat) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[127] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SupervisorHeartbeat.ProtoReflect.Descriptor instead. -func (*SupervisorHeartbeat) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{127} -} - -// Gateway heartbeat. -type GatewayHeartbeat struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GatewayHeartbeat) Reset() { - *x = GatewayHeartbeat{} - mi := &file_openshell_proto_msgTypes[128] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GatewayHeartbeat) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GatewayHeartbeat) ProtoMessage() {} - -func (x *GatewayHeartbeat) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[128] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GatewayHeartbeat.ProtoReflect.Descriptor instead. -func (*GatewayHeartbeat) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{128} -} - -// Gateway requests the supervisor to open a relay channel. -// -// On receiving this, the supervisor should initiate a RelayStream RPC to -// the gateway, sending a RelayInit in the first RelayFrame to associate -// the new HTTP/2 stream with the pending relay slot. The supervisor -// bridges that stream to the requested local target. -type RelayOpen struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Gateway-allocated channel identifier (UUID). - ChannelId string `protobuf:"bytes,1,opt,name=channel_id,json=channelId,proto3" json:"channel_id,omitempty"` - // Target the supervisor should dial inside the sandbox. - // If absent, supervisors treat the relay as SSH for compatibility. - // - // Types that are valid to be assigned to Target: - // - // *RelayOpen_Ssh - // *RelayOpen_Tcp - Target isRelayOpen_Target `protobuf_oneof:"target"` - // Optional service identifier for audit/correlation. - ServiceId string `protobuf:"bytes,5,opt,name=service_id,json=serviceId,proto3" json:"service_id,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RelayOpen) Reset() { - *x = RelayOpen{} - mi := &file_openshell_proto_msgTypes[129] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RelayOpen) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RelayOpen) ProtoMessage() {} - -func (x *RelayOpen) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[129] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RelayOpen.ProtoReflect.Descriptor instead. -func (*RelayOpen) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{129} -} - -func (x *RelayOpen) GetChannelId() string { - if x != nil { - return x.ChannelId - } - return "" -} - -func (x *RelayOpen) GetTarget() isRelayOpen_Target { - if x != nil { - return x.Target - } - return nil -} - -func (x *RelayOpen) GetSsh() *SshRelayTarget { - if x != nil { - if x, ok := x.Target.(*RelayOpen_Ssh); ok { - return x.Ssh - } - } - return nil -} - -func (x *RelayOpen) GetTcp() *TcpRelayTarget { - if x != nil { - if x, ok := x.Target.(*RelayOpen_Tcp); ok { - return x.Tcp - } - } - return nil -} - -func (x *RelayOpen) GetServiceId() string { - if x != nil { - return x.ServiceId - } - return "" -} - -type isRelayOpen_Target interface { - isRelayOpen_Target() -} - -type RelayOpen_Ssh struct { - Ssh *SshRelayTarget `protobuf:"bytes,2,opt,name=ssh,proto3,oneof"` -} - -type RelayOpen_Tcp struct { - Tcp *TcpRelayTarget `protobuf:"bytes,3,opt,name=tcp,proto3,oneof"` -} - -func (*RelayOpen_Ssh) isRelayOpen_Target() {} - -func (*RelayOpen_Tcp) isRelayOpen_Target() {} - -// Built-in SSH relay target. -type SshRelayTarget struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SshRelayTarget) Reset() { - *x = SshRelayTarget{} - mi := &file_openshell_proto_msgTypes[130] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SshRelayTarget) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SshRelayTarget) ProtoMessage() {} - -func (x *SshRelayTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[130] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SshRelayTarget.ProtoReflect.Descriptor instead. -func (*SshRelayTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{130} -} - -// TCP target dialed by the supervisor from inside the sandbox. -type TcpRelayTarget struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Phase 1 accepts loopback only: 127.0.0.1, ::1, or localhost. - Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"` - // Target port. Must fit in u16 and be non-zero. - Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *TcpRelayTarget) Reset() { - *x = TcpRelayTarget{} - mi := &file_openshell_proto_msgTypes[131] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *TcpRelayTarget) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*TcpRelayTarget) ProtoMessage() {} - -func (x *TcpRelayTarget) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[131] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use TcpRelayTarget.ProtoReflect.Descriptor instead. -func (*TcpRelayTarget) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{131} -} - -func (x *TcpRelayTarget) GetHost() string { - if x != nil { - return x.Host - } - return "" -} - -func (x *TcpRelayTarget) GetPort() uint32 { - if x != nil { - return x.Port - } - return 0 -} - -// Initial RelayStream frame sent by the supervisor to claim a pending relay. -type RelayInit struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Gateway-allocated channel identifier (UUID). - ChannelId string `protobuf:"bytes,1,opt,name=channel_id,json=channelId,proto3" json:"channel_id,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RelayInit) Reset() { - *x = RelayInit{} - mi := &file_openshell_proto_msgTypes[132] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RelayInit) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RelayInit) ProtoMessage() {} - -func (x *RelayInit) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[132] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RelayInit.ProtoReflect.Descriptor instead. -func (*RelayInit) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{132} -} - -func (x *RelayInit) GetChannelId() string { - if x != nil { - return x.ChannelId - } - return "" -} - -// A single frame on the RelayStream RPC. -// -// The supervisor MUST send `init` as the first frame. All subsequent frames -// in either direction carry raw bytes in `data`. -type RelayFrame struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Payload: - // - // *RelayFrame_Init - // *RelayFrame_Data - Payload isRelayFrame_Payload `protobuf_oneof:"payload"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RelayFrame) Reset() { - *x = RelayFrame{} - mi := &file_openshell_proto_msgTypes[133] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RelayFrame) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RelayFrame) ProtoMessage() {} - -func (x *RelayFrame) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[133] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RelayFrame.ProtoReflect.Descriptor instead. -func (*RelayFrame) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{133} -} - -func (x *RelayFrame) GetPayload() isRelayFrame_Payload { - if x != nil { - return x.Payload - } - return nil -} - -func (x *RelayFrame) GetInit() *RelayInit { - if x != nil { - if x, ok := x.Payload.(*RelayFrame_Init); ok { - return x.Init - } - } - return nil -} - -func (x *RelayFrame) GetData() []byte { - if x != nil { - if x, ok := x.Payload.(*RelayFrame_Data); ok { - return x.Data - } - } - return nil -} - -type isRelayFrame_Payload interface { - isRelayFrame_Payload() -} - -type RelayFrame_Init struct { - Init *RelayInit `protobuf:"bytes,1,opt,name=init,proto3,oneof"` -} - -type RelayFrame_Data struct { - Data []byte `protobuf:"bytes,2,opt,name=data,proto3,oneof"` -} - -func (*RelayFrame_Init) isRelayFrame_Payload() {} - -func (*RelayFrame_Data) isRelayFrame_Payload() {} - -// Supervisor reports the result of a relay open request. -type RelayOpenResult struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Channel identifier from the RelayOpen request. - ChannelId string `protobuf:"bytes,1,opt,name=channel_id,json=channelId,proto3" json:"channel_id,omitempty"` - // True if the relay was successfully established. - Success bool `protobuf:"varint,2,opt,name=success,proto3" json:"success,omitempty"` - // Error message if success is false. - Error string `protobuf:"bytes,3,opt,name=error,proto3" json:"error,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RelayOpenResult) Reset() { - *x = RelayOpenResult{} - mi := &file_openshell_proto_msgTypes[134] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RelayOpenResult) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RelayOpenResult) ProtoMessage() {} - -func (x *RelayOpenResult) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[134] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RelayOpenResult.ProtoReflect.Descriptor instead. -func (*RelayOpenResult) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{134} -} - -func (x *RelayOpenResult) GetChannelId() string { - if x != nil { - return x.ChannelId - } - return "" -} - -func (x *RelayOpenResult) GetSuccess() bool { - if x != nil { - return x.Success - } - return false -} - -func (x *RelayOpenResult) GetError() string { - if x != nil { - return x.Error - } - return "" -} - -// Either side requests closure of a relay channel. -type RelayClose struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Channel identifier to close. - ChannelId string `protobuf:"bytes,1,opt,name=channel_id,json=channelId,proto3" json:"channel_id,omitempty"` - // Optional reason for closure. - Reason string `protobuf:"bytes,2,opt,name=reason,proto3" json:"reason,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RelayClose) Reset() { - *x = RelayClose{} - mi := &file_openshell_proto_msgTypes[135] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RelayClose) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RelayClose) ProtoMessage() {} - -func (x *RelayClose) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[135] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RelayClose.ProtoReflect.Descriptor instead. -func (*RelayClose) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{135} -} - -func (x *RelayClose) GetChannelId() string { - if x != nil { - return x.ChannelId - } - return "" -} - -func (x *RelayClose) GetReason() string { - if x != nil { - return x.Reason - } - return "" -} - -// Observed HTTP method+path pattern from L7 inspection. -type L7RequestSample struct { - state protoimpl.MessageState `protogen:"open.v1"` - // HTTP method: GET, POST, PUT, DELETE, etc. - Method string `protobuf:"bytes,1,opt,name=method,proto3" json:"method,omitempty"` - // HTTP path: /v1/models, /repos/myorg/issues - Path string `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"` - // L7 decision: "audit" or "deny" (allowed requests not collected). - Decision string `protobuf:"bytes,3,opt,name=decision,proto3" json:"decision,omitempty"` - // Number of times this (method, path) was observed. - Count uint32 `protobuf:"varint,4,opt,name=count,proto3" json:"count,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *L7RequestSample) Reset() { - *x = L7RequestSample{} - mi := &file_openshell_proto_msgTypes[136] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *L7RequestSample) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*L7RequestSample) ProtoMessage() {} - -func (x *L7RequestSample) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[136] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use L7RequestSample.ProtoReflect.Descriptor instead. -func (*L7RequestSample) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{136} -} - -func (x *L7RequestSample) GetMethod() string { - if x != nil { - return x.Method - } - return "" -} - -func (x *L7RequestSample) GetPath() string { - if x != nil { - return x.Path - } - return "" -} - -func (x *L7RequestSample) GetDecision() string { - if x != nil { - return x.Decision - } - return "" -} - -func (x *L7RequestSample) GetCount() uint32 { - if x != nil { - return x.Count - } - return 0 -} - -// Structured denial summary from sandbox aggregator. -type DenialSummary struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox ID that produced this summary. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - // Denied destination host. - Host string `protobuf:"bytes,2,opt,name=host,proto3" json:"host,omitempty"` - // Denied destination port. - Port uint32 `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"` - // Binary that attempted the connection. - Binary string `protobuf:"bytes,4,opt,name=binary,proto3" json:"binary,omitempty"` - // Process ancestor chain. - Ancestors []string `protobuf:"bytes,5,rep,name=ancestors,proto3" json:"ancestors,omitempty"` - // Denial reason from OPA evaluation. - DenyReason string `protobuf:"bytes,6,opt,name=deny_reason,json=denyReason,proto3" json:"deny_reason,omitempty"` - // First denial timestamp (ms since epoch). - FirstSeenMs int64 `protobuf:"varint,7,opt,name=first_seen_ms,json=firstSeenMs,proto3" json:"first_seen_ms,omitempty"` - // Most recent denial timestamp (ms since epoch). - LastSeenMs int64 `protobuf:"varint,8,opt,name=last_seen_ms,json=lastSeenMs,proto3" json:"last_seen_ms,omitempty"` - // Number of denials in the current window. - Count uint32 `protobuf:"varint,9,opt,name=count,proto3" json:"count,omitempty"` - // Events dropped during aggregator cooldown. - SuppressedCount uint32 `protobuf:"varint,10,opt,name=suppressed_count,json=suppressedCount,proto3" json:"suppressed_count,omitempty"` - // Cumulative lifetime count (never resets). - TotalCount uint32 `protobuf:"varint,11,opt,name=total_count,json=totalCount,proto3" json:"total_count,omitempty"` - // Distinct cmdline strings observed (sanitized of credentials). - SampleCmdlines []string `protobuf:"bytes,12,rep,name=sample_cmdlines,json=sampleCmdlines,proto3" json:"sample_cmdlines,omitempty"` - // SHA-256 of the binary for audit trail. - BinarySha256 string `protobuf:"bytes,13,opt,name=binary_sha256,json=binarySha256,proto3" json:"binary_sha256,omitempty"` - // True if emitted by stale-flush rather than threshold. - Persistent bool `protobuf:"varint,14,opt,name=persistent,proto3" json:"persistent,omitempty"` - // Denial category: "l4_deny", "l7_deny", "l7_audit", "ssrf". - DenialStage string `protobuf:"bytes,15,opt,name=denial_stage,json=denialStage,proto3" json:"denial_stage,omitempty"` - // Observed HTTP request patterns (from L7 inspection). - L7RequestSamples []*L7RequestSample `protobuf:"bytes,16,rep,name=l7_request_samples,json=l7RequestSamples,proto3" json:"l7_request_samples,omitempty"` - // True if L7 inspection was active during observation window. - L7InspectionActive bool `protobuf:"varint,17,opt,name=l7_inspection_active,json=l7InspectionActive,proto3" json:"l7_inspection_active,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DenialSummary) Reset() { - *x = DenialSummary{} - mi := &file_openshell_proto_msgTypes[137] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DenialSummary) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DenialSummary) ProtoMessage() {} - -func (x *DenialSummary) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[137] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DenialSummary.ProtoReflect.Descriptor instead. -func (*DenialSummary) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{137} -} - -func (x *DenialSummary) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *DenialSummary) GetHost() string { - if x != nil { - return x.Host - } - return "" -} - -func (x *DenialSummary) GetPort() uint32 { - if x != nil { - return x.Port - } - return 0 -} - -func (x *DenialSummary) GetBinary() string { - if x != nil { - return x.Binary - } - return "" -} - -func (x *DenialSummary) GetAncestors() []string { - if x != nil { - return x.Ancestors - } - return nil -} - -func (x *DenialSummary) GetDenyReason() string { - if x != nil { - return x.DenyReason - } - return "" -} - -func (x *DenialSummary) GetFirstSeenMs() int64 { - if x != nil { - return x.FirstSeenMs - } - return 0 -} - -func (x *DenialSummary) GetLastSeenMs() int64 { - if x != nil { - return x.LastSeenMs - } - return 0 -} - -func (x *DenialSummary) GetCount() uint32 { - if x != nil { - return x.Count - } - return 0 -} - -func (x *DenialSummary) GetSuppressedCount() uint32 { - if x != nil { - return x.SuppressedCount - } - return 0 -} - -func (x *DenialSummary) GetTotalCount() uint32 { - if x != nil { - return x.TotalCount - } - return 0 -} - -func (x *DenialSummary) GetSampleCmdlines() []string { - if x != nil { - return x.SampleCmdlines - } - return nil -} - -func (x *DenialSummary) GetBinarySha256() string { - if x != nil { - return x.BinarySha256 - } - return "" -} - -func (x *DenialSummary) GetPersistent() bool { - if x != nil { - return x.Persistent - } - return false -} - -func (x *DenialSummary) GetDenialStage() string { - if x != nil { - return x.DenialStage - } - return "" -} - -func (x *DenialSummary) GetL7RequestSamples() []*L7RequestSample { - if x != nil { - return x.L7RequestSamples - } - return nil -} - -func (x *DenialSummary) GetL7InspectionActive() bool { - if x != nil { - return x.L7InspectionActive - } - return false -} - -// Count of denied actions grouped only by sanitized telemetry category. -type DenialGroupCount struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sanitized denial category, e.g. "connect_policy", "l7_policy", "ssrf". - DenyGroup string `protobuf:"bytes,1,opt,name=deny_group,json=denyGroup,proto3" json:"deny_group,omitempty"` - // Number of denied actions in this category. - DeniedCount uint32 `protobuf:"varint,2,opt,name=denied_count,json=deniedCount,proto3" json:"denied_count,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DenialGroupCount) Reset() { - *x = DenialGroupCount{} - mi := &file_openshell_proto_msgTypes[138] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DenialGroupCount) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DenialGroupCount) ProtoMessage() {} - -func (x *DenialGroupCount) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[138] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DenialGroupCount.ProtoReflect.Descriptor instead. -func (*DenialGroupCount) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{138} -} - -func (x *DenialGroupCount) GetDenyGroup() string { - if x != nil { - return x.DenyGroup - } - return "" -} - -func (x *DenialGroupCount) GetDeniedCount() uint32 { - if x != nil { - return x.DeniedCount - } - return 0 -} - -// Anonymous sandbox network activity counters. This intentionally excludes -// hosts, paths, binaries, raw deny reasons, sandbox IDs, and user content. -type NetworkActivitySummary struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Total observed network activities in the current window. - NetworkActivityCount uint32 `protobuf:"varint,1,opt,name=network_activity_count,json=networkActivityCount,proto3" json:"network_activity_count,omitempty"` - // Total denied actions in the current window. - DeniedActionCount uint32 `protobuf:"varint,2,opt,name=denied_action_count,json=deniedActionCount,proto3" json:"denied_action_count,omitempty"` - // Denied action counts grouped by sanitized category. - DenialsByGroup []*DenialGroupCount `protobuf:"bytes,3,rep,name=denials_by_group,json=denialsByGroup,proto3" json:"denials_by_group,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *NetworkActivitySummary) Reset() { - *x = NetworkActivitySummary{} - mi := &file_openshell_proto_msgTypes[139] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *NetworkActivitySummary) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*NetworkActivitySummary) ProtoMessage() {} - -func (x *NetworkActivitySummary) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[139] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use NetworkActivitySummary.ProtoReflect.Descriptor instead. -func (*NetworkActivitySummary) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{139} -} - -func (x *NetworkActivitySummary) GetNetworkActivityCount() uint32 { - if x != nil { - return x.NetworkActivityCount - } - return 0 -} - -func (x *NetworkActivitySummary) GetDeniedActionCount() uint32 { - if x != nil { - return x.DeniedActionCount - } - return 0 -} - -func (x *NetworkActivitySummary) GetDenialsByGroup() []*DenialGroupCount { - if x != nil { - return x.DenialsByGroup - } - return nil -} - -// A proposed policy rule with rationale and approval status. -type PolicyChunk struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Unique chunk identifier. - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` - // Approval status: "pending", "approved", "rejected". - Status string `protobuf:"bytes,2,opt,name=status,proto3" json:"status,omitempty"` - // Proposed network_policies map key. - RuleName string `protobuf:"bytes,3,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"` - // The proposed network policy rule. - ProposedRule *sandboxv1.NetworkPolicyRule `protobuf:"bytes,4,opt,name=proposed_rule,json=proposedRule,proto3" json:"proposed_rule,omitempty"` - // Human-readable explanation of why this rule is proposed. - Rationale string `protobuf:"bytes,5,opt,name=rationale,proto3" json:"rationale,omitempty"` - // Security concerns flagged by analysis (empty if none). - SecurityNotes string `protobuf:"bytes,6,opt,name=security_notes,json=securityNotes,proto3" json:"security_notes,omitempty"` - // Analysis confidence (0.0-1.0). 0 for mechanistic mode. - Confidence float32 `protobuf:"fixed32,7,opt,name=confidence,proto3" json:"confidence,omitempty"` - // IDs of denial summaries that led to this chunk. - DenialSummaryIds []string `protobuf:"bytes,8,rep,name=denial_summary_ids,json=denialSummaryIds,proto3" json:"denial_summary_ids,omitempty"` - // Creation timestamp (ms since epoch). - CreatedAtMs int64 `protobuf:"varint,9,opt,name=created_at_ms,json=createdAtMs,proto3" json:"created_at_ms,omitempty"` - // When the user approved/rejected (ms since epoch). 0 if undecided. - DecidedAtMs int64 `protobuf:"varint,10,opt,name=decided_at_ms,json=decidedAtMs,proto3" json:"decided_at_ms,omitempty"` - // Recommendation stage: "initial" or "refined" (progressive L7 visibility). - Stage string `protobuf:"bytes,11,opt,name=stage,proto3" json:"stage,omitempty"` - // For stage="refined": the initial chunk this replaces. - SupersedesChunkId string `protobuf:"bytes,12,opt,name=supersedes_chunk_id,json=supersedesChunkId,proto3" json:"supersedes_chunk_id,omitempty"` - // How many times this endpoint has been seen across denial flush cycles. - HitCount int32 `protobuf:"varint,13,opt,name=hit_count,json=hitCount,proto3" json:"hit_count,omitempty"` - // First time this endpoint was proposed (ms since epoch). - FirstSeenMs int64 `protobuf:"varint,14,opt,name=first_seen_ms,json=firstSeenMs,proto3" json:"first_seen_ms,omitempty"` - // Most recent time this endpoint was re-proposed (ms since epoch). - LastSeenMs int64 `protobuf:"varint,15,opt,name=last_seen_ms,json=lastSeenMs,proto3" json:"last_seen_ms,omitempty"` - // Binary path that triggered the denial (denormalized for display convenience). - Binary string `protobuf:"bytes,16,opt,name=binary,proto3" json:"binary,omitempty"` - // Validation verdict from gateway-side static checks (prover output). - // Free-form summary string for human consumption in the inbox card. - // Empty until the prover has run for this chunk. - ValidationResult string `protobuf:"bytes,17,opt,name=validation_result,json=validationResult,proto3" json:"validation_result,omitempty"` - // Operator-supplied free-form text accompanying a rejection. Populated - // when the reviewer rejects via `RejectDraftChunkRequest.reason`; surfaced - // back to the in-sandbox agent so it can revise the proposal. - // Empty for non-rejected chunks. - RejectionReason string `protobuf:"bytes,18,opt,name=rejection_reason,json=rejectionReason,proto3" json:"rejection_reason,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *PolicyChunk) Reset() { - *x = PolicyChunk{} - mi := &file_openshell_proto_msgTypes[140] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *PolicyChunk) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*PolicyChunk) ProtoMessage() {} - -func (x *PolicyChunk) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[140] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use PolicyChunk.ProtoReflect.Descriptor instead. -func (*PolicyChunk) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{140} -} - -func (x *PolicyChunk) GetId() string { - if x != nil { - return x.Id - } - return "" -} - -func (x *PolicyChunk) GetStatus() string { - if x != nil { - return x.Status - } - return "" -} - -func (x *PolicyChunk) GetRuleName() string { - if x != nil { - return x.RuleName - } - return "" -} - -func (x *PolicyChunk) GetProposedRule() *sandboxv1.NetworkPolicyRule { - if x != nil { - return x.ProposedRule - } - return nil -} - -func (x *PolicyChunk) GetRationale() string { - if x != nil { - return x.Rationale - } - return "" -} - -func (x *PolicyChunk) GetSecurityNotes() string { - if x != nil { - return x.SecurityNotes - } - return "" -} - -func (x *PolicyChunk) GetConfidence() float32 { - if x != nil { - return x.Confidence - } - return 0 -} - -func (x *PolicyChunk) GetDenialSummaryIds() []string { - if x != nil { - return x.DenialSummaryIds - } - return nil -} - -func (x *PolicyChunk) GetCreatedAtMs() int64 { - if x != nil { - return x.CreatedAtMs - } - return 0 -} - -func (x *PolicyChunk) GetDecidedAtMs() int64 { - if x != nil { - return x.DecidedAtMs - } - return 0 -} - -func (x *PolicyChunk) GetStage() string { - if x != nil { - return x.Stage - } - return "" -} - -func (x *PolicyChunk) GetSupersedesChunkId() string { - if x != nil { - return x.SupersedesChunkId - } - return "" -} - -func (x *PolicyChunk) GetHitCount() int32 { - if x != nil { - return x.HitCount - } - return 0 -} - -func (x *PolicyChunk) GetFirstSeenMs() int64 { - if x != nil { - return x.FirstSeenMs - } - return 0 -} - -func (x *PolicyChunk) GetLastSeenMs() int64 { - if x != nil { - return x.LastSeenMs - } - return 0 -} - -func (x *PolicyChunk) GetBinary() string { - if x != nil { - return x.Binary - } - return "" -} - -func (x *PolicyChunk) GetValidationResult() string { - if x != nil { - return x.ValidationResult - } - return "" -} - -func (x *PolicyChunk) GetRejectionReason() string { - if x != nil { - return x.RejectionReason - } - return "" -} - -// Notification that the draft policy was updated. -type DraftPolicyUpdate struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Current draft version. - DraftVersion uint64 `protobuf:"varint,1,opt,name=draft_version,json=draftVersion,proto3" json:"draft_version,omitempty"` - // Number of new chunks added in this update. - NewChunks uint32 `protobuf:"varint,2,opt,name=new_chunks,json=newChunks,proto3" json:"new_chunks,omitempty"` - // Total pending chunks awaiting approval. - TotalPending uint32 `protobuf:"varint,3,opt,name=total_pending,json=totalPending,proto3" json:"total_pending,omitempty"` - // Brief description of what changed. - Summary string `protobuf:"bytes,4,opt,name=summary,proto3" json:"summary,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DraftPolicyUpdate) Reset() { - *x = DraftPolicyUpdate{} - mi := &file_openshell_proto_msgTypes[141] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DraftPolicyUpdate) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DraftPolicyUpdate) ProtoMessage() {} - -func (x *DraftPolicyUpdate) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[141] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DraftPolicyUpdate.ProtoReflect.Descriptor instead. -func (*DraftPolicyUpdate) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{141} -} - -func (x *DraftPolicyUpdate) GetDraftVersion() uint64 { - if x != nil { - return x.DraftVersion - } - return 0 -} - -func (x *DraftPolicyUpdate) GetNewChunks() uint32 { - if x != nil { - return x.NewChunks - } - return 0 -} - -func (x *DraftPolicyUpdate) GetTotalPending() uint32 { - if x != nil { - return x.TotalPending - } - return 0 -} - -func (x *DraftPolicyUpdate) GetSummary() string { - if x != nil { - return x.Summary - } - return "" -} - -// Submit analysis results from sandbox to gateway. -type SubmitPolicyAnalysisRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Aggregated denial summaries. - Summaries []*DenialSummary `protobuf:"bytes,1,rep,name=summaries,proto3" json:"summaries,omitempty"` - // Proposed policy chunks (validated by sandbox OPA engine). - ProposedChunks []*PolicyChunk `protobuf:"bytes,2,rep,name=proposed_chunks,json=proposedChunks,proto3" json:"proposed_chunks,omitempty"` - // Analysis mode. `mechanistic` is the observation-driven path from the - // denial aggregator — chunks targeting the same host|port|binary fold - // into one row with hit_count incremented. `agent_authored` is an - // intentional proposal from an in-sandbox agent — each submission lands - // as its own chunk so the redraft-after-rejection loop has a stable id - // to watch. Other values are treated as agent-style (no dedup) so a new - // mode does not silently collapse proposals. - AnalysisMode string `protobuf:"bytes,3,opt,name=analysis_mode,json=analysisMode,proto3" json:"analysis_mode,omitempty"` - // Sandbox name. - Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"` - // Anonymous network activity counters. - NetworkActivitySummaries []*NetworkActivitySummary `protobuf:"bytes,5,rep,name=network_activity_summaries,json=networkActivitySummaries,proto3" json:"network_activity_summaries,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,6,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SubmitPolicyAnalysisRequest) Reset() { - *x = SubmitPolicyAnalysisRequest{} - mi := &file_openshell_proto_msgTypes[142] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SubmitPolicyAnalysisRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SubmitPolicyAnalysisRequest) ProtoMessage() {} - -func (x *SubmitPolicyAnalysisRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[142] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SubmitPolicyAnalysisRequest.ProtoReflect.Descriptor instead. -func (*SubmitPolicyAnalysisRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{142} -} - -func (x *SubmitPolicyAnalysisRequest) GetSummaries() []*DenialSummary { - if x != nil { - return x.Summaries - } - return nil -} - -func (x *SubmitPolicyAnalysisRequest) GetProposedChunks() []*PolicyChunk { - if x != nil { - return x.ProposedChunks - } - return nil -} - -func (x *SubmitPolicyAnalysisRequest) GetAnalysisMode() string { - if x != nil { - return x.AnalysisMode - } - return "" -} - -func (x *SubmitPolicyAnalysisRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *SubmitPolicyAnalysisRequest) GetNetworkActivitySummaries() []*NetworkActivitySummary { - if x != nil { - return x.NetworkActivitySummaries - } - return nil -} - -func (x *SubmitPolicyAnalysisRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type SubmitPolicyAnalysisResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Number of chunks accepted by the gateway. - AcceptedChunks uint32 `protobuf:"varint,1,opt,name=accepted_chunks,json=acceptedChunks,proto3" json:"accepted_chunks,omitempty"` - // Number of chunks rejected by gateway validation. - RejectedChunks uint32 `protobuf:"varint,2,opt,name=rejected_chunks,json=rejectedChunks,proto3" json:"rejected_chunks,omitempty"` - // Reasons for each rejected chunk. - RejectionReasons []string `protobuf:"bytes,3,rep,name=rejection_reasons,json=rejectionReasons,proto3" json:"rejection_reasons,omitempty"` - // Server-assigned chunk IDs for the accepted chunks, in submission order. - // Agents use these to watch proposal state via policy.local's - // GET /v1/proposals/{id} and /wait endpoints. - AcceptedChunkIds []string `protobuf:"bytes,4,rep,name=accepted_chunk_ids,json=acceptedChunkIds,proto3" json:"accepted_chunk_ids,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SubmitPolicyAnalysisResponse) Reset() { - *x = SubmitPolicyAnalysisResponse{} - mi := &file_openshell_proto_msgTypes[143] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SubmitPolicyAnalysisResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SubmitPolicyAnalysisResponse) ProtoMessage() {} - -func (x *SubmitPolicyAnalysisResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[143] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SubmitPolicyAnalysisResponse.ProtoReflect.Descriptor instead. -func (*SubmitPolicyAnalysisResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{143} -} - -func (x *SubmitPolicyAnalysisResponse) GetAcceptedChunks() uint32 { - if x != nil { - return x.AcceptedChunks - } - return 0 -} - -func (x *SubmitPolicyAnalysisResponse) GetRejectedChunks() uint32 { - if x != nil { - return x.RejectedChunks - } - return 0 -} - -func (x *SubmitPolicyAnalysisResponse) GetRejectionReasons() []string { - if x != nil { - return x.RejectionReasons - } - return nil -} - -func (x *SubmitPolicyAnalysisResponse) GetAcceptedChunkIds() []string { - if x != nil { - return x.AcceptedChunkIds - } - return nil -} - -// Get draft policy for a sandbox. -type GetDraftPolicyRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Optional status filter: "pending", "approved", "rejected", or "" for all. - StatusFilter string `protobuf:"bytes,2,opt,name=status_filter,json=statusFilter,proto3" json:"status_filter,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetDraftPolicyRequest) Reset() { - *x = GetDraftPolicyRequest{} - mi := &file_openshell_proto_msgTypes[144] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetDraftPolicyRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetDraftPolicyRequest) ProtoMessage() {} - -func (x *GetDraftPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[144] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetDraftPolicyRequest.ProtoReflect.Descriptor instead. -func (*GetDraftPolicyRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{144} -} - -func (x *GetDraftPolicyRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *GetDraftPolicyRequest) GetStatusFilter() string { - if x != nil { - return x.StatusFilter - } - return "" -} - -func (x *GetDraftPolicyRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type GetDraftPolicyResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Draft policy chunks. - Chunks []*PolicyChunk `protobuf:"bytes,1,rep,name=chunks,proto3" json:"chunks,omitempty"` - // LLM-generated summary of all analysis (empty in mechanistic mode). - RollingSummary string `protobuf:"bytes,2,opt,name=rolling_summary,json=rollingSummary,proto3" json:"rolling_summary,omitempty"` - // Current draft version. - DraftVersion uint64 `protobuf:"varint,3,opt,name=draft_version,json=draftVersion,proto3" json:"draft_version,omitempty"` - // When the last analysis completed (ms since epoch). - LastAnalyzedAtMs int64 `protobuf:"varint,4,opt,name=last_analyzed_at_ms,json=lastAnalyzedAtMs,proto3" json:"last_analyzed_at_ms,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetDraftPolicyResponse) Reset() { - *x = GetDraftPolicyResponse{} - mi := &file_openshell_proto_msgTypes[145] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetDraftPolicyResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetDraftPolicyResponse) ProtoMessage() {} - -func (x *GetDraftPolicyResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[145] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetDraftPolicyResponse.ProtoReflect.Descriptor instead. -func (*GetDraftPolicyResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{145} -} - -func (x *GetDraftPolicyResponse) GetChunks() []*PolicyChunk { - if x != nil { - return x.Chunks - } - return nil -} - -func (x *GetDraftPolicyResponse) GetRollingSummary() string { - if x != nil { - return x.RollingSummary - } - return "" -} - -func (x *GetDraftPolicyResponse) GetDraftVersion() uint64 { - if x != nil { - return x.DraftVersion - } - return 0 -} - -func (x *GetDraftPolicyResponse) GetLastAnalyzedAtMs() int64 { - if x != nil { - return x.LastAnalyzedAtMs - } - return 0 -} - -// Approve a single draft chunk. -type ApproveDraftChunkRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Chunk ID to approve. - ChunkId string `protobuf:"bytes,2,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ApproveDraftChunkRequest) Reset() { - *x = ApproveDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[146] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ApproveDraftChunkRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ApproveDraftChunkRequest) ProtoMessage() {} - -func (x *ApproveDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[146] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ApproveDraftChunkRequest.ProtoReflect.Descriptor instead. -func (*ApproveDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{146} -} - -func (x *ApproveDraftChunkRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *ApproveDraftChunkRequest) GetChunkId() string { - if x != nil { - return x.ChunkId - } - return "" -} - -func (x *ApproveDraftChunkRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type ApproveDraftChunkResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // New policy version after merge. - PolicyVersion uint32 `protobuf:"varint,1,opt,name=policy_version,json=policyVersion,proto3" json:"policy_version,omitempty"` - // SHA-256 hash of the new policy. - PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ApproveDraftChunkResponse) Reset() { - *x = ApproveDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[147] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ApproveDraftChunkResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ApproveDraftChunkResponse) ProtoMessage() {} - -func (x *ApproveDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[147] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ApproveDraftChunkResponse.ProtoReflect.Descriptor instead. -func (*ApproveDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{147} -} - -func (x *ApproveDraftChunkResponse) GetPolicyVersion() uint32 { - if x != nil { - return x.PolicyVersion - } - return 0 -} - -func (x *ApproveDraftChunkResponse) GetPolicyHash() string { - if x != nil { - return x.PolicyHash - } - return "" -} - -// Reject a single draft chunk. -type RejectDraftChunkRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Chunk ID to reject. - ChunkId string `protobuf:"bytes,2,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"` - // Optional reason for rejection (fed to LLM context in future analysis). - Reason string `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RejectDraftChunkRequest) Reset() { - *x = RejectDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[148] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RejectDraftChunkRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RejectDraftChunkRequest) ProtoMessage() {} - -func (x *RejectDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[148] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RejectDraftChunkRequest.ProtoReflect.Descriptor instead. -func (*RejectDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{148} -} - -func (x *RejectDraftChunkRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *RejectDraftChunkRequest) GetChunkId() string { - if x != nil { - return x.ChunkId - } - return "" -} - -func (x *RejectDraftChunkRequest) GetReason() string { - if x != nil { - return x.Reason - } - return "" -} - -func (x *RejectDraftChunkRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type RejectDraftChunkResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RejectDraftChunkResponse) Reset() { - *x = RejectDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[149] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RejectDraftChunkResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RejectDraftChunkResponse) ProtoMessage() {} - -func (x *RejectDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[149] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RejectDraftChunkResponse.ProtoReflect.Descriptor instead. -func (*RejectDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{149} -} - -// Approve all pending chunks. -type ApproveAllDraftChunksRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Include chunks with security_notes (default false: skips them). - IncludeSecurityFlagged bool `protobuf:"varint,2,opt,name=include_security_flagged,json=includeSecurityFlagged,proto3" json:"include_security_flagged,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ApproveAllDraftChunksRequest) Reset() { - *x = ApproveAllDraftChunksRequest{} - mi := &file_openshell_proto_msgTypes[150] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ApproveAllDraftChunksRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ApproveAllDraftChunksRequest) ProtoMessage() {} - -func (x *ApproveAllDraftChunksRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[150] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ApproveAllDraftChunksRequest.ProtoReflect.Descriptor instead. -func (*ApproveAllDraftChunksRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{150} -} - -func (x *ApproveAllDraftChunksRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *ApproveAllDraftChunksRequest) GetIncludeSecurityFlagged() bool { - if x != nil { - return x.IncludeSecurityFlagged - } - return false -} - -func (x *ApproveAllDraftChunksRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type ApproveAllDraftChunksResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // New policy version after merge. - PolicyVersion uint32 `protobuf:"varint,1,opt,name=policy_version,json=policyVersion,proto3" json:"policy_version,omitempty"` - // SHA-256 hash of the new policy. - PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"` - // Number of chunks approved. - ChunksApproved uint32 `protobuf:"varint,3,opt,name=chunks_approved,json=chunksApproved,proto3" json:"chunks_approved,omitempty"` - // Number of chunks skipped (security-flagged). - ChunksSkipped uint32 `protobuf:"varint,4,opt,name=chunks_skipped,json=chunksSkipped,proto3" json:"chunks_skipped,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ApproveAllDraftChunksResponse) Reset() { - *x = ApproveAllDraftChunksResponse{} - mi := &file_openshell_proto_msgTypes[151] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ApproveAllDraftChunksResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ApproveAllDraftChunksResponse) ProtoMessage() {} - -func (x *ApproveAllDraftChunksResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[151] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ApproveAllDraftChunksResponse.ProtoReflect.Descriptor instead. -func (*ApproveAllDraftChunksResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{151} -} - -func (x *ApproveAllDraftChunksResponse) GetPolicyVersion() uint32 { - if x != nil { - return x.PolicyVersion - } - return 0 -} - -func (x *ApproveAllDraftChunksResponse) GetPolicyHash() string { - if x != nil { - return x.PolicyHash - } - return "" -} - -func (x *ApproveAllDraftChunksResponse) GetChunksApproved() uint32 { - if x != nil { - return x.ChunksApproved - } - return 0 -} - -func (x *ApproveAllDraftChunksResponse) GetChunksSkipped() uint32 { - if x != nil { - return x.ChunksSkipped - } - return 0 -} - -// Edit a pending chunk in-place. -type EditDraftChunkRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Chunk ID to edit. - ChunkId string `protobuf:"bytes,2,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"` - // The modified rule (replaces existing proposed_rule). - ProposedRule *sandboxv1.NetworkPolicyRule `protobuf:"bytes,3,opt,name=proposed_rule,json=proposedRule,proto3" json:"proposed_rule,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *EditDraftChunkRequest) Reset() { - *x = EditDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[152] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *EditDraftChunkRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*EditDraftChunkRequest) ProtoMessage() {} - -func (x *EditDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[152] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use EditDraftChunkRequest.ProtoReflect.Descriptor instead. -func (*EditDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{152} -} - -func (x *EditDraftChunkRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *EditDraftChunkRequest) GetChunkId() string { - if x != nil { - return x.ChunkId - } - return "" -} - -func (x *EditDraftChunkRequest) GetProposedRule() *sandboxv1.NetworkPolicyRule { - if x != nil { - return x.ProposedRule - } - return nil -} - -func (x *EditDraftChunkRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type EditDraftChunkResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *EditDraftChunkResponse) Reset() { - *x = EditDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[153] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *EditDraftChunkResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*EditDraftChunkResponse) ProtoMessage() {} - -func (x *EditDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[153] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use EditDraftChunkResponse.ProtoReflect.Descriptor instead. -func (*EditDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{153} -} - -// Reverse an approval (remove merged rule from active policy). -type UndoDraftChunkRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Chunk ID to undo. - ChunkId string `protobuf:"bytes,2,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *UndoDraftChunkRequest) Reset() { - *x = UndoDraftChunkRequest{} - mi := &file_openshell_proto_msgTypes[154] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *UndoDraftChunkRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*UndoDraftChunkRequest) ProtoMessage() {} - -func (x *UndoDraftChunkRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[154] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use UndoDraftChunkRequest.ProtoReflect.Descriptor instead. -func (*UndoDraftChunkRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{154} -} - -func (x *UndoDraftChunkRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *UndoDraftChunkRequest) GetChunkId() string { - if x != nil { - return x.ChunkId - } - return "" -} - -func (x *UndoDraftChunkRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type UndoDraftChunkResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // New policy version after removal. - PolicyVersion uint32 `protobuf:"varint,1,opt,name=policy_version,json=policyVersion,proto3" json:"policy_version,omitempty"` - // SHA-256 hash of the updated policy. - PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *UndoDraftChunkResponse) Reset() { - *x = UndoDraftChunkResponse{} - mi := &file_openshell_proto_msgTypes[155] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *UndoDraftChunkResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*UndoDraftChunkResponse) ProtoMessage() {} - -func (x *UndoDraftChunkResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[155] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use UndoDraftChunkResponse.ProtoReflect.Descriptor instead. -func (*UndoDraftChunkResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{155} -} - -func (x *UndoDraftChunkResponse) GetPolicyVersion() uint32 { - if x != nil { - return x.PolicyVersion - } - return 0 -} - -func (x *UndoDraftChunkResponse) GetPolicyHash() string { - if x != nil { - return x.PolicyHash - } - return "" -} - -// Clear all pending draft chunks for a sandbox. -type ClearDraftChunksRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ClearDraftChunksRequest) Reset() { - *x = ClearDraftChunksRequest{} - mi := &file_openshell_proto_msgTypes[156] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ClearDraftChunksRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ClearDraftChunksRequest) ProtoMessage() {} - -func (x *ClearDraftChunksRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[156] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ClearDraftChunksRequest.ProtoReflect.Descriptor instead. -func (*ClearDraftChunksRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{156} -} - -func (x *ClearDraftChunksRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *ClearDraftChunksRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type ClearDraftChunksResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Number of chunks cleared. - ChunksCleared uint32 `protobuf:"varint,1,opt,name=chunks_cleared,json=chunksCleared,proto3" json:"chunks_cleared,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ClearDraftChunksResponse) Reset() { - *x = ClearDraftChunksResponse{} - mi := &file_openshell_proto_msgTypes[157] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ClearDraftChunksResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ClearDraftChunksResponse) ProtoMessage() {} - -func (x *ClearDraftChunksResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[157] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ClearDraftChunksResponse.ProtoReflect.Descriptor instead. -func (*ClearDraftChunksResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{157} -} - -func (x *ClearDraftChunksResponse) GetChunksCleared() uint32 { - if x != nil { - return x.ChunksCleared - } - return 0 -} - -// Get decision history for a sandbox's draft policy. -type GetDraftHistoryRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Sandbox name. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Workspace scope. Empty defaults to "default". - Workspace string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetDraftHistoryRequest) Reset() { - *x = GetDraftHistoryRequest{} - mi := &file_openshell_proto_msgTypes[158] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetDraftHistoryRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetDraftHistoryRequest) ProtoMessage() {} - -func (x *GetDraftHistoryRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[158] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetDraftHistoryRequest.ProtoReflect.Descriptor instead. -func (*GetDraftHistoryRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{158} -} - -func (x *GetDraftHistoryRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *GetDraftHistoryRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -type DraftHistoryEntry struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Event timestamp (ms since epoch). - TimestampMs int64 `protobuf:"varint,1,opt,name=timestamp_ms,json=timestampMs,proto3" json:"timestamp_ms,omitempty"` - // Event type: "denial_detected", "analysis_cycle", "approved", - // "rejected", "edited", "undone", "cleared". - EventType string `protobuf:"bytes,2,opt,name=event_type,json=eventType,proto3" json:"event_type,omitempty"` - // Human-readable description. - Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"` - // Associated chunk ID (if applicable). - ChunkId string `protobuf:"bytes,4,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DraftHistoryEntry) Reset() { - *x = DraftHistoryEntry{} - mi := &file_openshell_proto_msgTypes[159] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DraftHistoryEntry) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DraftHistoryEntry) ProtoMessage() {} - -func (x *DraftHistoryEntry) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[159] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DraftHistoryEntry.ProtoReflect.Descriptor instead. -func (*DraftHistoryEntry) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{159} -} - -func (x *DraftHistoryEntry) GetTimestampMs() int64 { - if x != nil { - return x.TimestampMs - } - return 0 -} - -func (x *DraftHistoryEntry) GetEventType() string { - if x != nil { - return x.EventType - } - return "" -} - -func (x *DraftHistoryEntry) GetDescription() string { - if x != nil { - return x.Description - } - return "" -} - -func (x *DraftHistoryEntry) GetChunkId() string { - if x != nil { - return x.ChunkId - } - return "" -} - -type GetDraftHistoryResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Chronological decision history. - Entries []*DraftHistoryEntry `protobuf:"bytes,1,rep,name=entries,proto3" json:"entries,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetDraftHistoryResponse) Reset() { - *x = GetDraftHistoryResponse{} - mi := &file_openshell_proto_msgTypes[160] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetDraftHistoryResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetDraftHistoryResponse) ProtoMessage() {} - -func (x *GetDraftHistoryResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[160] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetDraftHistoryResponse.ProtoReflect.Descriptor instead. -func (*GetDraftHistoryResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{160} -} - -func (x *GetDraftHistoryResponse) GetEntries() []*DraftHistoryEntry { - if x != nil { - return x.Entries - } - return nil -} - -// Stored payload for a policy revision row in the generic objects table. -type PolicyRevisionPayload struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Serialized policy contents. - Policy *sandboxv1.SandboxPolicy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"` - // Deterministic hash of the policy payload. - Hash string `protobuf:"bytes,2,opt,name=hash,proto3" json:"hash,omitempty"` - // Load error reported by the sandbox, if any. - LoadError string `protobuf:"bytes,3,opt,name=load_error,json=loadError,proto3" json:"load_error,omitempty"` - // When the policy version was reported as loaded (ms since epoch). 0 if unset. - LoadedAtMs int64 `protobuf:"varint,4,opt,name=loaded_at_ms,json=loadedAtMs,proto3" json:"loaded_at_ms,omitempty"` - // Immutable provenance supplied when this revision was created. - Provenance map[string]string `protobuf:"bytes,5,rep,name=provenance,proto3" json:"provenance,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *PolicyRevisionPayload) Reset() { - *x = PolicyRevisionPayload{} - mi := &file_openshell_proto_msgTypes[161] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *PolicyRevisionPayload) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*PolicyRevisionPayload) ProtoMessage() {} - -func (x *PolicyRevisionPayload) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[161] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use PolicyRevisionPayload.ProtoReflect.Descriptor instead. -func (*PolicyRevisionPayload) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{161} -} - -func (x *PolicyRevisionPayload) GetPolicy() *sandboxv1.SandboxPolicy { - if x != nil { - return x.Policy - } - return nil -} - -func (x *PolicyRevisionPayload) GetHash() string { - if x != nil { - return x.Hash - } - return "" -} - -func (x *PolicyRevisionPayload) GetLoadError() string { - if x != nil { - return x.LoadError - } - return "" -} - -func (x *PolicyRevisionPayload) GetLoadedAtMs() int64 { - if x != nil { - return x.LoadedAtMs - } - return 0 -} - -func (x *PolicyRevisionPayload) GetProvenance() map[string]string { - if x != nil { - return x.Provenance - } - return nil -} - -// Stored payload for a draft policy chunk row in the generic objects table. -type DraftChunkPayload struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Proposed network_policies map key. - RuleName string `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"` - // Proposed network policy rule. - ProposedRule *sandboxv1.NetworkPolicyRule `protobuf:"bytes,2,opt,name=proposed_rule,json=proposedRule,proto3" json:"proposed_rule,omitempty"` - // Human-readable explanation of why this rule is proposed. - Rationale string `protobuf:"bytes,3,opt,name=rationale,proto3" json:"rationale,omitempty"` - // Security concerns flagged by analysis (empty if none). - SecurityNotes string `protobuf:"bytes,4,opt,name=security_notes,json=securityNotes,proto3" json:"security_notes,omitempty"` - // Analysis confidence (0.0-1.0). 0 for mechanistic mode. - Confidence float32 `protobuf:"fixed32,5,opt,name=confidence,proto3" json:"confidence,omitempty"` - // When the user approved/rejected (ms since epoch). 0 if undecided. - DecidedAtMs int64 `protobuf:"varint,6,opt,name=decided_at_ms,json=decidedAtMs,proto3" json:"decided_at_ms,omitempty"` - // Denormalized endpoint host for dedup and display. - Host string `protobuf:"bytes,7,opt,name=host,proto3" json:"host,omitempty"` - // Denormalized endpoint port for dedup and display. - Port int32 `protobuf:"varint,8,opt,name=port,proto3" json:"port,omitempty"` - // Binary path that triggered the denial. - Binary string `protobuf:"bytes,9,opt,name=binary,proto3" json:"binary,omitempty"` - // Current draft version for the owning sandbox. - DraftVersion int64 `protobuf:"varint,10,opt,name=draft_version,json=draftVersion,proto3" json:"draft_version,omitempty"` - // Gateway prover verdict for this chunk; empty until prover runs. - // Mirrors PolicyChunk.validation_result. - ValidationResult string `protobuf:"bytes,11,opt,name=validation_result,json=validationResult,proto3" json:"validation_result,omitempty"` - // Operator-supplied free-form rejection text; empty for non-rejected - // chunks. Mirrors PolicyChunk.rejection_reason. - RejectionReason string `protobuf:"bytes,12,opt,name=rejection_reason,json=rejectionReason,proto3" json:"rejection_reason,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DraftChunkPayload) Reset() { - *x = DraftChunkPayload{} - mi := &file_openshell_proto_msgTypes[162] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DraftChunkPayload) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DraftChunkPayload) ProtoMessage() {} - -func (x *DraftChunkPayload) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[162] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DraftChunkPayload.ProtoReflect.Descriptor instead. -func (*DraftChunkPayload) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{162} -} - -func (x *DraftChunkPayload) GetRuleName() string { - if x != nil { - return x.RuleName - } - return "" -} - -func (x *DraftChunkPayload) GetProposedRule() *sandboxv1.NetworkPolicyRule { - if x != nil { - return x.ProposedRule - } - return nil -} - -func (x *DraftChunkPayload) GetRationale() string { - if x != nil { - return x.Rationale - } - return "" -} - -func (x *DraftChunkPayload) GetSecurityNotes() string { - if x != nil { - return x.SecurityNotes - } - return "" -} - -func (x *DraftChunkPayload) GetConfidence() float32 { - if x != nil { - return x.Confidence - } - return 0 -} - -func (x *DraftChunkPayload) GetDecidedAtMs() int64 { - if x != nil { - return x.DecidedAtMs - } - return 0 -} - -func (x *DraftChunkPayload) GetHost() string { - if x != nil { - return x.Host - } - return "" -} - -func (x *DraftChunkPayload) GetPort() int32 { - if x != nil { - return x.Port - } - return 0 -} - -func (x *DraftChunkPayload) GetBinary() string { - if x != nil { - return x.Binary - } - return "" -} - -func (x *DraftChunkPayload) GetDraftVersion() int64 { - if x != nil { - return x.DraftVersion - } - return 0 -} - -func (x *DraftChunkPayload) GetValidationResult() string { - if x != nil { - return x.ValidationResult - } - return "" -} - -func (x *DraftChunkPayload) GetRejectionReason() string { - if x != nil { - return x.RejectionReason - } - return "" -} - -// Internal stored policy revision row materialized from the generic objects table. -type StoredPolicyRevision struct { - state protoimpl.MessageState `protogen:"open.v1"` - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` - SandboxId string `protobuf:"bytes,2,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - Version int64 `protobuf:"varint,3,opt,name=version,proto3" json:"version,omitempty"` - PolicyPayload []byte `protobuf:"bytes,4,opt,name=policy_payload,json=policyPayload,proto3" json:"policy_payload,omitempty"` - PolicyHash string `protobuf:"bytes,5,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"` - Status string `protobuf:"bytes,6,opt,name=status,proto3" json:"status,omitempty"` - LoadError *string `protobuf:"bytes,7,opt,name=load_error,json=loadError,proto3,oneof" json:"load_error,omitempty"` - CreatedAtMs int64 `protobuf:"varint,8,opt,name=created_at_ms,json=createdAtMs,proto3" json:"created_at_ms,omitempty"` - LoadedAtMs *int64 `protobuf:"varint,9,opt,name=loaded_at_ms,json=loadedAtMs,proto3,oneof" json:"loaded_at_ms,omitempty"` - Provenance map[string]string `protobuf:"bytes,10,rep,name=provenance,proto3" json:"provenance,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *StoredPolicyRevision) Reset() { - *x = StoredPolicyRevision{} - mi := &file_openshell_proto_msgTypes[163] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *StoredPolicyRevision) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*StoredPolicyRevision) ProtoMessage() {} - -func (x *StoredPolicyRevision) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[163] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use StoredPolicyRevision.ProtoReflect.Descriptor instead. -func (*StoredPolicyRevision) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{163} -} - -func (x *StoredPolicyRevision) GetId() string { - if x != nil { - return x.Id - } - return "" -} - -func (x *StoredPolicyRevision) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *StoredPolicyRevision) GetVersion() int64 { - if x != nil { - return x.Version - } - return 0 -} - -func (x *StoredPolicyRevision) GetPolicyPayload() []byte { - if x != nil { - return x.PolicyPayload - } - return nil -} - -func (x *StoredPolicyRevision) GetPolicyHash() string { - if x != nil { - return x.PolicyHash - } - return "" -} - -func (x *StoredPolicyRevision) GetStatus() string { - if x != nil { - return x.Status - } - return "" -} - -func (x *StoredPolicyRevision) GetLoadError() string { - if x != nil && x.LoadError != nil { - return *x.LoadError - } - return "" -} - -func (x *StoredPolicyRevision) GetCreatedAtMs() int64 { - if x != nil { - return x.CreatedAtMs - } - return 0 -} - -func (x *StoredPolicyRevision) GetLoadedAtMs() int64 { - if x != nil && x.LoadedAtMs != nil { - return *x.LoadedAtMs - } - return 0 -} - -func (x *StoredPolicyRevision) GetProvenance() map[string]string { - if x != nil { - return x.Provenance - } - return nil -} - -// Internal stored draft chunk row materialized from the generic objects table. -type StoredDraftChunk struct { - state protoimpl.MessageState `protogen:"open.v1"` - Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` - SandboxId string `protobuf:"bytes,2,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - DraftVersion int64 `protobuf:"varint,3,opt,name=draft_version,json=draftVersion,proto3" json:"draft_version,omitempty"` - Status string `protobuf:"bytes,4,opt,name=status,proto3" json:"status,omitempty"` - RuleName string `protobuf:"bytes,5,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"` - ProposedRule []byte `protobuf:"bytes,6,opt,name=proposed_rule,json=proposedRule,proto3" json:"proposed_rule,omitempty"` - Rationale string `protobuf:"bytes,7,opt,name=rationale,proto3" json:"rationale,omitempty"` - SecurityNotes string `protobuf:"bytes,8,opt,name=security_notes,json=securityNotes,proto3" json:"security_notes,omitempty"` - Confidence float64 `protobuf:"fixed64,9,opt,name=confidence,proto3" json:"confidence,omitempty"` - CreatedAtMs int64 `protobuf:"varint,10,opt,name=created_at_ms,json=createdAtMs,proto3" json:"created_at_ms,omitempty"` - DecidedAtMs *int64 `protobuf:"varint,11,opt,name=decided_at_ms,json=decidedAtMs,proto3,oneof" json:"decided_at_ms,omitempty"` - Host string `protobuf:"bytes,12,opt,name=host,proto3" json:"host,omitempty"` - Port int32 `protobuf:"varint,13,opt,name=port,proto3" json:"port,omitempty"` - Binary string `protobuf:"bytes,14,opt,name=binary,proto3" json:"binary,omitempty"` - HitCount int32 `protobuf:"varint,15,opt,name=hit_count,json=hitCount,proto3" json:"hit_count,omitempty"` - FirstSeenMs int64 `protobuf:"varint,16,opt,name=first_seen_ms,json=firstSeenMs,proto3" json:"first_seen_ms,omitempty"` - LastSeenMs int64 `protobuf:"varint,17,opt,name=last_seen_ms,json=lastSeenMs,proto3" json:"last_seen_ms,omitempty"` - // Gateway prover verdict; empty until the prover runs. See PolicyChunk. - ValidationResult string `protobuf:"bytes,18,opt,name=validation_result,json=validationResult,proto3" json:"validation_result,omitempty"` - // Operator-supplied free-form rejection text. See PolicyChunk. - RejectionReason string `protobuf:"bytes,19,opt,name=rejection_reason,json=rejectionReason,proto3" json:"rejection_reason,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *StoredDraftChunk) Reset() { - *x = StoredDraftChunk{} - mi := &file_openshell_proto_msgTypes[164] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *StoredDraftChunk) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*StoredDraftChunk) ProtoMessage() {} - -func (x *StoredDraftChunk) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[164] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use StoredDraftChunk.ProtoReflect.Descriptor instead. -func (*StoredDraftChunk) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{164} -} - -func (x *StoredDraftChunk) GetId() string { - if x != nil { - return x.Id - } - return "" -} - -func (x *StoredDraftChunk) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -func (x *StoredDraftChunk) GetDraftVersion() int64 { - if x != nil { - return x.DraftVersion - } - return 0 -} - -func (x *StoredDraftChunk) GetStatus() string { - if x != nil { - return x.Status - } - return "" -} - -func (x *StoredDraftChunk) GetRuleName() string { - if x != nil { - return x.RuleName - } - return "" -} - -func (x *StoredDraftChunk) GetProposedRule() []byte { - if x != nil { - return x.ProposedRule - } - return nil -} - -func (x *StoredDraftChunk) GetRationale() string { - if x != nil { - return x.Rationale - } - return "" -} - -func (x *StoredDraftChunk) GetSecurityNotes() string { - if x != nil { - return x.SecurityNotes - } - return "" -} - -func (x *StoredDraftChunk) GetConfidence() float64 { - if x != nil { - return x.Confidence - } - return 0 -} - -func (x *StoredDraftChunk) GetCreatedAtMs() int64 { - if x != nil { - return x.CreatedAtMs - } - return 0 -} - -func (x *StoredDraftChunk) GetDecidedAtMs() int64 { - if x != nil && x.DecidedAtMs != nil { - return *x.DecidedAtMs - } - return 0 -} - -func (x *StoredDraftChunk) GetHost() string { - if x != nil { - return x.Host - } - return "" -} - -func (x *StoredDraftChunk) GetPort() int32 { - if x != nil { - return x.Port - } - return 0 -} - -func (x *StoredDraftChunk) GetBinary() string { - if x != nil { - return x.Binary - } - return "" -} - -func (x *StoredDraftChunk) GetHitCount() int32 { - if x != nil { - return x.HitCount - } - return 0 -} - -func (x *StoredDraftChunk) GetFirstSeenMs() int64 { - if x != nil { - return x.FirstSeenMs - } - return 0 -} - -func (x *StoredDraftChunk) GetLastSeenMs() int64 { - if x != nil { - return x.LastSeenMs - } - return 0 -} - -func (x *StoredDraftChunk) GetValidationResult() string { - if x != nil { - return x.ValidationResult - } - return "" -} - -func (x *StoredDraftChunk) GetRejectionReason() string { - if x != nil { - return x.RejectionReason - } - return "" -} - -// Create workspace request. -type CreateWorkspaceRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Workspace name. Must be a valid DNS-1123 label. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Optional labels for the workspace (key-value metadata). - Labels map[string]string `protobuf:"bytes,2,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *CreateWorkspaceRequest) Reset() { - *x = CreateWorkspaceRequest{} - mi := &file_openshell_proto_msgTypes[165] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *CreateWorkspaceRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*CreateWorkspaceRequest) ProtoMessage() {} - -func (x *CreateWorkspaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[165] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use CreateWorkspaceRequest.ProtoReflect.Descriptor instead. -func (*CreateWorkspaceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{165} -} - -func (x *CreateWorkspaceRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *CreateWorkspaceRequest) GetLabels() map[string]string { - if x != nil { - return x.Labels - } - return nil -} - -// Create workspace response. -type CreateWorkspaceResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Workspace *datamodelv1.Workspace `protobuf:"bytes,1,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *CreateWorkspaceResponse) Reset() { - *x = CreateWorkspaceResponse{} - mi := &file_openshell_proto_msgTypes[166] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *CreateWorkspaceResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*CreateWorkspaceResponse) ProtoMessage() {} - -func (x *CreateWorkspaceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[166] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use CreateWorkspaceResponse.ProtoReflect.Descriptor instead. -func (*CreateWorkspaceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{166} -} - -func (x *CreateWorkspaceResponse) GetWorkspace() *datamodelv1.Workspace { - if x != nil { - return x.Workspace - } - return nil -} - -// Get workspace request. -type GetWorkspaceRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Workspace name (canonical lookup key). - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetWorkspaceRequest) Reset() { - *x = GetWorkspaceRequest{} - mi := &file_openshell_proto_msgTypes[167] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetWorkspaceRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetWorkspaceRequest) ProtoMessage() {} - -func (x *GetWorkspaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[167] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetWorkspaceRequest.ProtoReflect.Descriptor instead. -func (*GetWorkspaceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{167} -} - -func (x *GetWorkspaceRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -// Get workspace response. -type GetWorkspaceResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Workspace *datamodelv1.Workspace `protobuf:"bytes,1,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetWorkspaceResponse) Reset() { - *x = GetWorkspaceResponse{} - mi := &file_openshell_proto_msgTypes[168] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetWorkspaceResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetWorkspaceResponse) ProtoMessage() {} - -func (x *GetWorkspaceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[168] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetWorkspaceResponse.ProtoReflect.Descriptor instead. -func (*GetWorkspaceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{168} -} - -func (x *GetWorkspaceResponse) GetWorkspace() *datamodelv1.Workspace { - if x != nil { - return x.Workspace - } - return nil -} - -// List workspaces request. -type ListWorkspacesRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Limit uint32 `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"` - Offset uint32 `protobuf:"varint,2,opt,name=offset,proto3" json:"offset,omitempty"` - // Optional label selector for filtering (format: "key1=value1,key2=value2"). - LabelSelector string `protobuf:"bytes,3,opt,name=label_selector,json=labelSelector,proto3" json:"label_selector,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListWorkspacesRequest) Reset() { - *x = ListWorkspacesRequest{} - mi := &file_openshell_proto_msgTypes[169] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListWorkspacesRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListWorkspacesRequest) ProtoMessage() {} - -func (x *ListWorkspacesRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[169] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListWorkspacesRequest.ProtoReflect.Descriptor instead. -func (*ListWorkspacesRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{169} -} - -func (x *ListWorkspacesRequest) GetLimit() uint32 { - if x != nil { - return x.Limit - } - return 0 -} - -func (x *ListWorkspacesRequest) GetOffset() uint32 { - if x != nil { - return x.Offset - } - return 0 -} - -func (x *ListWorkspacesRequest) GetLabelSelector() string { - if x != nil { - return x.LabelSelector - } - return "" -} - -// List workspaces response. -type ListWorkspacesResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Workspaces []*datamodelv1.Workspace `protobuf:"bytes,1,rep,name=workspaces,proto3" json:"workspaces,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListWorkspacesResponse) Reset() { - *x = ListWorkspacesResponse{} - mi := &file_openshell_proto_msgTypes[170] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListWorkspacesResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListWorkspacesResponse) ProtoMessage() {} - -func (x *ListWorkspacesResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[170] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListWorkspacesResponse.ProtoReflect.Descriptor instead. -func (*ListWorkspacesResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{170} -} - -func (x *ListWorkspacesResponse) GetWorkspaces() []*datamodelv1.Workspace { - if x != nil { - return x.Workspaces - } - return nil -} - -// Delete workspace request. -type DeleteWorkspaceRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Workspace name (canonical lookup key). - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteWorkspaceRequest) Reset() { - *x = DeleteWorkspaceRequest{} - mi := &file_openshell_proto_msgTypes[171] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteWorkspaceRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteWorkspaceRequest) ProtoMessage() {} - -func (x *DeleteWorkspaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[171] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteWorkspaceRequest.ProtoReflect.Descriptor instead. -func (*DeleteWorkspaceRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{171} -} - -func (x *DeleteWorkspaceRequest) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -// Delete workspace response. -type DeleteWorkspaceResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Deleted bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *DeleteWorkspaceResponse) Reset() { - *x = DeleteWorkspaceResponse{} - mi := &file_openshell_proto_msgTypes[172] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *DeleteWorkspaceResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*DeleteWorkspaceResponse) ProtoMessage() {} - -func (x *DeleteWorkspaceResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[172] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use DeleteWorkspaceResponse.ProtoReflect.Descriptor instead. -func (*DeleteWorkspaceResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{172} -} - -func (x *DeleteWorkspaceResponse) GetDeleted() bool { - if x != nil { - return x.Deleted - } - return false -} - -// Workspace membership record. -type WorkspaceMember struct { - state protoimpl.MessageState `protogen:"open.v1"` - Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` - // OIDC subject claim identifying the principal. - PrincipalSubject string `protobuf:"bytes,2,opt,name=principal_subject,json=principalSubject,proto3" json:"principal_subject,omitempty"` - // Role assigned to the principal within the workspace. - Role WorkspaceRole `protobuf:"varint,3,opt,name=role,proto3,enum=openshell.v1.WorkspaceRole" json:"role,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *WorkspaceMember) Reset() { - *x = WorkspaceMember{} - mi := &file_openshell_proto_msgTypes[173] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *WorkspaceMember) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*WorkspaceMember) ProtoMessage() {} - -func (x *WorkspaceMember) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[173] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use WorkspaceMember.ProtoReflect.Descriptor instead. -func (*WorkspaceMember) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{173} -} - -func (x *WorkspaceMember) GetMetadata() *datamodelv1.ObjectMeta { - if x != nil { - return x.Metadata - } - return nil -} - -func (x *WorkspaceMember) GetPrincipalSubject() string { - if x != nil { - return x.PrincipalSubject - } - return "" -} - -func (x *WorkspaceMember) GetRole() WorkspaceRole { - if x != nil { - return x.Role - } - return WorkspaceRole_WORKSPACE_ROLE_UNSPECIFIED -} - -// Add workspace member request. -type AddWorkspaceMemberRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Workspace name. - Workspace string `protobuf:"bytes,1,opt,name=workspace,proto3" json:"workspace,omitempty"` - // OIDC subject claim identifying the principal. - PrincipalSubject string `protobuf:"bytes,2,opt,name=principal_subject,json=principalSubject,proto3" json:"principal_subject,omitempty"` - // Role to assign. - Role WorkspaceRole `protobuf:"varint,3,opt,name=role,proto3,enum=openshell.v1.WorkspaceRole" json:"role,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *AddWorkspaceMemberRequest) Reset() { - *x = AddWorkspaceMemberRequest{} - mi := &file_openshell_proto_msgTypes[174] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *AddWorkspaceMemberRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*AddWorkspaceMemberRequest) ProtoMessage() {} - -func (x *AddWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[174] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use AddWorkspaceMemberRequest.ProtoReflect.Descriptor instead. -func (*AddWorkspaceMemberRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{174} -} - -func (x *AddWorkspaceMemberRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -func (x *AddWorkspaceMemberRequest) GetPrincipalSubject() string { - if x != nil { - return x.PrincipalSubject - } - return "" -} - -func (x *AddWorkspaceMemberRequest) GetRole() WorkspaceRole { - if x != nil { - return x.Role - } - return WorkspaceRole_WORKSPACE_ROLE_UNSPECIFIED -} - -// Add workspace member response. -type AddWorkspaceMemberResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Member *WorkspaceMember `protobuf:"bytes,1,opt,name=member,proto3" json:"member,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *AddWorkspaceMemberResponse) Reset() { - *x = AddWorkspaceMemberResponse{} - mi := &file_openshell_proto_msgTypes[175] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *AddWorkspaceMemberResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*AddWorkspaceMemberResponse) ProtoMessage() {} - -func (x *AddWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[175] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use AddWorkspaceMemberResponse.ProtoReflect.Descriptor instead. -func (*AddWorkspaceMemberResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{175} -} - -func (x *AddWorkspaceMemberResponse) GetMember() *WorkspaceMember { - if x != nil { - return x.Member - } - return nil -} - -// Remove workspace member request. -type RemoveWorkspaceMemberRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Workspace name. - Workspace string `protobuf:"bytes,1,opt,name=workspace,proto3" json:"workspace,omitempty"` - // OIDC subject claim identifying the principal to remove. - PrincipalSubject string `protobuf:"bytes,2,opt,name=principal_subject,json=principalSubject,proto3" json:"principal_subject,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RemoveWorkspaceMemberRequest) Reset() { - *x = RemoveWorkspaceMemberRequest{} - mi := &file_openshell_proto_msgTypes[176] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RemoveWorkspaceMemberRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RemoveWorkspaceMemberRequest) ProtoMessage() {} - -func (x *RemoveWorkspaceMemberRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[176] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RemoveWorkspaceMemberRequest.ProtoReflect.Descriptor instead. -func (*RemoveWorkspaceMemberRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{176} -} - -func (x *RemoveWorkspaceMemberRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -func (x *RemoveWorkspaceMemberRequest) GetPrincipalSubject() string { - if x != nil { - return x.PrincipalSubject - } - return "" -} - -// Remove workspace member response. -type RemoveWorkspaceMemberResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Removed bool `protobuf:"varint,1,opt,name=removed,proto3" json:"removed,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *RemoveWorkspaceMemberResponse) Reset() { - *x = RemoveWorkspaceMemberResponse{} - mi := &file_openshell_proto_msgTypes[177] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *RemoveWorkspaceMemberResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*RemoveWorkspaceMemberResponse) ProtoMessage() {} - -func (x *RemoveWorkspaceMemberResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[177] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use RemoveWorkspaceMemberResponse.ProtoReflect.Descriptor instead. -func (*RemoveWorkspaceMemberResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{177} -} - -func (x *RemoveWorkspaceMemberResponse) GetRemoved() bool { - if x != nil { - return x.Removed - } - return false -} - -// List workspace members request. -type ListWorkspaceMembersRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Workspace name. - Workspace string `protobuf:"bytes,1,opt,name=workspace,proto3" json:"workspace,omitempty"` - Limit uint32 `protobuf:"varint,2,opt,name=limit,proto3" json:"limit,omitempty"` - Offset uint32 `protobuf:"varint,3,opt,name=offset,proto3" json:"offset,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListWorkspaceMembersRequest) Reset() { - *x = ListWorkspaceMembersRequest{} - mi := &file_openshell_proto_msgTypes[178] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListWorkspaceMembersRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListWorkspaceMembersRequest) ProtoMessage() {} - -func (x *ListWorkspaceMembersRequest) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[178] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListWorkspaceMembersRequest.ProtoReflect.Descriptor instead. -func (*ListWorkspaceMembersRequest) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{178} -} - -func (x *ListWorkspaceMembersRequest) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -func (x *ListWorkspaceMembersRequest) GetLimit() uint32 { - if x != nil { - return x.Limit - } - return 0 -} - -func (x *ListWorkspaceMembersRequest) GetOffset() uint32 { - if x != nil { - return x.Offset - } - return 0 -} - -// List workspace members response. -type ListWorkspaceMembersResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - Members []*WorkspaceMember `protobuf:"bytes,1,rep,name=members,proto3" json:"members,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ListWorkspaceMembersResponse) Reset() { - *x = ListWorkspaceMembersResponse{} - mi := &file_openshell_proto_msgTypes[179] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ListWorkspaceMembersResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ListWorkspaceMembersResponse) ProtoMessage() {} - -func (x *ListWorkspaceMembersResponse) ProtoReflect() protoreflect.Message { - mi := &file_openshell_proto_msgTypes[179] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ListWorkspaceMembersResponse.ProtoReflect.Descriptor instead. -func (*ListWorkspaceMembersResponse) Descriptor() ([]byte, []int) { - return file_openshell_proto_rawDescGZIP(), []int{179} -} - -func (x *ListWorkspaceMembersResponse) GetMembers() []*WorkspaceMember { - if x != nil { - return x.Members - } - return nil -} - -var File_openshell_proto protoreflect.FileDescriptor - -const file_openshell_proto_rawDesc = "" + - "\n" + - "\x0fopenshell.proto\x12\fopenshell.v1\x1a\x0fdatamodel.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\roptions.proto\x1a\rsandbox.proto\"\x1a\n" + - "\x18IssueSandboxTokenRequest\"[\n" + - "\x19IssueSandboxTokenResponse\x12\x1a\n" + - "\x05token\x18\x01 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12\"\n" + - "\rexpires_at_ms\x18\x02 \x01(\x03R\vexpiresAtMs\"\x1c\n" + - "\x1aRefreshSandboxTokenRequest\"]\n" + - "\x1bRefreshSandboxTokenResponse\x12\x1a\n" + - "\x05token\x18\x01 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12\"\n" + - "\rexpires_at_ms\x18\x02 \x01(\x03R\vexpiresAtMs\"\x0f\n" + - "\rHealthRequest\"_\n" + - "\x0eHealthResponse\x123\n" + - "\x06status\x18\x01 \x01(\x0e2\x1b.openshell.v1.ServiceStatusR\x06status\x12\x18\n" + - "\aversion\x18\x02 \x01(\tR\aversion\"\x17\n" + - "\x15GetCurrentUserRequest\"\xb0\x01\n" + - "\x16GetCurrentUserResponse\x12\x18\n" + - "\asubject\x18\x01 \x01(\tR\asubject\x12!\n" + - "\fdisplay_name\x18\x02 \x01(\tR\vdisplayName\x12\x14\n" + - "\x05roles\x18\x03 \x03(\tR\x05roles\x12\x16\n" + - "\x06scopes\x18\x04 \x03(\tR\x06scopes\x12+\n" + - "\x11identity_provider\x18\x05 \x01(\tR\x10identityProvider\"\x17\n" + - "\x15GetGatewayInfoRequest\"\xc0\x01\n" + - "\x16GetGatewayInfoResponse\x123\n" + - "\x06status\x18\x01 \x01(\x0e2\x1b.openshell.v1.ServiceStatusR\x06status\x12'\n" + - "\x0fgateway_version\x18\x02 \x01(\tR\x0egatewayVersion\x12H\n" + - "\x0fcompute_drivers\x18\x03 \x03(\v2\x1f.openshell.v1.ComputeDriverInfoR\x0ecomputeDrivers\"t\n" + - "\x11ComputeDriverInfo\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12K\n" + - "\fcapabilities\x18\x02 \x01(\v2'.openshell.v1.ComputeDriverCapabilitiesR\fcapabilities\"c\n" + - "\x19ComputeDriverCapabilities\x12\x1f\n" + - "\vdriver_name\x18\x01 \x01(\tR\n" + - "driverName\x12%\n" + - "\x0edriver_version\x18\x02 \x01(\tR\rdriverVersion\"\xd8\x01\n" + - "\aSandbox\x12>\n" + - "\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12-\n" + - "\x04spec\x18\x02 \x01(\v2\x19.openshell.v1.SandboxSpecR\x04spec\x123\n" + - "\x06status\x18\x03 \x01(\v2\x1b.openshell.v1.SandboxStatusR\x06statusJ\x04\b\x04\x10\x05J\x04\b\x05\x10\x06R\x05phaseR\x16current_policy_version\"\xd7\x03\n" + - "\vSandboxSpec\x12\x1b\n" + - "\tlog_level\x18\x01 \x01(\tR\blogLevel\x12L\n" + - "\venvironment\x18\x05 \x03(\v2*.openshell.v1.SandboxSpec.EnvironmentEntryR\venvironment\x129\n" + - "\btemplate\x18\x06 \x01(\v2\x1d.openshell.v1.SandboxTemplateR\btemplate\x12;\n" + - "\x06policy\x18\a \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x06policy\x12\x1c\n" + - "\tproviders\x18\b \x03(\tR\tproviders\x12W\n" + - "\x15resource_requirements\x18\t \x01(\v2\".openshell.v1.ResourceRequirementsR\x14resourceRequirements\x1a>\n" + - "\x10EnvironmentEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01J\x04\b\n" + - "\x10\vJ\x04\b\v\x10\fR\n" + - "gpu_deviceR\x16proposal_approval_mode\"O\n" + - "\x14ResourceRequirements\x127\n" + - "\x03gpu\x18\x01 \x01(\v2%.openshell.v1.GpuResourceRequirementsR\x03gpu\">\n" + - "\x17GpuResourceRequirements\x12\x19\n" + - "\x05count\x18\x01 \x01(\rH\x00R\x05count\x88\x01\x01B\b\n" + - "\x06_count\"\xef\x05\n" + - "\x0fSandboxTemplate\x12\x14\n" + - "\x05image\x18\x01 \x01(\tR\x05image\x12,\n" + - "\x12runtime_class_name\x18\x02 \x01(\tR\x10runtimeClassName\x12!\n" + - "\fagent_socket\x18\x03 \x01(\tR\vagentSocket\x12A\n" + - "\x06labels\x18\x04 \x03(\v2).openshell.v1.SandboxTemplate.LabelsEntryR\x06labels\x12P\n" + - "\vannotations\x18\x05 \x03(\v2..openshell.v1.SandboxTemplate.AnnotationsEntryR\vannotations\x12P\n" + - "\venvironment\x18\x06 \x03(\v2..openshell.v1.SandboxTemplate.EnvironmentEntryR\venvironment\x125\n" + - "\tresources\x18\a \x01(\v2\x17.google.protobuf.StructR\tresources\x12,\n" + - "\x0fuser_namespaces\x18\n" + - " \x01(\bH\x00R\x0euserNamespaces\x88\x01\x01\x12<\n" + - "\rdriver_config\x18\v \x01(\v2\x17.google.protobuf.StructR\fdriverConfig\x1a9\n" + - "\vLabelsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" + - "\x10AnnotationsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" + - "\x10EnvironmentEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\x12\n" + - "\x10_user_namespacesJ\x04\b\t\x10\n" + - "R\x16volume_claim_templates\"\xb1\x02\n" + - "\rSandboxStatus\x12!\n" + - "\fsandbox_name\x18\x01 \x01(\tR\vsandboxName\x12\x1b\n" + - "\tagent_pod\x18\x02 \x01(\tR\bagentPod\x12\x19\n" + - "\bagent_fd\x18\x03 \x01(\tR\aagentFd\x12\x1d\n" + - "\n" + - "sandbox_fd\x18\x04 \x01(\tR\tsandboxFd\x12>\n" + - "\n" + - "conditions\x18\x05 \x03(\v2\x1e.openshell.v1.SandboxConditionR\n" + - "conditions\x120\n" + - "\x05phase\x18\x06 \x01(\x0e2\x1a.openshell.v1.SandboxPhaseR\x05phase\x124\n" + - "\x16current_policy_version\x18\a \x01(\rR\x14currentPolicyVersion\"\xa2\x01\n" + - "\x10SandboxCondition\x12\x12\n" + - "\x04type\x18\x01 \x01(\tR\x04type\x12\x16\n" + - "\x06status\x18\x02 \x01(\tR\x06status\x12\x16\n" + - "\x06reason\x18\x03 \x01(\tR\x06reason\x12\x18\n" + - "\amessage\x18\x04 \x01(\tR\amessage\x120\n" + - "\x14last_transition_time\x18\x05 \x01(\tR\x12lastTransitionTime\"\x94\x02\n" + - "\rPlatformEvent\x12!\n" + - "\ftimestamp_ms\x18\x01 \x01(\x03R\vtimestampMs\x12\x16\n" + - "\x06source\x18\x02 \x01(\tR\x06source\x12\x12\n" + - "\x04type\x18\x03 \x01(\tR\x04type\x12\x16\n" + - "\x06reason\x18\x04 \x01(\tR\x06reason\x12\x18\n" + - "\amessage\x18\x05 \x01(\tR\amessage\x12E\n" + - "\bmetadata\x18\x06 \x03(\v2).openshell.v1.PlatformEvent.MetadataEntryR\bmetadata\x1a;\n" + - "\rMetadataEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x91\x03\n" + - "\x14CreateSandboxRequest\x12-\n" + - "\x04spec\x18\x01 \x01(\v2\x19.openshell.v1.SandboxSpecR\x04spec\x12\x12\n" + - "\x04name\x18\x02 \x01(\tR\x04name\x12F\n" + - "\x06labels\x18\x03 \x03(\v2..openshell.v1.CreateSandboxRequest.LabelsEntryR\x06labels\x12U\n" + - "\vannotations\x18\x04 \x03(\v23.openshell.v1.CreateSandboxRequest.AnnotationsEntryR\vannotations\x12\x1c\n" + - "\tworkspace\x18\x05 \x01(\tR\tworkspace\x1a9\n" + - "\vLabelsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" + - "\x10AnnotationsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"E\n" + - "\x11GetSandboxRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"\xb0\x01\n" + - "\x14ListSandboxesRequest\x12\x14\n" + - "\x05limit\x18\x01 \x01(\rR\x05limit\x12\x16\n" + - "\x06offset\x18\x02 \x01(\rR\x06offset\x12%\n" + - "\x0elabel_selector\x18\x03 \x01(\tR\rlabelSelector\x12\x1c\n" + - "\tworkspace\x18\x04 \x01(\tR\tworkspace\x12%\n" + - "\x0eall_workspaces\x18\x05 \x01(\bR\rallWorkspaces\"^\n" + - "\x1bListSandboxProvidersRequest\x12!\n" + - "\fsandbox_name\x18\x01 \x01(\tR\vsandboxName\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"\xc0\x01\n" + - "\x1cAttachSandboxProviderRequest\x12!\n" + - "\fsandbox_name\x18\x01 \x01(\tR\vsandboxName\x12#\n" + - "\rprovider_name\x18\x02 \x01(\tR\fproviderName\x12:\n" + - "\x19expected_resource_version\x18\x03 \x01(\x04R\x17expectedResourceVersion\x12\x1c\n" + - "\tworkspace\x18\x04 \x01(\tR\tworkspace\"\xc0\x01\n" + - "\x1cDetachSandboxProviderRequest\x12!\n" + - "\fsandbox_name\x18\x01 \x01(\tR\vsandboxName\x12#\n" + - "\rprovider_name\x18\x02 \x01(\tR\fproviderName\x12:\n" + - "\x19expected_resource_version\x18\x03 \x01(\x04R\x17expectedResourceVersion\x12\x1c\n" + - "\tworkspace\x18\x04 \x01(\tR\tworkspace\"H\n" + - "\x14DeleteSandboxRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"B\n" + - "\x0fSandboxResponse\x12/\n" + - "\asandbox\x18\x01 \x01(\v2\x15.openshell.v1.SandboxR\asandbox\"L\n" + - "\x15ListSandboxesResponse\x123\n" + - "\tsandboxes\x18\x01 \x03(\v2\x15.openshell.v1.SandboxR\tsandboxes\"^\n" + - "\x1cListSandboxProvidersResponse\x12>\n" + - "\tproviders\x18\x01 \x03(\v2 .openshell.datamodel.v1.ProviderR\tproviders\"l\n" + - "\x1dAttachSandboxProviderResponse\x12/\n" + - "\asandbox\x18\x01 \x01(\v2\x15.openshell.v1.SandboxR\asandbox\x12\x1a\n" + - "\battached\x18\x02 \x01(\bR\battached\"l\n" + - "\x1dDetachSandboxProviderResponse\x12/\n" + - "\asandbox\x18\x01 \x01(\v2\x15.openshell.v1.SandboxR\asandbox\x12\x1a\n" + - "\bdetached\x18\x02 \x01(\bR\bdetached\"1\n" + - "\x15DeleteSandboxResponse\x12\x18\n" + - "\adeleted\x18\x01 \x01(\bR\adeleted\"8\n" + - "\x17CreateSshSessionRequest\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\"\x98\x02\n" + - "\x18CreateSshSessionResponse\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1a\n" + - "\x05token\x18\x02 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12!\n" + - "\fgateway_host\x18\x03 \x01(\tR\vgatewayHost\x12!\n" + - "\fgateway_port\x18\x04 \x01(\rR\vgatewayPort\x12%\n" + - "\x0egateway_scheme\x18\x05 \x01(\tR\rgatewayScheme\x120\n" + - "\x14host_key_fingerprint\x18\a \x01(\tR\x12hostKeyFingerprint\x12\"\n" + - "\rexpires_at_ms\x18\b \x01(\x03R\vexpiresAtMs\"\xa1\x01\n" + - "\x14ExposeServiceRequest\x12\x18\n" + - "\asandbox\x18\x01 \x01(\tR\asandbox\x12\x18\n" + - "\aservice\x18\x02 \x01(\tR\aservice\x12\x1f\n" + - "\vtarget_port\x18\x03 \x01(\rR\n" + - "targetPort\x12\x16\n" + - "\x06domain\x18\x04 \x01(\bR\x06domain\x12\x1c\n" + - "\tworkspace\x18\x05 \x01(\tR\tworkspace\"e\n" + - "\x11GetServiceRequest\x12\x18\n" + - "\asandbox\x18\x01 \x01(\tR\asandbox\x12\x18\n" + - "\aservice\x18\x02 \x01(\tR\aservice\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"\xa2\x01\n" + - "\x13ListServicesRequest\x12\x18\n" + - "\asandbox\x18\x01 \x01(\tR\asandbox\x12\x14\n" + - "\x05limit\x18\x02 \x01(\rR\x05limit\x12\x16\n" + - "\x06offset\x18\x03 \x01(\rR\x06offset\x12\x1c\n" + - "\tworkspace\x18\x04 \x01(\tR\tworkspace\x12%\n" + - "\x0eall_workspaces\x18\x05 \x01(\bR\rallWorkspaces\"Y\n" + - "\x14ListServicesResponse\x12A\n" + - "\bservices\x18\x01 \x03(\v2%.openshell.v1.ServiceEndpointResponseR\bservices\"h\n" + - "\x14DeleteServiceRequest\x12\x18\n" + - "\asandbox\x18\x01 \x01(\tR\asandbox\x12\x18\n" + - "\aservice\x18\x02 \x01(\tR\aservice\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"1\n" + - "\x15DeleteServiceResponse\x12\x18\n" + - "\adeleted\x18\x01 \x01(\bR\adeleted\"\xef\x01\n" + - "\x0fServiceEndpoint\x12>\n" + - "\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x02 \x01(\tR\tsandboxId\x12!\n" + - "\fsandbox_name\x18\x03 \x01(\tR\vsandboxName\x12!\n" + - "\fservice_name\x18\x04 \x01(\tR\vserviceName\x12\x1f\n" + - "\vtarget_port\x18\x05 \x01(\rR\n" + - "targetPort\x12\x16\n" + - "\x06domain\x18\x06 \x01(\bR\x06domain\"f\n" + - "\x17ServiceEndpointResponse\x129\n" + - "\bendpoint\x18\x01 \x01(\v2\x1d.openshell.v1.ServiceEndpointR\bendpoint\x12\x10\n" + - "\x03url\x18\x02 \x01(\tR\x03url\"5\n" + - "\x17RevokeSshSessionRequest\x12\x1a\n" + - "\x05token\x18\x01 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\"4\n" + - "\x18RevokeSshSessionResponse\x12\x18\n" + - "\arevoked\x18\x01 \x01(\bR\arevoked\"\xf5\x02\n" + - "\x12ExecSandboxRequest\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x18\n" + - "\acommand\x18\x02 \x03(\tR\acommand\x12\x18\n" + - "\aworkdir\x18\x03 \x01(\tR\aworkdir\x12S\n" + - "\venvironment\x18\x04 \x03(\v21.openshell.v1.ExecSandboxRequest.EnvironmentEntryR\venvironment\x12'\n" + - "\x0ftimeout_seconds\x18\x05 \x01(\rR\x0etimeoutSeconds\x12\x14\n" + - "\x05stdin\x18\x06 \x01(\fR\x05stdin\x12\x10\n" + - "\x03tty\x18\a \x01(\bR\x03tty\x12\x12\n" + - "\x04cols\x18\b \x01(\rR\x04cols\x12\x12\n" + - "\x04rows\x18\t \x01(\rR\x04rows\x1a>\n" + - "\x10EnvironmentEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"'\n" + - "\x11ExecSandboxStdout\x12\x12\n" + - "\x04data\x18\x01 \x01(\fR\x04data\"'\n" + - "\x11ExecSandboxStderr\x12\x12\n" + - "\x04data\x18\x01 \x01(\fR\x04data\".\n" + - "\x0fExecSandboxExit\x12\x1b\n" + - "\texit_code\x18\x01 \x01(\x05R\bexitCode\"\xc8\x01\n" + - "\x10ExecSandboxEvent\x129\n" + - "\x06stdout\x18\x01 \x01(\v2\x1f.openshell.v1.ExecSandboxStdoutH\x00R\x06stdout\x129\n" + - "\x06stderr\x18\x02 \x01(\v2\x1f.openshell.v1.ExecSandboxStderrH\x00R\x06stderr\x123\n" + - "\x04exit\x18\x03 \x01(\v2\x1d.openshell.v1.ExecSandboxExitH\x00R\x04exitB\t\n" + - "\apayload\"\xf3\x01\n" + - "\x0eTcpForwardInit\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1d\n" + - "\n" + - "service_id\x18\x04 \x01(\tR\tserviceId\x120\n" + - "\x03ssh\x18\x05 \x01(\v2\x1c.openshell.v1.SshRelayTargetH\x00R\x03ssh\x120\n" + - "\x03tcp\x18\x06 \x01(\v2\x1c.openshell.v1.TcpRelayTargetH\x00R\x03tcp\x125\n" + - "\x13authorization_token\x18\a \x01(\tB\x04\x88\xb5\x18\x01R\x12authorizationTokenB\b\n" + - "\x06target\"f\n" + - "\x0fTcpForwardFrame\x122\n" + - "\x04init\x18\x01 \x01(\v2\x1c.openshell.v1.TcpForwardInitH\x00R\x04init\x12\x14\n" + - "\x04data\x18\x02 \x01(\fH\x00R\x04dataB\t\n" + - "\apayload\"\xb0\x01\n" + - "\x10ExecSandboxInput\x128\n" + - "\x05start\x18\x01 \x01(\v2 .openshell.v1.ExecSandboxRequestH\x00R\x05start\x12\x16\n" + - "\x05stdin\x18\x02 \x01(\fH\x00R\x05stdin\x12?\n" + - "\x06resize\x18\x03 \x01(\v2%.openshell.v1.ExecSandboxWindowResizeH\x00R\x06resizeB\t\n" + - "\apayload\"A\n" + - "\x17ExecSandboxWindowResize\x12\x12\n" + - "\x04cols\x18\x01 \x01(\rR\x04cols\x12\x12\n" + - "\x04rows\x18\x02 \x01(\rR\x04rows\"\xc5\x01\n" + - "\n" + - "SshSession\x12>\n" + - "\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x02 \x01(\tR\tsandboxId\x12\x1a\n" + - "\x05token\x18\x03 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12\"\n" + - "\rexpires_at_ms\x18\x04 \x01(\x03R\vexpiresAtMs\x12\x18\n" + - "\arevoked\x18\x05 \x01(\bR\arevoked\"\xe6\x02\n" + - "\x13WatchSandboxRequest\x12\x0e\n" + - "\x02id\x18\x01 \x01(\tR\x02id\x12#\n" + - "\rfollow_status\x18\x02 \x01(\bR\ffollowStatus\x12\x1f\n" + - "\vfollow_logs\x18\x03 \x01(\bR\n" + - "followLogs\x12#\n" + - "\rfollow_events\x18\x04 \x01(\bR\ffollowEvents\x12$\n" + - "\x0elog_tail_lines\x18\x05 \x01(\rR\flogTailLines\x12\x1d\n" + - "\n" + - "event_tail\x18\x06 \x01(\rR\teventTail\x12(\n" + - "\x10stop_on_terminal\x18\a \x01(\bR\x0estopOnTerminal\x12 \n" + - "\flog_since_ms\x18\b \x01(\x03R\n" + - "logSinceMs\x12\x1f\n" + - "\vlog_sources\x18\t \x03(\tR\n" + - "logSources\x12\"\n" + - "\rlog_min_level\x18\n" + - " \x01(\tR\vlogMinLevel\"\xcc\x02\n" + - "\x12SandboxStreamEvent\x121\n" + - "\asandbox\x18\x01 \x01(\v2\x15.openshell.v1.SandboxH\x00R\asandbox\x120\n" + - "\x03log\x18\x02 \x01(\v2\x1c.openshell.v1.SandboxLogLineH\x00R\x03log\x123\n" + - "\x05event\x18\x03 \x01(\v2\x1b.openshell.v1.PlatformEventH\x00R\x05event\x12>\n" + - "\awarning\x18\x04 \x01(\v2\".openshell.v1.SandboxStreamWarningH\x00R\awarning\x12Q\n" + - "\x13draft_policy_update\x18\x05 \x01(\v2\x1f.openshell.v1.DraftPolicyUpdateH\x00R\x11draftPolicyUpdateB\t\n" + - "\apayload\"\xaf\x02\n" + - "\x0eSandboxLogLine\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12!\n" + - "\ftimestamp_ms\x18\x02 \x01(\x03R\vtimestampMs\x12\x14\n" + - "\x05level\x18\x03 \x01(\tR\x05level\x12\x16\n" + - "\x06target\x18\x04 \x01(\tR\x06target\x12\x18\n" + - "\amessage\x18\x05 \x01(\tR\amessage\x12\x16\n" + - "\x06source\x18\x06 \x01(\tR\x06source\x12@\n" + - "\x06fields\x18\a \x03(\v2(.openshell.v1.SandboxLogLine.FieldsEntryR\x06fields\x1a9\n" + - "\vFieldsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"0\n" + - "\x14SandboxStreamWarning\x12\x18\n" + - "\amessage\x18\x01 \x01(\tR\amessage\"s\n" + - "\x15CreateProviderRequest\x12<\n" + - "\bprovider\x18\x01 \x01(\v2 .openshell.datamodel.v1.ProviderR\bprovider\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"F\n" + - "\x12GetProviderRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"\x89\x01\n" + - "\x14ListProvidersRequest\x12\x14\n" + - "\x05limit\x18\x01 \x01(\rR\x05limit\x12\x16\n" + - "\x06offset\x18\x02 \x01(\rR\x06offset\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\x12%\n" + - "\x0eall_workspaces\x18\x04 \x01(\bR\rallWorkspaces\"\xb6\x02\n" + - "\x15UpdateProviderRequest\x12<\n" + - "\bprovider\x18\x01 \x01(\v2 .openshell.datamodel.v1.ProviderR\bprovider\x12w\n" + - "\x18credential_expires_at_ms\x18\x02 \x03(\v2>.openshell.v1.UpdateProviderRequest.CredentialExpiresAtMsEntryR\x15credentialExpiresAtMs\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\x1aH\n" + - "\x1aCredentialExpiresAtMsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\x03R\x05value:\x028\x01\"I\n" + - "\x15DeleteProviderRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"P\n" + - "\x10ProviderResponse\x12<\n" + - "\bprovider\x18\x01 \x01(\v2 .openshell.datamodel.v1.ProviderR\bprovider\"W\n" + - "\x15ListProvidersResponse\x12>\n" + - "\tproviders\x18\x01 \x03(\v2 .openshell.datamodel.v1.ProviderR\tproviders\"i\n" + - "\x1bListProviderProfilesRequest\x12\x14\n" + - "\x05limit\x18\x01 \x01(\rR\x05limit\x12\x16\n" + - "\x06offset\x18\x02 \x01(\rR\x06offset\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"I\n" + - "\x19GetProviderProfileRequest\x12\x0e\n" + - "\x02id\x18\x01 \x01(\tR\x02id\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"l\n" + - "\x19ProviderProfileImportItem\x127\n" + - "\aprofile\x18\x01 \x01(\v2\x1d.openshell.v1.ProviderProfileR\aprofile\x12\x16\n" + - "\x06source\x18\x02 \x01(\tR\x06source\"\x9e\x01\n" + - "\x19ProviderProfileDiagnostic\x12\x16\n" + - "\x06source\x18\x01 \x01(\tR\x06source\x12\x1d\n" + - "\n" + - "profile_id\x18\x02 \x01(\tR\tprofileId\x12\x14\n" + - "\x05field\x18\x03 \x01(\tR\x05field\x12\x18\n" + - "\amessage\x18\x04 \x01(\tR\amessage\x12\x1a\n" + - "\bseverity\x18\x05 \x01(\tR\bseverity\"\x9e\x01\n" + - ",ProviderCredentialTokenGrantAudienceOverride\x12\x12\n" + - "\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" + - "\x04port\x18\x02 \x01(\rR\x04port\x12\x12\n" + - "\x04path\x18\x03 \x01(\tR\x04path\x12\x1a\n" + - "\baudience\x18\x04 \x01(\tR\baudience\x12\x16\n" + - "\x06scopes\x18\x05 \x03(\tR\x06scopes\"\xf0\x02\n" + - "\x1cProviderCredentialTokenGrant\x12%\n" + - "\x0etoken_endpoint\x18\x01 \x01(\tR\rtokenEndpoint\x12\x1a\n" + - "\baudience\x18\x02 \x01(\tR\baudience\x12*\n" + - "\x11jwt_svid_audience\x18\x06 \x01(\tR\x0fjwtSvidAudience\x12\x16\n" + - "\x06scopes\x18\x03 \x03(\tR\x06scopes\x12*\n" + - "\x11cache_ttl_seconds\x18\x04 \x01(\x03R\x0fcacheTtlSeconds\x12i\n" + - "\x12audience_overrides\x18\x05 \x03(\v2:.openshell.v1.ProviderCredentialTokenGrantAudienceOverrideR\x11audienceOverrides\x122\n" + - "\x15client_assertion_type\x18\a \x01(\tR\x13clientAssertionType\"\x9e\x03\n" + - "\x19ProviderProfileCredential\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12 \n" + - "\vdescription\x18\x02 \x01(\tR\vdescription\x12\x19\n" + - "\benv_vars\x18\x03 \x03(\tR\aenvVars\x12\x1a\n" + - "\brequired\x18\x04 \x01(\bR\brequired\x12\x1d\n" + - "\n" + - "auth_style\x18\x05 \x01(\tR\tauthStyle\x12\x1f\n" + - "\vheader_name\x18\x06 \x01(\tR\n" + - "headerName\x12\x1f\n" + - "\vquery_param\x18\a \x01(\tR\n" + - "queryParam\x12A\n" + - "\arefresh\x18\b \x01(\v2'.openshell.v1.ProviderCredentialRefreshR\arefresh\x12#\n" + - "\rpath_template\x18\t \x01(\tR\fpathTemplate\x12K\n" + - "\vtoken_grant\x18\n" + - " \x01(\v2*.openshell.v1.ProviderCredentialTokenGrantR\n" + - "tokenGrant\"\x8d\x01\n" + - "!ProviderCredentialRefreshMaterial\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12 \n" + - "\vdescription\x18\x02 \x01(\tR\vdescription\x12\x1a\n" + - "\brequired\x18\x03 \x01(\bR\brequired\x12\x16\n" + - "\x06secret\x18\x04 \x01(\bR\x06secret\"Y\n" + - "\x1fProviderCredentialRefreshOutput\x12\x16\n" + - "\x06output\x18\x01 \x01(\tR\x06output\x12\x1e\n" + - "\n" + - "credential\x18\x02 \x01(\tR\n" + - "credential\"\xb0\x03\n" + - "\x19ProviderCredentialRefresh\x12K\n" + - "\bstrategy\x18\x01 \x01(\x0e2/.openshell.v1.ProviderCredentialRefreshStrategyR\bstrategy\x12\x1b\n" + - "\ttoken_url\x18\x02 \x01(\tR\btokenUrl\x12\x16\n" + - "\x06scopes\x18\x03 \x03(\tR\x06scopes\x124\n" + - "\x16refresh_before_seconds\x18\x04 \x01(\x03R\x14refreshBeforeSeconds\x120\n" + - "\x14max_lifetime_seconds\x18\x05 \x01(\x03R\x12maxLifetimeSeconds\x12K\n" + - "\bmaterial\x18\x06 \x03(\v2/.openshell.v1.ProviderCredentialRefreshMaterialR\bmaterial\x12\\\n" + - "\x12additional_outputs\x18\a \x03(\v2-.openshell.v1.ProviderCredentialRefreshOutputR\x11additionalOutputs\"\x90\x03\n" + - "\x1fProviderCredentialRefreshStatus\x12#\n" + - "\rprovider_name\x18\x01 \x01(\tR\fproviderName\x12\x1f\n" + - "\vprovider_id\x18\x02 \x01(\tR\n" + - "providerId\x12%\n" + - "\x0ecredential_key\x18\x03 \x01(\tR\rcredentialKey\x12K\n" + - "\bstrategy\x18\x04 \x01(\x0e2/.openshell.v1.ProviderCredentialRefreshStrategyR\bstrategy\x12\x16\n" + - "\x06status\x18\x05 \x01(\tR\x06status\x12\"\n" + - "\rexpires_at_ms\x18\x06 \x01(\x03R\vexpiresAtMs\x12+\n" + - "\x12next_refresh_at_ms\x18\a \x01(\x03R\x0fnextRefreshAtMs\x12+\n" + - "\x12last_refresh_at_ms\x18\b \x01(\x03R\x0flastRefreshAtMs\x12\x1d\n" + - "\n" + - "last_error\x18\t \x01(\tR\tlastError\"<\n" + - "\x18ProviderProfileDiscovery\x12 \n" + - "\vcredentials\x18\x01 \x03(\tR\vcredentials\"\x93\b\n" + - "$StoredProviderCredentialRefreshState\x12>\n" + - "\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12\x1f\n" + - "\vprovider_id\x18\x02 \x01(\tR\n" + - "providerId\x12#\n" + - "\rprovider_name\x18\x03 \x01(\tR\fproviderName\x12%\n" + - "\x0ecredential_key\x18\x04 \x01(\tR\rcredentialKey\x12K\n" + - "\bstrategy\x18\x05 \x01(\x0e2/.openshell.v1.ProviderCredentialRefreshStrategyR\bstrategy\x12b\n" + - "\bmaterial\x18\x06 \x03(\v2@.openshell.v1.StoredProviderCredentialRefreshState.MaterialEntryB\x04\x88\xb5\x18\x01R\bmaterial\x120\n" + - "\x14secret_material_keys\x18\a \x03(\tR\x12secretMaterialKeys\x12\"\n" + - "\rexpires_at_ms\x18\b \x01(\x03R\vexpiresAtMs\x12+\n" + - "\x12next_refresh_at_ms\x18\t \x01(\x03R\x0fnextRefreshAtMs\x12+\n" + - "\x12last_refresh_at_ms\x18\n" + - " \x01(\x03R\x0flastRefreshAtMs\x12\x16\n" + - "\x06status\x18\v \x01(\tR\x06status\x12\x1d\n" + - "\n" + - "last_error\x18\f \x01(\tR\tlastError\x12\x1b\n" + - "\ttoken_url\x18\r \x01(\tR\btokenUrl\x12\x16\n" + - "\x06scopes\x18\x0e \x03(\tR\x06scopes\x124\n" + - "\x16refresh_before_seconds\x18\x0f \x01(\x03R\x14refreshBeforeSeconds\x120\n" + - "\x14max_lifetime_seconds\x18\x10 \x01(\x03R\x12maxLifetimeSeconds\x12\x82\x01\n" + - "\x16additional_output_keys\x18\x11 \x03(\v2L.openshell.v1.StoredProviderCredentialRefreshState.AdditionalOutputKeysEntryR\x14additionalOutputKeys\x1a;\n" + - "\rMaterialEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1aG\n" + - "\x19AdditionalOutputKeysEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x82\x01\n" + - "\x1fGetProviderRefreshStatusRequest\x12\x1a\n" + - "\bprovider\x18\x01 \x01(\tR\bprovider\x12%\n" + - "\x0ecredential_key\x18\x02 \x01(\tR\rcredentialKey\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"s\n" + - " GetProviderRefreshStatusResponse\x12O\n" + - "\vcredentials\x18\x01 \x03(\v2-.openshell.v1.ProviderCredentialRefreshStatusR\vcredentials\"\xd8\x03\n" + - "\x1fConfigureProviderRefreshRequest\x12\x1a\n" + - "\bprovider\x18\x01 \x01(\tR\bprovider\x12%\n" + - "\x0ecredential_key\x18\x02 \x01(\tR\rcredentialKey\x12K\n" + - "\bstrategy\x18\x03 \x01(\x0e2/.openshell.v1.ProviderCredentialRefreshStrategyR\bstrategy\x12]\n" + - "\bmaterial\x18\x04 \x03(\v2;.openshell.v1.ConfigureProviderRefreshRequest.MaterialEntryB\x04\x88\xb5\x18\x01R\bmaterial\x120\n" + - "\x14secret_material_keys\x18\x05 \x03(\tR\x12secretMaterialKeys\x12'\n" + - "\rexpires_at_ms\x18\x06 \x01(\x03H\x00R\vexpiresAtMs\x88\x01\x01\x12\x1c\n" + - "\tworkspace\x18\a \x01(\tR\tworkspace\x1a;\n" + - "\rMaterialEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\x10\n" + - "\x0e_expires_at_ms\"i\n" + - " ConfigureProviderRefreshResponse\x12E\n" + - "\x06status\x18\x01 \x01(\v2-.openshell.v1.ProviderCredentialRefreshStatusR\x06status\"\x82\x01\n" + - "\x1fRotateProviderCredentialRequest\x12\x1a\n" + - "\bprovider\x18\x01 \x01(\tR\bprovider\x12%\n" + - "\x0ecredential_key\x18\x02 \x01(\tR\rcredentialKey\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"i\n" + - " RotateProviderCredentialResponse\x12E\n" + - "\x06status\x18\x01 \x01(\v2-.openshell.v1.ProviderCredentialRefreshStatusR\x06status\"\x7f\n" + - "\x1cDeleteProviderRefreshRequest\x12\x1a\n" + - "\bprovider\x18\x01 \x01(\tR\bprovider\x12%\n" + - "\x0ecredential_key\x18\x02 \x01(\tR\rcredentialKey\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"9\n" + - "\x1dDeleteProviderRefreshResponse\x12\x18\n" + - "\adeleted\x18\x01 \x01(\bR\adeleted\"\xd8\x05\n" + - "\x0fProviderProfile\x12\x0e\n" + - "\x02id\x18\x01 \x01(\tR\x02id\x12!\n" + - "\fdisplay_name\x18\x02 \x01(\tR\vdisplayName\x12 \n" + - "\vdescription\x18\x03 \x01(\tR\vdescription\x12A\n" + - "\bcategory\x18\x04 \x01(\x0e2%.openshell.v1.ProviderProfileCategoryR\bcategory\x12I\n" + - "\vcredentials\x18\x05 \x03(\v2'.openshell.v1.ProviderProfileCredentialR\vcredentials\x12C\n" + - "\tendpoints\x18\x06 \x03(\v2%.openshell.sandbox.v1.NetworkEndpointR\tendpoints\x12?\n" + - "\bbinaries\x18\a \x03(\v2#.openshell.sandbox.v1.NetworkBinaryR\bbinaries\x12+\n" + - "\x11inference_capable\x18\b \x01(\bR\x10inferenceCapable\x12D\n" + - "\tdiscovery\x18\t \x01(\v2&.openshell.v1.ProviderProfileDiscoveryR\tdiscovery\x12)\n" + - "\x10resource_version\x18\n" + - " \x01(\x04R\x0fresourceVersion\x12P\n" + - "\vannotations\x18\v \x03(\v2..openshell.v1.ProviderProfile.AnnotationsEntryR\vannotations\x12\x16\n" + - "\x06source\x18\f \x01(\tR\x06source\x12\x14\n" + - "\x05scope\x18\r \x01(\tR\x05scope\x1a>\n" + - "\x10AnnotationsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x90\x01\n" + - "\x15StoredProviderProfile\x12>\n" + - "\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x127\n" + - "\aprofile\x18\x02 \x01(\v2\x1d.openshell.v1.ProviderProfileR\aprofile\"R\n" + - "\x17ProviderProfileResponse\x127\n" + - "\aprofile\x18\x01 \x01(\v2\x1d.openshell.v1.ProviderProfileR\aprofile\"Y\n" + - "\x1cListProviderProfilesResponse\x129\n" + - "\bprofiles\x18\x01 \x03(\v2\x1d.openshell.v1.ProviderProfileR\bprofiles\"\x82\x01\n" + - "\x1dImportProviderProfilesRequest\x12C\n" + - "\bprofiles\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileImportItemR\bprofiles\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"\xc2\x01\n" + - "\x1eImportProviderProfilesResponse\x12I\n" + - "\vdiagnostics\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileDiagnosticR\vdiagnostics\x129\n" + - "\bprofiles\x18\x02 \x03(\v2\x1d.openshell.v1.ProviderProfileR\bprofiles\x12\x1a\n" + - "\bimported\x18\x03 \x01(\bR\bimported\"\xcc\x01\n" + - "\x1dUpdateProviderProfilesRequest\x12A\n" + - "\aprofile\x18\x01 \x01(\v2'.openshell.v1.ProviderProfileImportItemR\aprofile\x12:\n" + - "\x19expected_resource_version\x18\x02 \x01(\x04R\x17expectedResourceVersion\x12\x0e\n" + - "\x02id\x18\x03 \x01(\tR\x02id\x12\x1c\n" + - "\tworkspace\x18\x04 \x01(\tR\tworkspace\"\xbe\x01\n" + - "\x1eUpdateProviderProfilesResponse\x12I\n" + - "\vdiagnostics\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileDiagnosticR\vdiagnostics\x127\n" + - "\aprofile\x18\x02 \x01(\v2\x1d.openshell.v1.ProviderProfileR\aprofile\x12\x18\n" + - "\aupdated\x18\x03 \x01(\bR\aupdated\"\x80\x01\n" + - "\x1bLintProviderProfilesRequest\x12C\n" + - "\bprofiles\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileImportItemR\bprofiles\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"\x7f\n" + - "\x1cLintProviderProfilesResponse\x12I\n" + - "\vdiagnostics\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileDiagnosticR\vdiagnostics\x12\x14\n" + - "\x05valid\x18\x02 \x01(\bR\x05valid\"2\n" + - "\x16DeleteProviderResponse\x12\x18\n" + - "\adeleted\x18\x01 \x01(\bR\adeleted\"L\n" + - "\x1cDeleteProviderProfileRequest\x12\x0e\n" + - "\x02id\x18\x01 \x01(\tR\x02id\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"9\n" + - "\x1dDeleteProviderProfileResponse\x12\x18\n" + - "\adeleted\x18\x01 \x01(\bR\adeleted\"E\n" + - "$GetSandboxProviderEnvironmentRequest\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\"\xcb\x05\n" + - "%GetSandboxProviderEnvironmentResponse\x12l\n" + - "\venvironment\x18\x01 \x03(\v2D.openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntryB\x04\x88\xb5\x18\x01R\venvironment\x122\n" + - "\x15provider_env_revision\x18\x02 \x01(\x04R\x13providerEnvRevision\x12\x87\x01\n" + - "\x18credential_expires_at_ms\x18\x03 \x03(\v2N.openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpiresAtMsEntryR\x15credentialExpiresAtMs\x12|\n" + - "\x13dynamic_credentials\x18\x04 \x03(\v2K.openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntryR\x12dynamicCredentials\x1a>\n" + - "\x10EnvironmentEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1aH\n" + - "\x1aCredentialExpiresAtMsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\x03R\x05value:\x028\x01\x1an\n" + - "\x17DynamicCredentialsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12=\n" + - "\x05value\x18\x02 \x01(\v2'.openshell.v1.ProviderProfileCredentialR\x05value:\x028\x01\"\xce\x04\n" + - "\x13UpdateConfigRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12;\n" + - "\x06policy\x18\x02 \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x06policy\x12\x1f\n" + - "\vsetting_key\x18\x03 \x01(\tR\n" + - "settingKey\x12G\n" + - "\rsetting_value\x18\x04 \x01(\v2\".openshell.sandbox.v1.SettingValueR\fsettingValue\x12%\n" + - "\x0edelete_setting\x18\x05 \x01(\bR\rdeleteSetting\x12\x16\n" + - "\x06global\x18\x06 \x01(\bR\x06global\x12M\n" + - "\x10merge_operations\x18\a \x03(\v2\".openshell.v1.PolicyMergeOperationR\x0fmergeOperations\x12:\n" + - "\x19expected_resource_version\x18\b \x01(\x04R\x17expectedResourceVersion\x12T\n" + - "\vannotations\x18\t \x03(\v22.openshell.v1.UpdateConfigRequest.AnnotationsEntryR\vannotations\x12\x1c\n" + - "\tworkspace\x18\n" + - " \x01(\tR\tworkspace\x1a>\n" + - "\x10AnnotationsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xc7\x03\n" + - "\x14PolicyMergeOperation\x129\n" + - "\badd_rule\x18\x01 \x01(\v2\x1c.openshell.v1.AddNetworkRuleH\x00R\aaddRule\x12N\n" + - "\x0fremove_endpoint\x18\x02 \x01(\v2#.openshell.v1.RemoveNetworkEndpointH\x00R\x0eremoveEndpoint\x12B\n" + - "\vremove_rule\x18\x03 \x01(\v2\x1f.openshell.v1.RemoveNetworkRuleH\x00R\n" + - "removeRule\x12B\n" + - "\x0eadd_deny_rules\x18\x04 \x01(\v2\x1a.openshell.v1.AddDenyRulesH\x00R\faddDenyRules\x12E\n" + - "\x0fadd_allow_rules\x18\x05 \x01(\v2\x1b.openshell.v1.AddAllowRulesH\x00R\raddAllowRules\x12H\n" + - "\rremove_binary\x18\x06 \x01(\v2!.openshell.v1.RemoveNetworkBinaryH\x00R\fremoveBinaryB\v\n" + - "\toperation\"j\n" + - "\x0eAddNetworkRule\x12\x1b\n" + - "\trule_name\x18\x01 \x01(\tR\bruleName\x12;\n" + - "\x04rule\x18\x02 \x01(\v2'.openshell.sandbox.v1.NetworkPolicyRuleR\x04rule\"\\\n" + - "\x15RemoveNetworkEndpoint\x12\x1b\n" + - "\trule_name\x18\x01 \x01(\tR\bruleName\x12\x12\n" + - "\x04host\x18\x02 \x01(\tR\x04host\x12\x12\n" + - "\x04port\x18\x03 \x01(\rR\x04port\"0\n" + - "\x11RemoveNetworkRule\x12\x1b\n" + - "\trule_name\x18\x01 \x01(\tR\bruleName\"w\n" + - "\fAddDenyRules\x12\x12\n" + - "\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" + - "\x04port\x18\x02 \x01(\rR\x04port\x12?\n" + - "\n" + - "deny_rules\x18\x03 \x03(\v2 .openshell.sandbox.v1.L7DenyRuleR\tdenyRules\"k\n" + - "\rAddAllowRules\x12\x12\n" + - "\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" + - "\x04port\x18\x02 \x01(\rR\x04port\x122\n" + - "\x05rules\x18\x03 \x03(\v2\x1c.openshell.sandbox.v1.L7RuleR\x05rules\"S\n" + - "\x13RemoveNetworkBinary\x12\x1b\n" + - "\trule_name\x18\x01 \x01(\tR\bruleName\x12\x1f\n" + - "\vbinary_path\x18\x02 \x01(\tR\n" + - "binaryPath\"\xaf\x02\n" + - "\x14UpdateConfigResponse\x12\x18\n" + - "\aversion\x18\x01 \x01(\rR\aversion\x12\x1f\n" + - "\vpolicy_hash\x18\x02 \x01(\tR\n" + - "policyHash\x12+\n" + - "\x11settings_revision\x18\x03 \x01(\x04R\x10settingsRevision\x12\x18\n" + - "\adeleted\x18\x04 \x01(\bR\adeleted\x12U\n" + - "\vannotations\x18\x05 \x03(\v23.openshell.v1.UpdateConfigResponse.AnnotationsEntryR\vannotations\x1a>\n" + - "\x10AnnotationsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x83\x01\n" + - "\x1dGetSandboxPolicyStatusRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x18\n" + - "\aversion\x18\x02 \x01(\rR\aversion\x12\x16\n" + - "\x06global\x18\x03 \x01(\bR\x06global\x12\x1c\n" + - "\tworkspace\x18\x04 \x01(\tR\tworkspace\"\x88\x01\n" + - "\x1eGetSandboxPolicyStatusResponse\x12?\n" + - "\brevision\x18\x01 \x01(\v2#.openshell.v1.SandboxPolicyRevisionR\brevision\x12%\n" + - "\x0eactive_version\x18\x02 \x01(\rR\ractiveVersion\"\x94\x01\n" + - "\x1aListSandboxPoliciesRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x14\n" + - "\x05limit\x18\x02 \x01(\rR\x05limit\x12\x16\n" + - "\x06offset\x18\x03 \x01(\rR\x06offset\x12\x16\n" + - "\x06global\x18\x04 \x01(\bR\x06global\x12\x1c\n" + - "\tworkspace\x18\x05 \x01(\tR\tworkspace\"`\n" + - "\x1bListSandboxPoliciesResponse\x12A\n" + - "\trevisions\x18\x01 \x03(\v2#.openshell.v1.SandboxPolicyRevisionR\trevisions\"\xa7\x01\n" + - "\x19ReportPolicyStatusRequest\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x18\n" + - "\aversion\x18\x02 \x01(\rR\aversion\x122\n" + - "\x06status\x18\x03 \x01(\x0e2\x1a.openshell.v1.PolicyStatusR\x06status\x12\x1d\n" + - "\n" + - "load_error\x18\x04 \x01(\tR\tloadError\"\x1c\n" + - "\x1aReportPolicyStatusResponse\"\xbc\x03\n" + - "\x15SandboxPolicyRevision\x12\x18\n" + - "\aversion\x18\x01 \x01(\rR\aversion\x12\x1f\n" + - "\vpolicy_hash\x18\x02 \x01(\tR\n" + - "policyHash\x122\n" + - "\x06status\x18\x03 \x01(\x0e2\x1a.openshell.v1.PolicyStatusR\x06status\x12\x1d\n" + - "\n" + - "load_error\x18\x04 \x01(\tR\tloadError\x12\"\n" + - "\rcreated_at_ms\x18\x05 \x01(\x03R\vcreatedAtMs\x12 \n" + - "\floaded_at_ms\x18\x06 \x01(\x03R\n" + - "loadedAtMs\x12;\n" + - "\x06policy\x18\a \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x06policy\x12S\n" + - "\n" + - "provenance\x18\b \x03(\v23.openshell.v1.SandboxPolicyRevision.ProvenanceEntryR\n" + - "provenance\x1a=\n" + - "\x0fProvenanceEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xbc\x01\n" + - "\x15GetSandboxLogsRequest\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x14\n" + - "\x05lines\x18\x02 \x01(\rR\x05lines\x12\x19\n" + - "\bsince_ms\x18\x03 \x01(\x03R\asinceMs\x12\x18\n" + - "\asources\x18\x04 \x03(\tR\asources\x12\x1b\n" + - "\tmin_level\x18\x05 \x01(\tR\bminLevel\x12\x1c\n" + - "\tworkspace\x18\x06 \x01(\tR\tworkspace\"i\n" + - "\x16PushSandboxLogsRequest\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x120\n" + - "\x04logs\x18\x02 \x03(\v2\x1c.openshell.v1.SandboxLogLineR\x04logs\"\x19\n" + - "\x17PushSandboxLogsResponse\"m\n" + - "\x16GetSandboxLogsResponse\x120\n" + - "\x04logs\x18\x01 \x03(\v2\x1c.openshell.v1.SandboxLogLineR\x04logs\x12!\n" + - "\fbuffer_total\x18\x02 \x01(\rR\vbufferTotal\"\xa2\x02\n" + - "\x11SupervisorMessage\x125\n" + - "\x05hello\x18\x01 \x01(\v2\x1d.openshell.v1.SupervisorHelloH\x00R\x05hello\x12A\n" + - "\theartbeat\x18\x02 \x01(\v2!.openshell.v1.SupervisorHeartbeatH\x00R\theartbeat\x12K\n" + - "\x11relay_open_result\x18\x03 \x01(\v2\x1d.openshell.v1.RelayOpenResultH\x00R\x0frelayOpenResult\x12;\n" + - "\vrelay_close\x18\x04 \x01(\v2\x18.openshell.v1.RelayCloseH\x00R\n" + - "relayCloseB\t\n" + - "\apayload\"\xea\x02\n" + - "\x0eGatewayMessage\x12J\n" + - "\x10session_accepted\x18\x01 \x01(\v2\x1d.openshell.v1.SessionAcceptedH\x00R\x0fsessionAccepted\x12J\n" + - "\x10session_rejected\x18\x02 \x01(\v2\x1d.openshell.v1.SessionRejectedH\x00R\x0fsessionRejected\x12>\n" + - "\theartbeat\x18\x03 \x01(\v2\x1e.openshell.v1.GatewayHeartbeatH\x00R\theartbeat\x128\n" + - "\n" + - "relay_open\x18\x04 \x01(\v2\x17.openshell.v1.RelayOpenH\x00R\trelayOpen\x12;\n" + - "\vrelay_close\x18\x05 \x01(\v2\x18.openshell.v1.RelayCloseH\x00R\n" + - "relayCloseB\t\n" + - "\apayload\"Q\n" + - "\x0fSupervisorHello\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1f\n" + - "\vinstance_id\x18\x02 \x01(\tR\n" + - "instanceId\"h\n" + - "\x0fSessionAccepted\x12\x1d\n" + - "\n" + - "session_id\x18\x01 \x01(\tR\tsessionId\x126\n" + - "\x17heartbeat_interval_secs\x18\x02 \x01(\rR\x15heartbeatIntervalSecs\")\n" + - "\x0fSessionRejected\x12\x16\n" + - "\x06reason\x18\x01 \x01(\tR\x06reason\"\x15\n" + - "\x13SupervisorHeartbeat\"\x12\n" + - "\x10GatewayHeartbeat\"\xb7\x01\n" + - "\tRelayOpen\x12\x1d\n" + - "\n" + - "channel_id\x18\x01 \x01(\tR\tchannelId\x120\n" + - "\x03ssh\x18\x02 \x01(\v2\x1c.openshell.v1.SshRelayTargetH\x00R\x03ssh\x120\n" + - "\x03tcp\x18\x03 \x01(\v2\x1c.openshell.v1.TcpRelayTargetH\x00R\x03tcp\x12\x1d\n" + - "\n" + - "service_id\x18\x05 \x01(\tR\tserviceIdB\b\n" + - "\x06target\"\x10\n" + - "\x0eSshRelayTarget\"8\n" + - "\x0eTcpRelayTarget\x12\x12\n" + - "\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" + - "\x04port\x18\x02 \x01(\rR\x04port\"*\n" + - "\tRelayInit\x12\x1d\n" + - "\n" + - "channel_id\x18\x01 \x01(\tR\tchannelId\"\\\n" + - "\n" + - "RelayFrame\x12-\n" + - "\x04init\x18\x01 \x01(\v2\x17.openshell.v1.RelayInitH\x00R\x04init\x12\x14\n" + - "\x04data\x18\x02 \x01(\fH\x00R\x04dataB\t\n" + - "\apayload\"`\n" + - "\x0fRelayOpenResult\x12\x1d\n" + - "\n" + - "channel_id\x18\x01 \x01(\tR\tchannelId\x12\x18\n" + - "\asuccess\x18\x02 \x01(\bR\asuccess\x12\x14\n" + - "\x05error\x18\x03 \x01(\tR\x05error\"C\n" + - "\n" + - "RelayClose\x12\x1d\n" + - "\n" + - "channel_id\x18\x01 \x01(\tR\tchannelId\x12\x16\n" + - "\x06reason\x18\x02 \x01(\tR\x06reason\"o\n" + - "\x0fL7RequestSample\x12\x16\n" + - "\x06method\x18\x01 \x01(\tR\x06method\x12\x12\n" + - "\x04path\x18\x02 \x01(\tR\x04path\x12\x1a\n" + - "\bdecision\x18\x03 \x01(\tR\bdecision\x12\x14\n" + - "\x05count\x18\x04 \x01(\rR\x05count\"\xe5\x04\n" + - "\rDenialSummary\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x12\n" + - "\x04host\x18\x02 \x01(\tR\x04host\x12\x12\n" + - "\x04port\x18\x03 \x01(\rR\x04port\x12\x16\n" + - "\x06binary\x18\x04 \x01(\tR\x06binary\x12\x1c\n" + - "\tancestors\x18\x05 \x03(\tR\tancestors\x12\x1f\n" + - "\vdeny_reason\x18\x06 \x01(\tR\n" + - "denyReason\x12\"\n" + - "\rfirst_seen_ms\x18\a \x01(\x03R\vfirstSeenMs\x12 \n" + - "\flast_seen_ms\x18\b \x01(\x03R\n" + - "lastSeenMs\x12\x14\n" + - "\x05count\x18\t \x01(\rR\x05count\x12)\n" + - "\x10suppressed_count\x18\n" + - " \x01(\rR\x0fsuppressedCount\x12\x1f\n" + - "\vtotal_count\x18\v \x01(\rR\n" + - "totalCount\x12'\n" + - "\x0fsample_cmdlines\x18\f \x03(\tR\x0esampleCmdlines\x12#\n" + - "\rbinary_sha256\x18\r \x01(\tR\fbinarySha256\x12\x1e\n" + - "\n" + - "persistent\x18\x0e \x01(\bR\n" + - "persistent\x12!\n" + - "\fdenial_stage\x18\x0f \x01(\tR\vdenialStage\x12K\n" + - "\x12l7_request_samples\x18\x10 \x03(\v2\x1d.openshell.v1.L7RequestSampleR\x10l7RequestSamples\x120\n" + - "\x14l7_inspection_active\x18\x11 \x01(\bR\x12l7InspectionActive\"T\n" + - "\x10DenialGroupCount\x12\x1d\n" + - "\n" + - "deny_group\x18\x01 \x01(\tR\tdenyGroup\x12!\n" + - "\fdenied_count\x18\x02 \x01(\rR\vdeniedCount\"\xc8\x01\n" + - "\x16NetworkActivitySummary\x124\n" + - "\x16network_activity_count\x18\x01 \x01(\rR\x14networkActivityCount\x12.\n" + - "\x13denied_action_count\x18\x02 \x01(\rR\x11deniedActionCount\x12H\n" + - "\x10denials_by_group\x18\x03 \x03(\v2\x1e.openshell.v1.DenialGroupCountR\x0edenialsByGroup\"\x94\x05\n" + - "\vPolicyChunk\x12\x0e\n" + - "\x02id\x18\x01 \x01(\tR\x02id\x12\x16\n" + - "\x06status\x18\x02 \x01(\tR\x06status\x12\x1b\n" + - "\trule_name\x18\x03 \x01(\tR\bruleName\x12L\n" + - "\rproposed_rule\x18\x04 \x01(\v2'.openshell.sandbox.v1.NetworkPolicyRuleR\fproposedRule\x12\x1c\n" + - "\trationale\x18\x05 \x01(\tR\trationale\x12%\n" + - "\x0esecurity_notes\x18\x06 \x01(\tR\rsecurityNotes\x12\x1e\n" + - "\n" + - "confidence\x18\a \x01(\x02R\n" + - "confidence\x12,\n" + - "\x12denial_summary_ids\x18\b \x03(\tR\x10denialSummaryIds\x12\"\n" + - "\rcreated_at_ms\x18\t \x01(\x03R\vcreatedAtMs\x12\"\n" + - "\rdecided_at_ms\x18\n" + - " \x01(\x03R\vdecidedAtMs\x12\x14\n" + - "\x05stage\x18\v \x01(\tR\x05stage\x12.\n" + - "\x13supersedes_chunk_id\x18\f \x01(\tR\x11supersedesChunkId\x12\x1b\n" + - "\thit_count\x18\r \x01(\x05R\bhitCount\x12\"\n" + - "\rfirst_seen_ms\x18\x0e \x01(\x03R\vfirstSeenMs\x12 \n" + - "\flast_seen_ms\x18\x0f \x01(\x03R\n" + - "lastSeenMs\x12\x16\n" + - "\x06binary\x18\x10 \x01(\tR\x06binary\x12+\n" + - "\x11validation_result\x18\x11 \x01(\tR\x10validationResult\x12)\n" + - "\x10rejection_reason\x18\x12 \x01(\tR\x0frejectionReason\"\x96\x01\n" + - "\x11DraftPolicyUpdate\x12#\n" + - "\rdraft_version\x18\x01 \x01(\x04R\fdraftVersion\x12\x1d\n" + - "\n" + - "new_chunks\x18\x02 \x01(\rR\tnewChunks\x12#\n" + - "\rtotal_pending\x18\x03 \x01(\rR\ftotalPending\x12\x18\n" + - "\asummary\x18\x04 \x01(\tR\asummary\"\xd7\x02\n" + - "\x1bSubmitPolicyAnalysisRequest\x129\n" + - "\tsummaries\x18\x01 \x03(\v2\x1b.openshell.v1.DenialSummaryR\tsummaries\x12B\n" + - "\x0fproposed_chunks\x18\x02 \x03(\v2\x19.openshell.v1.PolicyChunkR\x0eproposedChunks\x12#\n" + - "\ranalysis_mode\x18\x03 \x01(\tR\fanalysisMode\x12\x12\n" + - "\x04name\x18\x04 \x01(\tR\x04name\x12b\n" + - "\x1anetwork_activity_summaries\x18\x05 \x03(\v2$.openshell.v1.NetworkActivitySummaryR\x18networkActivitySummaries\x12\x1c\n" + - "\tworkspace\x18\x06 \x01(\tR\tworkspace\"\xcb\x01\n" + - "\x1cSubmitPolicyAnalysisResponse\x12'\n" + - "\x0faccepted_chunks\x18\x01 \x01(\rR\x0eacceptedChunks\x12'\n" + - "\x0frejected_chunks\x18\x02 \x01(\rR\x0erejectedChunks\x12+\n" + - "\x11rejection_reasons\x18\x03 \x03(\tR\x10rejectionReasons\x12,\n" + - "\x12accepted_chunk_ids\x18\x04 \x03(\tR\x10acceptedChunkIds\"n\n" + - "\x15GetDraftPolicyRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12#\n" + - "\rstatus_filter\x18\x02 \x01(\tR\fstatusFilter\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"\xc8\x01\n" + - "\x16GetDraftPolicyResponse\x121\n" + - "\x06chunks\x18\x01 \x03(\v2\x19.openshell.v1.PolicyChunkR\x06chunks\x12'\n" + - "\x0frolling_summary\x18\x02 \x01(\tR\x0erollingSummary\x12#\n" + - "\rdraft_version\x18\x03 \x01(\x04R\fdraftVersion\x12-\n" + - "\x13last_analyzed_at_ms\x18\x04 \x01(\x03R\x10lastAnalyzedAtMs\"g\n" + - "\x18ApproveDraftChunkRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x19\n" + - "\bchunk_id\x18\x02 \x01(\tR\achunkId\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"c\n" + - "\x19ApproveDraftChunkResponse\x12%\n" + - "\x0epolicy_version\x18\x01 \x01(\rR\rpolicyVersion\x12\x1f\n" + - "\vpolicy_hash\x18\x02 \x01(\tR\n" + - "policyHash\"~\n" + - "\x17RejectDraftChunkRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x19\n" + - "\bchunk_id\x18\x02 \x01(\tR\achunkId\x12\x16\n" + - "\x06reason\x18\x03 \x01(\tR\x06reason\x12\x1c\n" + - "\tworkspace\x18\x04 \x01(\tR\tworkspace\"\x1a\n" + - "\x18RejectDraftChunkResponse\"\x8a\x01\n" + - "\x1cApproveAllDraftChunksRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x128\n" + - "\x18include_security_flagged\x18\x02 \x01(\bR\x16includeSecurityFlagged\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"\xb7\x01\n" + - "\x1dApproveAllDraftChunksResponse\x12%\n" + - "\x0epolicy_version\x18\x01 \x01(\rR\rpolicyVersion\x12\x1f\n" + - "\vpolicy_hash\x18\x02 \x01(\tR\n" + - "policyHash\x12'\n" + - "\x0fchunks_approved\x18\x03 \x01(\rR\x0echunksApproved\x12%\n" + - "\x0echunks_skipped\x18\x04 \x01(\rR\rchunksSkipped\"\xb2\x01\n" + - "\x15EditDraftChunkRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x19\n" + - "\bchunk_id\x18\x02 \x01(\tR\achunkId\x12L\n" + - "\rproposed_rule\x18\x03 \x01(\v2'.openshell.sandbox.v1.NetworkPolicyRuleR\fproposedRule\x12\x1c\n" + - "\tworkspace\x18\x04 \x01(\tR\tworkspace\"\x18\n" + - "\x16EditDraftChunkResponse\"d\n" + - "\x15UndoDraftChunkRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x19\n" + - "\bchunk_id\x18\x02 \x01(\tR\achunkId\x12\x1c\n" + - "\tworkspace\x18\x03 \x01(\tR\tworkspace\"`\n" + - "\x16UndoDraftChunkResponse\x12%\n" + - "\x0epolicy_version\x18\x01 \x01(\rR\rpolicyVersion\x12\x1f\n" + - "\vpolicy_hash\x18\x02 \x01(\tR\n" + - "policyHash\"K\n" + - "\x17ClearDraftChunksRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"A\n" + - "\x18ClearDraftChunksResponse\x12%\n" + - "\x0echunks_cleared\x18\x01 \x01(\rR\rchunksCleared\"J\n" + - "\x16GetDraftHistoryRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" + - "\tworkspace\x18\x02 \x01(\tR\tworkspace\"\x92\x01\n" + - "\x11DraftHistoryEntry\x12!\n" + - "\ftimestamp_ms\x18\x01 \x01(\x03R\vtimestampMs\x12\x1d\n" + - "\n" + - "event_type\x18\x02 \x01(\tR\teventType\x12 \n" + - "\vdescription\x18\x03 \x01(\tR\vdescription\x12\x19\n" + - "\bchunk_id\x18\x04 \x01(\tR\achunkId\"T\n" + - "\x17GetDraftHistoryResponse\x129\n" + - "\aentries\x18\x01 \x03(\v2\x1f.openshell.v1.DraftHistoryEntryR\aentries\"\xbd\x02\n" + - "\x15PolicyRevisionPayload\x12;\n" + - "\x06policy\x18\x01 \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x06policy\x12\x12\n" + - "\x04hash\x18\x02 \x01(\tR\x04hash\x12\x1d\n" + - "\n" + - "load_error\x18\x03 \x01(\tR\tloadError\x12 \n" + - "\floaded_at_ms\x18\x04 \x01(\x03R\n" + - "loadedAtMs\x12S\n" + - "\n" + - "provenance\x18\x05 \x03(\v23.openshell.v1.PolicyRevisionPayload.ProvenanceEntryR\n" + - "provenance\x1a=\n" + - "\x0fProvenanceEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xc4\x03\n" + - "\x11DraftChunkPayload\x12\x1b\n" + - "\trule_name\x18\x01 \x01(\tR\bruleName\x12L\n" + - "\rproposed_rule\x18\x02 \x01(\v2'.openshell.sandbox.v1.NetworkPolicyRuleR\fproposedRule\x12\x1c\n" + - "\trationale\x18\x03 \x01(\tR\trationale\x12%\n" + - "\x0esecurity_notes\x18\x04 \x01(\tR\rsecurityNotes\x12\x1e\n" + - "\n" + - "confidence\x18\x05 \x01(\x02R\n" + - "confidence\x12\"\n" + - "\rdecided_at_ms\x18\x06 \x01(\x03R\vdecidedAtMs\x12\x12\n" + - "\x04host\x18\a \x01(\tR\x04host\x12\x12\n" + - "\x04port\x18\b \x01(\x05R\x04port\x12\x16\n" + - "\x06binary\x18\t \x01(\tR\x06binary\x12#\n" + - "\rdraft_version\x18\n" + - " \x01(\x03R\fdraftVersion\x12+\n" + - "\x11validation_result\x18\v \x01(\tR\x10validationResult\x12)\n" + - "\x10rejection_reason\x18\f \x01(\tR\x0frejectionReason\"\xe1\x03\n" + - "\x14StoredPolicyRevision\x12\x0e\n" + - "\x02id\x18\x01 \x01(\tR\x02id\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x02 \x01(\tR\tsandboxId\x12\x18\n" + - "\aversion\x18\x03 \x01(\x03R\aversion\x12%\n" + - "\x0epolicy_payload\x18\x04 \x01(\fR\rpolicyPayload\x12\x1f\n" + - "\vpolicy_hash\x18\x05 \x01(\tR\n" + - "policyHash\x12\x16\n" + - "\x06status\x18\x06 \x01(\tR\x06status\x12\"\n" + - "\n" + - "load_error\x18\a \x01(\tH\x00R\tloadError\x88\x01\x01\x12\"\n" + - "\rcreated_at_ms\x18\b \x01(\x03R\vcreatedAtMs\x12%\n" + - "\floaded_at_ms\x18\t \x01(\x03H\x01R\n" + - "loadedAtMs\x88\x01\x01\x12R\n" + - "\n" + - "provenance\x18\n" + - " \x03(\v22.openshell.v1.StoredPolicyRevision.ProvenanceEntryR\n" + - "provenance\x1a=\n" + - "\x0fProvenanceEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\r\n" + - "\v_load_errorB\x0f\n" + - "\r_loaded_at_ms\"\xff\x04\n" + - "\x10StoredDraftChunk\x12\x0e\n" + - "\x02id\x18\x01 \x01(\tR\x02id\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x02 \x01(\tR\tsandboxId\x12#\n" + - "\rdraft_version\x18\x03 \x01(\x03R\fdraftVersion\x12\x16\n" + - "\x06status\x18\x04 \x01(\tR\x06status\x12\x1b\n" + - "\trule_name\x18\x05 \x01(\tR\bruleName\x12#\n" + - "\rproposed_rule\x18\x06 \x01(\fR\fproposedRule\x12\x1c\n" + - "\trationale\x18\a \x01(\tR\trationale\x12%\n" + - "\x0esecurity_notes\x18\b \x01(\tR\rsecurityNotes\x12\x1e\n" + - "\n" + - "confidence\x18\t \x01(\x01R\n" + - "confidence\x12\"\n" + - "\rcreated_at_ms\x18\n" + - " \x01(\x03R\vcreatedAtMs\x12'\n" + - "\rdecided_at_ms\x18\v \x01(\x03H\x00R\vdecidedAtMs\x88\x01\x01\x12\x12\n" + - "\x04host\x18\f \x01(\tR\x04host\x12\x12\n" + - "\x04port\x18\r \x01(\x05R\x04port\x12\x16\n" + - "\x06binary\x18\x0e \x01(\tR\x06binary\x12\x1b\n" + - "\thit_count\x18\x0f \x01(\x05R\bhitCount\x12\"\n" + - "\rfirst_seen_ms\x18\x10 \x01(\x03R\vfirstSeenMs\x12 \n" + - "\flast_seen_ms\x18\x11 \x01(\x03R\n" + - "lastSeenMs\x12+\n" + - "\x11validation_result\x18\x12 \x01(\tR\x10validationResult\x12)\n" + - "\x10rejection_reason\x18\x13 \x01(\tR\x0frejectionReasonB\x10\n" + - "\x0e_decided_at_ms\"\xb1\x01\n" + - "\x16CreateWorkspaceRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12H\n" + - "\x06labels\x18\x02 \x03(\v20.openshell.v1.CreateWorkspaceRequest.LabelsEntryR\x06labels\x1a9\n" + - "\vLabelsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" + - "\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"Z\n" + - "\x17CreateWorkspaceResponse\x12?\n" + - "\tworkspace\x18\x01 \x01(\v2!.openshell.datamodel.v1.WorkspaceR\tworkspace\")\n" + - "\x13GetWorkspaceRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\"W\n" + - "\x14GetWorkspaceResponse\x12?\n" + - "\tworkspace\x18\x01 \x01(\v2!.openshell.datamodel.v1.WorkspaceR\tworkspace\"l\n" + - "\x15ListWorkspacesRequest\x12\x14\n" + - "\x05limit\x18\x01 \x01(\rR\x05limit\x12\x16\n" + - "\x06offset\x18\x02 \x01(\rR\x06offset\x12%\n" + - "\x0elabel_selector\x18\x03 \x01(\tR\rlabelSelector\"[\n" + - "\x16ListWorkspacesResponse\x12A\n" + - "\n" + - "workspaces\x18\x01 \x03(\v2!.openshell.datamodel.v1.WorkspaceR\n" + - "workspaces\",\n" + - "\x16DeleteWorkspaceRequest\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\"3\n" + - "\x17DeleteWorkspaceResponse\x12\x18\n" + - "\adeleted\x18\x01 \x01(\bR\adeleted\"\xaf\x01\n" + - "\x0fWorkspaceMember\x12>\n" + - "\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12+\n" + - "\x11principal_subject\x18\x02 \x01(\tR\x10principalSubject\x12/\n" + - "\x04role\x18\x03 \x01(\x0e2\x1b.openshell.v1.WorkspaceRoleR\x04role\"\x97\x01\n" + - "\x19AddWorkspaceMemberRequest\x12\x1c\n" + - "\tworkspace\x18\x01 \x01(\tR\tworkspace\x12+\n" + - "\x11principal_subject\x18\x02 \x01(\tR\x10principalSubject\x12/\n" + - "\x04role\x18\x03 \x01(\x0e2\x1b.openshell.v1.WorkspaceRoleR\x04role\"S\n" + - "\x1aAddWorkspaceMemberResponse\x125\n" + - "\x06member\x18\x01 \x01(\v2\x1d.openshell.v1.WorkspaceMemberR\x06member\"i\n" + - "\x1cRemoveWorkspaceMemberRequest\x12\x1c\n" + - "\tworkspace\x18\x01 \x01(\tR\tworkspace\x12+\n" + - "\x11principal_subject\x18\x02 \x01(\tR\x10principalSubject\"9\n" + - "\x1dRemoveWorkspaceMemberResponse\x12\x18\n" + - "\aremoved\x18\x01 \x01(\bR\aremoved\"i\n" + - "\x1bListWorkspaceMembersRequest\x12\x1c\n" + - "\tworkspace\x18\x01 \x01(\tR\tworkspace\x12\x14\n" + - "\x05limit\x18\x02 \x01(\rR\x05limit\x12\x16\n" + - "\x06offset\x18\x03 \x01(\rR\x06offset\"W\n" + - "\x1cListWorkspaceMembersResponse\x127\n" + - "\amembers\x18\x01 \x03(\v2\x1d.openshell.v1.WorkspaceMemberR\amembers*\xb6\x01\n" + - "\fSandboxPhase\x12\x1d\n" + - "\x19SANDBOX_PHASE_UNSPECIFIED\x10\x00\x12\x1e\n" + - "\x1aSANDBOX_PHASE_PROVISIONING\x10\x01\x12\x17\n" + - "\x13SANDBOX_PHASE_READY\x10\x02\x12\x17\n" + - "\x13SANDBOX_PHASE_ERROR\x10\x03\x12\x1a\n" + - "\x16SANDBOX_PHASE_DELETING\x10\x04\x12\x19\n" + - "\x15SANDBOX_PHASE_UNKNOWN\x10\x05*\xc3\x03\n" + - "!ProviderCredentialRefreshStrategy\x124\n" + - "0PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED\x10\x00\x12/\n" + - "+PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC\x10\x01\x121\n" + - "-PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL\x10\x02\x12=\n" + - "9PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN\x10\x03\x12B\n" + - ">PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS\x10\x04\x12C\n" + - "?PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT\x10\x05\x12<\n" + - "8PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE\x10\x06*\xdb\x02\n" + - "\x17ProviderProfileCategory\x12)\n" + - "%PROVIDER_PROFILE_CATEGORY_UNSPECIFIED\x10\x00\x12#\n" + - "\x1fPROVIDER_PROFILE_CATEGORY_OTHER\x10\x01\x12'\n" + - "#PROVIDER_PROFILE_CATEGORY_INFERENCE\x10\x02\x12#\n" + - "\x1fPROVIDER_PROFILE_CATEGORY_AGENT\x10\x03\x12,\n" + - "(PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL\x10\x04\x12'\n" + - "#PROVIDER_PROFILE_CATEGORY_MESSAGING\x10\x05\x12\"\n" + - "\x1ePROVIDER_PROFILE_CATEGORY_DATA\x10\x06\x12'\n" + - "#PROVIDER_PROFILE_CATEGORY_KNOWLEDGE\x10\a*\x9a\x01\n" + - "\fPolicyStatus\x12\x1d\n" + - "\x19POLICY_STATUS_UNSPECIFIED\x10\x00\x12\x19\n" + - "\x15POLICY_STATUS_PENDING\x10\x01\x12\x18\n" + - "\x14POLICY_STATUS_LOADED\x10\x02\x12\x18\n" + - "\x14POLICY_STATUS_FAILED\x10\x03\x12\x1c\n" + - "\x18POLICY_STATUS_SUPERSEDED\x10\x04*\x86\x01\n" + - "\rServiceStatus\x12\x1e\n" + - "\x1aSERVICE_STATUS_UNSPECIFIED\x10\x00\x12\x1a\n" + - "\x16SERVICE_STATUS_HEALTHY\x10\x01\x12\x1b\n" + - "\x17SERVICE_STATUS_DEGRADED\x10\x02\x12\x1c\n" + - "\x18SERVICE_STATUS_UNHEALTHY\x10\x03*b\n" + - "\rWorkspaceRole\x12\x1e\n" + - "\x1aWORKSPACE_ROLE_UNSPECIFIED\x10\x00\x12\x17\n" + - "\x13WORKSPACE_ROLE_USER\x10\x01\x12\x18\n" + - "\x14WORKSPACE_ROLE_ADMIN\x10\x022\xacB\n" + - "\tOpenShell\x12Z\n" + - "\x06Health\x12\x1b.openshell.v1.HealthRequest\x1a\x1c.openshell.v1.HealthResponse\"\x15\x82\xb5\x18\x11\n" + - "\x0funauthenticated\x12i\n" + - "\x0eGetCurrentUser\x12#.openshell.v1.GetCurrentUserRequest\x1a$.openshell.v1.GetCurrentUserResponse\"\f\x82\xb5\x18\b\n" + - "\x06bearer\x12\x86\x01\n" + - "\x0eGetGatewayInfo\x12#.openshell.v1.GetGatewayInfoRequest\x1a$.openshell.v1.GetGatewayInfoResponse\")\x82\xb5\x18%\n" + - "\x06bearer\x1a\x0eplatform_admin\"\vconfig:read\x12u\n" + - "\rCreateSandbox\x12\".openshell.v1.CreateSandboxRequest\x1a\x1d.openshell.v1.SandboxResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write\x12n\n" + - "\n" + - "GetSandbox\x12\x1f.openshell.v1.GetSandboxRequest\x1a\x1d.openshell.v1.SandboxResponse\" \x82\xb5\x18\x1c\n" + - "\x06bearer\x12\x04user\"\fsandbox:read\x12z\n" + - "\rListSandboxes\x12\".openshell.v1.ListSandboxesRequest\x1a#.openshell.v1.ListSandboxesResponse\" \x82\xb5\x18\x1c\n" + - "\x06bearer\x12\x04user\"\fsandbox:read\x12\x8f\x01\n" + - "\x14ListSandboxProviders\x12).openshell.v1.ListSandboxProvidersRequest\x1a*.openshell.v1.ListSandboxProvidersResponse\" \x82\xb5\x18\x1c\n" + - "\x06bearer\x12\x04user\"\fsandbox:read\x12\x93\x01\n" + - "\x15AttachSandboxProvider\x12*.openshell.v1.AttachSandboxProviderRequest\x1a+.openshell.v1.AttachSandboxProviderResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write\x12\x93\x01\n" + - "\x15DetachSandboxProvider\x12*.openshell.v1.DetachSandboxProviderRequest\x1a+.openshell.v1.DetachSandboxProviderResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write\x12{\n" + - "\rDeleteSandbox\x12\".openshell.v1.DeleteSandboxRequest\x1a#.openshell.v1.DeleteSandboxResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write\x12\x84\x01\n" + - "\x10CreateSshSession\x12%.openshell.v1.CreateSshSessionRequest\x1a&.openshell.v1.CreateSshSessionResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write\x12}\n" + - "\rExposeService\x12\".openshell.v1.ExposeServiceRequest\x1a%.openshell.v1.ServiceEndpointResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write\x12v\n" + - "\n" + - "GetService\x12\x1f.openshell.v1.GetServiceRequest\x1a%.openshell.v1.ServiceEndpointResponse\" \x82\xb5\x18\x1c\n" + - "\x06bearer\x12\x04user\"\fsandbox:read\x12w\n" + - "\fListServices\x12!.openshell.v1.ListServicesRequest\x1a\".openshell.v1.ListServicesResponse\" \x82\xb5\x18\x1c\n" + - "\x06bearer\x12\x04user\"\fsandbox:read\x12{\n" + - "\rDeleteService\x12\".openshell.v1.DeleteServiceRequest\x1a#.openshell.v1.DeleteServiceResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write\x12\x84\x01\n" + - "\x10RevokeSshSession\x12%.openshell.v1.RevokeSshSessionRequest\x1a&.openshell.v1.RevokeSshSessionResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write\x12t\n" + - "\vExecSandbox\x12 .openshell.v1.ExecSandboxRequest\x1a\x1e.openshell.v1.ExecSandboxEvent\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write0\x01\x12q\n" + - "\n" + - "ForwardTcp\x12\x1d.openshell.v1.TcpForwardFrame\x1a\x1d.openshell.v1.TcpForwardFrame\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write(\x010\x01\x12\x7f\n" + - "\x16ExecSandboxInteractive\x12\x1e.openshell.v1.ExecSandboxInput\x1a\x1e.openshell.v1.ExecSandboxEvent\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rsandbox:write(\x010\x01\x12z\n" + - "\x0eCreateProvider\x12#.openshell.v1.CreateProviderRequest\x1a\x1e.openshell.v1.ProviderResponse\"#\x82\xb5\x18\x1f\n" + - "\x06bearer\x12\x05admin\"\x0eprovider:write\x12r\n" + - "\vGetProvider\x12 .openshell.v1.GetProviderRequest\x1a\x1e.openshell.v1.ProviderResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rprovider:read\x12{\n" + - "\rListProviders\x12\".openshell.v1.ListProvidersRequest\x1a#.openshell.v1.ListProvidersResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rprovider:read\x12\x90\x01\n" + - "\x14ListProviderProfiles\x12).openshell.v1.ListProviderProfilesRequest\x1a*.openshell.v1.ListProviderProfilesResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rprovider:read\x12\x87\x01\n" + - "\x12GetProviderProfile\x12'.openshell.v1.GetProviderProfileRequest\x1a%.openshell.v1.ProviderProfileResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rprovider:read\x12\x98\x01\n" + - "\x16ImportProviderProfiles\x12+.openshell.v1.ImportProviderProfilesRequest\x1a,.openshell.v1.ImportProviderProfilesResponse\"#\x82\xb5\x18\x1f\n" + - "\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x98\x01\n" + - "\x16UpdateProviderProfiles\x12+.openshell.v1.UpdateProviderProfilesRequest\x1a,.openshell.v1.UpdateProviderProfilesResponse\"#\x82\xb5\x18\x1f\n" + - "\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x90\x01\n" + - "\x14LintProviderProfiles\x12).openshell.v1.LintProviderProfilesRequest\x1a*.openshell.v1.LintProviderProfilesResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rprovider:read\x12z\n" + - "\x0eUpdateProvider\x12#.openshell.v1.UpdateProviderRequest\x1a\x1e.openshell.v1.ProviderResponse\"#\x82\xb5\x18\x1f\n" + - "\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x9c\x01\n" + - "\x18GetProviderRefreshStatus\x12-.openshell.v1.GetProviderRefreshStatusRequest\x1a..openshell.v1.GetProviderRefreshStatusResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x04user\"\rprovider:read\x12\x9e\x01\n" + - "\x18ConfigureProviderRefresh\x12-.openshell.v1.ConfigureProviderRefreshRequest\x1a..openshell.v1.ConfigureProviderRefreshResponse\"#\x82\xb5\x18\x1f\n" + - "\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x9e\x01\n" + - "\x18RotateProviderCredential\x12-.openshell.v1.RotateProviderCredentialRequest\x1a..openshell.v1.RotateProviderCredentialResponse\"#\x82\xb5\x18\x1f\n" + - "\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x95\x01\n" + - "\x15DeleteProviderRefresh\x12*.openshell.v1.DeleteProviderRefreshRequest\x1a+.openshell.v1.DeleteProviderRefreshResponse\"#\x82\xb5\x18\x1f\n" + - "\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x80\x01\n" + - "\x0eDeleteProvider\x12#.openshell.v1.DeleteProviderRequest\x1a$.openshell.v1.DeleteProviderResponse\"#\x82\xb5\x18\x1f\n" + - "\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x95\x01\n" + - "\x15DeleteProviderProfile\x12*.openshell.v1.DeleteProviderProfileRequest\x1a+.openshell.v1.DeleteProviderProfileResponse\"#\x82\xb5\x18\x1f\n" + - "\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x90\x01\n" + - "\x10GetSandboxConfig\x12-.openshell.sandbox.v1.GetSandboxConfigRequest\x1a..openshell.sandbox.v1.GetSandboxConfigResponse\"\x1d\x82\xb5\x18\x19\n" + - "\x04dual\x12\x04user\"\vconfig:read\x12\x8c\x01\n" + - "\x10GetGatewayConfig\x12-.openshell.sandbox.v1.GetGatewayConfigRequest\x1a..openshell.sandbox.v1.GetGatewayConfigResponse\"\x19\x82\xb5\x18\x15\n" + - "\x06bearer\"\vconfig:read\x12v\n" + - "\fUpdateConfig\x12!.openshell.v1.UpdateConfigRequest\x1a\".openshell.v1.UpdateConfigResponse\"\x1f\x82\xb5\x18\x1b\n" + - "\x04dual\x12\x05admin\"\fconfig:write\x12\x95\x01\n" + - "\x16GetSandboxPolicyStatus\x12+.openshell.v1.GetSandboxPolicyStatusRequest\x1a,.openshell.v1.GetSandboxPolicyStatusResponse\" \x82\xb5\x18\x1c\n" + - "\x06bearer\x12\x04user\"\fsandbox:read\x12\x8c\x01\n" + - "\x13ListSandboxPolicies\x12(.openshell.v1.ListSandboxPoliciesRequest\x1a).openshell.v1.ListSandboxPoliciesResponse\" \x82\xb5\x18\x1c\n" + - "\x06bearer\x12\x04user\"\fsandbox:read\x12v\n" + - "\x12ReportPolicyStatus\x12'.openshell.v1.ReportPolicyStatusRequest\x1a(.openshell.v1.ReportPolicyStatusResponse\"\r\x82\xb5\x18\t\n" + - "\asandbox\x12\x97\x01\n" + - "\x1dGetSandboxProviderEnvironment\x122.openshell.v1.GetSandboxProviderEnvironmentRequest\x1a3.openshell.v1.GetSandboxProviderEnvironmentResponse\"\r\x82\xb5\x18\t\n" + - "\asandbox\x12}\n" + - "\x0eGetSandboxLogs\x12#.openshell.v1.GetSandboxLogsRequest\x1a$.openshell.v1.GetSandboxLogsResponse\" \x82\xb5\x18\x1c\n" + - "\x06bearer\x12\x04user\"\fsandbox:read\x12o\n" + - "\x0fPushSandboxLogs\x12$.openshell.v1.PushSandboxLogsRequest\x1a%.openshell.v1.PushSandboxLogsResponse\"\r\x82\xb5\x18\t\n" + - "\asandbox(\x01\x12e\n" + - "\x11ConnectSupervisor\x12\x1f.openshell.v1.SupervisorMessage\x1a\x1c.openshell.v1.GatewayMessage\"\r\x82\xb5\x18\t\n" + - "\asandbox(\x010\x01\x12T\n" + - "\vRelayStream\x12\x18.openshell.v1.RelayFrame\x1a\x18.openshell.v1.RelayFrame\"\r\x82\xb5\x18\t\n" + - "\asandbox(\x010\x01\x12w\n" + - "\fWatchSandbox\x12!.openshell.v1.WatchSandboxRequest\x1a .openshell.v1.SandboxStreamEvent\" \x82\xb5\x18\x1c\n" + - "\x06bearer\x12\x04user\"\fsandbox:read0\x01\x12|\n" + - "\x14SubmitPolicyAnalysis\x12).openshell.v1.SubmitPolicyAnalysisRequest\x1a*.openshell.v1.SubmitPolicyAnalysisResponse\"\r\x82\xb5\x18\t\n" + - "\asandbox\x12z\n" + - "\x0eGetDraftPolicy\x12#.openshell.v1.GetDraftPolicyRequest\x1a$.openshell.v1.GetDraftPolicyResponse\"\x1d\x82\xb5\x18\x19\n" + - "\x04dual\x12\x04user\"\vconfig:read\x12\x87\x01\n" + - "\x11ApproveDraftChunk\x12&.openshell.v1.ApproveDraftChunkRequest\x1a'.openshell.v1.ApproveDraftChunkResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x05admin\"\fconfig:write\x12\x84\x01\n" + - "\x10RejectDraftChunk\x12%.openshell.v1.RejectDraftChunkRequest\x1a&.openshell.v1.RejectDraftChunkResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x05admin\"\fconfig:write\x12\x93\x01\n" + - "\x15ApproveAllDraftChunks\x12*.openshell.v1.ApproveAllDraftChunksRequest\x1a+.openshell.v1.ApproveAllDraftChunksResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x05admin\"\fconfig:write\x12~\n" + - "\x0eEditDraftChunk\x12#.openshell.v1.EditDraftChunkRequest\x1a$.openshell.v1.EditDraftChunkResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x05admin\"\fconfig:write\x12~\n" + - "\x0eUndoDraftChunk\x12#.openshell.v1.UndoDraftChunkRequest\x1a$.openshell.v1.UndoDraftChunkResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x05admin\"\fconfig:write\x12\x84\x01\n" + - "\x10ClearDraftChunks\x12%.openshell.v1.ClearDraftChunksRequest\x1a&.openshell.v1.ClearDraftChunksResponse\"!\x82\xb5\x18\x1d\n" + - "\x06bearer\x12\x05admin\"\fconfig:write\x12\x7f\n" + - "\x0fGetDraftHistory\x12$.openshell.v1.GetDraftHistoryRequest\x1a%.openshell.v1.GetDraftHistoryResponse\"\x1f\x82\xb5\x18\x1b\n" + - "\x06bearer\x12\x04user\"\vconfig:read\x12s\n" + - "\x11IssueSandboxToken\x12&.openshell.v1.IssueSandboxTokenRequest\x1a'.openshell.v1.IssueSandboxTokenResponse\"\r\x82\xb5\x18\t\n" + - "\asandbox\x12y\n" + - "\x13RefreshSandboxToken\x12(.openshell.v1.RefreshSandboxTokenRequest\x1a).openshell.v1.RefreshSandboxTokenResponse\"\r\x82\xb5\x18\t\n" + - "\asandbox\x12\x8d\x01\n" + - "\x0fCreateWorkspace\x12$.openshell.v1.CreateWorkspaceRequest\x1a%.openshell.v1.CreateWorkspaceResponse\"-\x82\xb5\x18)\n" + - "\x06bearer\x1a\x0eplatform_admin\"\x0fworkspace:write\x12y\n" + - "\fGetWorkspace\x12!.openshell.v1.GetWorkspaceRequest\x1a\".openshell.v1.GetWorkspaceResponse\"\"\x82\xb5\x18\x1e\n" + - "\x06bearer\x12\x04user\"\x0eworkspace:read\x12\x7f\n" + - "\x0eListWorkspaces\x12#.openshell.v1.ListWorkspacesRequest\x1a$.openshell.v1.ListWorkspacesResponse\"\"\x82\xb5\x18\x1e\n" + - "\x06bearer\x12\x04user\"\x0eworkspace:read\x12\x8d\x01\n" + - "\x0fDeleteWorkspace\x12$.openshell.v1.DeleteWorkspaceRequest\x1a%.openshell.v1.DeleteWorkspaceResponse\"-\x82\xb5\x18)\n" + - "\x06bearer\x1a\x0eplatform_admin\"\x0fworkspace:write\x12\x8d\x01\n" + - "\x12AddWorkspaceMember\x12'.openshell.v1.AddWorkspaceMemberRequest\x1a(.openshell.v1.AddWorkspaceMemberResponse\"$\x82\xb5\x18 \n" + - "\x06bearer\x12\x05admin\"\x0fworkspace:write\x12\x96\x01\n" + - "\x15RemoveWorkspaceMember\x12*.openshell.v1.RemoveWorkspaceMemberRequest\x1a+.openshell.v1.RemoveWorkspaceMemberResponse\"$\x82\xb5\x18 \n" + - "\x06bearer\x12\x05admin\"\x0fworkspace:write\x12\x91\x01\n" + - "\x14ListWorkspaceMembers\x12).openshell.v1.ListWorkspaceMembersRequest\x1a*.openshell.v1.ListWorkspaceMembersResponse\"\"\x82\xb5\x18\x1e\n" + - "\x06bearer\x12\x04user\"\x0eworkspace:readb\x06proto3" - -var ( - file_openshell_proto_rawDescOnce sync.Once - file_openshell_proto_rawDescData []byte -) - -func file_openshell_proto_rawDescGZIP() []byte { - file_openshell_proto_rawDescOnce.Do(func() { - file_openshell_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_openshell_proto_rawDesc), len(file_openshell_proto_rawDesc))) - }) - return file_openshell_proto_rawDescData -} - -var file_openshell_proto_enumTypes = make([]protoimpl.EnumInfo, 6) -var file_openshell_proto_msgTypes = make([]protoimpl.MessageInfo, 203) -var file_openshell_proto_goTypes = []any{ - (SandboxPhase)(0), // 0: openshell.v1.SandboxPhase - (ProviderCredentialRefreshStrategy)(0), // 1: openshell.v1.ProviderCredentialRefreshStrategy - (ProviderProfileCategory)(0), // 2: openshell.v1.ProviderProfileCategory - (PolicyStatus)(0), // 3: openshell.v1.PolicyStatus - (ServiceStatus)(0), // 4: openshell.v1.ServiceStatus - (WorkspaceRole)(0), // 5: openshell.v1.WorkspaceRole - (*IssueSandboxTokenRequest)(nil), // 6: openshell.v1.IssueSandboxTokenRequest - (*IssueSandboxTokenResponse)(nil), // 7: openshell.v1.IssueSandboxTokenResponse - (*RefreshSandboxTokenRequest)(nil), // 8: openshell.v1.RefreshSandboxTokenRequest - (*RefreshSandboxTokenResponse)(nil), // 9: openshell.v1.RefreshSandboxTokenResponse - (*HealthRequest)(nil), // 10: openshell.v1.HealthRequest - (*HealthResponse)(nil), // 11: openshell.v1.HealthResponse - (*GetCurrentUserRequest)(nil), // 12: openshell.v1.GetCurrentUserRequest - (*GetCurrentUserResponse)(nil), // 13: openshell.v1.GetCurrentUserResponse - (*GetGatewayInfoRequest)(nil), // 14: openshell.v1.GetGatewayInfoRequest - (*GetGatewayInfoResponse)(nil), // 15: openshell.v1.GetGatewayInfoResponse - (*ComputeDriverInfo)(nil), // 16: openshell.v1.ComputeDriverInfo - (*ComputeDriverCapabilities)(nil), // 17: openshell.v1.ComputeDriverCapabilities - (*Sandbox)(nil), // 18: openshell.v1.Sandbox - (*SandboxSpec)(nil), // 19: openshell.v1.SandboxSpec - (*ResourceRequirements)(nil), // 20: openshell.v1.ResourceRequirements - (*GpuResourceRequirements)(nil), // 21: openshell.v1.GpuResourceRequirements - (*SandboxTemplate)(nil), // 22: openshell.v1.SandboxTemplate - (*SandboxStatus)(nil), // 23: openshell.v1.SandboxStatus - (*SandboxCondition)(nil), // 24: openshell.v1.SandboxCondition - (*PlatformEvent)(nil), // 25: openshell.v1.PlatformEvent - (*CreateSandboxRequest)(nil), // 26: openshell.v1.CreateSandboxRequest - (*GetSandboxRequest)(nil), // 27: openshell.v1.GetSandboxRequest - (*ListSandboxesRequest)(nil), // 28: openshell.v1.ListSandboxesRequest - (*ListSandboxProvidersRequest)(nil), // 29: openshell.v1.ListSandboxProvidersRequest - (*AttachSandboxProviderRequest)(nil), // 30: openshell.v1.AttachSandboxProviderRequest - (*DetachSandboxProviderRequest)(nil), // 31: openshell.v1.DetachSandboxProviderRequest - (*DeleteSandboxRequest)(nil), // 32: openshell.v1.DeleteSandboxRequest - (*SandboxResponse)(nil), // 33: openshell.v1.SandboxResponse - (*ListSandboxesResponse)(nil), // 34: openshell.v1.ListSandboxesResponse - (*ListSandboxProvidersResponse)(nil), // 35: openshell.v1.ListSandboxProvidersResponse - (*AttachSandboxProviderResponse)(nil), // 36: openshell.v1.AttachSandboxProviderResponse - (*DetachSandboxProviderResponse)(nil), // 37: openshell.v1.DetachSandboxProviderResponse - (*DeleteSandboxResponse)(nil), // 38: openshell.v1.DeleteSandboxResponse - (*CreateSshSessionRequest)(nil), // 39: openshell.v1.CreateSshSessionRequest - (*CreateSshSessionResponse)(nil), // 40: openshell.v1.CreateSshSessionResponse - (*ExposeServiceRequest)(nil), // 41: openshell.v1.ExposeServiceRequest - (*GetServiceRequest)(nil), // 42: openshell.v1.GetServiceRequest - (*ListServicesRequest)(nil), // 43: openshell.v1.ListServicesRequest - (*ListServicesResponse)(nil), // 44: openshell.v1.ListServicesResponse - (*DeleteServiceRequest)(nil), // 45: openshell.v1.DeleteServiceRequest - (*DeleteServiceResponse)(nil), // 46: openshell.v1.DeleteServiceResponse - (*ServiceEndpoint)(nil), // 47: openshell.v1.ServiceEndpoint - (*ServiceEndpointResponse)(nil), // 48: openshell.v1.ServiceEndpointResponse - (*RevokeSshSessionRequest)(nil), // 49: openshell.v1.RevokeSshSessionRequest - (*RevokeSshSessionResponse)(nil), // 50: openshell.v1.RevokeSshSessionResponse - (*ExecSandboxRequest)(nil), // 51: openshell.v1.ExecSandboxRequest - (*ExecSandboxStdout)(nil), // 52: openshell.v1.ExecSandboxStdout - (*ExecSandboxStderr)(nil), // 53: openshell.v1.ExecSandboxStderr - (*ExecSandboxExit)(nil), // 54: openshell.v1.ExecSandboxExit - (*ExecSandboxEvent)(nil), // 55: openshell.v1.ExecSandboxEvent - (*TcpForwardInit)(nil), // 56: openshell.v1.TcpForwardInit - (*TcpForwardFrame)(nil), // 57: openshell.v1.TcpForwardFrame - (*ExecSandboxInput)(nil), // 58: openshell.v1.ExecSandboxInput - (*ExecSandboxWindowResize)(nil), // 59: openshell.v1.ExecSandboxWindowResize - (*SshSession)(nil), // 60: openshell.v1.SshSession - (*WatchSandboxRequest)(nil), // 61: openshell.v1.WatchSandboxRequest - (*SandboxStreamEvent)(nil), // 62: openshell.v1.SandboxStreamEvent - (*SandboxLogLine)(nil), // 63: openshell.v1.SandboxLogLine - (*SandboxStreamWarning)(nil), // 64: openshell.v1.SandboxStreamWarning - (*CreateProviderRequest)(nil), // 65: openshell.v1.CreateProviderRequest - (*GetProviderRequest)(nil), // 66: openshell.v1.GetProviderRequest - (*ListProvidersRequest)(nil), // 67: openshell.v1.ListProvidersRequest - (*UpdateProviderRequest)(nil), // 68: openshell.v1.UpdateProviderRequest - (*DeleteProviderRequest)(nil), // 69: openshell.v1.DeleteProviderRequest - (*ProviderResponse)(nil), // 70: openshell.v1.ProviderResponse - (*ListProvidersResponse)(nil), // 71: openshell.v1.ListProvidersResponse - (*ListProviderProfilesRequest)(nil), // 72: openshell.v1.ListProviderProfilesRequest - (*GetProviderProfileRequest)(nil), // 73: openshell.v1.GetProviderProfileRequest - (*ProviderProfileImportItem)(nil), // 74: openshell.v1.ProviderProfileImportItem - (*ProviderProfileDiagnostic)(nil), // 75: openshell.v1.ProviderProfileDiagnostic - (*ProviderCredentialTokenGrantAudienceOverride)(nil), // 76: openshell.v1.ProviderCredentialTokenGrantAudienceOverride - (*ProviderCredentialTokenGrant)(nil), // 77: openshell.v1.ProviderCredentialTokenGrant - (*ProviderProfileCredential)(nil), // 78: openshell.v1.ProviderProfileCredential - (*ProviderCredentialRefreshMaterial)(nil), // 79: openshell.v1.ProviderCredentialRefreshMaterial - (*ProviderCredentialRefreshOutput)(nil), // 80: openshell.v1.ProviderCredentialRefreshOutput - (*ProviderCredentialRefresh)(nil), // 81: openshell.v1.ProviderCredentialRefresh - (*ProviderCredentialRefreshStatus)(nil), // 82: openshell.v1.ProviderCredentialRefreshStatus - (*ProviderProfileDiscovery)(nil), // 83: openshell.v1.ProviderProfileDiscovery - (*StoredProviderCredentialRefreshState)(nil), // 84: openshell.v1.StoredProviderCredentialRefreshState - (*GetProviderRefreshStatusRequest)(nil), // 85: openshell.v1.GetProviderRefreshStatusRequest - (*GetProviderRefreshStatusResponse)(nil), // 86: openshell.v1.GetProviderRefreshStatusResponse - (*ConfigureProviderRefreshRequest)(nil), // 87: openshell.v1.ConfigureProviderRefreshRequest - (*ConfigureProviderRefreshResponse)(nil), // 88: openshell.v1.ConfigureProviderRefreshResponse - (*RotateProviderCredentialRequest)(nil), // 89: openshell.v1.RotateProviderCredentialRequest - (*RotateProviderCredentialResponse)(nil), // 90: openshell.v1.RotateProviderCredentialResponse - (*DeleteProviderRefreshRequest)(nil), // 91: openshell.v1.DeleteProviderRefreshRequest - (*DeleteProviderRefreshResponse)(nil), // 92: openshell.v1.DeleteProviderRefreshResponse - (*ProviderProfile)(nil), // 93: openshell.v1.ProviderProfile - (*StoredProviderProfile)(nil), // 94: openshell.v1.StoredProviderProfile - (*ProviderProfileResponse)(nil), // 95: openshell.v1.ProviderProfileResponse - (*ListProviderProfilesResponse)(nil), // 96: openshell.v1.ListProviderProfilesResponse - (*ImportProviderProfilesRequest)(nil), // 97: openshell.v1.ImportProviderProfilesRequest - (*ImportProviderProfilesResponse)(nil), // 98: openshell.v1.ImportProviderProfilesResponse - (*UpdateProviderProfilesRequest)(nil), // 99: openshell.v1.UpdateProviderProfilesRequest - (*UpdateProviderProfilesResponse)(nil), // 100: openshell.v1.UpdateProviderProfilesResponse - (*LintProviderProfilesRequest)(nil), // 101: openshell.v1.LintProviderProfilesRequest - (*LintProviderProfilesResponse)(nil), // 102: openshell.v1.LintProviderProfilesResponse - (*DeleteProviderResponse)(nil), // 103: openshell.v1.DeleteProviderResponse - (*DeleteProviderProfileRequest)(nil), // 104: openshell.v1.DeleteProviderProfileRequest - (*DeleteProviderProfileResponse)(nil), // 105: openshell.v1.DeleteProviderProfileResponse - (*GetSandboxProviderEnvironmentRequest)(nil), // 106: openshell.v1.GetSandboxProviderEnvironmentRequest - (*GetSandboxProviderEnvironmentResponse)(nil), // 107: openshell.v1.GetSandboxProviderEnvironmentResponse - (*UpdateConfigRequest)(nil), // 108: openshell.v1.UpdateConfigRequest - (*PolicyMergeOperation)(nil), // 109: openshell.v1.PolicyMergeOperation - (*AddNetworkRule)(nil), // 110: openshell.v1.AddNetworkRule - (*RemoveNetworkEndpoint)(nil), // 111: openshell.v1.RemoveNetworkEndpoint - (*RemoveNetworkRule)(nil), // 112: openshell.v1.RemoveNetworkRule - (*AddDenyRules)(nil), // 113: openshell.v1.AddDenyRules - (*AddAllowRules)(nil), // 114: openshell.v1.AddAllowRules - (*RemoveNetworkBinary)(nil), // 115: openshell.v1.RemoveNetworkBinary - (*UpdateConfigResponse)(nil), // 116: openshell.v1.UpdateConfigResponse - (*GetSandboxPolicyStatusRequest)(nil), // 117: openshell.v1.GetSandboxPolicyStatusRequest - (*GetSandboxPolicyStatusResponse)(nil), // 118: openshell.v1.GetSandboxPolicyStatusResponse - (*ListSandboxPoliciesRequest)(nil), // 119: openshell.v1.ListSandboxPoliciesRequest - (*ListSandboxPoliciesResponse)(nil), // 120: openshell.v1.ListSandboxPoliciesResponse - (*ReportPolicyStatusRequest)(nil), // 121: openshell.v1.ReportPolicyStatusRequest - (*ReportPolicyStatusResponse)(nil), // 122: openshell.v1.ReportPolicyStatusResponse - (*SandboxPolicyRevision)(nil), // 123: openshell.v1.SandboxPolicyRevision - (*GetSandboxLogsRequest)(nil), // 124: openshell.v1.GetSandboxLogsRequest - (*PushSandboxLogsRequest)(nil), // 125: openshell.v1.PushSandboxLogsRequest - (*PushSandboxLogsResponse)(nil), // 126: openshell.v1.PushSandboxLogsResponse - (*GetSandboxLogsResponse)(nil), // 127: openshell.v1.GetSandboxLogsResponse - (*SupervisorMessage)(nil), // 128: openshell.v1.SupervisorMessage - (*GatewayMessage)(nil), // 129: openshell.v1.GatewayMessage - (*SupervisorHello)(nil), // 130: openshell.v1.SupervisorHello - (*SessionAccepted)(nil), // 131: openshell.v1.SessionAccepted - (*SessionRejected)(nil), // 132: openshell.v1.SessionRejected - (*SupervisorHeartbeat)(nil), // 133: openshell.v1.SupervisorHeartbeat - (*GatewayHeartbeat)(nil), // 134: openshell.v1.GatewayHeartbeat - (*RelayOpen)(nil), // 135: openshell.v1.RelayOpen - (*SshRelayTarget)(nil), // 136: openshell.v1.SshRelayTarget - (*TcpRelayTarget)(nil), // 137: openshell.v1.TcpRelayTarget - (*RelayInit)(nil), // 138: openshell.v1.RelayInit - (*RelayFrame)(nil), // 139: openshell.v1.RelayFrame - (*RelayOpenResult)(nil), // 140: openshell.v1.RelayOpenResult - (*RelayClose)(nil), // 141: openshell.v1.RelayClose - (*L7RequestSample)(nil), // 142: openshell.v1.L7RequestSample - (*DenialSummary)(nil), // 143: openshell.v1.DenialSummary - (*DenialGroupCount)(nil), // 144: openshell.v1.DenialGroupCount - (*NetworkActivitySummary)(nil), // 145: openshell.v1.NetworkActivitySummary - (*PolicyChunk)(nil), // 146: openshell.v1.PolicyChunk - (*DraftPolicyUpdate)(nil), // 147: openshell.v1.DraftPolicyUpdate - (*SubmitPolicyAnalysisRequest)(nil), // 148: openshell.v1.SubmitPolicyAnalysisRequest - (*SubmitPolicyAnalysisResponse)(nil), // 149: openshell.v1.SubmitPolicyAnalysisResponse - (*GetDraftPolicyRequest)(nil), // 150: openshell.v1.GetDraftPolicyRequest - (*GetDraftPolicyResponse)(nil), // 151: openshell.v1.GetDraftPolicyResponse - (*ApproveDraftChunkRequest)(nil), // 152: openshell.v1.ApproveDraftChunkRequest - (*ApproveDraftChunkResponse)(nil), // 153: openshell.v1.ApproveDraftChunkResponse - (*RejectDraftChunkRequest)(nil), // 154: openshell.v1.RejectDraftChunkRequest - (*RejectDraftChunkResponse)(nil), // 155: openshell.v1.RejectDraftChunkResponse - (*ApproveAllDraftChunksRequest)(nil), // 156: openshell.v1.ApproveAllDraftChunksRequest - (*ApproveAllDraftChunksResponse)(nil), // 157: openshell.v1.ApproveAllDraftChunksResponse - (*EditDraftChunkRequest)(nil), // 158: openshell.v1.EditDraftChunkRequest - (*EditDraftChunkResponse)(nil), // 159: openshell.v1.EditDraftChunkResponse - (*UndoDraftChunkRequest)(nil), // 160: openshell.v1.UndoDraftChunkRequest - (*UndoDraftChunkResponse)(nil), // 161: openshell.v1.UndoDraftChunkResponse - (*ClearDraftChunksRequest)(nil), // 162: openshell.v1.ClearDraftChunksRequest - (*ClearDraftChunksResponse)(nil), // 163: openshell.v1.ClearDraftChunksResponse - (*GetDraftHistoryRequest)(nil), // 164: openshell.v1.GetDraftHistoryRequest - (*DraftHistoryEntry)(nil), // 165: openshell.v1.DraftHistoryEntry - (*GetDraftHistoryResponse)(nil), // 166: openshell.v1.GetDraftHistoryResponse - (*PolicyRevisionPayload)(nil), // 167: openshell.v1.PolicyRevisionPayload - (*DraftChunkPayload)(nil), // 168: openshell.v1.DraftChunkPayload - (*StoredPolicyRevision)(nil), // 169: openshell.v1.StoredPolicyRevision - (*StoredDraftChunk)(nil), // 170: openshell.v1.StoredDraftChunk - (*CreateWorkspaceRequest)(nil), // 171: openshell.v1.CreateWorkspaceRequest - (*CreateWorkspaceResponse)(nil), // 172: openshell.v1.CreateWorkspaceResponse - (*GetWorkspaceRequest)(nil), // 173: openshell.v1.GetWorkspaceRequest - (*GetWorkspaceResponse)(nil), // 174: openshell.v1.GetWorkspaceResponse - (*ListWorkspacesRequest)(nil), // 175: openshell.v1.ListWorkspacesRequest - (*ListWorkspacesResponse)(nil), // 176: openshell.v1.ListWorkspacesResponse - (*DeleteWorkspaceRequest)(nil), // 177: openshell.v1.DeleteWorkspaceRequest - (*DeleteWorkspaceResponse)(nil), // 178: openshell.v1.DeleteWorkspaceResponse - (*WorkspaceMember)(nil), // 179: openshell.v1.WorkspaceMember - (*AddWorkspaceMemberRequest)(nil), // 180: openshell.v1.AddWorkspaceMemberRequest - (*AddWorkspaceMemberResponse)(nil), // 181: openshell.v1.AddWorkspaceMemberResponse - (*RemoveWorkspaceMemberRequest)(nil), // 182: openshell.v1.RemoveWorkspaceMemberRequest - (*RemoveWorkspaceMemberResponse)(nil), // 183: openshell.v1.RemoveWorkspaceMemberResponse - (*ListWorkspaceMembersRequest)(nil), // 184: openshell.v1.ListWorkspaceMembersRequest - (*ListWorkspaceMembersResponse)(nil), // 185: openshell.v1.ListWorkspaceMembersResponse - nil, // 186: openshell.v1.SandboxSpec.EnvironmentEntry - nil, // 187: openshell.v1.SandboxTemplate.LabelsEntry - nil, // 188: openshell.v1.SandboxTemplate.AnnotationsEntry - nil, // 189: openshell.v1.SandboxTemplate.EnvironmentEntry - nil, // 190: openshell.v1.PlatformEvent.MetadataEntry - nil, // 191: openshell.v1.CreateSandboxRequest.LabelsEntry - nil, // 192: openshell.v1.CreateSandboxRequest.AnnotationsEntry - nil, // 193: openshell.v1.ExecSandboxRequest.EnvironmentEntry - nil, // 194: openshell.v1.SandboxLogLine.FieldsEntry - nil, // 195: openshell.v1.UpdateProviderRequest.CredentialExpiresAtMsEntry - nil, // 196: openshell.v1.StoredProviderCredentialRefreshState.MaterialEntry - nil, // 197: openshell.v1.StoredProviderCredentialRefreshState.AdditionalOutputKeysEntry - nil, // 198: openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry - nil, // 199: openshell.v1.ProviderProfile.AnnotationsEntry - nil, // 200: openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry - nil, // 201: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpiresAtMsEntry - nil, // 202: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry - nil, // 203: openshell.v1.UpdateConfigRequest.AnnotationsEntry - nil, // 204: openshell.v1.UpdateConfigResponse.AnnotationsEntry - nil, // 205: openshell.v1.SandboxPolicyRevision.ProvenanceEntry - nil, // 206: openshell.v1.PolicyRevisionPayload.ProvenanceEntry - nil, // 207: openshell.v1.StoredPolicyRevision.ProvenanceEntry - nil, // 208: openshell.v1.CreateWorkspaceRequest.LabelsEntry - (*datamodelv1.ObjectMeta)(nil), // 209: openshell.datamodel.v1.ObjectMeta - (*sandboxv1.SandboxPolicy)(nil), // 210: openshell.sandbox.v1.SandboxPolicy - (*structpb.Struct)(nil), // 211: google.protobuf.Struct - (*datamodelv1.Provider)(nil), // 212: openshell.datamodel.v1.Provider - (*sandboxv1.NetworkEndpoint)(nil), // 213: openshell.sandbox.v1.NetworkEndpoint - (*sandboxv1.NetworkBinary)(nil), // 214: openshell.sandbox.v1.NetworkBinary - (*sandboxv1.SettingValue)(nil), // 215: openshell.sandbox.v1.SettingValue - (*sandboxv1.NetworkPolicyRule)(nil), // 216: openshell.sandbox.v1.NetworkPolicyRule - (*sandboxv1.L7DenyRule)(nil), // 217: openshell.sandbox.v1.L7DenyRule - (*sandboxv1.L7Rule)(nil), // 218: openshell.sandbox.v1.L7Rule - (*datamodelv1.Workspace)(nil), // 219: openshell.datamodel.v1.Workspace - (*sandboxv1.GetSandboxConfigRequest)(nil), // 220: openshell.sandbox.v1.GetSandboxConfigRequest - (*sandboxv1.GetGatewayConfigRequest)(nil), // 221: openshell.sandbox.v1.GetGatewayConfigRequest - (*sandboxv1.GetSandboxConfigResponse)(nil), // 222: openshell.sandbox.v1.GetSandboxConfigResponse - (*sandboxv1.GetGatewayConfigResponse)(nil), // 223: openshell.sandbox.v1.GetGatewayConfigResponse -} -var file_openshell_proto_depIdxs = []int32{ - 4, // 0: openshell.v1.HealthResponse.status:type_name -> openshell.v1.ServiceStatus - 4, // 1: openshell.v1.GetGatewayInfoResponse.status:type_name -> openshell.v1.ServiceStatus - 16, // 2: openshell.v1.GetGatewayInfoResponse.compute_drivers:type_name -> openshell.v1.ComputeDriverInfo - 17, // 3: openshell.v1.ComputeDriverInfo.capabilities:type_name -> openshell.v1.ComputeDriverCapabilities - 209, // 4: openshell.v1.Sandbox.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 19, // 5: openshell.v1.Sandbox.spec:type_name -> openshell.v1.SandboxSpec - 23, // 6: openshell.v1.Sandbox.status:type_name -> openshell.v1.SandboxStatus - 186, // 7: openshell.v1.SandboxSpec.environment:type_name -> openshell.v1.SandboxSpec.EnvironmentEntry - 22, // 8: openshell.v1.SandboxSpec.template:type_name -> openshell.v1.SandboxTemplate - 210, // 9: openshell.v1.SandboxSpec.policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 20, // 10: openshell.v1.SandboxSpec.resource_requirements:type_name -> openshell.v1.ResourceRequirements - 21, // 11: openshell.v1.ResourceRequirements.gpu:type_name -> openshell.v1.GpuResourceRequirements - 187, // 12: openshell.v1.SandboxTemplate.labels:type_name -> openshell.v1.SandboxTemplate.LabelsEntry - 188, // 13: openshell.v1.SandboxTemplate.annotations:type_name -> openshell.v1.SandboxTemplate.AnnotationsEntry - 189, // 14: openshell.v1.SandboxTemplate.environment:type_name -> openshell.v1.SandboxTemplate.EnvironmentEntry - 211, // 15: openshell.v1.SandboxTemplate.resources:type_name -> google.protobuf.Struct - 211, // 16: openshell.v1.SandboxTemplate.driver_config:type_name -> google.protobuf.Struct - 24, // 17: openshell.v1.SandboxStatus.conditions:type_name -> openshell.v1.SandboxCondition - 0, // 18: openshell.v1.SandboxStatus.phase:type_name -> openshell.v1.SandboxPhase - 190, // 19: openshell.v1.PlatformEvent.metadata:type_name -> openshell.v1.PlatformEvent.MetadataEntry - 19, // 20: openshell.v1.CreateSandboxRequest.spec:type_name -> openshell.v1.SandboxSpec - 191, // 21: openshell.v1.CreateSandboxRequest.labels:type_name -> openshell.v1.CreateSandboxRequest.LabelsEntry - 192, // 22: openshell.v1.CreateSandboxRequest.annotations:type_name -> openshell.v1.CreateSandboxRequest.AnnotationsEntry - 18, // 23: openshell.v1.SandboxResponse.sandbox:type_name -> openshell.v1.Sandbox - 18, // 24: openshell.v1.ListSandboxesResponse.sandboxes:type_name -> openshell.v1.Sandbox - 212, // 25: openshell.v1.ListSandboxProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider - 18, // 26: openshell.v1.AttachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox - 18, // 27: openshell.v1.DetachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox - 48, // 28: openshell.v1.ListServicesResponse.services:type_name -> openshell.v1.ServiceEndpointResponse - 209, // 29: openshell.v1.ServiceEndpoint.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 47, // 30: openshell.v1.ServiceEndpointResponse.endpoint:type_name -> openshell.v1.ServiceEndpoint - 193, // 31: openshell.v1.ExecSandboxRequest.environment:type_name -> openshell.v1.ExecSandboxRequest.EnvironmentEntry - 52, // 32: openshell.v1.ExecSandboxEvent.stdout:type_name -> openshell.v1.ExecSandboxStdout - 53, // 33: openshell.v1.ExecSandboxEvent.stderr:type_name -> openshell.v1.ExecSandboxStderr - 54, // 34: openshell.v1.ExecSandboxEvent.exit:type_name -> openshell.v1.ExecSandboxExit - 136, // 35: openshell.v1.TcpForwardInit.ssh:type_name -> openshell.v1.SshRelayTarget - 137, // 36: openshell.v1.TcpForwardInit.tcp:type_name -> openshell.v1.TcpRelayTarget - 56, // 37: openshell.v1.TcpForwardFrame.init:type_name -> openshell.v1.TcpForwardInit - 51, // 38: openshell.v1.ExecSandboxInput.start:type_name -> openshell.v1.ExecSandboxRequest - 59, // 39: openshell.v1.ExecSandboxInput.resize:type_name -> openshell.v1.ExecSandboxWindowResize - 209, // 40: openshell.v1.SshSession.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 18, // 41: openshell.v1.SandboxStreamEvent.sandbox:type_name -> openshell.v1.Sandbox - 63, // 42: openshell.v1.SandboxStreamEvent.log:type_name -> openshell.v1.SandboxLogLine - 25, // 43: openshell.v1.SandboxStreamEvent.event:type_name -> openshell.v1.PlatformEvent - 64, // 44: openshell.v1.SandboxStreamEvent.warning:type_name -> openshell.v1.SandboxStreamWarning - 147, // 45: openshell.v1.SandboxStreamEvent.draft_policy_update:type_name -> openshell.v1.DraftPolicyUpdate - 194, // 46: openshell.v1.SandboxLogLine.fields:type_name -> openshell.v1.SandboxLogLine.FieldsEntry - 212, // 47: openshell.v1.CreateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider - 212, // 48: openshell.v1.UpdateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider - 195, // 49: openshell.v1.UpdateProviderRequest.credential_expires_at_ms:type_name -> openshell.v1.UpdateProviderRequest.CredentialExpiresAtMsEntry - 212, // 50: openshell.v1.ProviderResponse.provider:type_name -> openshell.datamodel.v1.Provider - 212, // 51: openshell.v1.ListProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider - 93, // 52: openshell.v1.ProviderProfileImportItem.profile:type_name -> openshell.v1.ProviderProfile - 76, // 53: openshell.v1.ProviderCredentialTokenGrant.audience_overrides:type_name -> openshell.v1.ProviderCredentialTokenGrantAudienceOverride - 81, // 54: openshell.v1.ProviderProfileCredential.refresh:type_name -> openshell.v1.ProviderCredentialRefresh - 77, // 55: openshell.v1.ProviderProfileCredential.token_grant:type_name -> openshell.v1.ProviderCredentialTokenGrant - 1, // 56: openshell.v1.ProviderCredentialRefresh.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 79, // 57: openshell.v1.ProviderCredentialRefresh.material:type_name -> openshell.v1.ProviderCredentialRefreshMaterial - 80, // 58: openshell.v1.ProviderCredentialRefresh.additional_outputs:type_name -> openshell.v1.ProviderCredentialRefreshOutput - 1, // 59: openshell.v1.ProviderCredentialRefreshStatus.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 209, // 60: openshell.v1.StoredProviderCredentialRefreshState.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 1, // 61: openshell.v1.StoredProviderCredentialRefreshState.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 196, // 62: openshell.v1.StoredProviderCredentialRefreshState.material:type_name -> openshell.v1.StoredProviderCredentialRefreshState.MaterialEntry - 197, // 63: openshell.v1.StoredProviderCredentialRefreshState.additional_output_keys:type_name -> openshell.v1.StoredProviderCredentialRefreshState.AdditionalOutputKeysEntry - 82, // 64: openshell.v1.GetProviderRefreshStatusResponse.credentials:type_name -> openshell.v1.ProviderCredentialRefreshStatus - 1, // 65: openshell.v1.ConfigureProviderRefreshRequest.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy - 198, // 66: openshell.v1.ConfigureProviderRefreshRequest.material:type_name -> openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry - 82, // 67: openshell.v1.ConfigureProviderRefreshResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus - 82, // 68: openshell.v1.RotateProviderCredentialResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus - 2, // 69: openshell.v1.ProviderProfile.category:type_name -> openshell.v1.ProviderProfileCategory - 78, // 70: openshell.v1.ProviderProfile.credentials:type_name -> openshell.v1.ProviderProfileCredential - 213, // 71: openshell.v1.ProviderProfile.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint - 214, // 72: openshell.v1.ProviderProfile.binaries:type_name -> openshell.sandbox.v1.NetworkBinary - 83, // 73: openshell.v1.ProviderProfile.discovery:type_name -> openshell.v1.ProviderProfileDiscovery - 199, // 74: openshell.v1.ProviderProfile.annotations:type_name -> openshell.v1.ProviderProfile.AnnotationsEntry - 209, // 75: openshell.v1.StoredProviderProfile.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 93, // 76: openshell.v1.StoredProviderProfile.profile:type_name -> openshell.v1.ProviderProfile - 93, // 77: openshell.v1.ProviderProfileResponse.profile:type_name -> openshell.v1.ProviderProfile - 93, // 78: openshell.v1.ListProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile - 74, // 79: openshell.v1.ImportProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem - 75, // 80: openshell.v1.ImportProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic - 93, // 81: openshell.v1.ImportProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile - 74, // 82: openshell.v1.UpdateProviderProfilesRequest.profile:type_name -> openshell.v1.ProviderProfileImportItem - 75, // 83: openshell.v1.UpdateProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic - 93, // 84: openshell.v1.UpdateProviderProfilesResponse.profile:type_name -> openshell.v1.ProviderProfile - 74, // 85: openshell.v1.LintProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem - 75, // 86: openshell.v1.LintProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic - 200, // 87: openshell.v1.GetSandboxProviderEnvironmentResponse.environment:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry - 201, // 88: openshell.v1.GetSandboxProviderEnvironmentResponse.credential_expires_at_ms:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpiresAtMsEntry - 202, // 89: openshell.v1.GetSandboxProviderEnvironmentResponse.dynamic_credentials:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry - 210, // 90: openshell.v1.UpdateConfigRequest.policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 215, // 91: openshell.v1.UpdateConfigRequest.setting_value:type_name -> openshell.sandbox.v1.SettingValue - 109, // 92: openshell.v1.UpdateConfigRequest.merge_operations:type_name -> openshell.v1.PolicyMergeOperation - 203, // 93: openshell.v1.UpdateConfigRequest.annotations:type_name -> openshell.v1.UpdateConfigRequest.AnnotationsEntry - 110, // 94: openshell.v1.PolicyMergeOperation.add_rule:type_name -> openshell.v1.AddNetworkRule - 111, // 95: openshell.v1.PolicyMergeOperation.remove_endpoint:type_name -> openshell.v1.RemoveNetworkEndpoint - 112, // 96: openshell.v1.PolicyMergeOperation.remove_rule:type_name -> openshell.v1.RemoveNetworkRule - 113, // 97: openshell.v1.PolicyMergeOperation.add_deny_rules:type_name -> openshell.v1.AddDenyRules - 114, // 98: openshell.v1.PolicyMergeOperation.add_allow_rules:type_name -> openshell.v1.AddAllowRules - 115, // 99: openshell.v1.PolicyMergeOperation.remove_binary:type_name -> openshell.v1.RemoveNetworkBinary - 216, // 100: openshell.v1.AddNetworkRule.rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 217, // 101: openshell.v1.AddDenyRules.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule - 218, // 102: openshell.v1.AddAllowRules.rules:type_name -> openshell.sandbox.v1.L7Rule - 204, // 103: openshell.v1.UpdateConfigResponse.annotations:type_name -> openshell.v1.UpdateConfigResponse.AnnotationsEntry - 123, // 104: openshell.v1.GetSandboxPolicyStatusResponse.revision:type_name -> openshell.v1.SandboxPolicyRevision - 123, // 105: openshell.v1.ListSandboxPoliciesResponse.revisions:type_name -> openshell.v1.SandboxPolicyRevision - 3, // 106: openshell.v1.ReportPolicyStatusRequest.status:type_name -> openshell.v1.PolicyStatus - 3, // 107: openshell.v1.SandboxPolicyRevision.status:type_name -> openshell.v1.PolicyStatus - 210, // 108: openshell.v1.SandboxPolicyRevision.policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 205, // 109: openshell.v1.SandboxPolicyRevision.provenance:type_name -> openshell.v1.SandboxPolicyRevision.ProvenanceEntry - 63, // 110: openshell.v1.PushSandboxLogsRequest.logs:type_name -> openshell.v1.SandboxLogLine - 63, // 111: openshell.v1.GetSandboxLogsResponse.logs:type_name -> openshell.v1.SandboxLogLine - 130, // 112: openshell.v1.SupervisorMessage.hello:type_name -> openshell.v1.SupervisorHello - 133, // 113: openshell.v1.SupervisorMessage.heartbeat:type_name -> openshell.v1.SupervisorHeartbeat - 140, // 114: openshell.v1.SupervisorMessage.relay_open_result:type_name -> openshell.v1.RelayOpenResult - 141, // 115: openshell.v1.SupervisorMessage.relay_close:type_name -> openshell.v1.RelayClose - 131, // 116: openshell.v1.GatewayMessage.session_accepted:type_name -> openshell.v1.SessionAccepted - 132, // 117: openshell.v1.GatewayMessage.session_rejected:type_name -> openshell.v1.SessionRejected - 134, // 118: openshell.v1.GatewayMessage.heartbeat:type_name -> openshell.v1.GatewayHeartbeat - 135, // 119: openshell.v1.GatewayMessage.relay_open:type_name -> openshell.v1.RelayOpen - 141, // 120: openshell.v1.GatewayMessage.relay_close:type_name -> openshell.v1.RelayClose - 136, // 121: openshell.v1.RelayOpen.ssh:type_name -> openshell.v1.SshRelayTarget - 137, // 122: openshell.v1.RelayOpen.tcp:type_name -> openshell.v1.TcpRelayTarget - 138, // 123: openshell.v1.RelayFrame.init:type_name -> openshell.v1.RelayInit - 142, // 124: openshell.v1.DenialSummary.l7_request_samples:type_name -> openshell.v1.L7RequestSample - 144, // 125: openshell.v1.NetworkActivitySummary.denials_by_group:type_name -> openshell.v1.DenialGroupCount - 216, // 126: openshell.v1.PolicyChunk.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 143, // 127: openshell.v1.SubmitPolicyAnalysisRequest.summaries:type_name -> openshell.v1.DenialSummary - 146, // 128: openshell.v1.SubmitPolicyAnalysisRequest.proposed_chunks:type_name -> openshell.v1.PolicyChunk - 145, // 129: openshell.v1.SubmitPolicyAnalysisRequest.network_activity_summaries:type_name -> openshell.v1.NetworkActivitySummary - 146, // 130: openshell.v1.GetDraftPolicyResponse.chunks:type_name -> openshell.v1.PolicyChunk - 216, // 131: openshell.v1.EditDraftChunkRequest.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 165, // 132: openshell.v1.GetDraftHistoryResponse.entries:type_name -> openshell.v1.DraftHistoryEntry - 210, // 133: openshell.v1.PolicyRevisionPayload.policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 206, // 134: openshell.v1.PolicyRevisionPayload.provenance:type_name -> openshell.v1.PolicyRevisionPayload.ProvenanceEntry - 216, // 135: openshell.v1.DraftChunkPayload.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 207, // 136: openshell.v1.StoredPolicyRevision.provenance:type_name -> openshell.v1.StoredPolicyRevision.ProvenanceEntry - 208, // 137: openshell.v1.CreateWorkspaceRequest.labels:type_name -> openshell.v1.CreateWorkspaceRequest.LabelsEntry - 219, // 138: openshell.v1.CreateWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace - 219, // 139: openshell.v1.GetWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace - 219, // 140: openshell.v1.ListWorkspacesResponse.workspaces:type_name -> openshell.datamodel.v1.Workspace - 209, // 141: openshell.v1.WorkspaceMember.metadata:type_name -> openshell.datamodel.v1.ObjectMeta - 5, // 142: openshell.v1.WorkspaceMember.role:type_name -> openshell.v1.WorkspaceRole - 5, // 143: openshell.v1.AddWorkspaceMemberRequest.role:type_name -> openshell.v1.WorkspaceRole - 179, // 144: openshell.v1.AddWorkspaceMemberResponse.member:type_name -> openshell.v1.WorkspaceMember - 179, // 145: openshell.v1.ListWorkspaceMembersResponse.members:type_name -> openshell.v1.WorkspaceMember - 78, // 146: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential - 10, // 147: openshell.v1.OpenShell.Health:input_type -> openshell.v1.HealthRequest - 12, // 148: openshell.v1.OpenShell.GetCurrentUser:input_type -> openshell.v1.GetCurrentUserRequest - 14, // 149: openshell.v1.OpenShell.GetGatewayInfo:input_type -> openshell.v1.GetGatewayInfoRequest - 26, // 150: openshell.v1.OpenShell.CreateSandbox:input_type -> openshell.v1.CreateSandboxRequest - 27, // 151: openshell.v1.OpenShell.GetSandbox:input_type -> openshell.v1.GetSandboxRequest - 28, // 152: openshell.v1.OpenShell.ListSandboxes:input_type -> openshell.v1.ListSandboxesRequest - 29, // 153: openshell.v1.OpenShell.ListSandboxProviders:input_type -> openshell.v1.ListSandboxProvidersRequest - 30, // 154: openshell.v1.OpenShell.AttachSandboxProvider:input_type -> openshell.v1.AttachSandboxProviderRequest - 31, // 155: openshell.v1.OpenShell.DetachSandboxProvider:input_type -> openshell.v1.DetachSandboxProviderRequest - 32, // 156: openshell.v1.OpenShell.DeleteSandbox:input_type -> openshell.v1.DeleteSandboxRequest - 39, // 157: openshell.v1.OpenShell.CreateSshSession:input_type -> openshell.v1.CreateSshSessionRequest - 41, // 158: openshell.v1.OpenShell.ExposeService:input_type -> openshell.v1.ExposeServiceRequest - 42, // 159: openshell.v1.OpenShell.GetService:input_type -> openshell.v1.GetServiceRequest - 43, // 160: openshell.v1.OpenShell.ListServices:input_type -> openshell.v1.ListServicesRequest - 45, // 161: openshell.v1.OpenShell.DeleteService:input_type -> openshell.v1.DeleteServiceRequest - 49, // 162: openshell.v1.OpenShell.RevokeSshSession:input_type -> openshell.v1.RevokeSshSessionRequest - 51, // 163: openshell.v1.OpenShell.ExecSandbox:input_type -> openshell.v1.ExecSandboxRequest - 57, // 164: openshell.v1.OpenShell.ForwardTcp:input_type -> openshell.v1.TcpForwardFrame - 58, // 165: openshell.v1.OpenShell.ExecSandboxInteractive:input_type -> openshell.v1.ExecSandboxInput - 65, // 166: openshell.v1.OpenShell.CreateProvider:input_type -> openshell.v1.CreateProviderRequest - 66, // 167: openshell.v1.OpenShell.GetProvider:input_type -> openshell.v1.GetProviderRequest - 67, // 168: openshell.v1.OpenShell.ListProviders:input_type -> openshell.v1.ListProvidersRequest - 72, // 169: openshell.v1.OpenShell.ListProviderProfiles:input_type -> openshell.v1.ListProviderProfilesRequest - 73, // 170: openshell.v1.OpenShell.GetProviderProfile:input_type -> openshell.v1.GetProviderProfileRequest - 97, // 171: openshell.v1.OpenShell.ImportProviderProfiles:input_type -> openshell.v1.ImportProviderProfilesRequest - 99, // 172: openshell.v1.OpenShell.UpdateProviderProfiles:input_type -> openshell.v1.UpdateProviderProfilesRequest - 101, // 173: openshell.v1.OpenShell.LintProviderProfiles:input_type -> openshell.v1.LintProviderProfilesRequest - 68, // 174: openshell.v1.OpenShell.UpdateProvider:input_type -> openshell.v1.UpdateProviderRequest - 85, // 175: openshell.v1.OpenShell.GetProviderRefreshStatus:input_type -> openshell.v1.GetProviderRefreshStatusRequest - 87, // 176: openshell.v1.OpenShell.ConfigureProviderRefresh:input_type -> openshell.v1.ConfigureProviderRefreshRequest - 89, // 177: openshell.v1.OpenShell.RotateProviderCredential:input_type -> openshell.v1.RotateProviderCredentialRequest - 91, // 178: openshell.v1.OpenShell.DeleteProviderRefresh:input_type -> openshell.v1.DeleteProviderRefreshRequest - 69, // 179: openshell.v1.OpenShell.DeleteProvider:input_type -> openshell.v1.DeleteProviderRequest - 104, // 180: openshell.v1.OpenShell.DeleteProviderProfile:input_type -> openshell.v1.DeleteProviderProfileRequest - 220, // 181: openshell.v1.OpenShell.GetSandboxConfig:input_type -> openshell.sandbox.v1.GetSandboxConfigRequest - 221, // 182: openshell.v1.OpenShell.GetGatewayConfig:input_type -> openshell.sandbox.v1.GetGatewayConfigRequest - 108, // 183: openshell.v1.OpenShell.UpdateConfig:input_type -> openshell.v1.UpdateConfigRequest - 117, // 184: openshell.v1.OpenShell.GetSandboxPolicyStatus:input_type -> openshell.v1.GetSandboxPolicyStatusRequest - 119, // 185: openshell.v1.OpenShell.ListSandboxPolicies:input_type -> openshell.v1.ListSandboxPoliciesRequest - 121, // 186: openshell.v1.OpenShell.ReportPolicyStatus:input_type -> openshell.v1.ReportPolicyStatusRequest - 106, // 187: openshell.v1.OpenShell.GetSandboxProviderEnvironment:input_type -> openshell.v1.GetSandboxProviderEnvironmentRequest - 124, // 188: openshell.v1.OpenShell.GetSandboxLogs:input_type -> openshell.v1.GetSandboxLogsRequest - 125, // 189: openshell.v1.OpenShell.PushSandboxLogs:input_type -> openshell.v1.PushSandboxLogsRequest - 128, // 190: openshell.v1.OpenShell.ConnectSupervisor:input_type -> openshell.v1.SupervisorMessage - 139, // 191: openshell.v1.OpenShell.RelayStream:input_type -> openshell.v1.RelayFrame - 61, // 192: openshell.v1.OpenShell.WatchSandbox:input_type -> openshell.v1.WatchSandboxRequest - 148, // 193: openshell.v1.OpenShell.SubmitPolicyAnalysis:input_type -> openshell.v1.SubmitPolicyAnalysisRequest - 150, // 194: openshell.v1.OpenShell.GetDraftPolicy:input_type -> openshell.v1.GetDraftPolicyRequest - 152, // 195: openshell.v1.OpenShell.ApproveDraftChunk:input_type -> openshell.v1.ApproveDraftChunkRequest - 154, // 196: openshell.v1.OpenShell.RejectDraftChunk:input_type -> openshell.v1.RejectDraftChunkRequest - 156, // 197: openshell.v1.OpenShell.ApproveAllDraftChunks:input_type -> openshell.v1.ApproveAllDraftChunksRequest - 158, // 198: openshell.v1.OpenShell.EditDraftChunk:input_type -> openshell.v1.EditDraftChunkRequest - 160, // 199: openshell.v1.OpenShell.UndoDraftChunk:input_type -> openshell.v1.UndoDraftChunkRequest - 162, // 200: openshell.v1.OpenShell.ClearDraftChunks:input_type -> openshell.v1.ClearDraftChunksRequest - 164, // 201: openshell.v1.OpenShell.GetDraftHistory:input_type -> openshell.v1.GetDraftHistoryRequest - 6, // 202: openshell.v1.OpenShell.IssueSandboxToken:input_type -> openshell.v1.IssueSandboxTokenRequest - 8, // 203: openshell.v1.OpenShell.RefreshSandboxToken:input_type -> openshell.v1.RefreshSandboxTokenRequest - 171, // 204: openshell.v1.OpenShell.CreateWorkspace:input_type -> openshell.v1.CreateWorkspaceRequest - 173, // 205: openshell.v1.OpenShell.GetWorkspace:input_type -> openshell.v1.GetWorkspaceRequest - 175, // 206: openshell.v1.OpenShell.ListWorkspaces:input_type -> openshell.v1.ListWorkspacesRequest - 177, // 207: openshell.v1.OpenShell.DeleteWorkspace:input_type -> openshell.v1.DeleteWorkspaceRequest - 180, // 208: openshell.v1.OpenShell.AddWorkspaceMember:input_type -> openshell.v1.AddWorkspaceMemberRequest - 182, // 209: openshell.v1.OpenShell.RemoveWorkspaceMember:input_type -> openshell.v1.RemoveWorkspaceMemberRequest - 184, // 210: openshell.v1.OpenShell.ListWorkspaceMembers:input_type -> openshell.v1.ListWorkspaceMembersRequest - 11, // 211: openshell.v1.OpenShell.Health:output_type -> openshell.v1.HealthResponse - 13, // 212: openshell.v1.OpenShell.GetCurrentUser:output_type -> openshell.v1.GetCurrentUserResponse - 15, // 213: openshell.v1.OpenShell.GetGatewayInfo:output_type -> openshell.v1.GetGatewayInfoResponse - 33, // 214: openshell.v1.OpenShell.CreateSandbox:output_type -> openshell.v1.SandboxResponse - 33, // 215: openshell.v1.OpenShell.GetSandbox:output_type -> openshell.v1.SandboxResponse - 34, // 216: openshell.v1.OpenShell.ListSandboxes:output_type -> openshell.v1.ListSandboxesResponse - 35, // 217: openshell.v1.OpenShell.ListSandboxProviders:output_type -> openshell.v1.ListSandboxProvidersResponse - 36, // 218: openshell.v1.OpenShell.AttachSandboxProvider:output_type -> openshell.v1.AttachSandboxProviderResponse - 37, // 219: openshell.v1.OpenShell.DetachSandboxProvider:output_type -> openshell.v1.DetachSandboxProviderResponse - 38, // 220: openshell.v1.OpenShell.DeleteSandbox:output_type -> openshell.v1.DeleteSandboxResponse - 40, // 221: openshell.v1.OpenShell.CreateSshSession:output_type -> openshell.v1.CreateSshSessionResponse - 48, // 222: openshell.v1.OpenShell.ExposeService:output_type -> openshell.v1.ServiceEndpointResponse - 48, // 223: openshell.v1.OpenShell.GetService:output_type -> openshell.v1.ServiceEndpointResponse - 44, // 224: openshell.v1.OpenShell.ListServices:output_type -> openshell.v1.ListServicesResponse - 46, // 225: openshell.v1.OpenShell.DeleteService:output_type -> openshell.v1.DeleteServiceResponse - 50, // 226: openshell.v1.OpenShell.RevokeSshSession:output_type -> openshell.v1.RevokeSshSessionResponse - 55, // 227: openshell.v1.OpenShell.ExecSandbox:output_type -> openshell.v1.ExecSandboxEvent - 57, // 228: openshell.v1.OpenShell.ForwardTcp:output_type -> openshell.v1.TcpForwardFrame - 55, // 229: openshell.v1.OpenShell.ExecSandboxInteractive:output_type -> openshell.v1.ExecSandboxEvent - 70, // 230: openshell.v1.OpenShell.CreateProvider:output_type -> openshell.v1.ProviderResponse - 70, // 231: openshell.v1.OpenShell.GetProvider:output_type -> openshell.v1.ProviderResponse - 71, // 232: openshell.v1.OpenShell.ListProviders:output_type -> openshell.v1.ListProvidersResponse - 96, // 233: openshell.v1.OpenShell.ListProviderProfiles:output_type -> openshell.v1.ListProviderProfilesResponse - 95, // 234: openshell.v1.OpenShell.GetProviderProfile:output_type -> openshell.v1.ProviderProfileResponse - 98, // 235: openshell.v1.OpenShell.ImportProviderProfiles:output_type -> openshell.v1.ImportProviderProfilesResponse - 100, // 236: openshell.v1.OpenShell.UpdateProviderProfiles:output_type -> openshell.v1.UpdateProviderProfilesResponse - 102, // 237: openshell.v1.OpenShell.LintProviderProfiles:output_type -> openshell.v1.LintProviderProfilesResponse - 70, // 238: openshell.v1.OpenShell.UpdateProvider:output_type -> openshell.v1.ProviderResponse - 86, // 239: openshell.v1.OpenShell.GetProviderRefreshStatus:output_type -> openshell.v1.GetProviderRefreshStatusResponse - 88, // 240: openshell.v1.OpenShell.ConfigureProviderRefresh:output_type -> openshell.v1.ConfigureProviderRefreshResponse - 90, // 241: openshell.v1.OpenShell.RotateProviderCredential:output_type -> openshell.v1.RotateProviderCredentialResponse - 92, // 242: openshell.v1.OpenShell.DeleteProviderRefresh:output_type -> openshell.v1.DeleteProviderRefreshResponse - 103, // 243: openshell.v1.OpenShell.DeleteProvider:output_type -> openshell.v1.DeleteProviderResponse - 105, // 244: openshell.v1.OpenShell.DeleteProviderProfile:output_type -> openshell.v1.DeleteProviderProfileResponse - 222, // 245: openshell.v1.OpenShell.GetSandboxConfig:output_type -> openshell.sandbox.v1.GetSandboxConfigResponse - 223, // 246: openshell.v1.OpenShell.GetGatewayConfig:output_type -> openshell.sandbox.v1.GetGatewayConfigResponse - 116, // 247: openshell.v1.OpenShell.UpdateConfig:output_type -> openshell.v1.UpdateConfigResponse - 118, // 248: openshell.v1.OpenShell.GetSandboxPolicyStatus:output_type -> openshell.v1.GetSandboxPolicyStatusResponse - 120, // 249: openshell.v1.OpenShell.ListSandboxPolicies:output_type -> openshell.v1.ListSandboxPoliciesResponse - 122, // 250: openshell.v1.OpenShell.ReportPolicyStatus:output_type -> openshell.v1.ReportPolicyStatusResponse - 107, // 251: openshell.v1.OpenShell.GetSandboxProviderEnvironment:output_type -> openshell.v1.GetSandboxProviderEnvironmentResponse - 127, // 252: openshell.v1.OpenShell.GetSandboxLogs:output_type -> openshell.v1.GetSandboxLogsResponse - 126, // 253: openshell.v1.OpenShell.PushSandboxLogs:output_type -> openshell.v1.PushSandboxLogsResponse - 129, // 254: openshell.v1.OpenShell.ConnectSupervisor:output_type -> openshell.v1.GatewayMessage - 139, // 255: openshell.v1.OpenShell.RelayStream:output_type -> openshell.v1.RelayFrame - 62, // 256: openshell.v1.OpenShell.WatchSandbox:output_type -> openshell.v1.SandboxStreamEvent - 149, // 257: openshell.v1.OpenShell.SubmitPolicyAnalysis:output_type -> openshell.v1.SubmitPolicyAnalysisResponse - 151, // 258: openshell.v1.OpenShell.GetDraftPolicy:output_type -> openshell.v1.GetDraftPolicyResponse - 153, // 259: openshell.v1.OpenShell.ApproveDraftChunk:output_type -> openshell.v1.ApproveDraftChunkResponse - 155, // 260: openshell.v1.OpenShell.RejectDraftChunk:output_type -> openshell.v1.RejectDraftChunkResponse - 157, // 261: openshell.v1.OpenShell.ApproveAllDraftChunks:output_type -> openshell.v1.ApproveAllDraftChunksResponse - 159, // 262: openshell.v1.OpenShell.EditDraftChunk:output_type -> openshell.v1.EditDraftChunkResponse - 161, // 263: openshell.v1.OpenShell.UndoDraftChunk:output_type -> openshell.v1.UndoDraftChunkResponse - 163, // 264: openshell.v1.OpenShell.ClearDraftChunks:output_type -> openshell.v1.ClearDraftChunksResponse - 166, // 265: openshell.v1.OpenShell.GetDraftHistory:output_type -> openshell.v1.GetDraftHistoryResponse - 7, // 266: openshell.v1.OpenShell.IssueSandboxToken:output_type -> openshell.v1.IssueSandboxTokenResponse - 9, // 267: openshell.v1.OpenShell.RefreshSandboxToken:output_type -> openshell.v1.RefreshSandboxTokenResponse - 172, // 268: openshell.v1.OpenShell.CreateWorkspace:output_type -> openshell.v1.CreateWorkspaceResponse - 174, // 269: openshell.v1.OpenShell.GetWorkspace:output_type -> openshell.v1.GetWorkspaceResponse - 176, // 270: openshell.v1.OpenShell.ListWorkspaces:output_type -> openshell.v1.ListWorkspacesResponse - 178, // 271: openshell.v1.OpenShell.DeleteWorkspace:output_type -> openshell.v1.DeleteWorkspaceResponse - 181, // 272: openshell.v1.OpenShell.AddWorkspaceMember:output_type -> openshell.v1.AddWorkspaceMemberResponse - 183, // 273: openshell.v1.OpenShell.RemoveWorkspaceMember:output_type -> openshell.v1.RemoveWorkspaceMemberResponse - 185, // 274: openshell.v1.OpenShell.ListWorkspaceMembers:output_type -> openshell.v1.ListWorkspaceMembersResponse - 211, // [211:275] is the sub-list for method output_type - 147, // [147:211] is the sub-list for method input_type - 147, // [147:147] is the sub-list for extension type_name - 147, // [147:147] is the sub-list for extension extendee - 0, // [0:147] is the sub-list for field type_name -} - -func init() { file_openshell_proto_init() } -func file_openshell_proto_init() { - if File_openshell_proto != nil { - return - } - file_openshell_proto_msgTypes[15].OneofWrappers = []any{} - file_openshell_proto_msgTypes[16].OneofWrappers = []any{} - file_openshell_proto_msgTypes[49].OneofWrappers = []any{ - (*ExecSandboxEvent_Stdout)(nil), - (*ExecSandboxEvent_Stderr)(nil), - (*ExecSandboxEvent_Exit)(nil), - } - file_openshell_proto_msgTypes[50].OneofWrappers = []any{ - (*TcpForwardInit_Ssh)(nil), - (*TcpForwardInit_Tcp)(nil), - } - file_openshell_proto_msgTypes[51].OneofWrappers = []any{ - (*TcpForwardFrame_Init)(nil), - (*TcpForwardFrame_Data)(nil), - } - file_openshell_proto_msgTypes[52].OneofWrappers = []any{ - (*ExecSandboxInput_Start)(nil), - (*ExecSandboxInput_Stdin)(nil), - (*ExecSandboxInput_Resize)(nil), - } - file_openshell_proto_msgTypes[56].OneofWrappers = []any{ - (*SandboxStreamEvent_Sandbox)(nil), - (*SandboxStreamEvent_Log)(nil), - (*SandboxStreamEvent_Event)(nil), - (*SandboxStreamEvent_Warning)(nil), - (*SandboxStreamEvent_DraftPolicyUpdate)(nil), - } - file_openshell_proto_msgTypes[81].OneofWrappers = []any{} - file_openshell_proto_msgTypes[103].OneofWrappers = []any{ - (*PolicyMergeOperation_AddRule)(nil), - (*PolicyMergeOperation_RemoveEndpoint)(nil), - (*PolicyMergeOperation_RemoveRule)(nil), - (*PolicyMergeOperation_AddDenyRules)(nil), - (*PolicyMergeOperation_AddAllowRules)(nil), - (*PolicyMergeOperation_RemoveBinary)(nil), - } - file_openshell_proto_msgTypes[122].OneofWrappers = []any{ - (*SupervisorMessage_Hello)(nil), - (*SupervisorMessage_Heartbeat)(nil), - (*SupervisorMessage_RelayOpenResult)(nil), - (*SupervisorMessage_RelayClose)(nil), - } - file_openshell_proto_msgTypes[123].OneofWrappers = []any{ - (*GatewayMessage_SessionAccepted)(nil), - (*GatewayMessage_SessionRejected)(nil), - (*GatewayMessage_Heartbeat)(nil), - (*GatewayMessage_RelayOpen)(nil), - (*GatewayMessage_RelayClose)(nil), - } - file_openshell_proto_msgTypes[129].OneofWrappers = []any{ - (*RelayOpen_Ssh)(nil), - (*RelayOpen_Tcp)(nil), - } - file_openshell_proto_msgTypes[133].OneofWrappers = []any{ - (*RelayFrame_Init)(nil), - (*RelayFrame_Data)(nil), - } - file_openshell_proto_msgTypes[163].OneofWrappers = []any{} - file_openshell_proto_msgTypes[164].OneofWrappers = []any{} - type x struct{} - out := protoimpl.TypeBuilder{ - File: protoimpl.DescBuilder{ - GoPackagePath: reflect.TypeOf(x{}).PkgPath(), - RawDescriptor: unsafe.Slice(unsafe.StringData(file_openshell_proto_rawDesc), len(file_openshell_proto_rawDesc)), - NumEnums: 6, - NumMessages: 203, - NumExtensions: 0, - NumServices: 1, - }, - GoTypes: file_openshell_proto_goTypes, - DependencyIndexes: file_openshell_proto_depIdxs, - EnumInfos: file_openshell_proto_enumTypes, - MessageInfos: file_openshell_proto_msgTypes, - }.Build() - File_openshell_proto = out.File - file_openshell_proto_goTypes = nil - file_openshell_proto_depIdxs = nil -} diff --git a/backend/gen/openshellv1/openshell_grpc.pb.go b/backend/gen/openshellv1/openshell_grpc.pb.go deleted file mode 100644 index 6c6b757..0000000 --- a/backend/gen/openshellv1/openshell_grpc.pb.go +++ /dev/null @@ -1,2719 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -// Code generated by protoc-gen-go-grpc. DO NOT EDIT. -// versions: -// - protoc-gen-go-grpc v1.6.2 -// - protoc v6.33.2 -// source: openshell.proto - -package openshellv1 - -import ( - context "context" - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" - grpc "google.golang.org/grpc" - codes "google.golang.org/grpc/codes" - status "google.golang.org/grpc/status" -) - -// This is a compile-time assertion to ensure that this generated file -// is compatible with the grpc package it is being compiled against. -// Requires gRPC-Go v1.64.0 or later. -const _ = grpc.SupportPackageIsVersion9 - -const ( - OpenShell_Health_FullMethodName = "/openshell.v1.OpenShell/Health" - OpenShell_GetCurrentUser_FullMethodName = "/openshell.v1.OpenShell/GetCurrentUser" - OpenShell_GetGatewayInfo_FullMethodName = "/openshell.v1.OpenShell/GetGatewayInfo" - OpenShell_CreateSandbox_FullMethodName = "/openshell.v1.OpenShell/CreateSandbox" - OpenShell_GetSandbox_FullMethodName = "/openshell.v1.OpenShell/GetSandbox" - OpenShell_ListSandboxes_FullMethodName = "/openshell.v1.OpenShell/ListSandboxes" - OpenShell_ListSandboxProviders_FullMethodName = "/openshell.v1.OpenShell/ListSandboxProviders" - OpenShell_AttachSandboxProvider_FullMethodName = "/openshell.v1.OpenShell/AttachSandboxProvider" - OpenShell_DetachSandboxProvider_FullMethodName = "/openshell.v1.OpenShell/DetachSandboxProvider" - OpenShell_DeleteSandbox_FullMethodName = "/openshell.v1.OpenShell/DeleteSandbox" - OpenShell_CreateSshSession_FullMethodName = "/openshell.v1.OpenShell/CreateSshSession" - OpenShell_ExposeService_FullMethodName = "/openshell.v1.OpenShell/ExposeService" - OpenShell_GetService_FullMethodName = "/openshell.v1.OpenShell/GetService" - OpenShell_ListServices_FullMethodName = "/openshell.v1.OpenShell/ListServices" - OpenShell_DeleteService_FullMethodName = "/openshell.v1.OpenShell/DeleteService" - OpenShell_RevokeSshSession_FullMethodName = "/openshell.v1.OpenShell/RevokeSshSession" - OpenShell_ExecSandbox_FullMethodName = "/openshell.v1.OpenShell/ExecSandbox" - OpenShell_ForwardTcp_FullMethodName = "/openshell.v1.OpenShell/ForwardTcp" - OpenShell_ExecSandboxInteractive_FullMethodName = "/openshell.v1.OpenShell/ExecSandboxInteractive" - OpenShell_CreateProvider_FullMethodName = "/openshell.v1.OpenShell/CreateProvider" - OpenShell_GetProvider_FullMethodName = "/openshell.v1.OpenShell/GetProvider" - OpenShell_ListProviders_FullMethodName = "/openshell.v1.OpenShell/ListProviders" - OpenShell_ListProviderProfiles_FullMethodName = "/openshell.v1.OpenShell/ListProviderProfiles" - OpenShell_GetProviderProfile_FullMethodName = "/openshell.v1.OpenShell/GetProviderProfile" - OpenShell_ImportProviderProfiles_FullMethodName = "/openshell.v1.OpenShell/ImportProviderProfiles" - OpenShell_UpdateProviderProfiles_FullMethodName = "/openshell.v1.OpenShell/UpdateProviderProfiles" - OpenShell_LintProviderProfiles_FullMethodName = "/openshell.v1.OpenShell/LintProviderProfiles" - OpenShell_UpdateProvider_FullMethodName = "/openshell.v1.OpenShell/UpdateProvider" - OpenShell_GetProviderRefreshStatus_FullMethodName = "/openshell.v1.OpenShell/GetProviderRefreshStatus" - OpenShell_ConfigureProviderRefresh_FullMethodName = "/openshell.v1.OpenShell/ConfigureProviderRefresh" - OpenShell_RotateProviderCredential_FullMethodName = "/openshell.v1.OpenShell/RotateProviderCredential" - OpenShell_DeleteProviderRefresh_FullMethodName = "/openshell.v1.OpenShell/DeleteProviderRefresh" - OpenShell_DeleteProvider_FullMethodName = "/openshell.v1.OpenShell/DeleteProvider" - OpenShell_DeleteProviderProfile_FullMethodName = "/openshell.v1.OpenShell/DeleteProviderProfile" - OpenShell_GetSandboxConfig_FullMethodName = "/openshell.v1.OpenShell/GetSandboxConfig" - OpenShell_GetGatewayConfig_FullMethodName = "/openshell.v1.OpenShell/GetGatewayConfig" - OpenShell_UpdateConfig_FullMethodName = "/openshell.v1.OpenShell/UpdateConfig" - OpenShell_GetSandboxPolicyStatus_FullMethodName = "/openshell.v1.OpenShell/GetSandboxPolicyStatus" - OpenShell_ListSandboxPolicies_FullMethodName = "/openshell.v1.OpenShell/ListSandboxPolicies" - OpenShell_ReportPolicyStatus_FullMethodName = "/openshell.v1.OpenShell/ReportPolicyStatus" - OpenShell_GetSandboxProviderEnvironment_FullMethodName = "/openshell.v1.OpenShell/GetSandboxProviderEnvironment" - OpenShell_GetSandboxLogs_FullMethodName = "/openshell.v1.OpenShell/GetSandboxLogs" - OpenShell_PushSandboxLogs_FullMethodName = "/openshell.v1.OpenShell/PushSandboxLogs" - OpenShell_ConnectSupervisor_FullMethodName = "/openshell.v1.OpenShell/ConnectSupervisor" - OpenShell_RelayStream_FullMethodName = "/openshell.v1.OpenShell/RelayStream" - OpenShell_WatchSandbox_FullMethodName = "/openshell.v1.OpenShell/WatchSandbox" - OpenShell_SubmitPolicyAnalysis_FullMethodName = "/openshell.v1.OpenShell/SubmitPolicyAnalysis" - OpenShell_GetDraftPolicy_FullMethodName = "/openshell.v1.OpenShell/GetDraftPolicy" - OpenShell_ApproveDraftChunk_FullMethodName = "/openshell.v1.OpenShell/ApproveDraftChunk" - OpenShell_RejectDraftChunk_FullMethodName = "/openshell.v1.OpenShell/RejectDraftChunk" - OpenShell_ApproveAllDraftChunks_FullMethodName = "/openshell.v1.OpenShell/ApproveAllDraftChunks" - OpenShell_EditDraftChunk_FullMethodName = "/openshell.v1.OpenShell/EditDraftChunk" - OpenShell_UndoDraftChunk_FullMethodName = "/openshell.v1.OpenShell/UndoDraftChunk" - OpenShell_ClearDraftChunks_FullMethodName = "/openshell.v1.OpenShell/ClearDraftChunks" - OpenShell_GetDraftHistory_FullMethodName = "/openshell.v1.OpenShell/GetDraftHistory" - OpenShell_IssueSandboxToken_FullMethodName = "/openshell.v1.OpenShell/IssueSandboxToken" - OpenShell_RefreshSandboxToken_FullMethodName = "/openshell.v1.OpenShell/RefreshSandboxToken" - OpenShell_CreateWorkspace_FullMethodName = "/openshell.v1.OpenShell/CreateWorkspace" - OpenShell_GetWorkspace_FullMethodName = "/openshell.v1.OpenShell/GetWorkspace" - OpenShell_ListWorkspaces_FullMethodName = "/openshell.v1.OpenShell/ListWorkspaces" - OpenShell_DeleteWorkspace_FullMethodName = "/openshell.v1.OpenShell/DeleteWorkspace" - OpenShell_AddWorkspaceMember_FullMethodName = "/openshell.v1.OpenShell/AddWorkspaceMember" - OpenShell_RemoveWorkspaceMember_FullMethodName = "/openshell.v1.OpenShell/RemoveWorkspaceMember" - OpenShell_ListWorkspaceMembers_FullMethodName = "/openshell.v1.OpenShell/ListWorkspaceMembers" -) - -// OpenShellClient is the client API for OpenShell service. -// -// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream. -// -// OpenShell service provides sandbox, provider, and runtime management capabilities. -// -// Conventions: -// - This file owns the public API resource model exposed to OpenShell clients. -// - `Sandbox`, `SandboxSpec`, `SandboxStatus`, and `SandboxPhase` are gateway-owned -// public types. Internal compute drivers must not import or return them directly. -// - The gateway translates internal compute-driver observations into these public -// resource messages before persisting or returning them to clients. -type OpenShellClient interface { - // Check the health of the service. - Health(ctx context.Context, in *HealthRequest, opts ...grpc.CallOption) (*HealthResponse, error) - // Return the authenticated caller identity established by the gateway. - GetCurrentUser(ctx context.Context, in *GetCurrentUserRequest, opts ...grpc.CallOption) (*GetCurrentUserResponse, error) - // Fetch elevated live gateway runtime metadata. - GetGatewayInfo(ctx context.Context, in *GetGatewayInfoRequest, opts ...grpc.CallOption) (*GetGatewayInfoResponse, error) - // Create a new sandbox. - CreateSandbox(ctx context.Context, in *CreateSandboxRequest, opts ...grpc.CallOption) (*SandboxResponse, error) - // Fetch a sandbox by name. - GetSandbox(ctx context.Context, in *GetSandboxRequest, opts ...grpc.CallOption) (*SandboxResponse, error) - // List sandboxes. - ListSandboxes(ctx context.Context, in *ListSandboxesRequest, opts ...grpc.CallOption) (*ListSandboxesResponse, error) - // List provider records attached to a sandbox. - ListSandboxProviders(ctx context.Context, in *ListSandboxProvidersRequest, opts ...grpc.CallOption) (*ListSandboxProvidersResponse, error) - // Attach a provider record to an existing sandbox. - AttachSandboxProvider(ctx context.Context, in *AttachSandboxProviderRequest, opts ...grpc.CallOption) (*AttachSandboxProviderResponse, error) - // Detach a provider record from an existing sandbox. - DetachSandboxProvider(ctx context.Context, in *DetachSandboxProviderRequest, opts ...grpc.CallOption) (*DetachSandboxProviderResponse, error) - // Delete a sandbox by name. - DeleteSandbox(ctx context.Context, in *DeleteSandboxRequest, opts ...grpc.CallOption) (*DeleteSandboxResponse, error) - // Create a short-lived SSH session for a sandbox. - CreateSshSession(ctx context.Context, in *CreateSshSessionRequest, opts ...grpc.CallOption) (*CreateSshSessionResponse, error) - // Create or update a sandbox HTTP service endpoint for local routing. - ExposeService(ctx context.Context, in *ExposeServiceRequest, opts ...grpc.CallOption) (*ServiceEndpointResponse, error) - // Fetch one sandbox HTTP service endpoint. - GetService(ctx context.Context, in *GetServiceRequest, opts ...grpc.CallOption) (*ServiceEndpointResponse, error) - // List sandbox HTTP service endpoints. - ListServices(ctx context.Context, in *ListServicesRequest, opts ...grpc.CallOption) (*ListServicesResponse, error) - // Delete one sandbox HTTP service endpoint. - DeleteService(ctx context.Context, in *DeleteServiceRequest, opts ...grpc.CallOption) (*DeleteServiceResponse, error) - // Revoke a previously issued SSH session. - RevokeSshSession(ctx context.Context, in *RevokeSshSessionRequest, opts ...grpc.CallOption) (*RevokeSshSessionResponse, error) - // Execute a command in a ready sandbox and stream output. - ExecSandbox(ctx context.Context, in *ExecSandboxRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ExecSandboxEvent], error) - // Forward one CLI-side TCP connection to a loopback TCP target in a sandbox. - ForwardTcp(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[TcpForwardFrame, TcpForwardFrame], error) - // Execute an interactive command with bidirectional stdin/stdout streaming. - // The first client message MUST carry an ExecSandboxInput with the start - // variant. Subsequent messages carry stdin bytes or window resize events. - ExecSandboxInteractive(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[ExecSandboxInput, ExecSandboxEvent], error) - // Create a provider. - CreateProvider(ctx context.Context, in *CreateProviderRequest, opts ...grpc.CallOption) (*ProviderResponse, error) - // Fetch a provider by name. - GetProvider(ctx context.Context, in *GetProviderRequest, opts ...grpc.CallOption) (*ProviderResponse, error) - // List providers. - ListProviders(ctx context.Context, in *ListProvidersRequest, opts ...grpc.CallOption) (*ListProvidersResponse, error) - // List available provider type profiles. - ListProviderProfiles(ctx context.Context, in *ListProviderProfilesRequest, opts ...grpc.CallOption) (*ListProviderProfilesResponse, error) - // Fetch one provider type profile by id. - GetProviderProfile(ctx context.Context, in *GetProviderProfileRequest, opts ...grpc.CallOption) (*ProviderProfileResponse, error) - // Import custom provider type profiles. - ImportProviderProfiles(ctx context.Context, in *ImportProviderProfilesRequest, opts ...grpc.CallOption) (*ImportProviderProfilesResponse, error) - // Update an existing custom provider type profile. - UpdateProviderProfiles(ctx context.Context, in *UpdateProviderProfilesRequest, opts ...grpc.CallOption) (*UpdateProviderProfilesResponse, error) - // Validate provider type profiles without registering them. - LintProviderProfiles(ctx context.Context, in *LintProviderProfilesRequest, opts ...grpc.CallOption) (*LintProviderProfilesResponse, error) - // Update an existing provider by name. - UpdateProvider(ctx context.Context, in *UpdateProviderRequest, opts ...grpc.CallOption) (*ProviderResponse, error) - // Fetch refresh status for one provider or provider credential. - GetProviderRefreshStatus(ctx context.Context, in *GetProviderRefreshStatusRequest, opts ...grpc.CallOption) (*GetProviderRefreshStatusResponse, error) - // Configure gateway-owned refresh material for one provider credential. - ConfigureProviderRefresh(ctx context.Context, in *ConfigureProviderRefreshRequest, opts ...grpc.CallOption) (*ConfigureProviderRefreshResponse, error) - // Record a gateway-owned refresh request for one provider credential. - RotateProviderCredential(ctx context.Context, in *RotateProviderCredentialRequest, opts ...grpc.CallOption) (*RotateProviderCredentialResponse, error) - // Delete gateway-owned refresh configuration for one provider credential. - DeleteProviderRefresh(ctx context.Context, in *DeleteProviderRefreshRequest, opts ...grpc.CallOption) (*DeleteProviderRefreshResponse, error) - // Delete a provider by name. - DeleteProvider(ctx context.Context, in *DeleteProviderRequest, opts ...grpc.CallOption) (*DeleteProviderResponse, error) - // Delete a custom provider type profile by id. - DeleteProviderProfile(ctx context.Context, in *DeleteProviderProfileRequest, opts ...grpc.CallOption) (*DeleteProviderProfileResponse, error) - // Get sandbox settings by id (called by sandbox entrypoint and poll loop). - GetSandboxConfig(ctx context.Context, in *sandboxv1.GetSandboxConfigRequest, opts ...grpc.CallOption) (*sandboxv1.GetSandboxConfigResponse, error) - // Get gateway-global settings (read-only feature flags; any authenticated - // user may read these so the CLI and TUI can discover capabilities like - // providers_v2_enabled without requiring Platform Admin). - // - // Scope-only (no role): scopes are granted by the IdP at token issuance, - // orthogonal to workspace membership. Deployments that enable scope - // enforcement configure the IdP to grant config:read (or openshell:all) - // to all sandbox users, so this does not block least-privilege flows. - GetGatewayConfig(ctx context.Context, in *sandboxv1.GetGatewayConfigRequest, opts ...grpc.CallOption) (*sandboxv1.GetGatewayConfigResponse, error) - // Update settings or policy at sandbox or global scope. - UpdateConfig(ctx context.Context, in *UpdateConfigRequest, opts ...grpc.CallOption) (*UpdateConfigResponse, error) - // Get the load status of a specific policy version. - GetSandboxPolicyStatus(ctx context.Context, in *GetSandboxPolicyStatusRequest, opts ...grpc.CallOption) (*GetSandboxPolicyStatusResponse, error) - // List policy history for a sandbox. - ListSandboxPolicies(ctx context.Context, in *ListSandboxPoliciesRequest, opts ...grpc.CallOption) (*ListSandboxPoliciesResponse, error) - // Report policy load result (called by sandbox after reload attempt). - ReportPolicyStatus(ctx context.Context, in *ReportPolicyStatusRequest, opts ...grpc.CallOption) (*ReportPolicyStatusResponse, error) - // Get provider environment for a sandbox (called by sandbox supervisor at startup). - GetSandboxProviderEnvironment(ctx context.Context, in *GetSandboxProviderEnvironmentRequest, opts ...grpc.CallOption) (*GetSandboxProviderEnvironmentResponse, error) - // Fetch recent sandbox logs (one-shot). - GetSandboxLogs(ctx context.Context, in *GetSandboxLogsRequest, opts ...grpc.CallOption) (*GetSandboxLogsResponse, error) - // Push sandbox supervisor logs to the server (client-streaming). - PushSandboxLogs(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStreamingClient[PushSandboxLogsRequest, PushSandboxLogsResponse], error) - // Persistent supervisor-to-gateway session (bidirectional streaming). - // - // The supervisor opens this stream at startup and keeps it alive for the - // sandbox lifetime. The gateway uses it to coordinate relay channels for - // SSH connect, ExecSandbox, and targetable sandbox services. Raw service - // bytes flow over RelayStream calls (separate HTTP/2 streams on the same - // connection), not over this stream. - ConnectSupervisor(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[SupervisorMessage, GatewayMessage], error) - // Raw byte relay between supervisor and gateway. - // - // The supervisor initiates this call after receiving a RelayOpen message - // on its ConnectSupervisor stream. The first RelayFrame carries a - // RelayInit with the channel_id to associate the new HTTP/2 stream with - // the pending relay slot on the gateway. Subsequent frames carry raw bytes in either - // direction between the gateway-side waiter (ForwardTcp / exec handler) - // and the supervisor-side target bridge. - // - // This rides the same TCP+TLS+HTTP/2 connection as ConnectSupervisor — - // no new TLS handshake, no reverse HTTP CONNECT. - RelayStream(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[RelayFrame, RelayFrame], error) - // Watch a sandbox and stream updates. - // - // This stream can include: - // - Sandbox status snapshots (phase/status) - // - OpenShell server process logs correlated by sandbox_id - // - Platform events correlated to the sandbox - WatchSandbox(ctx context.Context, in *WatchSandboxRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[SandboxStreamEvent], error) - // Submit denial analysis results from sandbox (summaries + proposed chunks). - SubmitPolicyAnalysis(ctx context.Context, in *SubmitPolicyAnalysisRequest, opts ...grpc.CallOption) (*SubmitPolicyAnalysisResponse, error) - // Get draft policy recommendations for a sandbox. - GetDraftPolicy(ctx context.Context, in *GetDraftPolicyRequest, opts ...grpc.CallOption) (*GetDraftPolicyResponse, error) - // Approve a single draft policy chunk (merges into active policy). - ApproveDraftChunk(ctx context.Context, in *ApproveDraftChunkRequest, opts ...grpc.CallOption) (*ApproveDraftChunkResponse, error) - // Reject a single draft policy chunk. - RejectDraftChunk(ctx context.Context, in *RejectDraftChunkRequest, opts ...grpc.CallOption) (*RejectDraftChunkResponse, error) - // Approve all pending draft chunks (skips security-flagged unless forced). - ApproveAllDraftChunks(ctx context.Context, in *ApproveAllDraftChunksRequest, opts ...grpc.CallOption) (*ApproveAllDraftChunksResponse, error) - // Edit a pending draft chunk in-place (e.g. narrow allowed_ips). - EditDraftChunk(ctx context.Context, in *EditDraftChunkRequest, opts ...grpc.CallOption) (*EditDraftChunkResponse, error) - // Reverse an approval (remove merged rule from active policy). - UndoDraftChunk(ctx context.Context, in *UndoDraftChunkRequest, opts ...grpc.CallOption) (*UndoDraftChunkResponse, error) - // Clear all pending draft chunks for a sandbox. - ClearDraftChunks(ctx context.Context, in *ClearDraftChunksRequest, opts ...grpc.CallOption) (*ClearDraftChunksResponse, error) - // Get decision history for a sandbox's draft policy. - GetDraftHistory(ctx context.Context, in *GetDraftHistoryRequest, opts ...grpc.CallOption) (*GetDraftHistoryResponse, error) - // Exchange a sandbox-bootstrap credential (e.g. a Kubernetes projected - // ServiceAccount token) for a gateway-minted JWT bound to the calling - // sandbox's UUID. Used by the Kubernetes driver path; singleplayer - // drivers receive the gateway JWT directly from the create-sandbox flow - // and never call this RPC. - IssueSandboxToken(ctx context.Context, in *IssueSandboxTokenRequest, opts ...grpc.CallOption) (*IssueSandboxTokenResponse, error) - // Renew the calling sandbox's gateway JWT. Older tokens remain valid - // until their own expiry; deployments should keep token TTLs short to - // bound replay exposure. The supervisor calls this from a background - // task at ~80% of the token's lifetime; the new token is cached in - // memory only — the on-disk bootstrap file is intentionally not - // rewritten. - RefreshSandboxToken(ctx context.Context, in *RefreshSandboxTokenRequest, opts ...grpc.CallOption) (*RefreshSandboxTokenResponse, error) - // Create a workspace. - CreateWorkspace(ctx context.Context, in *CreateWorkspaceRequest, opts ...grpc.CallOption) (*CreateWorkspaceResponse, error) - // Fetch a workspace by name. - GetWorkspace(ctx context.Context, in *GetWorkspaceRequest, opts ...grpc.CallOption) (*GetWorkspaceResponse, error) - // List workspaces. - ListWorkspaces(ctx context.Context, in *ListWorkspacesRequest, opts ...grpc.CallOption) (*ListWorkspacesResponse, error) - // Delete a workspace by name. - DeleteWorkspace(ctx context.Context, in *DeleteWorkspaceRequest, opts ...grpc.CallOption) (*DeleteWorkspaceResponse, error) - // Add a member to a workspace. - AddWorkspaceMember(ctx context.Context, in *AddWorkspaceMemberRequest, opts ...grpc.CallOption) (*AddWorkspaceMemberResponse, error) - // Remove a member from a workspace. - RemoveWorkspaceMember(ctx context.Context, in *RemoveWorkspaceMemberRequest, opts ...grpc.CallOption) (*RemoveWorkspaceMemberResponse, error) - // List members of a workspace. - ListWorkspaceMembers(ctx context.Context, in *ListWorkspaceMembersRequest, opts ...grpc.CallOption) (*ListWorkspaceMembersResponse, error) -} - -type openShellClient struct { - cc grpc.ClientConnInterface -} - -func NewOpenShellClient(cc grpc.ClientConnInterface) OpenShellClient { - return &openShellClient{cc} -} - -func (c *openShellClient) Health(ctx context.Context, in *HealthRequest, opts ...grpc.CallOption) (*HealthResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(HealthResponse) - err := c.cc.Invoke(ctx, OpenShell_Health_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetCurrentUser(ctx context.Context, in *GetCurrentUserRequest, opts ...grpc.CallOption) (*GetCurrentUserResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetCurrentUserResponse) - err := c.cc.Invoke(ctx, OpenShell_GetCurrentUser_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetGatewayInfo(ctx context.Context, in *GetGatewayInfoRequest, opts ...grpc.CallOption) (*GetGatewayInfoResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetGatewayInfoResponse) - err := c.cc.Invoke(ctx, OpenShell_GetGatewayInfo_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) CreateSandbox(ctx context.Context, in *CreateSandboxRequest, opts ...grpc.CallOption) (*SandboxResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(SandboxResponse) - err := c.cc.Invoke(ctx, OpenShell_CreateSandbox_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetSandbox(ctx context.Context, in *GetSandboxRequest, opts ...grpc.CallOption) (*SandboxResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(SandboxResponse) - err := c.cc.Invoke(ctx, OpenShell_GetSandbox_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ListSandboxes(ctx context.Context, in *ListSandboxesRequest, opts ...grpc.CallOption) (*ListSandboxesResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ListSandboxesResponse) - err := c.cc.Invoke(ctx, OpenShell_ListSandboxes_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ListSandboxProviders(ctx context.Context, in *ListSandboxProvidersRequest, opts ...grpc.CallOption) (*ListSandboxProvidersResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ListSandboxProvidersResponse) - err := c.cc.Invoke(ctx, OpenShell_ListSandboxProviders_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) AttachSandboxProvider(ctx context.Context, in *AttachSandboxProviderRequest, opts ...grpc.CallOption) (*AttachSandboxProviderResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(AttachSandboxProviderResponse) - err := c.cc.Invoke(ctx, OpenShell_AttachSandboxProvider_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) DetachSandboxProvider(ctx context.Context, in *DetachSandboxProviderRequest, opts ...grpc.CallOption) (*DetachSandboxProviderResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(DetachSandboxProviderResponse) - err := c.cc.Invoke(ctx, OpenShell_DetachSandboxProvider_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) DeleteSandbox(ctx context.Context, in *DeleteSandboxRequest, opts ...grpc.CallOption) (*DeleteSandboxResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(DeleteSandboxResponse) - err := c.cc.Invoke(ctx, OpenShell_DeleteSandbox_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) CreateSshSession(ctx context.Context, in *CreateSshSessionRequest, opts ...grpc.CallOption) (*CreateSshSessionResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(CreateSshSessionResponse) - err := c.cc.Invoke(ctx, OpenShell_CreateSshSession_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ExposeService(ctx context.Context, in *ExposeServiceRequest, opts ...grpc.CallOption) (*ServiceEndpointResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ServiceEndpointResponse) - err := c.cc.Invoke(ctx, OpenShell_ExposeService_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetService(ctx context.Context, in *GetServiceRequest, opts ...grpc.CallOption) (*ServiceEndpointResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ServiceEndpointResponse) - err := c.cc.Invoke(ctx, OpenShell_GetService_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ListServices(ctx context.Context, in *ListServicesRequest, opts ...grpc.CallOption) (*ListServicesResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ListServicesResponse) - err := c.cc.Invoke(ctx, OpenShell_ListServices_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) DeleteService(ctx context.Context, in *DeleteServiceRequest, opts ...grpc.CallOption) (*DeleteServiceResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(DeleteServiceResponse) - err := c.cc.Invoke(ctx, OpenShell_DeleteService_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) RevokeSshSession(ctx context.Context, in *RevokeSshSessionRequest, opts ...grpc.CallOption) (*RevokeSshSessionResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(RevokeSshSessionResponse) - err := c.cc.Invoke(ctx, OpenShell_RevokeSshSession_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ExecSandbox(ctx context.Context, in *ExecSandboxRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ExecSandboxEvent], error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - stream, err := c.cc.NewStream(ctx, &OpenShell_ServiceDesc.Streams[0], OpenShell_ExecSandbox_FullMethodName, cOpts...) - if err != nil { - return nil, err - } - x := &grpc.GenericClientStream[ExecSandboxRequest, ExecSandboxEvent]{ClientStream: stream} - if err := x.ClientStream.SendMsg(in); err != nil { - return nil, err - } - if err := x.ClientStream.CloseSend(); err != nil { - return nil, err - } - return x, nil -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_ExecSandboxClient = grpc.ServerStreamingClient[ExecSandboxEvent] - -func (c *openShellClient) ForwardTcp(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[TcpForwardFrame, TcpForwardFrame], error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - stream, err := c.cc.NewStream(ctx, &OpenShell_ServiceDesc.Streams[1], OpenShell_ForwardTcp_FullMethodName, cOpts...) - if err != nil { - return nil, err - } - x := &grpc.GenericClientStream[TcpForwardFrame, TcpForwardFrame]{ClientStream: stream} - return x, nil -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_ForwardTcpClient = grpc.BidiStreamingClient[TcpForwardFrame, TcpForwardFrame] - -func (c *openShellClient) ExecSandboxInteractive(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[ExecSandboxInput, ExecSandboxEvent], error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - stream, err := c.cc.NewStream(ctx, &OpenShell_ServiceDesc.Streams[2], OpenShell_ExecSandboxInteractive_FullMethodName, cOpts...) - if err != nil { - return nil, err - } - x := &grpc.GenericClientStream[ExecSandboxInput, ExecSandboxEvent]{ClientStream: stream} - return x, nil -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_ExecSandboxInteractiveClient = grpc.BidiStreamingClient[ExecSandboxInput, ExecSandboxEvent] - -func (c *openShellClient) CreateProvider(ctx context.Context, in *CreateProviderRequest, opts ...grpc.CallOption) (*ProviderResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ProviderResponse) - err := c.cc.Invoke(ctx, OpenShell_CreateProvider_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetProvider(ctx context.Context, in *GetProviderRequest, opts ...grpc.CallOption) (*ProviderResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ProviderResponse) - err := c.cc.Invoke(ctx, OpenShell_GetProvider_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ListProviders(ctx context.Context, in *ListProvidersRequest, opts ...grpc.CallOption) (*ListProvidersResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ListProvidersResponse) - err := c.cc.Invoke(ctx, OpenShell_ListProviders_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ListProviderProfiles(ctx context.Context, in *ListProviderProfilesRequest, opts ...grpc.CallOption) (*ListProviderProfilesResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ListProviderProfilesResponse) - err := c.cc.Invoke(ctx, OpenShell_ListProviderProfiles_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetProviderProfile(ctx context.Context, in *GetProviderProfileRequest, opts ...grpc.CallOption) (*ProviderProfileResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ProviderProfileResponse) - err := c.cc.Invoke(ctx, OpenShell_GetProviderProfile_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ImportProviderProfiles(ctx context.Context, in *ImportProviderProfilesRequest, opts ...grpc.CallOption) (*ImportProviderProfilesResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ImportProviderProfilesResponse) - err := c.cc.Invoke(ctx, OpenShell_ImportProviderProfiles_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) UpdateProviderProfiles(ctx context.Context, in *UpdateProviderProfilesRequest, opts ...grpc.CallOption) (*UpdateProviderProfilesResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(UpdateProviderProfilesResponse) - err := c.cc.Invoke(ctx, OpenShell_UpdateProviderProfiles_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) LintProviderProfiles(ctx context.Context, in *LintProviderProfilesRequest, opts ...grpc.CallOption) (*LintProviderProfilesResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(LintProviderProfilesResponse) - err := c.cc.Invoke(ctx, OpenShell_LintProviderProfiles_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) UpdateProvider(ctx context.Context, in *UpdateProviderRequest, opts ...grpc.CallOption) (*ProviderResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ProviderResponse) - err := c.cc.Invoke(ctx, OpenShell_UpdateProvider_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetProviderRefreshStatus(ctx context.Context, in *GetProviderRefreshStatusRequest, opts ...grpc.CallOption) (*GetProviderRefreshStatusResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetProviderRefreshStatusResponse) - err := c.cc.Invoke(ctx, OpenShell_GetProviderRefreshStatus_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ConfigureProviderRefresh(ctx context.Context, in *ConfigureProviderRefreshRequest, opts ...grpc.CallOption) (*ConfigureProviderRefreshResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ConfigureProviderRefreshResponse) - err := c.cc.Invoke(ctx, OpenShell_ConfigureProviderRefresh_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) RotateProviderCredential(ctx context.Context, in *RotateProviderCredentialRequest, opts ...grpc.CallOption) (*RotateProviderCredentialResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(RotateProviderCredentialResponse) - err := c.cc.Invoke(ctx, OpenShell_RotateProviderCredential_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) DeleteProviderRefresh(ctx context.Context, in *DeleteProviderRefreshRequest, opts ...grpc.CallOption) (*DeleteProviderRefreshResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(DeleteProviderRefreshResponse) - err := c.cc.Invoke(ctx, OpenShell_DeleteProviderRefresh_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) DeleteProvider(ctx context.Context, in *DeleteProviderRequest, opts ...grpc.CallOption) (*DeleteProviderResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(DeleteProviderResponse) - err := c.cc.Invoke(ctx, OpenShell_DeleteProvider_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) DeleteProviderProfile(ctx context.Context, in *DeleteProviderProfileRequest, opts ...grpc.CallOption) (*DeleteProviderProfileResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(DeleteProviderProfileResponse) - err := c.cc.Invoke(ctx, OpenShell_DeleteProviderProfile_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetSandboxConfig(ctx context.Context, in *sandboxv1.GetSandboxConfigRequest, opts ...grpc.CallOption) (*sandboxv1.GetSandboxConfigResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(sandboxv1.GetSandboxConfigResponse) - err := c.cc.Invoke(ctx, OpenShell_GetSandboxConfig_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetGatewayConfig(ctx context.Context, in *sandboxv1.GetGatewayConfigRequest, opts ...grpc.CallOption) (*sandboxv1.GetGatewayConfigResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(sandboxv1.GetGatewayConfigResponse) - err := c.cc.Invoke(ctx, OpenShell_GetGatewayConfig_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) UpdateConfig(ctx context.Context, in *UpdateConfigRequest, opts ...grpc.CallOption) (*UpdateConfigResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(UpdateConfigResponse) - err := c.cc.Invoke(ctx, OpenShell_UpdateConfig_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetSandboxPolicyStatus(ctx context.Context, in *GetSandboxPolicyStatusRequest, opts ...grpc.CallOption) (*GetSandboxPolicyStatusResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetSandboxPolicyStatusResponse) - err := c.cc.Invoke(ctx, OpenShell_GetSandboxPolicyStatus_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ListSandboxPolicies(ctx context.Context, in *ListSandboxPoliciesRequest, opts ...grpc.CallOption) (*ListSandboxPoliciesResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ListSandboxPoliciesResponse) - err := c.cc.Invoke(ctx, OpenShell_ListSandboxPolicies_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ReportPolicyStatus(ctx context.Context, in *ReportPolicyStatusRequest, opts ...grpc.CallOption) (*ReportPolicyStatusResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ReportPolicyStatusResponse) - err := c.cc.Invoke(ctx, OpenShell_ReportPolicyStatus_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetSandboxProviderEnvironment(ctx context.Context, in *GetSandboxProviderEnvironmentRequest, opts ...grpc.CallOption) (*GetSandboxProviderEnvironmentResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetSandboxProviderEnvironmentResponse) - err := c.cc.Invoke(ctx, OpenShell_GetSandboxProviderEnvironment_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetSandboxLogs(ctx context.Context, in *GetSandboxLogsRequest, opts ...grpc.CallOption) (*GetSandboxLogsResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetSandboxLogsResponse) - err := c.cc.Invoke(ctx, OpenShell_GetSandboxLogs_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) PushSandboxLogs(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStreamingClient[PushSandboxLogsRequest, PushSandboxLogsResponse], error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - stream, err := c.cc.NewStream(ctx, &OpenShell_ServiceDesc.Streams[3], OpenShell_PushSandboxLogs_FullMethodName, cOpts...) - if err != nil { - return nil, err - } - x := &grpc.GenericClientStream[PushSandboxLogsRequest, PushSandboxLogsResponse]{ClientStream: stream} - return x, nil -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_PushSandboxLogsClient = grpc.ClientStreamingClient[PushSandboxLogsRequest, PushSandboxLogsResponse] - -func (c *openShellClient) ConnectSupervisor(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[SupervisorMessage, GatewayMessage], error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - stream, err := c.cc.NewStream(ctx, &OpenShell_ServiceDesc.Streams[4], OpenShell_ConnectSupervisor_FullMethodName, cOpts...) - if err != nil { - return nil, err - } - x := &grpc.GenericClientStream[SupervisorMessage, GatewayMessage]{ClientStream: stream} - return x, nil -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_ConnectSupervisorClient = grpc.BidiStreamingClient[SupervisorMessage, GatewayMessage] - -func (c *openShellClient) RelayStream(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[RelayFrame, RelayFrame], error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - stream, err := c.cc.NewStream(ctx, &OpenShell_ServiceDesc.Streams[5], OpenShell_RelayStream_FullMethodName, cOpts...) - if err != nil { - return nil, err - } - x := &grpc.GenericClientStream[RelayFrame, RelayFrame]{ClientStream: stream} - return x, nil -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_RelayStreamClient = grpc.BidiStreamingClient[RelayFrame, RelayFrame] - -func (c *openShellClient) WatchSandbox(ctx context.Context, in *WatchSandboxRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[SandboxStreamEvent], error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - stream, err := c.cc.NewStream(ctx, &OpenShell_ServiceDesc.Streams[6], OpenShell_WatchSandbox_FullMethodName, cOpts...) - if err != nil { - return nil, err - } - x := &grpc.GenericClientStream[WatchSandboxRequest, SandboxStreamEvent]{ClientStream: stream} - if err := x.ClientStream.SendMsg(in); err != nil { - return nil, err - } - if err := x.ClientStream.CloseSend(); err != nil { - return nil, err - } - return x, nil -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_WatchSandboxClient = grpc.ServerStreamingClient[SandboxStreamEvent] - -func (c *openShellClient) SubmitPolicyAnalysis(ctx context.Context, in *SubmitPolicyAnalysisRequest, opts ...grpc.CallOption) (*SubmitPolicyAnalysisResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(SubmitPolicyAnalysisResponse) - err := c.cc.Invoke(ctx, OpenShell_SubmitPolicyAnalysis_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetDraftPolicy(ctx context.Context, in *GetDraftPolicyRequest, opts ...grpc.CallOption) (*GetDraftPolicyResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetDraftPolicyResponse) - err := c.cc.Invoke(ctx, OpenShell_GetDraftPolicy_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ApproveDraftChunk(ctx context.Context, in *ApproveDraftChunkRequest, opts ...grpc.CallOption) (*ApproveDraftChunkResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ApproveDraftChunkResponse) - err := c.cc.Invoke(ctx, OpenShell_ApproveDraftChunk_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) RejectDraftChunk(ctx context.Context, in *RejectDraftChunkRequest, opts ...grpc.CallOption) (*RejectDraftChunkResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(RejectDraftChunkResponse) - err := c.cc.Invoke(ctx, OpenShell_RejectDraftChunk_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ApproveAllDraftChunks(ctx context.Context, in *ApproveAllDraftChunksRequest, opts ...grpc.CallOption) (*ApproveAllDraftChunksResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ApproveAllDraftChunksResponse) - err := c.cc.Invoke(ctx, OpenShell_ApproveAllDraftChunks_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) EditDraftChunk(ctx context.Context, in *EditDraftChunkRequest, opts ...grpc.CallOption) (*EditDraftChunkResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(EditDraftChunkResponse) - err := c.cc.Invoke(ctx, OpenShell_EditDraftChunk_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) UndoDraftChunk(ctx context.Context, in *UndoDraftChunkRequest, opts ...grpc.CallOption) (*UndoDraftChunkResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(UndoDraftChunkResponse) - err := c.cc.Invoke(ctx, OpenShell_UndoDraftChunk_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ClearDraftChunks(ctx context.Context, in *ClearDraftChunksRequest, opts ...grpc.CallOption) (*ClearDraftChunksResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ClearDraftChunksResponse) - err := c.cc.Invoke(ctx, OpenShell_ClearDraftChunks_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetDraftHistory(ctx context.Context, in *GetDraftHistoryRequest, opts ...grpc.CallOption) (*GetDraftHistoryResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetDraftHistoryResponse) - err := c.cc.Invoke(ctx, OpenShell_GetDraftHistory_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) IssueSandboxToken(ctx context.Context, in *IssueSandboxTokenRequest, opts ...grpc.CallOption) (*IssueSandboxTokenResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(IssueSandboxTokenResponse) - err := c.cc.Invoke(ctx, OpenShell_IssueSandboxToken_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) RefreshSandboxToken(ctx context.Context, in *RefreshSandboxTokenRequest, opts ...grpc.CallOption) (*RefreshSandboxTokenResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(RefreshSandboxTokenResponse) - err := c.cc.Invoke(ctx, OpenShell_RefreshSandboxToken_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) CreateWorkspace(ctx context.Context, in *CreateWorkspaceRequest, opts ...grpc.CallOption) (*CreateWorkspaceResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(CreateWorkspaceResponse) - err := c.cc.Invoke(ctx, OpenShell_CreateWorkspace_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) GetWorkspace(ctx context.Context, in *GetWorkspaceRequest, opts ...grpc.CallOption) (*GetWorkspaceResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetWorkspaceResponse) - err := c.cc.Invoke(ctx, OpenShell_GetWorkspace_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ListWorkspaces(ctx context.Context, in *ListWorkspacesRequest, opts ...grpc.CallOption) (*ListWorkspacesResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ListWorkspacesResponse) - err := c.cc.Invoke(ctx, OpenShell_ListWorkspaces_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) DeleteWorkspace(ctx context.Context, in *DeleteWorkspaceRequest, opts ...grpc.CallOption) (*DeleteWorkspaceResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(DeleteWorkspaceResponse) - err := c.cc.Invoke(ctx, OpenShell_DeleteWorkspace_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) AddWorkspaceMember(ctx context.Context, in *AddWorkspaceMemberRequest, opts ...grpc.CallOption) (*AddWorkspaceMemberResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(AddWorkspaceMemberResponse) - err := c.cc.Invoke(ctx, OpenShell_AddWorkspaceMember_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) RemoveWorkspaceMember(ctx context.Context, in *RemoveWorkspaceMemberRequest, opts ...grpc.CallOption) (*RemoveWorkspaceMemberResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(RemoveWorkspaceMemberResponse) - err := c.cc.Invoke(ctx, OpenShell_RemoveWorkspaceMember_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -func (c *openShellClient) ListWorkspaceMembers(ctx context.Context, in *ListWorkspaceMembersRequest, opts ...grpc.CallOption) (*ListWorkspaceMembersResponse, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(ListWorkspaceMembersResponse) - err := c.cc.Invoke(ctx, OpenShell_ListWorkspaceMembers_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -// OpenShellServer is the server API for OpenShell service. -// All implementations must embed UnimplementedOpenShellServer -// for forward compatibility. -// -// OpenShell service provides sandbox, provider, and runtime management capabilities. -// -// Conventions: -// - This file owns the public API resource model exposed to OpenShell clients. -// - `Sandbox`, `SandboxSpec`, `SandboxStatus`, and `SandboxPhase` are gateway-owned -// public types. Internal compute drivers must not import or return them directly. -// - The gateway translates internal compute-driver observations into these public -// resource messages before persisting or returning them to clients. -type OpenShellServer interface { - // Check the health of the service. - Health(context.Context, *HealthRequest) (*HealthResponse, error) - // Return the authenticated caller identity established by the gateway. - GetCurrentUser(context.Context, *GetCurrentUserRequest) (*GetCurrentUserResponse, error) - // Fetch elevated live gateway runtime metadata. - GetGatewayInfo(context.Context, *GetGatewayInfoRequest) (*GetGatewayInfoResponse, error) - // Create a new sandbox. - CreateSandbox(context.Context, *CreateSandboxRequest) (*SandboxResponse, error) - // Fetch a sandbox by name. - GetSandbox(context.Context, *GetSandboxRequest) (*SandboxResponse, error) - // List sandboxes. - ListSandboxes(context.Context, *ListSandboxesRequest) (*ListSandboxesResponse, error) - // List provider records attached to a sandbox. - ListSandboxProviders(context.Context, *ListSandboxProvidersRequest) (*ListSandboxProvidersResponse, error) - // Attach a provider record to an existing sandbox. - AttachSandboxProvider(context.Context, *AttachSandboxProviderRequest) (*AttachSandboxProviderResponse, error) - // Detach a provider record from an existing sandbox. - DetachSandboxProvider(context.Context, *DetachSandboxProviderRequest) (*DetachSandboxProviderResponse, error) - // Delete a sandbox by name. - DeleteSandbox(context.Context, *DeleteSandboxRequest) (*DeleteSandboxResponse, error) - // Create a short-lived SSH session for a sandbox. - CreateSshSession(context.Context, *CreateSshSessionRequest) (*CreateSshSessionResponse, error) - // Create or update a sandbox HTTP service endpoint for local routing. - ExposeService(context.Context, *ExposeServiceRequest) (*ServiceEndpointResponse, error) - // Fetch one sandbox HTTP service endpoint. - GetService(context.Context, *GetServiceRequest) (*ServiceEndpointResponse, error) - // List sandbox HTTP service endpoints. - ListServices(context.Context, *ListServicesRequest) (*ListServicesResponse, error) - // Delete one sandbox HTTP service endpoint. - DeleteService(context.Context, *DeleteServiceRequest) (*DeleteServiceResponse, error) - // Revoke a previously issued SSH session. - RevokeSshSession(context.Context, *RevokeSshSessionRequest) (*RevokeSshSessionResponse, error) - // Execute a command in a ready sandbox and stream output. - ExecSandbox(*ExecSandboxRequest, grpc.ServerStreamingServer[ExecSandboxEvent]) error - // Forward one CLI-side TCP connection to a loopback TCP target in a sandbox. - ForwardTcp(grpc.BidiStreamingServer[TcpForwardFrame, TcpForwardFrame]) error - // Execute an interactive command with bidirectional stdin/stdout streaming. - // The first client message MUST carry an ExecSandboxInput with the start - // variant. Subsequent messages carry stdin bytes or window resize events. - ExecSandboxInteractive(grpc.BidiStreamingServer[ExecSandboxInput, ExecSandboxEvent]) error - // Create a provider. - CreateProvider(context.Context, *CreateProviderRequest) (*ProviderResponse, error) - // Fetch a provider by name. - GetProvider(context.Context, *GetProviderRequest) (*ProviderResponse, error) - // List providers. - ListProviders(context.Context, *ListProvidersRequest) (*ListProvidersResponse, error) - // List available provider type profiles. - ListProviderProfiles(context.Context, *ListProviderProfilesRequest) (*ListProviderProfilesResponse, error) - // Fetch one provider type profile by id. - GetProviderProfile(context.Context, *GetProviderProfileRequest) (*ProviderProfileResponse, error) - // Import custom provider type profiles. - ImportProviderProfiles(context.Context, *ImportProviderProfilesRequest) (*ImportProviderProfilesResponse, error) - // Update an existing custom provider type profile. - UpdateProviderProfiles(context.Context, *UpdateProviderProfilesRequest) (*UpdateProviderProfilesResponse, error) - // Validate provider type profiles without registering them. - LintProviderProfiles(context.Context, *LintProviderProfilesRequest) (*LintProviderProfilesResponse, error) - // Update an existing provider by name. - UpdateProvider(context.Context, *UpdateProviderRequest) (*ProviderResponse, error) - // Fetch refresh status for one provider or provider credential. - GetProviderRefreshStatus(context.Context, *GetProviderRefreshStatusRequest) (*GetProviderRefreshStatusResponse, error) - // Configure gateway-owned refresh material for one provider credential. - ConfigureProviderRefresh(context.Context, *ConfigureProviderRefreshRequest) (*ConfigureProviderRefreshResponse, error) - // Record a gateway-owned refresh request for one provider credential. - RotateProviderCredential(context.Context, *RotateProviderCredentialRequest) (*RotateProviderCredentialResponse, error) - // Delete gateway-owned refresh configuration for one provider credential. - DeleteProviderRefresh(context.Context, *DeleteProviderRefreshRequest) (*DeleteProviderRefreshResponse, error) - // Delete a provider by name. - DeleteProvider(context.Context, *DeleteProviderRequest) (*DeleteProviderResponse, error) - // Delete a custom provider type profile by id. - DeleteProviderProfile(context.Context, *DeleteProviderProfileRequest) (*DeleteProviderProfileResponse, error) - // Get sandbox settings by id (called by sandbox entrypoint and poll loop). - GetSandboxConfig(context.Context, *sandboxv1.GetSandboxConfigRequest) (*sandboxv1.GetSandboxConfigResponse, error) - // Get gateway-global settings (read-only feature flags; any authenticated - // user may read these so the CLI and TUI can discover capabilities like - // providers_v2_enabled without requiring Platform Admin). - // - // Scope-only (no role): scopes are granted by the IdP at token issuance, - // orthogonal to workspace membership. Deployments that enable scope - // enforcement configure the IdP to grant config:read (or openshell:all) - // to all sandbox users, so this does not block least-privilege flows. - GetGatewayConfig(context.Context, *sandboxv1.GetGatewayConfigRequest) (*sandboxv1.GetGatewayConfigResponse, error) - // Update settings or policy at sandbox or global scope. - UpdateConfig(context.Context, *UpdateConfigRequest) (*UpdateConfigResponse, error) - // Get the load status of a specific policy version. - GetSandboxPolicyStatus(context.Context, *GetSandboxPolicyStatusRequest) (*GetSandboxPolicyStatusResponse, error) - // List policy history for a sandbox. - ListSandboxPolicies(context.Context, *ListSandboxPoliciesRequest) (*ListSandboxPoliciesResponse, error) - // Report policy load result (called by sandbox after reload attempt). - ReportPolicyStatus(context.Context, *ReportPolicyStatusRequest) (*ReportPolicyStatusResponse, error) - // Get provider environment for a sandbox (called by sandbox supervisor at startup). - GetSandboxProviderEnvironment(context.Context, *GetSandboxProviderEnvironmentRequest) (*GetSandboxProviderEnvironmentResponse, error) - // Fetch recent sandbox logs (one-shot). - GetSandboxLogs(context.Context, *GetSandboxLogsRequest) (*GetSandboxLogsResponse, error) - // Push sandbox supervisor logs to the server (client-streaming). - PushSandboxLogs(grpc.ClientStreamingServer[PushSandboxLogsRequest, PushSandboxLogsResponse]) error - // Persistent supervisor-to-gateway session (bidirectional streaming). - // - // The supervisor opens this stream at startup and keeps it alive for the - // sandbox lifetime. The gateway uses it to coordinate relay channels for - // SSH connect, ExecSandbox, and targetable sandbox services. Raw service - // bytes flow over RelayStream calls (separate HTTP/2 streams on the same - // connection), not over this stream. - ConnectSupervisor(grpc.BidiStreamingServer[SupervisorMessage, GatewayMessage]) error - // Raw byte relay between supervisor and gateway. - // - // The supervisor initiates this call after receiving a RelayOpen message - // on its ConnectSupervisor stream. The first RelayFrame carries a - // RelayInit with the channel_id to associate the new HTTP/2 stream with - // the pending relay slot on the gateway. Subsequent frames carry raw bytes in either - // direction between the gateway-side waiter (ForwardTcp / exec handler) - // and the supervisor-side target bridge. - // - // This rides the same TCP+TLS+HTTP/2 connection as ConnectSupervisor — - // no new TLS handshake, no reverse HTTP CONNECT. - RelayStream(grpc.BidiStreamingServer[RelayFrame, RelayFrame]) error - // Watch a sandbox and stream updates. - // - // This stream can include: - // - Sandbox status snapshots (phase/status) - // - OpenShell server process logs correlated by sandbox_id - // - Platform events correlated to the sandbox - WatchSandbox(*WatchSandboxRequest, grpc.ServerStreamingServer[SandboxStreamEvent]) error - // Submit denial analysis results from sandbox (summaries + proposed chunks). - SubmitPolicyAnalysis(context.Context, *SubmitPolicyAnalysisRequest) (*SubmitPolicyAnalysisResponse, error) - // Get draft policy recommendations for a sandbox. - GetDraftPolicy(context.Context, *GetDraftPolicyRequest) (*GetDraftPolicyResponse, error) - // Approve a single draft policy chunk (merges into active policy). - ApproveDraftChunk(context.Context, *ApproveDraftChunkRequest) (*ApproveDraftChunkResponse, error) - // Reject a single draft policy chunk. - RejectDraftChunk(context.Context, *RejectDraftChunkRequest) (*RejectDraftChunkResponse, error) - // Approve all pending draft chunks (skips security-flagged unless forced). - ApproveAllDraftChunks(context.Context, *ApproveAllDraftChunksRequest) (*ApproveAllDraftChunksResponse, error) - // Edit a pending draft chunk in-place (e.g. narrow allowed_ips). - EditDraftChunk(context.Context, *EditDraftChunkRequest) (*EditDraftChunkResponse, error) - // Reverse an approval (remove merged rule from active policy). - UndoDraftChunk(context.Context, *UndoDraftChunkRequest) (*UndoDraftChunkResponse, error) - // Clear all pending draft chunks for a sandbox. - ClearDraftChunks(context.Context, *ClearDraftChunksRequest) (*ClearDraftChunksResponse, error) - // Get decision history for a sandbox's draft policy. - GetDraftHistory(context.Context, *GetDraftHistoryRequest) (*GetDraftHistoryResponse, error) - // Exchange a sandbox-bootstrap credential (e.g. a Kubernetes projected - // ServiceAccount token) for a gateway-minted JWT bound to the calling - // sandbox's UUID. Used by the Kubernetes driver path; singleplayer - // drivers receive the gateway JWT directly from the create-sandbox flow - // and never call this RPC. - IssueSandboxToken(context.Context, *IssueSandboxTokenRequest) (*IssueSandboxTokenResponse, error) - // Renew the calling sandbox's gateway JWT. Older tokens remain valid - // until their own expiry; deployments should keep token TTLs short to - // bound replay exposure. The supervisor calls this from a background - // task at ~80% of the token's lifetime; the new token is cached in - // memory only — the on-disk bootstrap file is intentionally not - // rewritten. - RefreshSandboxToken(context.Context, *RefreshSandboxTokenRequest) (*RefreshSandboxTokenResponse, error) - // Create a workspace. - CreateWorkspace(context.Context, *CreateWorkspaceRequest) (*CreateWorkspaceResponse, error) - // Fetch a workspace by name. - GetWorkspace(context.Context, *GetWorkspaceRequest) (*GetWorkspaceResponse, error) - // List workspaces. - ListWorkspaces(context.Context, *ListWorkspacesRequest) (*ListWorkspacesResponse, error) - // Delete a workspace by name. - DeleteWorkspace(context.Context, *DeleteWorkspaceRequest) (*DeleteWorkspaceResponse, error) - // Add a member to a workspace. - AddWorkspaceMember(context.Context, *AddWorkspaceMemberRequest) (*AddWorkspaceMemberResponse, error) - // Remove a member from a workspace. - RemoveWorkspaceMember(context.Context, *RemoveWorkspaceMemberRequest) (*RemoveWorkspaceMemberResponse, error) - // List members of a workspace. - ListWorkspaceMembers(context.Context, *ListWorkspaceMembersRequest) (*ListWorkspaceMembersResponse, error) - mustEmbedUnimplementedOpenShellServer() -} - -// UnimplementedOpenShellServer must be embedded to have -// forward compatible implementations. -// -// NOTE: this should be embedded by value instead of pointer to avoid a nil -// pointer dereference when methods are called. -type UnimplementedOpenShellServer struct{} - -func (UnimplementedOpenShellServer) Health(context.Context, *HealthRequest) (*HealthResponse, error) { - return nil, status.Error(codes.Unimplemented, "method Health not implemented") -} -func (UnimplementedOpenShellServer) GetCurrentUser(context.Context, *GetCurrentUserRequest) (*GetCurrentUserResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetCurrentUser not implemented") -} -func (UnimplementedOpenShellServer) GetGatewayInfo(context.Context, *GetGatewayInfoRequest) (*GetGatewayInfoResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetGatewayInfo not implemented") -} -func (UnimplementedOpenShellServer) CreateSandbox(context.Context, *CreateSandboxRequest) (*SandboxResponse, error) { - return nil, status.Error(codes.Unimplemented, "method CreateSandbox not implemented") -} -func (UnimplementedOpenShellServer) GetSandbox(context.Context, *GetSandboxRequest) (*SandboxResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetSandbox not implemented") -} -func (UnimplementedOpenShellServer) ListSandboxes(context.Context, *ListSandboxesRequest) (*ListSandboxesResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ListSandboxes not implemented") -} -func (UnimplementedOpenShellServer) ListSandboxProviders(context.Context, *ListSandboxProvidersRequest) (*ListSandboxProvidersResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ListSandboxProviders not implemented") -} -func (UnimplementedOpenShellServer) AttachSandboxProvider(context.Context, *AttachSandboxProviderRequest) (*AttachSandboxProviderResponse, error) { - return nil, status.Error(codes.Unimplemented, "method AttachSandboxProvider not implemented") -} -func (UnimplementedOpenShellServer) DetachSandboxProvider(context.Context, *DetachSandboxProviderRequest) (*DetachSandboxProviderResponse, error) { - return nil, status.Error(codes.Unimplemented, "method DetachSandboxProvider not implemented") -} -func (UnimplementedOpenShellServer) DeleteSandbox(context.Context, *DeleteSandboxRequest) (*DeleteSandboxResponse, error) { - return nil, status.Error(codes.Unimplemented, "method DeleteSandbox not implemented") -} -func (UnimplementedOpenShellServer) CreateSshSession(context.Context, *CreateSshSessionRequest) (*CreateSshSessionResponse, error) { - return nil, status.Error(codes.Unimplemented, "method CreateSshSession not implemented") -} -func (UnimplementedOpenShellServer) ExposeService(context.Context, *ExposeServiceRequest) (*ServiceEndpointResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ExposeService not implemented") -} -func (UnimplementedOpenShellServer) GetService(context.Context, *GetServiceRequest) (*ServiceEndpointResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetService not implemented") -} -func (UnimplementedOpenShellServer) ListServices(context.Context, *ListServicesRequest) (*ListServicesResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ListServices not implemented") -} -func (UnimplementedOpenShellServer) DeleteService(context.Context, *DeleteServiceRequest) (*DeleteServiceResponse, error) { - return nil, status.Error(codes.Unimplemented, "method DeleteService not implemented") -} -func (UnimplementedOpenShellServer) RevokeSshSession(context.Context, *RevokeSshSessionRequest) (*RevokeSshSessionResponse, error) { - return nil, status.Error(codes.Unimplemented, "method RevokeSshSession not implemented") -} -func (UnimplementedOpenShellServer) ExecSandbox(*ExecSandboxRequest, grpc.ServerStreamingServer[ExecSandboxEvent]) error { - return status.Error(codes.Unimplemented, "method ExecSandbox not implemented") -} -func (UnimplementedOpenShellServer) ForwardTcp(grpc.BidiStreamingServer[TcpForwardFrame, TcpForwardFrame]) error { - return status.Error(codes.Unimplemented, "method ForwardTcp not implemented") -} -func (UnimplementedOpenShellServer) ExecSandboxInteractive(grpc.BidiStreamingServer[ExecSandboxInput, ExecSandboxEvent]) error { - return status.Error(codes.Unimplemented, "method ExecSandboxInteractive not implemented") -} -func (UnimplementedOpenShellServer) CreateProvider(context.Context, *CreateProviderRequest) (*ProviderResponse, error) { - return nil, status.Error(codes.Unimplemented, "method CreateProvider not implemented") -} -func (UnimplementedOpenShellServer) GetProvider(context.Context, *GetProviderRequest) (*ProviderResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetProvider not implemented") -} -func (UnimplementedOpenShellServer) ListProviders(context.Context, *ListProvidersRequest) (*ListProvidersResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ListProviders not implemented") -} -func (UnimplementedOpenShellServer) ListProviderProfiles(context.Context, *ListProviderProfilesRequest) (*ListProviderProfilesResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ListProviderProfiles not implemented") -} -func (UnimplementedOpenShellServer) GetProviderProfile(context.Context, *GetProviderProfileRequest) (*ProviderProfileResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetProviderProfile not implemented") -} -func (UnimplementedOpenShellServer) ImportProviderProfiles(context.Context, *ImportProviderProfilesRequest) (*ImportProviderProfilesResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ImportProviderProfiles not implemented") -} -func (UnimplementedOpenShellServer) UpdateProviderProfiles(context.Context, *UpdateProviderProfilesRequest) (*UpdateProviderProfilesResponse, error) { - return nil, status.Error(codes.Unimplemented, "method UpdateProviderProfiles not implemented") -} -func (UnimplementedOpenShellServer) LintProviderProfiles(context.Context, *LintProviderProfilesRequest) (*LintProviderProfilesResponse, error) { - return nil, status.Error(codes.Unimplemented, "method LintProviderProfiles not implemented") -} -func (UnimplementedOpenShellServer) UpdateProvider(context.Context, *UpdateProviderRequest) (*ProviderResponse, error) { - return nil, status.Error(codes.Unimplemented, "method UpdateProvider not implemented") -} -func (UnimplementedOpenShellServer) GetProviderRefreshStatus(context.Context, *GetProviderRefreshStatusRequest) (*GetProviderRefreshStatusResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetProviderRefreshStatus not implemented") -} -func (UnimplementedOpenShellServer) ConfigureProviderRefresh(context.Context, *ConfigureProviderRefreshRequest) (*ConfigureProviderRefreshResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ConfigureProviderRefresh not implemented") -} -func (UnimplementedOpenShellServer) RotateProviderCredential(context.Context, *RotateProviderCredentialRequest) (*RotateProviderCredentialResponse, error) { - return nil, status.Error(codes.Unimplemented, "method RotateProviderCredential not implemented") -} -func (UnimplementedOpenShellServer) DeleteProviderRefresh(context.Context, *DeleteProviderRefreshRequest) (*DeleteProviderRefreshResponse, error) { - return nil, status.Error(codes.Unimplemented, "method DeleteProviderRefresh not implemented") -} -func (UnimplementedOpenShellServer) DeleteProvider(context.Context, *DeleteProviderRequest) (*DeleteProviderResponse, error) { - return nil, status.Error(codes.Unimplemented, "method DeleteProvider not implemented") -} -func (UnimplementedOpenShellServer) DeleteProviderProfile(context.Context, *DeleteProviderProfileRequest) (*DeleteProviderProfileResponse, error) { - return nil, status.Error(codes.Unimplemented, "method DeleteProviderProfile not implemented") -} -func (UnimplementedOpenShellServer) GetSandboxConfig(context.Context, *sandboxv1.GetSandboxConfigRequest) (*sandboxv1.GetSandboxConfigResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetSandboxConfig not implemented") -} -func (UnimplementedOpenShellServer) GetGatewayConfig(context.Context, *sandboxv1.GetGatewayConfigRequest) (*sandboxv1.GetGatewayConfigResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetGatewayConfig not implemented") -} -func (UnimplementedOpenShellServer) UpdateConfig(context.Context, *UpdateConfigRequest) (*UpdateConfigResponse, error) { - return nil, status.Error(codes.Unimplemented, "method UpdateConfig not implemented") -} -func (UnimplementedOpenShellServer) GetSandboxPolicyStatus(context.Context, *GetSandboxPolicyStatusRequest) (*GetSandboxPolicyStatusResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetSandboxPolicyStatus not implemented") -} -func (UnimplementedOpenShellServer) ListSandboxPolicies(context.Context, *ListSandboxPoliciesRequest) (*ListSandboxPoliciesResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ListSandboxPolicies not implemented") -} -func (UnimplementedOpenShellServer) ReportPolicyStatus(context.Context, *ReportPolicyStatusRequest) (*ReportPolicyStatusResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ReportPolicyStatus not implemented") -} -func (UnimplementedOpenShellServer) GetSandboxProviderEnvironment(context.Context, *GetSandboxProviderEnvironmentRequest) (*GetSandboxProviderEnvironmentResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetSandboxProviderEnvironment not implemented") -} -func (UnimplementedOpenShellServer) GetSandboxLogs(context.Context, *GetSandboxLogsRequest) (*GetSandboxLogsResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetSandboxLogs not implemented") -} -func (UnimplementedOpenShellServer) PushSandboxLogs(grpc.ClientStreamingServer[PushSandboxLogsRequest, PushSandboxLogsResponse]) error { - return status.Error(codes.Unimplemented, "method PushSandboxLogs not implemented") -} -func (UnimplementedOpenShellServer) ConnectSupervisor(grpc.BidiStreamingServer[SupervisorMessage, GatewayMessage]) error { - return status.Error(codes.Unimplemented, "method ConnectSupervisor not implemented") -} -func (UnimplementedOpenShellServer) RelayStream(grpc.BidiStreamingServer[RelayFrame, RelayFrame]) error { - return status.Error(codes.Unimplemented, "method RelayStream not implemented") -} -func (UnimplementedOpenShellServer) WatchSandbox(*WatchSandboxRequest, grpc.ServerStreamingServer[SandboxStreamEvent]) error { - return status.Error(codes.Unimplemented, "method WatchSandbox not implemented") -} -func (UnimplementedOpenShellServer) SubmitPolicyAnalysis(context.Context, *SubmitPolicyAnalysisRequest) (*SubmitPolicyAnalysisResponse, error) { - return nil, status.Error(codes.Unimplemented, "method SubmitPolicyAnalysis not implemented") -} -func (UnimplementedOpenShellServer) GetDraftPolicy(context.Context, *GetDraftPolicyRequest) (*GetDraftPolicyResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetDraftPolicy not implemented") -} -func (UnimplementedOpenShellServer) ApproveDraftChunk(context.Context, *ApproveDraftChunkRequest) (*ApproveDraftChunkResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ApproveDraftChunk not implemented") -} -func (UnimplementedOpenShellServer) RejectDraftChunk(context.Context, *RejectDraftChunkRequest) (*RejectDraftChunkResponse, error) { - return nil, status.Error(codes.Unimplemented, "method RejectDraftChunk not implemented") -} -func (UnimplementedOpenShellServer) ApproveAllDraftChunks(context.Context, *ApproveAllDraftChunksRequest) (*ApproveAllDraftChunksResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ApproveAllDraftChunks not implemented") -} -func (UnimplementedOpenShellServer) EditDraftChunk(context.Context, *EditDraftChunkRequest) (*EditDraftChunkResponse, error) { - return nil, status.Error(codes.Unimplemented, "method EditDraftChunk not implemented") -} -func (UnimplementedOpenShellServer) UndoDraftChunk(context.Context, *UndoDraftChunkRequest) (*UndoDraftChunkResponse, error) { - return nil, status.Error(codes.Unimplemented, "method UndoDraftChunk not implemented") -} -func (UnimplementedOpenShellServer) ClearDraftChunks(context.Context, *ClearDraftChunksRequest) (*ClearDraftChunksResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ClearDraftChunks not implemented") -} -func (UnimplementedOpenShellServer) GetDraftHistory(context.Context, *GetDraftHistoryRequest) (*GetDraftHistoryResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetDraftHistory not implemented") -} -func (UnimplementedOpenShellServer) IssueSandboxToken(context.Context, *IssueSandboxTokenRequest) (*IssueSandboxTokenResponse, error) { - return nil, status.Error(codes.Unimplemented, "method IssueSandboxToken not implemented") -} -func (UnimplementedOpenShellServer) RefreshSandboxToken(context.Context, *RefreshSandboxTokenRequest) (*RefreshSandboxTokenResponse, error) { - return nil, status.Error(codes.Unimplemented, "method RefreshSandboxToken not implemented") -} -func (UnimplementedOpenShellServer) CreateWorkspace(context.Context, *CreateWorkspaceRequest) (*CreateWorkspaceResponse, error) { - return nil, status.Error(codes.Unimplemented, "method CreateWorkspace not implemented") -} -func (UnimplementedOpenShellServer) GetWorkspace(context.Context, *GetWorkspaceRequest) (*GetWorkspaceResponse, error) { - return nil, status.Error(codes.Unimplemented, "method GetWorkspace not implemented") -} -func (UnimplementedOpenShellServer) ListWorkspaces(context.Context, *ListWorkspacesRequest) (*ListWorkspacesResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ListWorkspaces not implemented") -} -func (UnimplementedOpenShellServer) DeleteWorkspace(context.Context, *DeleteWorkspaceRequest) (*DeleteWorkspaceResponse, error) { - return nil, status.Error(codes.Unimplemented, "method DeleteWorkspace not implemented") -} -func (UnimplementedOpenShellServer) AddWorkspaceMember(context.Context, *AddWorkspaceMemberRequest) (*AddWorkspaceMemberResponse, error) { - return nil, status.Error(codes.Unimplemented, "method AddWorkspaceMember not implemented") -} -func (UnimplementedOpenShellServer) RemoveWorkspaceMember(context.Context, *RemoveWorkspaceMemberRequest) (*RemoveWorkspaceMemberResponse, error) { - return nil, status.Error(codes.Unimplemented, "method RemoveWorkspaceMember not implemented") -} -func (UnimplementedOpenShellServer) ListWorkspaceMembers(context.Context, *ListWorkspaceMembersRequest) (*ListWorkspaceMembersResponse, error) { - return nil, status.Error(codes.Unimplemented, "method ListWorkspaceMembers not implemented") -} -func (UnimplementedOpenShellServer) mustEmbedUnimplementedOpenShellServer() {} -func (UnimplementedOpenShellServer) testEmbeddedByValue() {} - -// UnsafeOpenShellServer may be embedded to opt out of forward compatibility for this service. -// Use of this interface is not recommended, as added methods to OpenShellServer will -// result in compilation errors. -type UnsafeOpenShellServer interface { - mustEmbedUnimplementedOpenShellServer() -} - -func RegisterOpenShellServer(s grpc.ServiceRegistrar, srv OpenShellServer) { - // If the following call panics, it indicates UnimplementedOpenShellServer was - // embedded by pointer and is nil. This will cause panics if an - // unimplemented method is ever invoked, so we test this at initialization - // time to prevent it from happening at runtime later due to I/O. - if t, ok := srv.(interface{ testEmbeddedByValue() }); ok { - t.testEmbeddedByValue() - } - s.RegisterService(&OpenShell_ServiceDesc, srv) -} - -func _OpenShell_Health_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(HealthRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).Health(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_Health_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).Health(ctx, req.(*HealthRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetCurrentUser_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetCurrentUserRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetCurrentUser(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetCurrentUser_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetCurrentUser(ctx, req.(*GetCurrentUserRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetGatewayInfo_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetGatewayInfoRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetGatewayInfo(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetGatewayInfo_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetGatewayInfo(ctx, req.(*GetGatewayInfoRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_CreateSandbox_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(CreateSandboxRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).CreateSandbox(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_CreateSandbox_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).CreateSandbox(ctx, req.(*CreateSandboxRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetSandbox_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetSandboxRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetSandbox(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetSandbox_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetSandbox(ctx, req.(*GetSandboxRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ListSandboxes_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ListSandboxesRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ListSandboxes(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ListSandboxes_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ListSandboxes(ctx, req.(*ListSandboxesRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ListSandboxProviders_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ListSandboxProvidersRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ListSandboxProviders(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ListSandboxProviders_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ListSandboxProviders(ctx, req.(*ListSandboxProvidersRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_AttachSandboxProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(AttachSandboxProviderRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).AttachSandboxProvider(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_AttachSandboxProvider_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).AttachSandboxProvider(ctx, req.(*AttachSandboxProviderRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_DetachSandboxProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(DetachSandboxProviderRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).DetachSandboxProvider(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_DetachSandboxProvider_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).DetachSandboxProvider(ctx, req.(*DetachSandboxProviderRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_DeleteSandbox_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(DeleteSandboxRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).DeleteSandbox(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_DeleteSandbox_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).DeleteSandbox(ctx, req.(*DeleteSandboxRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_CreateSshSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(CreateSshSessionRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).CreateSshSession(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_CreateSshSession_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).CreateSshSession(ctx, req.(*CreateSshSessionRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ExposeService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ExposeServiceRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ExposeService(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ExposeService_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ExposeService(ctx, req.(*ExposeServiceRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetServiceRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetService(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetService_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetService(ctx, req.(*GetServiceRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ListServices_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ListServicesRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ListServices(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ListServices_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ListServices(ctx, req.(*ListServicesRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_DeleteService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(DeleteServiceRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).DeleteService(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_DeleteService_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).DeleteService(ctx, req.(*DeleteServiceRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_RevokeSshSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(RevokeSshSessionRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).RevokeSshSession(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_RevokeSshSession_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).RevokeSshSession(ctx, req.(*RevokeSshSessionRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ExecSandbox_Handler(srv interface{}, stream grpc.ServerStream) error { - m := new(ExecSandboxRequest) - if err := stream.RecvMsg(m); err != nil { - return err - } - return srv.(OpenShellServer).ExecSandbox(m, &grpc.GenericServerStream[ExecSandboxRequest, ExecSandboxEvent]{ServerStream: stream}) -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_ExecSandboxServer = grpc.ServerStreamingServer[ExecSandboxEvent] - -func _OpenShell_ForwardTcp_Handler(srv interface{}, stream grpc.ServerStream) error { - return srv.(OpenShellServer).ForwardTcp(&grpc.GenericServerStream[TcpForwardFrame, TcpForwardFrame]{ServerStream: stream}) -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_ForwardTcpServer = grpc.BidiStreamingServer[TcpForwardFrame, TcpForwardFrame] - -func _OpenShell_ExecSandboxInteractive_Handler(srv interface{}, stream grpc.ServerStream) error { - return srv.(OpenShellServer).ExecSandboxInteractive(&grpc.GenericServerStream[ExecSandboxInput, ExecSandboxEvent]{ServerStream: stream}) -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_ExecSandboxInteractiveServer = grpc.BidiStreamingServer[ExecSandboxInput, ExecSandboxEvent] - -func _OpenShell_CreateProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(CreateProviderRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).CreateProvider(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_CreateProvider_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).CreateProvider(ctx, req.(*CreateProviderRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetProviderRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetProvider(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetProvider_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetProvider(ctx, req.(*GetProviderRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ListProviders_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ListProvidersRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ListProviders(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ListProviders_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ListProviders(ctx, req.(*ListProvidersRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ListProviderProfiles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ListProviderProfilesRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ListProviderProfiles(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ListProviderProfiles_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ListProviderProfiles(ctx, req.(*ListProviderProfilesRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetProviderProfile_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetProviderProfileRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetProviderProfile(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetProviderProfile_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetProviderProfile(ctx, req.(*GetProviderProfileRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ImportProviderProfiles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ImportProviderProfilesRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ImportProviderProfiles(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ImportProviderProfiles_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ImportProviderProfiles(ctx, req.(*ImportProviderProfilesRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_UpdateProviderProfiles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(UpdateProviderProfilesRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).UpdateProviderProfiles(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_UpdateProviderProfiles_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).UpdateProviderProfiles(ctx, req.(*UpdateProviderProfilesRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_LintProviderProfiles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(LintProviderProfilesRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).LintProviderProfiles(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_LintProviderProfiles_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).LintProviderProfiles(ctx, req.(*LintProviderProfilesRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_UpdateProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(UpdateProviderRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).UpdateProvider(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_UpdateProvider_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).UpdateProvider(ctx, req.(*UpdateProviderRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetProviderRefreshStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetProviderRefreshStatusRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetProviderRefreshStatus(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetProviderRefreshStatus_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetProviderRefreshStatus(ctx, req.(*GetProviderRefreshStatusRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ConfigureProviderRefresh_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ConfigureProviderRefreshRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ConfigureProviderRefresh(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ConfigureProviderRefresh_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ConfigureProviderRefresh(ctx, req.(*ConfigureProviderRefreshRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_RotateProviderCredential_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(RotateProviderCredentialRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).RotateProviderCredential(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_RotateProviderCredential_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).RotateProviderCredential(ctx, req.(*RotateProviderCredentialRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_DeleteProviderRefresh_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(DeleteProviderRefreshRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).DeleteProviderRefresh(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_DeleteProviderRefresh_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).DeleteProviderRefresh(ctx, req.(*DeleteProviderRefreshRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_DeleteProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(DeleteProviderRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).DeleteProvider(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_DeleteProvider_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).DeleteProvider(ctx, req.(*DeleteProviderRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_DeleteProviderProfile_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(DeleteProviderProfileRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).DeleteProviderProfile(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_DeleteProviderProfile_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).DeleteProviderProfile(ctx, req.(*DeleteProviderProfileRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetSandboxConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(sandboxv1.GetSandboxConfigRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetSandboxConfig(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetSandboxConfig_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetSandboxConfig(ctx, req.(*sandboxv1.GetSandboxConfigRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetGatewayConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(sandboxv1.GetGatewayConfigRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetGatewayConfig(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetGatewayConfig_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetGatewayConfig(ctx, req.(*sandboxv1.GetGatewayConfigRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_UpdateConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(UpdateConfigRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).UpdateConfig(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_UpdateConfig_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).UpdateConfig(ctx, req.(*UpdateConfigRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetSandboxPolicyStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetSandboxPolicyStatusRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetSandboxPolicyStatus(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetSandboxPolicyStatus_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetSandboxPolicyStatus(ctx, req.(*GetSandboxPolicyStatusRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ListSandboxPolicies_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ListSandboxPoliciesRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ListSandboxPolicies(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ListSandboxPolicies_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ListSandboxPolicies(ctx, req.(*ListSandboxPoliciesRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ReportPolicyStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ReportPolicyStatusRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ReportPolicyStatus(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ReportPolicyStatus_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ReportPolicyStatus(ctx, req.(*ReportPolicyStatusRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetSandboxProviderEnvironment_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetSandboxProviderEnvironmentRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetSandboxProviderEnvironment(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetSandboxProviderEnvironment_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetSandboxProviderEnvironment(ctx, req.(*GetSandboxProviderEnvironmentRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetSandboxLogs_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetSandboxLogsRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetSandboxLogs(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetSandboxLogs_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetSandboxLogs(ctx, req.(*GetSandboxLogsRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_PushSandboxLogs_Handler(srv interface{}, stream grpc.ServerStream) error { - return srv.(OpenShellServer).PushSandboxLogs(&grpc.GenericServerStream[PushSandboxLogsRequest, PushSandboxLogsResponse]{ServerStream: stream}) -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_PushSandboxLogsServer = grpc.ClientStreamingServer[PushSandboxLogsRequest, PushSandboxLogsResponse] - -func _OpenShell_ConnectSupervisor_Handler(srv interface{}, stream grpc.ServerStream) error { - return srv.(OpenShellServer).ConnectSupervisor(&grpc.GenericServerStream[SupervisorMessage, GatewayMessage]{ServerStream: stream}) -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_ConnectSupervisorServer = grpc.BidiStreamingServer[SupervisorMessage, GatewayMessage] - -func _OpenShell_RelayStream_Handler(srv interface{}, stream grpc.ServerStream) error { - return srv.(OpenShellServer).RelayStream(&grpc.GenericServerStream[RelayFrame, RelayFrame]{ServerStream: stream}) -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_RelayStreamServer = grpc.BidiStreamingServer[RelayFrame, RelayFrame] - -func _OpenShell_WatchSandbox_Handler(srv interface{}, stream grpc.ServerStream) error { - m := new(WatchSandboxRequest) - if err := stream.RecvMsg(m); err != nil { - return err - } - return srv.(OpenShellServer).WatchSandbox(m, &grpc.GenericServerStream[WatchSandboxRequest, SandboxStreamEvent]{ServerStream: stream}) -} - -// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name. -type OpenShell_WatchSandboxServer = grpc.ServerStreamingServer[SandboxStreamEvent] - -func _OpenShell_SubmitPolicyAnalysis_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(SubmitPolicyAnalysisRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).SubmitPolicyAnalysis(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_SubmitPolicyAnalysis_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).SubmitPolicyAnalysis(ctx, req.(*SubmitPolicyAnalysisRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetDraftPolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetDraftPolicyRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetDraftPolicy(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetDraftPolicy_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetDraftPolicy(ctx, req.(*GetDraftPolicyRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ApproveDraftChunk_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ApproveDraftChunkRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ApproveDraftChunk(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ApproveDraftChunk_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ApproveDraftChunk(ctx, req.(*ApproveDraftChunkRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_RejectDraftChunk_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(RejectDraftChunkRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).RejectDraftChunk(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_RejectDraftChunk_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).RejectDraftChunk(ctx, req.(*RejectDraftChunkRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ApproveAllDraftChunks_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ApproveAllDraftChunksRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ApproveAllDraftChunks(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ApproveAllDraftChunks_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ApproveAllDraftChunks(ctx, req.(*ApproveAllDraftChunksRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_EditDraftChunk_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(EditDraftChunkRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).EditDraftChunk(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_EditDraftChunk_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).EditDraftChunk(ctx, req.(*EditDraftChunkRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_UndoDraftChunk_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(UndoDraftChunkRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).UndoDraftChunk(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_UndoDraftChunk_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).UndoDraftChunk(ctx, req.(*UndoDraftChunkRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ClearDraftChunks_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ClearDraftChunksRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ClearDraftChunks(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ClearDraftChunks_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ClearDraftChunks(ctx, req.(*ClearDraftChunksRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetDraftHistory_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetDraftHistoryRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetDraftHistory(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetDraftHistory_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetDraftHistory(ctx, req.(*GetDraftHistoryRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_IssueSandboxToken_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(IssueSandboxTokenRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).IssueSandboxToken(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_IssueSandboxToken_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).IssueSandboxToken(ctx, req.(*IssueSandboxTokenRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_RefreshSandboxToken_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(RefreshSandboxTokenRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).RefreshSandboxToken(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_RefreshSandboxToken_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).RefreshSandboxToken(ctx, req.(*RefreshSandboxTokenRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_CreateWorkspace_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(CreateWorkspaceRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).CreateWorkspace(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_CreateWorkspace_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).CreateWorkspace(ctx, req.(*CreateWorkspaceRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_GetWorkspace_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetWorkspaceRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).GetWorkspace(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_GetWorkspace_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).GetWorkspace(ctx, req.(*GetWorkspaceRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ListWorkspaces_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ListWorkspacesRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ListWorkspaces(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ListWorkspaces_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ListWorkspaces(ctx, req.(*ListWorkspacesRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_DeleteWorkspace_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(DeleteWorkspaceRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).DeleteWorkspace(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_DeleteWorkspace_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).DeleteWorkspace(ctx, req.(*DeleteWorkspaceRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_AddWorkspaceMember_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(AddWorkspaceMemberRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).AddWorkspaceMember(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_AddWorkspaceMember_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).AddWorkspaceMember(ctx, req.(*AddWorkspaceMemberRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_RemoveWorkspaceMember_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(RemoveWorkspaceMemberRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).RemoveWorkspaceMember(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_RemoveWorkspaceMember_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).RemoveWorkspaceMember(ctx, req.(*RemoveWorkspaceMemberRequest)) - } - return interceptor(ctx, in, info, handler) -} - -func _OpenShell_ListWorkspaceMembers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(ListWorkspaceMembersRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(OpenShellServer).ListWorkspaceMembers(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: OpenShell_ListWorkspaceMembers_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(OpenShellServer).ListWorkspaceMembers(ctx, req.(*ListWorkspaceMembersRequest)) - } - return interceptor(ctx, in, info, handler) -} - -// OpenShell_ServiceDesc is the grpc.ServiceDesc for OpenShell service. -// It's only intended for direct use with grpc.RegisterService, -// and not to be introspected or modified (even as a copy) -var OpenShell_ServiceDesc = grpc.ServiceDesc{ - ServiceName: "openshell.v1.OpenShell", - HandlerType: (*OpenShellServer)(nil), - Methods: []grpc.MethodDesc{ - { - MethodName: "Health", - Handler: _OpenShell_Health_Handler, - }, - { - MethodName: "GetCurrentUser", - Handler: _OpenShell_GetCurrentUser_Handler, - }, - { - MethodName: "GetGatewayInfo", - Handler: _OpenShell_GetGatewayInfo_Handler, - }, - { - MethodName: "CreateSandbox", - Handler: _OpenShell_CreateSandbox_Handler, - }, - { - MethodName: "GetSandbox", - Handler: _OpenShell_GetSandbox_Handler, - }, - { - MethodName: "ListSandboxes", - Handler: _OpenShell_ListSandboxes_Handler, - }, - { - MethodName: "ListSandboxProviders", - Handler: _OpenShell_ListSandboxProviders_Handler, - }, - { - MethodName: "AttachSandboxProvider", - Handler: _OpenShell_AttachSandboxProvider_Handler, - }, - { - MethodName: "DetachSandboxProvider", - Handler: _OpenShell_DetachSandboxProvider_Handler, - }, - { - MethodName: "DeleteSandbox", - Handler: _OpenShell_DeleteSandbox_Handler, - }, - { - MethodName: "CreateSshSession", - Handler: _OpenShell_CreateSshSession_Handler, - }, - { - MethodName: "ExposeService", - Handler: _OpenShell_ExposeService_Handler, - }, - { - MethodName: "GetService", - Handler: _OpenShell_GetService_Handler, - }, - { - MethodName: "ListServices", - Handler: _OpenShell_ListServices_Handler, - }, - { - MethodName: "DeleteService", - Handler: _OpenShell_DeleteService_Handler, - }, - { - MethodName: "RevokeSshSession", - Handler: _OpenShell_RevokeSshSession_Handler, - }, - { - MethodName: "CreateProvider", - Handler: _OpenShell_CreateProvider_Handler, - }, - { - MethodName: "GetProvider", - Handler: _OpenShell_GetProvider_Handler, - }, - { - MethodName: "ListProviders", - Handler: _OpenShell_ListProviders_Handler, - }, - { - MethodName: "ListProviderProfiles", - Handler: _OpenShell_ListProviderProfiles_Handler, - }, - { - MethodName: "GetProviderProfile", - Handler: _OpenShell_GetProviderProfile_Handler, - }, - { - MethodName: "ImportProviderProfiles", - Handler: _OpenShell_ImportProviderProfiles_Handler, - }, - { - MethodName: "UpdateProviderProfiles", - Handler: _OpenShell_UpdateProviderProfiles_Handler, - }, - { - MethodName: "LintProviderProfiles", - Handler: _OpenShell_LintProviderProfiles_Handler, - }, - { - MethodName: "UpdateProvider", - Handler: _OpenShell_UpdateProvider_Handler, - }, - { - MethodName: "GetProviderRefreshStatus", - Handler: _OpenShell_GetProviderRefreshStatus_Handler, - }, - { - MethodName: "ConfigureProviderRefresh", - Handler: _OpenShell_ConfigureProviderRefresh_Handler, - }, - { - MethodName: "RotateProviderCredential", - Handler: _OpenShell_RotateProviderCredential_Handler, - }, - { - MethodName: "DeleteProviderRefresh", - Handler: _OpenShell_DeleteProviderRefresh_Handler, - }, - { - MethodName: "DeleteProvider", - Handler: _OpenShell_DeleteProvider_Handler, - }, - { - MethodName: "DeleteProviderProfile", - Handler: _OpenShell_DeleteProviderProfile_Handler, - }, - { - MethodName: "GetSandboxConfig", - Handler: _OpenShell_GetSandboxConfig_Handler, - }, - { - MethodName: "GetGatewayConfig", - Handler: _OpenShell_GetGatewayConfig_Handler, - }, - { - MethodName: "UpdateConfig", - Handler: _OpenShell_UpdateConfig_Handler, - }, - { - MethodName: "GetSandboxPolicyStatus", - Handler: _OpenShell_GetSandboxPolicyStatus_Handler, - }, - { - MethodName: "ListSandboxPolicies", - Handler: _OpenShell_ListSandboxPolicies_Handler, - }, - { - MethodName: "ReportPolicyStatus", - Handler: _OpenShell_ReportPolicyStatus_Handler, - }, - { - MethodName: "GetSandboxProviderEnvironment", - Handler: _OpenShell_GetSandboxProviderEnvironment_Handler, - }, - { - MethodName: "GetSandboxLogs", - Handler: _OpenShell_GetSandboxLogs_Handler, - }, - { - MethodName: "SubmitPolicyAnalysis", - Handler: _OpenShell_SubmitPolicyAnalysis_Handler, - }, - { - MethodName: "GetDraftPolicy", - Handler: _OpenShell_GetDraftPolicy_Handler, - }, - { - MethodName: "ApproveDraftChunk", - Handler: _OpenShell_ApproveDraftChunk_Handler, - }, - { - MethodName: "RejectDraftChunk", - Handler: _OpenShell_RejectDraftChunk_Handler, - }, - { - MethodName: "ApproveAllDraftChunks", - Handler: _OpenShell_ApproveAllDraftChunks_Handler, - }, - { - MethodName: "EditDraftChunk", - Handler: _OpenShell_EditDraftChunk_Handler, - }, - { - MethodName: "UndoDraftChunk", - Handler: _OpenShell_UndoDraftChunk_Handler, - }, - { - MethodName: "ClearDraftChunks", - Handler: _OpenShell_ClearDraftChunks_Handler, - }, - { - MethodName: "GetDraftHistory", - Handler: _OpenShell_GetDraftHistory_Handler, - }, - { - MethodName: "IssueSandboxToken", - Handler: _OpenShell_IssueSandboxToken_Handler, - }, - { - MethodName: "RefreshSandboxToken", - Handler: _OpenShell_RefreshSandboxToken_Handler, - }, - { - MethodName: "CreateWorkspace", - Handler: _OpenShell_CreateWorkspace_Handler, - }, - { - MethodName: "GetWorkspace", - Handler: _OpenShell_GetWorkspace_Handler, - }, - { - MethodName: "ListWorkspaces", - Handler: _OpenShell_ListWorkspaces_Handler, - }, - { - MethodName: "DeleteWorkspace", - Handler: _OpenShell_DeleteWorkspace_Handler, - }, - { - MethodName: "AddWorkspaceMember", - Handler: _OpenShell_AddWorkspaceMember_Handler, - }, - { - MethodName: "RemoveWorkspaceMember", - Handler: _OpenShell_RemoveWorkspaceMember_Handler, - }, - { - MethodName: "ListWorkspaceMembers", - Handler: _OpenShell_ListWorkspaceMembers_Handler, - }, - }, - Streams: []grpc.StreamDesc{ - { - StreamName: "ExecSandbox", - Handler: _OpenShell_ExecSandbox_Handler, - ServerStreams: true, - }, - { - StreamName: "ForwardTcp", - Handler: _OpenShell_ForwardTcp_Handler, - ServerStreams: true, - ClientStreams: true, - }, - { - StreamName: "ExecSandboxInteractive", - Handler: _OpenShell_ExecSandboxInteractive_Handler, - ServerStreams: true, - ClientStreams: true, - }, - { - StreamName: "PushSandboxLogs", - Handler: _OpenShell_PushSandboxLogs_Handler, - ClientStreams: true, - }, - { - StreamName: "ConnectSupervisor", - Handler: _OpenShell_ConnectSupervisor_Handler, - ServerStreams: true, - ClientStreams: true, - }, - { - StreamName: "RelayStream", - Handler: _OpenShell_RelayStream_Handler, - ServerStreams: true, - ClientStreams: true, - }, - { - StreamName: "WatchSandbox", - Handler: _OpenShell_WatchSandbox_Handler, - ServerStreams: true, - }, - }, - Metadata: "openshell.proto", -} diff --git a/backend/gen/optionsv1/options.pb.go b/backend/gen/optionsv1/options.pb.go deleted file mode 100644 index bbfc7e0..0000000 --- a/backend/gen/optionsv1/options.pb.go +++ /dev/null @@ -1,204 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -// Code generated by protoc-gen-go. DO NOT EDIT. -// versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 -// source: options.proto - -package optionsv1 - -import ( - protoreflect "google.golang.org/protobuf/reflect/protoreflect" - protoimpl "google.golang.org/protobuf/runtime/protoimpl" - descriptorpb "google.golang.org/protobuf/types/descriptorpb" - reflect "reflect" - sync "sync" - unsafe "unsafe" -) - -const ( - // Verify that this generated code is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) - // Verify that runtime/protoimpl is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) -) - -// Per-method authorization rule. Consumed at runtime by the gateway's -// descriptor-pool-based auth table to enforce auth mode, role, and scope. -type AuthorizationRule struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Authentication mode: "bearer", "sandbox", "dual", or "unauthenticated". - AuthMode string `protobuf:"bytes,1,opt,name=auth_mode,json=authMode,proto3" json:"auth_mode,omitempty"` - // Minimum workspace-level role required (checked by handler via - // authorize_workspace): "user" or "admin". Mutually exclusive with - // global_role. - WorkspaceRole string `protobuf:"bytes,2,opt,name=workspace_role,json=workspaceRole,proto3" json:"workspace_role,omitempty"` - // Global role required (checked by middleware via OIDC claims): - // "platform_admin". Mutually exclusive with workspace_role. - GlobalRole string `protobuf:"bytes,3,opt,name=global_role,json=globalRole,proto3" json:"global_role,omitempty"` - // Required OIDC scope on the bearer path (e.g. "sandbox:read"). - Scope string `protobuf:"bytes,4,opt,name=scope,proto3" json:"scope,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *AuthorizationRule) Reset() { - *x = AuthorizationRule{} - mi := &file_options_proto_msgTypes[0] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *AuthorizationRule) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*AuthorizationRule) ProtoMessage() {} - -func (x *AuthorizationRule) ProtoReflect() protoreflect.Message { - mi := &file_options_proto_msgTypes[0] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use AuthorizationRule.ProtoReflect.Descriptor instead. -func (*AuthorizationRule) Descriptor() ([]byte, []int) { - return file_options_proto_rawDescGZIP(), []int{0} -} - -func (x *AuthorizationRule) GetAuthMode() string { - if x != nil { - return x.AuthMode - } - return "" -} - -func (x *AuthorizationRule) GetWorkspaceRole() string { - if x != nil { - return x.WorkspaceRole - } - return "" -} - -func (x *AuthorizationRule) GetGlobalRole() string { - if x != nil { - return x.GlobalRole - } - return "" -} - -func (x *AuthorizationRule) GetScope() string { - if x != nil { - return x.Scope - } - return "" -} - -var file_options_proto_extTypes = []protoimpl.ExtensionInfo{ - { - ExtendedType: (*descriptorpb.MethodOptions)(nil), - ExtensionType: (*AuthorizationRule)(nil), - Field: 50000, - Name: "openshell.options.v1.authorization", - Tag: "bytes,50000,opt,name=authorization", - Filename: "options.proto", - }, - { - ExtendedType: (*descriptorpb.FieldOptions)(nil), - ExtensionType: (*bool)(nil), - Field: 50001, - Name: "openshell.options.v1.secret", - Tag: "varint,50001,opt,name=secret", - Filename: "options.proto", - }, -} - -// Extension fields to descriptorpb.MethodOptions. -var ( - // Authorization metadata for a gRPC method. - // - // optional openshell.options.v1.AuthorizationRule authorization = 50000; - E_Authorization = &file_options_proto_extTypes[0] -) - -// Extension fields to descriptorpb.FieldOptions. -var ( - // optional bool secret = 50001; - E_Secret = &file_options_proto_extTypes[1] -) - -var File_options_proto protoreflect.FileDescriptor - -const file_options_proto_rawDesc = "" + - "\n" + - "\roptions.proto\x12\x14openshell.options.v1\x1a google/protobuf/descriptor.proto\"\x8e\x01\n" + - "\x11AuthorizationRule\x12\x1b\n" + - "\tauth_mode\x18\x01 \x01(\tR\bauthMode\x12%\n" + - "\x0eworkspace_role\x18\x02 \x01(\tR\rworkspaceRole\x12\x1f\n" + - "\vglobal_role\x18\x03 \x01(\tR\n" + - "globalRole\x12\x14\n" + - "\x05scope\x18\x04 \x01(\tR\x05scope:o\n" + - "\rauthorization\x12\x1e.google.protobuf.MethodOptions\x18І\x03 \x01(\v2'.openshell.options.v1.AuthorizationRuleR\rauthorization:7\n" + - "\x06secret\x12\x1d.google.protobuf.FieldOptions\x18ц\x03 \x01(\bR\x06secretb\x06proto3" - -var ( - file_options_proto_rawDescOnce sync.Once - file_options_proto_rawDescData []byte -) - -func file_options_proto_rawDescGZIP() []byte { - file_options_proto_rawDescOnce.Do(func() { - file_options_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_options_proto_rawDesc), len(file_options_proto_rawDesc))) - }) - return file_options_proto_rawDescData -} - -var file_options_proto_msgTypes = make([]protoimpl.MessageInfo, 1) -var file_options_proto_goTypes = []any{ - (*AuthorizationRule)(nil), // 0: openshell.options.v1.AuthorizationRule - (*descriptorpb.MethodOptions)(nil), // 1: google.protobuf.MethodOptions - (*descriptorpb.FieldOptions)(nil), // 2: google.protobuf.FieldOptions -} -var file_options_proto_depIdxs = []int32{ - 1, // 0: openshell.options.v1.authorization:extendee -> google.protobuf.MethodOptions - 2, // 1: openshell.options.v1.secret:extendee -> google.protobuf.FieldOptions - 0, // 2: openshell.options.v1.authorization:type_name -> openshell.options.v1.AuthorizationRule - 3, // [3:3] is the sub-list for method output_type - 3, // [3:3] is the sub-list for method input_type - 2, // [2:3] is the sub-list for extension type_name - 0, // [0:2] is the sub-list for extension extendee - 0, // [0:0] is the sub-list for field type_name -} - -func init() { file_options_proto_init() } -func file_options_proto_init() { - if File_options_proto != nil { - return - } - type x struct{} - out := protoimpl.TypeBuilder{ - File: protoimpl.DescBuilder{ - GoPackagePath: reflect.TypeOf(x{}).PkgPath(), - RawDescriptor: unsafe.Slice(unsafe.StringData(file_options_proto_rawDesc), len(file_options_proto_rawDesc)), - NumEnums: 0, - NumMessages: 1, - NumExtensions: 2, - NumServices: 0, - }, - GoTypes: file_options_proto_goTypes, - DependencyIndexes: file_options_proto_depIdxs, - MessageInfos: file_options_proto_msgTypes, - ExtensionInfos: file_options_proto_extTypes, - }.Build() - File_options_proto = out.File - file_options_proto_goTypes = nil - file_options_proto_depIdxs = nil -} diff --git a/backend/gen/sandboxv1/sandbox.pb.go b/backend/gen/sandboxv1/sandbox.pb.go deleted file mode 100644 index be6fa5e..0000000 --- a/backend/gen/sandboxv1/sandbox.pb.go +++ /dev/null @@ -1,2222 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -// Code generated by protoc-gen-go. DO NOT EDIT. -// versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 -// source: sandbox.proto - -package sandboxv1 - -import ( - protoreflect "google.golang.org/protobuf/reflect/protoreflect" - protoimpl "google.golang.org/protobuf/runtime/protoimpl" - structpb "google.golang.org/protobuf/types/known/structpb" - reflect "reflect" - sync "sync" - unsafe "unsafe" -) - -const ( - // Verify that this generated code is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) - // Verify that runtime/protoimpl is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) -) - -// Scope that currently controls a setting. -type SettingScope int32 - -const ( - SettingScope_SETTING_SCOPE_UNSPECIFIED SettingScope = 0 - SettingScope_SETTING_SCOPE_SANDBOX SettingScope = 1 - SettingScope_SETTING_SCOPE_GLOBAL SettingScope = 2 -) - -// Enum value maps for SettingScope. -var ( - SettingScope_name = map[int32]string{ - 0: "SETTING_SCOPE_UNSPECIFIED", - 1: "SETTING_SCOPE_SANDBOX", - 2: "SETTING_SCOPE_GLOBAL", - } - SettingScope_value = map[string]int32{ - "SETTING_SCOPE_UNSPECIFIED": 0, - "SETTING_SCOPE_SANDBOX": 1, - "SETTING_SCOPE_GLOBAL": 2, - } -) - -func (x SettingScope) Enum() *SettingScope { - p := new(SettingScope) - *p = x - return p -} - -func (x SettingScope) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (SettingScope) Descriptor() protoreflect.EnumDescriptor { - return file_sandbox_proto_enumTypes[0].Descriptor() -} - -func (SettingScope) Type() protoreflect.EnumType { - return &file_sandbox_proto_enumTypes[0] -} - -func (x SettingScope) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use SettingScope.Descriptor instead. -func (SettingScope) EnumDescriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{0} -} - -// Source used for the policy payload in GetSandboxConfigResponse. -type PolicySource int32 - -const ( - PolicySource_POLICY_SOURCE_UNSPECIFIED PolicySource = 0 - PolicySource_POLICY_SOURCE_SANDBOX PolicySource = 1 - PolicySource_POLICY_SOURCE_GLOBAL PolicySource = 2 -) - -// Enum value maps for PolicySource. -var ( - PolicySource_name = map[int32]string{ - 0: "POLICY_SOURCE_UNSPECIFIED", - 1: "POLICY_SOURCE_SANDBOX", - 2: "POLICY_SOURCE_GLOBAL", - } - PolicySource_value = map[string]int32{ - "POLICY_SOURCE_UNSPECIFIED": 0, - "POLICY_SOURCE_SANDBOX": 1, - "POLICY_SOURCE_GLOBAL": 2, - } -) - -func (x PolicySource) Enum() *PolicySource { - p := new(PolicySource) - *p = x - return p -} - -func (x PolicySource) String() string { - return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) -} - -func (PolicySource) Descriptor() protoreflect.EnumDescriptor { - return file_sandbox_proto_enumTypes[1].Descriptor() -} - -func (PolicySource) Type() protoreflect.EnumType { - return &file_sandbox_proto_enumTypes[1] -} - -func (x PolicySource) Number() protoreflect.EnumNumber { - return protoreflect.EnumNumber(x) -} - -// Deprecated: Use PolicySource.Descriptor instead. -func (PolicySource) EnumDescriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{1} -} - -// Sandbox security policy configuration. -type SandboxPolicy struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Policy version. - Version uint32 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"` - // Filesystem access policy. - Filesystem *FilesystemPolicy `protobuf:"bytes,2,opt,name=filesystem,proto3" json:"filesystem,omitempty"` - // Landlock configuration. - Landlock *LandlockPolicy `protobuf:"bytes,3,opt,name=landlock,proto3" json:"landlock,omitempty"` - // Process execution policy. - Process *ProcessPolicy `protobuf:"bytes,4,opt,name=process,proto3" json:"process,omitempty"` - // Network access policies keyed by name (e.g. "claude_code", "gitlab"). - NetworkPolicies map[string]*NetworkPolicyRule `protobuf:"bytes,5,rep,name=network_policies,json=networkPolicies,proto3" json:"network_policies,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Reusable supervisor middleware configs for network egress, keyed by their - // policy-local names. At most 10 configs are accepted, and at most 10 stages - // can be selected per request. - NetworkMiddlewares map[string]*NetworkMiddlewareConfig `protobuf:"bytes,6,rep,name=network_middlewares,json=networkMiddlewares,proto3" json:"network_middlewares,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SandboxPolicy) Reset() { - *x = SandboxPolicy{} - mi := &file_sandbox_proto_msgTypes[0] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SandboxPolicy) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SandboxPolicy) ProtoMessage() {} - -func (x *SandboxPolicy) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[0] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SandboxPolicy.ProtoReflect.Descriptor instead. -func (*SandboxPolicy) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{0} -} - -func (x *SandboxPolicy) GetVersion() uint32 { - if x != nil { - return x.Version - } - return 0 -} - -func (x *SandboxPolicy) GetFilesystem() *FilesystemPolicy { - if x != nil { - return x.Filesystem - } - return nil -} - -func (x *SandboxPolicy) GetLandlock() *LandlockPolicy { - if x != nil { - return x.Landlock - } - return nil -} - -func (x *SandboxPolicy) GetProcess() *ProcessPolicy { - if x != nil { - return x.Process - } - return nil -} - -func (x *SandboxPolicy) GetNetworkPolicies() map[string]*NetworkPolicyRule { - if x != nil { - return x.NetworkPolicies - } - return nil -} - -func (x *SandboxPolicy) GetNetworkMiddlewares() map[string]*NetworkMiddlewareConfig { - if x != nil { - return x.NetworkMiddlewares - } - return nil -} - -// Filesystem access policy. -type FilesystemPolicy struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Automatically include the workdir as read-write. - IncludeWorkdir bool `protobuf:"varint,1,opt,name=include_workdir,json=includeWorkdir,proto3" json:"include_workdir,omitempty"` - // Read-only directory allow list. - ReadOnly []string `protobuf:"bytes,2,rep,name=read_only,json=readOnly,proto3" json:"read_only,omitempty"` - // Read-write directory allow list. - ReadWrite []string `protobuf:"bytes,3,rep,name=read_write,json=readWrite,proto3" json:"read_write,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *FilesystemPolicy) Reset() { - *x = FilesystemPolicy{} - mi := &file_sandbox_proto_msgTypes[1] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *FilesystemPolicy) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*FilesystemPolicy) ProtoMessage() {} - -func (x *FilesystemPolicy) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[1] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use FilesystemPolicy.ProtoReflect.Descriptor instead. -func (*FilesystemPolicy) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{1} -} - -func (x *FilesystemPolicy) GetIncludeWorkdir() bool { - if x != nil { - return x.IncludeWorkdir - } - return false -} - -func (x *FilesystemPolicy) GetReadOnly() []string { - if x != nil { - return x.ReadOnly - } - return nil -} - -func (x *FilesystemPolicy) GetReadWrite() []string { - if x != nil { - return x.ReadWrite - } - return nil -} - -// Landlock policy configuration. -type LandlockPolicy struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Compatibility mode (e.g. "best_effort", "hard_requirement"). - Compatibility string `protobuf:"bytes,1,opt,name=compatibility,proto3" json:"compatibility,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *LandlockPolicy) Reset() { - *x = LandlockPolicy{} - mi := &file_sandbox_proto_msgTypes[2] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *LandlockPolicy) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*LandlockPolicy) ProtoMessage() {} - -func (x *LandlockPolicy) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[2] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use LandlockPolicy.ProtoReflect.Descriptor instead. -func (*LandlockPolicy) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{2} -} - -func (x *LandlockPolicy) GetCompatibility() string { - if x != nil { - return x.Compatibility - } - return "" -} - -// Process execution policy. -type ProcessPolicy struct { - state protoimpl.MessageState `protogen:"open.v1"` - // User name to run the sandboxed process as. - RunAsUser string `protobuf:"bytes,1,opt,name=run_as_user,json=runAsUser,proto3" json:"run_as_user,omitempty"` - // Group name to run the sandboxed process as. - RunAsGroup string `protobuf:"bytes,2,opt,name=run_as_group,json=runAsGroup,proto3" json:"run_as_group,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *ProcessPolicy) Reset() { - *x = ProcessPolicy{} - mi := &file_sandbox_proto_msgTypes[3] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *ProcessPolicy) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*ProcessPolicy) ProtoMessage() {} - -func (x *ProcessPolicy) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[3] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use ProcessPolicy.ProtoReflect.Descriptor instead. -func (*ProcessPolicy) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{3} -} - -func (x *ProcessPolicy) GetRunAsUser() string { - if x != nil { - return x.RunAsUser - } - return "" -} - -func (x *ProcessPolicy) GetRunAsGroup() string { - if x != nil { - return x.RunAsGroup - } - return "" -} - -// A named network access policy rule. -type NetworkPolicyRule struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Human-readable name for this policy rule. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Allowed endpoint (host:port) pairs. - Endpoints []*NetworkEndpoint `protobuf:"bytes,2,rep,name=endpoints,proto3" json:"endpoints,omitempty"` - // Allowed binary identities. - Binaries []*NetworkBinary `protobuf:"bytes,3,rep,name=binaries,proto3" json:"binaries,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *NetworkPolicyRule) Reset() { - *x = NetworkPolicyRule{} - mi := &file_sandbox_proto_msgTypes[4] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *NetworkPolicyRule) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*NetworkPolicyRule) ProtoMessage() {} - -func (x *NetworkPolicyRule) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[4] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use NetworkPolicyRule.ProtoReflect.Descriptor instead. -func (*NetworkPolicyRule) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{4} -} - -func (x *NetworkPolicyRule) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *NetworkPolicyRule) GetEndpoints() []*NetworkEndpoint { - if x != nil { - return x.Endpoints - } - return nil -} - -func (x *NetworkPolicyRule) GetBinaries() []*NetworkBinary { - if x != nil { - return x.Binaries - } - return nil -} - -// A reusable middleware config selected for admitted egress by host. -type NetworkMiddlewareConfig struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Human-readable name for this middleware config. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // Built-in middleware name or operator-owned registration name. - Middleware string `protobuf:"bytes,2,opt,name=middleware,proto3" json:"middleware,omitempty"` - // Service-specific configuration. - Config *structpb.Struct `protobuf:"bytes,3,opt,name=config,proto3" json:"config,omitempty"` - // Failure behavior: "fail_closed" (default) or "fail_open". - OnError string `protobuf:"bytes,4,opt,name=on_error,json=onError,proto3" json:"on_error,omitempty"` - // Host selector controlling which admitted destinations use this config. - Endpoints *MiddlewareEndpointSelector `protobuf:"bytes,5,opt,name=endpoints,proto3" json:"endpoints,omitempty"` - // Execution order. Values must be unique within a policy; lower values run first. - Order int32 `protobuf:"varint,6,opt,name=order,proto3" json:"order,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *NetworkMiddlewareConfig) Reset() { - *x = NetworkMiddlewareConfig{} - mi := &file_sandbox_proto_msgTypes[5] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *NetworkMiddlewareConfig) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*NetworkMiddlewareConfig) ProtoMessage() {} - -func (x *NetworkMiddlewareConfig) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[5] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use NetworkMiddlewareConfig.ProtoReflect.Descriptor instead. -func (*NetworkMiddlewareConfig) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{5} -} - -func (x *NetworkMiddlewareConfig) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *NetworkMiddlewareConfig) GetMiddleware() string { - if x != nil { - return x.Middleware - } - return "" -} - -func (x *NetworkMiddlewareConfig) GetConfig() *structpb.Struct { - if x != nil { - return x.Config - } - return nil -} - -func (x *NetworkMiddlewareConfig) GetOnError() string { - if x != nil { - return x.OnError - } - return "" -} - -func (x *NetworkMiddlewareConfig) GetEndpoints() *MiddlewareEndpointSelector { - if x != nil { - return x.Endpoints - } - return nil -} - -func (x *NetworkMiddlewareConfig) GetOrder() int32 { - if x != nil { - return x.Order - } - return 0 -} - -// Host selector controlling which admitted destinations use a middleware config. -type MiddlewareEndpointSelector struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Exact host or DNS glob patterns included in the selection. Include and - // exclude accept at most 32 combined patterns. - Include []string `protobuf:"bytes,1,rep,name=include,proto3" json:"include,omitempty"` - // Exact host or DNS glob patterns removed from the selection. - // Exclusions take precedence over inclusions. - Exclude []string `protobuf:"bytes,2,rep,name=exclude,proto3" json:"exclude,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *MiddlewareEndpointSelector) Reset() { - *x = MiddlewareEndpointSelector{} - mi := &file_sandbox_proto_msgTypes[6] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *MiddlewareEndpointSelector) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*MiddlewareEndpointSelector) ProtoMessage() {} - -func (x *MiddlewareEndpointSelector) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[6] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use MiddlewareEndpointSelector.ProtoReflect.Descriptor instead. -func (*MiddlewareEndpointSelector) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{6} -} - -func (x *MiddlewareEndpointSelector) GetInclude() []string { - if x != nil { - return x.Include - } - return nil -} - -func (x *MiddlewareEndpointSelector) GetExclude() []string { - if x != nil { - return x.Exclude - } - return nil -} - -// A network endpoint (host + port) with optional L7 inspection config. -type NetworkEndpoint struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Hostname or host glob pattern. Exact match is case-insensitive. - // Glob patterns use "." as delimiter: "*.example.com" matches a single - // subdomain label, "**.example.com" matches across labels. - Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"` - // Single port (backwards compat). Use `ports` for multiple ports. - // Mutually exclusive with `ports` — if both are set, `ports` takes precedence. - Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"` - // Application protocol for L7 inspection: "rest", "websocket", "graphql", "sql", or "" (L4-only). - Protocol string `protobuf:"bytes,3,opt,name=protocol,proto3" json:"protocol,omitempty"` - // TLS handling: "terminate" or "passthrough" (default). - Tls string `protobuf:"bytes,4,opt,name=tls,proto3" json:"tls,omitempty"` - // Enforcement mode: "enforce" or "audit" (default). - Enforcement string `protobuf:"bytes,5,opt,name=enforcement,proto3" json:"enforcement,omitempty"` - // Access preset shorthand: "read-only", "read-write", "full". - // Mutually exclusive with rules. - Access string `protobuf:"bytes,6,opt,name=access,proto3" json:"access,omitempty"` - // Explicit L7 rules (mutually exclusive with access). - Rules []*L7Rule `protobuf:"bytes,7,rep,name=rules,proto3" json:"rules,omitempty"` - // Allowed resolved IP addresses or CIDR ranges for this endpoint. - // When non-empty, the SSRF internal-IP check is replaced by an allowlist check: - // - If host is also set: domain must resolve to an IP in this list. - // - If host is empty: any domain is allowed as long as it resolves to an IP in this list. - // - // Supports exact IPs ("10.0.5.20") and CIDR notation ("10.0.5.0/24"). - // Loopback (127.0.0.0/8) and link-local (169.254.0.0/16) are always blocked - // regardless of this field. - AllowedIps []string `protobuf:"bytes,8,rep,name=allowed_ips,json=allowedIps,proto3" json:"allowed_ips,omitempty"` - // Multiple ports. When non-empty, this endpoint covers all listed ports. - // If `port` is set and `ports` is empty, `port` is normalized to `ports: [port]`. - // If both are set, `ports` takes precedence. - Ports []uint32 `protobuf:"varint,9,rep,packed,name=ports,proto3" json:"ports,omitempty"` - // Explicit L7 deny rules. When present, requests matching any deny rule - // are blocked even if they match an allow rule or access preset. - // Deny rules take precedence over allow rules. - DenyRules []*L7DenyRule `protobuf:"bytes,10,rep,name=deny_rules,json=denyRules,proto3" json:"deny_rules,omitempty"` - // When true, percent-encoded '/' (%2F) is preserved in path segments - // rather than rejected by the L7 path canonicalizer. Required for - // upstreams like GitLab that embed %2F in namespaced resource paths. - // Defaults to false (strict). - AllowEncodedSlash bool `protobuf:"varint,11,opt,name=allow_encoded_slash,json=allowEncodedSlash,proto3" json:"allow_encoded_slash,omitempty"` - // GraphQL persisted-query behavior for hash-only/saved-query requests: - // "deny" (default) or "allow_registered". - PersistedQueries string `protobuf:"bytes,12,opt,name=persisted_queries,json=persistedQueries,proto3" json:"persisted_queries,omitempty"` - // Trusted GraphQL persisted-query registry keyed by hash or service-specific ID. - // Only used when persisted_queries is "allow_registered". - GraphqlPersistedQueries map[string]*GraphqlOperation `protobuf:"bytes,13,rep,name=graphql_persisted_queries,json=graphqlPersistedQueries,proto3" json:"graphql_persisted_queries,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Maximum GraphQL request body bytes to buffer for inspection. - // Defaults to 65536 when unset. - GraphqlMaxBodyBytes uint32 `protobuf:"varint,14,opt,name=graphql_max_body_bytes,json=graphqlMaxBodyBytes,proto3" json:"graphql_max_body_bytes,omitempty"` - // Optional HTTP path glob that scopes this L7 endpoint on shared host:port APIs. - // Example: use path "/graphql" for protocol "graphql" and "/repos/**" for - // protocol "rest" when both surfaces live under api.example.com:443. - // Empty means all paths. - Path string `protobuf:"bytes,15,opt,name=path,proto3" json:"path,omitempty"` - // When true on a "rest" endpoint, OpenShell rewrites credential placeholders - // inside client-to-server WebSocket text messages after an allowed HTTP 101 - // upgrade. Defaults to false. - WebsocketCredentialRewrite bool `protobuf:"varint,16,opt,name=websocket_credential_rewrite,json=websocketCredentialRewrite,proto3" json:"websocket_credential_rewrite,omitempty"` - // When true on a "rest" endpoint, OpenShell rewrites credential placeholders - // inside supported textual HTTP request bodies before forwarding upstream. - // Defaults to false. - RequestBodyCredentialRewrite bool `protobuf:"varint,17,opt,name=request_body_credential_rewrite,json=requestBodyCredentialRewrite,proto3" json:"request_body_credential_rewrite,omitempty"` - // Internal provenance marker for policy-advisor generated endpoints. - // Advisor-proposed endpoints must not satisfy exact-host SSRF trust unless - // they are converted through an explicit user-authored policy path. - AdvisorProposed bool `protobuf:"varint,18,opt,name=advisor_proposed,json=advisorProposed,proto3" json:"advisor_proposed,omitempty"` - // Proxy-side credential signing mode: "sigv4" for AWS SigV4 re-signing. - // When set, the proxy strips the client's Authorization header and computes - // a fresh SigV4 signature using real credentials from the provider. - CredentialSigning string `protobuf:"bytes,19,opt,name=credential_signing,json=credentialSigning,proto3" json:"credential_signing,omitempty"` - // AWS signing service name override. Required when credential_signing is - // "sigv4" — e.g. "bedrock" for bedrock-runtime endpoints. - SigningService string `protobuf:"bytes,20,opt,name=signing_service,json=signingService,proto3" json:"signing_service,omitempty"` - // AWS region override for SigV4 signing. When set, takes precedence over - // hostname-based region extraction. Required for non-standard endpoints. - SigningRegion string `protobuf:"bytes,21,opt,name=signing_region,json=signingRegion,proto3" json:"signing_region,omitempty"` - // Maximum JSON-RPC-over-HTTP request body bytes to buffer for inspection. - // Defaults to 65536 when unset. - JsonRpcMaxBodyBytes uint32 `protobuf:"varint,22,opt,name=json_rpc_max_body_bytes,json=jsonRpcMaxBodyBytes,proto3" json:"json_rpc_max_body_bytes,omitempty"` - // MCP-only policy and inspection options. Only used when protocol is "mcp". - Mcp *McpOptions `protobuf:"bytes,23,opt,name=mcp,proto3" json:"mcp,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *NetworkEndpoint) Reset() { - *x = NetworkEndpoint{} - mi := &file_sandbox_proto_msgTypes[7] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *NetworkEndpoint) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*NetworkEndpoint) ProtoMessage() {} - -func (x *NetworkEndpoint) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[7] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use NetworkEndpoint.ProtoReflect.Descriptor instead. -func (*NetworkEndpoint) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{7} -} - -func (x *NetworkEndpoint) GetHost() string { - if x != nil { - return x.Host - } - return "" -} - -func (x *NetworkEndpoint) GetPort() uint32 { - if x != nil { - return x.Port - } - return 0 -} - -func (x *NetworkEndpoint) GetProtocol() string { - if x != nil { - return x.Protocol - } - return "" -} - -func (x *NetworkEndpoint) GetTls() string { - if x != nil { - return x.Tls - } - return "" -} - -func (x *NetworkEndpoint) GetEnforcement() string { - if x != nil { - return x.Enforcement - } - return "" -} - -func (x *NetworkEndpoint) GetAccess() string { - if x != nil { - return x.Access - } - return "" -} - -func (x *NetworkEndpoint) GetRules() []*L7Rule { - if x != nil { - return x.Rules - } - return nil -} - -func (x *NetworkEndpoint) GetAllowedIps() []string { - if x != nil { - return x.AllowedIps - } - return nil -} - -func (x *NetworkEndpoint) GetPorts() []uint32 { - if x != nil { - return x.Ports - } - return nil -} - -func (x *NetworkEndpoint) GetDenyRules() []*L7DenyRule { - if x != nil { - return x.DenyRules - } - return nil -} - -func (x *NetworkEndpoint) GetAllowEncodedSlash() bool { - if x != nil { - return x.AllowEncodedSlash - } - return false -} - -func (x *NetworkEndpoint) GetPersistedQueries() string { - if x != nil { - return x.PersistedQueries - } - return "" -} - -func (x *NetworkEndpoint) GetGraphqlPersistedQueries() map[string]*GraphqlOperation { - if x != nil { - return x.GraphqlPersistedQueries - } - return nil -} - -func (x *NetworkEndpoint) GetGraphqlMaxBodyBytes() uint32 { - if x != nil { - return x.GraphqlMaxBodyBytes - } - return 0 -} - -func (x *NetworkEndpoint) GetPath() string { - if x != nil { - return x.Path - } - return "" -} - -func (x *NetworkEndpoint) GetWebsocketCredentialRewrite() bool { - if x != nil { - return x.WebsocketCredentialRewrite - } - return false -} - -func (x *NetworkEndpoint) GetRequestBodyCredentialRewrite() bool { - if x != nil { - return x.RequestBodyCredentialRewrite - } - return false -} - -func (x *NetworkEndpoint) GetAdvisorProposed() bool { - if x != nil { - return x.AdvisorProposed - } - return false -} - -func (x *NetworkEndpoint) GetCredentialSigning() string { - if x != nil { - return x.CredentialSigning - } - return "" -} - -func (x *NetworkEndpoint) GetSigningService() string { - if x != nil { - return x.SigningService - } - return "" -} - -func (x *NetworkEndpoint) GetSigningRegion() string { - if x != nil { - return x.SigningRegion - } - return "" -} - -func (x *NetworkEndpoint) GetJsonRpcMaxBodyBytes() uint32 { - if x != nil { - return x.JsonRpcMaxBodyBytes - } - return 0 -} - -func (x *NetworkEndpoint) GetMcp() *McpOptions { - if x != nil { - return x.Mcp - } - return nil -} - -// MCP options are grouped so MCP-specific policy can grow without adding more -// top-level NetworkEndpoint fields. Current enforcement targets the active -// 2025-11-25 Streamable HTTP/tools behavior, while preserving space for -// version-profile policy if OpenShell adopts 2026-07-28 draft behavior later. -// -// Planned policy extensions should use OpenShell-owned static definitions for -// MCP method/version profiles rather than treating dependency enums as the -// policy contract. Candidate profile checks include request metadata/header -// validation, response/SSE introspection, trusted annotation handling, -// resultType/cache metadata validation, x-mcp-header tool-definition checks, -// and subscriptions/listen handling. -// -// Sources: -// - https://modelcontextprotocol.io/specification/2025-11-25/server/tools -// - https://modelcontextprotocol.io/specification/draft/changelog -// - https://modelcontextprotocol.io/specification/draft/basic/transports/streamable-http -// - https://modelcontextprotocol.io/specification/draft/server/tools -type McpOptions struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Hardening boundary for tools/call params.name. When unset or true, the - // supervisor enforces the MCP recommended tool-name syntax - // ^[A-Za-z0-9_.-]{1,128}$ before policy evaluation. Set false only for - // compatibility with servers that intentionally use non-recommended names. - // - // Source: - // - https://modelcontextprotocol.io/specification/2025-11-25/server/tools#tool-names - StrictToolNames *bool `protobuf:"varint,1,opt,name=strict_tool_names,json=strictToolNames,proto3,oneof" json:"strict_tool_names,omitempty"` - // Method-layer default for MCP endpoints. When true, OpenShell allows parsed - // MCP-family methods at the method layer unless a tool-name policy narrows - // tools/call. When unset or false, explicit method rules are required. - AllowAllKnownMcpMethods *bool `protobuf:"varint,2,opt,name=allow_all_known_mcp_methods,json=allowAllKnownMcpMethods,proto3,oneof" json:"allow_all_known_mcp_methods,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *McpOptions) Reset() { - *x = McpOptions{} - mi := &file_sandbox_proto_msgTypes[8] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *McpOptions) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*McpOptions) ProtoMessage() {} - -func (x *McpOptions) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[8] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use McpOptions.ProtoReflect.Descriptor instead. -func (*McpOptions) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{8} -} - -func (x *McpOptions) GetStrictToolNames() bool { - if x != nil && x.StrictToolNames != nil { - return *x.StrictToolNames - } - return false -} - -func (x *McpOptions) GetAllowAllKnownMcpMethods() bool { - if x != nil && x.AllowAllKnownMcpMethods != nil { - return *x.AllowAllKnownMcpMethods - } - return false -} - -// Trusted GraphQL operation classification. -type GraphqlOperation struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Operation type: "query", "mutation", or "subscription". - OperationType string `protobuf:"bytes,1,opt,name=operation_type,json=operationType,proto3" json:"operation_type,omitempty"` - // Operation name, if known. - OperationName string `protobuf:"bytes,2,opt,name=operation_name,json=operationName,proto3" json:"operation_name,omitempty"` - // Root field names selected by the operation. - Fields []string `protobuf:"bytes,3,rep,name=fields,proto3" json:"fields,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GraphqlOperation) Reset() { - *x = GraphqlOperation{} - mi := &file_sandbox_proto_msgTypes[9] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GraphqlOperation) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GraphqlOperation) ProtoMessage() {} - -func (x *GraphqlOperation) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[9] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GraphqlOperation.ProtoReflect.Descriptor instead. -func (*GraphqlOperation) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{9} -} - -func (x *GraphqlOperation) GetOperationType() string { - if x != nil { - return x.OperationType - } - return "" -} - -func (x *GraphqlOperation) GetOperationName() string { - if x != nil { - return x.OperationName - } - return "" -} - -func (x *GraphqlOperation) GetFields() []string { - if x != nil { - return x.Fields - } - return nil -} - -// An L7 deny rule that blocks specific requests. -// Mirrors L7Allow — same fields, same matching semantics, inverted effect. -// Deny rules are evaluated after allow rules and take precedence. -type L7DenyRule struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Protocol method: HTTP method (REST/WebSocket), JSON-RPC method name, or - // "*" for any when supported by the protocol. - Method string `protobuf:"bytes,1,opt,name=method,proto3" json:"method,omitempty"` - // URL path glob pattern (REST): "/repos/*/pulls/*/reviews", "**" for any. - Path string `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"` - // SQL command (SQL): SELECT, INSERT, etc. or "*" for any. - Command string `protobuf:"bytes,3,opt,name=command,proto3" json:"command,omitempty"` - // Query parameter matcher map (REST). - // Same semantics as L7Allow.query. - Query map[string]*L7QueryMatcher `protobuf:"bytes,4,rep,name=query,proto3" json:"query,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // GraphQL operation type: "query", "mutation", "subscription", or "*" for any. - OperationType string `protobuf:"bytes,5,opt,name=operation_type,json=operationType,proto3" json:"operation_type,omitempty"` - // GraphQL operation name glob. "*" matches any operation name. - OperationName string `protobuf:"bytes,6,opt,name=operation_name,json=operationName,proto3" json:"operation_name,omitempty"` - // GraphQL root field globs. Deny rules match when any selected root field - // matches any configured glob. - Fields []string `protobuf:"bytes,7,rep,name=fields,proto3" json:"fields,omitempty"` - // MCP params matcher map. Currently only params.name is supported for - // tools/call filtering. Generic protocol "json-rpc" rejects params matchers. - Params map[string]*L7QueryMatcher `protobuf:"bytes,9,rep,name=params,proto3" json:"params,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *L7DenyRule) Reset() { - *x = L7DenyRule{} - mi := &file_sandbox_proto_msgTypes[10] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *L7DenyRule) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*L7DenyRule) ProtoMessage() {} - -func (x *L7DenyRule) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[10] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use L7DenyRule.ProtoReflect.Descriptor instead. -func (*L7DenyRule) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{10} -} - -func (x *L7DenyRule) GetMethod() string { - if x != nil { - return x.Method - } - return "" -} - -func (x *L7DenyRule) GetPath() string { - if x != nil { - return x.Path - } - return "" -} - -func (x *L7DenyRule) GetCommand() string { - if x != nil { - return x.Command - } - return "" -} - -func (x *L7DenyRule) GetQuery() map[string]*L7QueryMatcher { - if x != nil { - return x.Query - } - return nil -} - -func (x *L7DenyRule) GetOperationType() string { - if x != nil { - return x.OperationType - } - return "" -} - -func (x *L7DenyRule) GetOperationName() string { - if x != nil { - return x.OperationName - } - return "" -} - -func (x *L7DenyRule) GetFields() []string { - if x != nil { - return x.Fields - } - return nil -} - -func (x *L7DenyRule) GetParams() map[string]*L7QueryMatcher { - if x != nil { - return x.Params - } - return nil -} - -// An L7 policy rule (allow-only). -type L7Rule struct { - state protoimpl.MessageState `protogen:"open.v1"` - Allow *L7Allow `protobuf:"bytes,1,opt,name=allow,proto3" json:"allow,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *L7Rule) Reset() { - *x = L7Rule{} - mi := &file_sandbox_proto_msgTypes[11] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *L7Rule) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*L7Rule) ProtoMessage() {} - -func (x *L7Rule) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[11] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use L7Rule.ProtoReflect.Descriptor instead. -func (*L7Rule) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{11} -} - -func (x *L7Rule) GetAllow() *L7Allow { - if x != nil { - return x.Allow - } - return nil -} - -// Allowed action definition for L7 rules. -type L7Allow struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Protocol method: HTTP method (REST/WebSocket), JSON-RPC method name, or - // "*" for any when supported by the protocol. - Method string `protobuf:"bytes,1,opt,name=method,proto3" json:"method,omitempty"` - // URL path glob pattern (REST): "/repos/**", "**" for any. - Path string `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"` - // SQL command (SQL): SELECT, INSERT, etc. or "*" for any. - Command string `protobuf:"bytes,3,opt,name=command,proto3" json:"command,omitempty"` - // Query parameter matcher map (REST). - // Key is the decoded query parameter name (case-sensitive). - // Value supports either a single glob (`glob`) or a list (`any`). - Query map[string]*L7QueryMatcher `protobuf:"bytes,4,rep,name=query,proto3" json:"query,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // GraphQL operation type: "query", "mutation", "subscription", or "*" for any. - OperationType string `protobuf:"bytes,5,opt,name=operation_type,json=operationType,proto3" json:"operation_type,omitempty"` - // GraphQL operation name glob. "*" matches any operation name. - OperationName string `protobuf:"bytes,6,opt,name=operation_name,json=operationName,proto3" json:"operation_name,omitempty"` - // GraphQL root field globs. Allow rules match only when every selected root - // field matches one of the configured globs. Omit to match all fields. - Fields []string `protobuf:"bytes,7,rep,name=fields,proto3" json:"fields,omitempty"` - // MCP params matcher map. Currently only params.name is supported for - // tools/call filtering. Generic protocol "json-rpc" rejects params matchers. - Params map[string]*L7QueryMatcher `protobuf:"bytes,9,rep,name=params,proto3" json:"params,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *L7Allow) Reset() { - *x = L7Allow{} - mi := &file_sandbox_proto_msgTypes[12] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *L7Allow) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*L7Allow) ProtoMessage() {} - -func (x *L7Allow) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[12] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use L7Allow.ProtoReflect.Descriptor instead. -func (*L7Allow) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{12} -} - -func (x *L7Allow) GetMethod() string { - if x != nil { - return x.Method - } - return "" -} - -func (x *L7Allow) GetPath() string { - if x != nil { - return x.Path - } - return "" -} - -func (x *L7Allow) GetCommand() string { - if x != nil { - return x.Command - } - return "" -} - -func (x *L7Allow) GetQuery() map[string]*L7QueryMatcher { - if x != nil { - return x.Query - } - return nil -} - -func (x *L7Allow) GetOperationType() string { - if x != nil { - return x.OperationType - } - return "" -} - -func (x *L7Allow) GetOperationName() string { - if x != nil { - return x.OperationName - } - return "" -} - -func (x *L7Allow) GetFields() []string { - if x != nil { - return x.Fields - } - return nil -} - -func (x *L7Allow) GetParams() map[string]*L7QueryMatcher { - if x != nil { - return x.Params - } - return nil -} - -// Query value matcher for one query parameter key. -type L7QueryMatcher struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Single glob pattern. - Glob string `protobuf:"bytes,1,opt,name=glob,proto3" json:"glob,omitempty"` - // Any-of glob patterns. - Any []string `protobuf:"bytes,2,rep,name=any,proto3" json:"any,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *L7QueryMatcher) Reset() { - *x = L7QueryMatcher{} - mi := &file_sandbox_proto_msgTypes[13] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *L7QueryMatcher) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*L7QueryMatcher) ProtoMessage() {} - -func (x *L7QueryMatcher) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[13] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use L7QueryMatcher.ProtoReflect.Descriptor instead. -func (*L7QueryMatcher) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{13} -} - -func (x *L7QueryMatcher) GetGlob() string { - if x != nil { - return x.Glob - } - return "" -} - -func (x *L7QueryMatcher) GetAny() []string { - if x != nil { - return x.Any - } - return nil -} - -// A binary identity for network policy matching. -type NetworkBinary struct { - state protoimpl.MessageState `protogen:"open.v1"` - Path string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"` - // Deprecated: the harness concept has been removed. This field is ignored. - // - // Deprecated: Marked as deprecated in sandbox.proto. - Harness bool `protobuf:"varint,2,opt,name=harness,proto3" json:"harness,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *NetworkBinary) Reset() { - *x = NetworkBinary{} - mi := &file_sandbox_proto_msgTypes[14] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *NetworkBinary) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*NetworkBinary) ProtoMessage() {} - -func (x *NetworkBinary) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[14] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use NetworkBinary.ProtoReflect.Descriptor instead. -func (*NetworkBinary) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{14} -} - -func (x *NetworkBinary) GetPath() string { - if x != nil { - return x.Path - } - return "" -} - -// Deprecated: Marked as deprecated in sandbox.proto. -func (x *NetworkBinary) GetHarness() bool { - if x != nil { - return x.Harness - } - return false -} - -// Request to get sandbox settings by sandbox ID. -type GetSandboxConfigRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // The sandbox ID. - SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetSandboxConfigRequest) Reset() { - *x = GetSandboxConfigRequest{} - mi := &file_sandbox_proto_msgTypes[15] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetSandboxConfigRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetSandboxConfigRequest) ProtoMessage() {} - -func (x *GetSandboxConfigRequest) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[15] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetSandboxConfigRequest.ProtoReflect.Descriptor instead. -func (*GetSandboxConfigRequest) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{15} -} - -func (x *GetSandboxConfigRequest) GetSandboxId() string { - if x != nil { - return x.SandboxId - } - return "" -} - -// Request to get gateway-global settings. -type GetGatewayConfigRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetGatewayConfigRequest) Reset() { - *x = GetGatewayConfigRequest{} - mi := &file_sandbox_proto_msgTypes[16] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetGatewayConfigRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetGatewayConfigRequest) ProtoMessage() {} - -func (x *GetGatewayConfigRequest) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[16] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetGatewayConfigRequest.ProtoReflect.Descriptor instead. -func (*GetGatewayConfigRequest) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{16} -} - -// Response containing gateway-global settings. -type GetGatewayConfigResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Gateway-global settings map excluding the reserved policy key. - // Registered keys without a configured value are returned with an empty SettingValue. - Settings map[string]*SettingValue `protobuf:"bytes,1,rep,name=settings,proto3" json:"settings,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Monotonically increasing revision for gateway-global settings. - SettingsRevision uint64 `protobuf:"varint,2,opt,name=settings_revision,json=settingsRevision,proto3" json:"settings_revision,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetGatewayConfigResponse) Reset() { - *x = GetGatewayConfigResponse{} - mi := &file_sandbox_proto_msgTypes[17] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetGatewayConfigResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetGatewayConfigResponse) ProtoMessage() {} - -func (x *GetGatewayConfigResponse) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[17] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetGatewayConfigResponse.ProtoReflect.Descriptor instead. -func (*GetGatewayConfigResponse) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{17} -} - -func (x *GetGatewayConfigResponse) GetSettings() map[string]*SettingValue { - if x != nil { - return x.Settings - } - return nil -} - -func (x *GetGatewayConfigResponse) GetSettingsRevision() uint64 { - if x != nil { - return x.SettingsRevision - } - return 0 -} - -// Type-aware setting value for sandbox/gateway settings. -type SettingValue struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Value: - // - // *SettingValue_StringValue - // *SettingValue_BoolValue - // *SettingValue_IntValue - // *SettingValue_BytesValue - Value isSettingValue_Value `protobuf_oneof:"value"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SettingValue) Reset() { - *x = SettingValue{} - mi := &file_sandbox_proto_msgTypes[18] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SettingValue) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SettingValue) ProtoMessage() {} - -func (x *SettingValue) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[18] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SettingValue.ProtoReflect.Descriptor instead. -func (*SettingValue) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{18} -} - -func (x *SettingValue) GetValue() isSettingValue_Value { - if x != nil { - return x.Value - } - return nil -} - -func (x *SettingValue) GetStringValue() string { - if x != nil { - if x, ok := x.Value.(*SettingValue_StringValue); ok { - return x.StringValue - } - } - return "" -} - -func (x *SettingValue) GetBoolValue() bool { - if x != nil { - if x, ok := x.Value.(*SettingValue_BoolValue); ok { - return x.BoolValue - } - } - return false -} - -func (x *SettingValue) GetIntValue() int64 { - if x != nil { - if x, ok := x.Value.(*SettingValue_IntValue); ok { - return x.IntValue - } - } - return 0 -} - -func (x *SettingValue) GetBytesValue() []byte { - if x != nil { - if x, ok := x.Value.(*SettingValue_BytesValue); ok { - return x.BytesValue - } - } - return nil -} - -type isSettingValue_Value interface { - isSettingValue_Value() -} - -type SettingValue_StringValue struct { - StringValue string `protobuf:"bytes,1,opt,name=string_value,json=stringValue,proto3,oneof"` -} - -type SettingValue_BoolValue struct { - BoolValue bool `protobuf:"varint,2,opt,name=bool_value,json=boolValue,proto3,oneof"` -} - -type SettingValue_IntValue struct { - IntValue int64 `protobuf:"varint,3,opt,name=int_value,json=intValue,proto3,oneof"` -} - -type SettingValue_BytesValue struct { - BytesValue []byte `protobuf:"bytes,4,opt,name=bytes_value,json=bytesValue,proto3,oneof"` -} - -func (*SettingValue_StringValue) isSettingValue_Value() {} - -func (*SettingValue_BoolValue) isSettingValue_Value() {} - -func (*SettingValue_IntValue) isSettingValue_Value() {} - -func (*SettingValue_BytesValue) isSettingValue_Value() {} - -// Effective setting value and the scope it was resolved from. -type EffectiveSetting struct { - state protoimpl.MessageState `protogen:"open.v1"` - Value *SettingValue `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"` - Scope SettingScope `protobuf:"varint,2,opt,name=scope,proto3,enum=openshell.sandbox.v1.SettingScope" json:"scope,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *EffectiveSetting) Reset() { - *x = EffectiveSetting{} - mi := &file_sandbox_proto_msgTypes[19] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *EffectiveSetting) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*EffectiveSetting) ProtoMessage() {} - -func (x *EffectiveSetting) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[19] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use EffectiveSetting.ProtoReflect.Descriptor instead. -func (*EffectiveSetting) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{19} -} - -func (x *EffectiveSetting) GetValue() *SettingValue { - if x != nil { - return x.Value - } - return nil -} - -func (x *EffectiveSetting) GetScope() SettingScope { - if x != nil { - return x.Scope - } - return SettingScope_SETTING_SCOPE_UNSPECIFIED -} - -// Response containing effective sandbox settings and policy. -type GetSandboxConfigResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // The sandbox policy configuration. - Policy *SandboxPolicy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"` - // Current policy version (monotonically increasing per sandbox). - Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"` - // SHA-256 hash of the serialized policy payload. - PolicyHash string `protobuf:"bytes,3,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"` - // Effective settings resolved for this sandbox, excluding the reserved policy key. - // Registered keys without a configured value are returned with an empty EffectiveSetting.value. - Settings map[string]*EffectiveSetting `protobuf:"bytes,4,rep,name=settings,proto3" json:"settings,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"` - // Fingerprint for effective config (policy + settings). Changes when any effective input changes. - ConfigRevision uint64 `protobuf:"varint,5,opt,name=config_revision,json=configRevision,proto3" json:"config_revision,omitempty"` - // Source of the policy payload for this response. - PolicySource PolicySource `protobuf:"varint,6,opt,name=policy_source,json=policySource,proto3,enum=openshell.sandbox.v1.PolicySource" json:"policy_source,omitempty"` - // When policy_source is GLOBAL, the version of the global policy revision. - // Zero when no global policy is active or when policy_source is SANDBOX. - GlobalPolicyVersion uint32 `protobuf:"varint,7,opt,name=global_policy_version,json=globalPolicyVersion,proto3" json:"global_policy_version,omitempty"` - // Fingerprint for provider credential inputs attached to this sandbox. - // Changes when attached provider names or attached provider records change. - ProviderEnvRevision uint64 `protobuf:"varint,8,opt,name=provider_env_revision,json=providerEnvRevision,proto3" json:"provider_env_revision,omitempty"` - // Operator-registered supervisor middleware services required by the - // effective policy. Built-in middleware is not included. - SupervisorMiddlewareServices []*SupervisorMiddlewareService `protobuf:"bytes,9,rep,name=supervisor_middleware_services,json=supervisorMiddlewareServices,proto3" json:"supervisor_middleware_services,omitempty"` - // Workspace the sandbox belongs to. Allows the supervisor to learn its - // workspace context for subsequent workspace-scoped RPCs. - Workspace string `protobuf:"bytes,10,opt,name=workspace,proto3" json:"workspace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetSandboxConfigResponse) Reset() { - *x = GetSandboxConfigResponse{} - mi := &file_sandbox_proto_msgTypes[20] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetSandboxConfigResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetSandboxConfigResponse) ProtoMessage() {} - -func (x *GetSandboxConfigResponse) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[20] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetSandboxConfigResponse.ProtoReflect.Descriptor instead. -func (*GetSandboxConfigResponse) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{20} -} - -func (x *GetSandboxConfigResponse) GetPolicy() *SandboxPolicy { - if x != nil { - return x.Policy - } - return nil -} - -func (x *GetSandboxConfigResponse) GetVersion() uint32 { - if x != nil { - return x.Version - } - return 0 -} - -func (x *GetSandboxConfigResponse) GetPolicyHash() string { - if x != nil { - return x.PolicyHash - } - return "" -} - -func (x *GetSandboxConfigResponse) GetSettings() map[string]*EffectiveSetting { - if x != nil { - return x.Settings - } - return nil -} - -func (x *GetSandboxConfigResponse) GetConfigRevision() uint64 { - if x != nil { - return x.ConfigRevision - } - return 0 -} - -func (x *GetSandboxConfigResponse) GetPolicySource() PolicySource { - if x != nil { - return x.PolicySource - } - return PolicySource_POLICY_SOURCE_UNSPECIFIED -} - -func (x *GetSandboxConfigResponse) GetGlobalPolicyVersion() uint32 { - if x != nil { - return x.GlobalPolicyVersion - } - return 0 -} - -func (x *GetSandboxConfigResponse) GetProviderEnvRevision() uint64 { - if x != nil { - return x.ProviderEnvRevision - } - return 0 -} - -func (x *GetSandboxConfigResponse) GetSupervisorMiddlewareServices() []*SupervisorMiddlewareService { - if x != nil { - return x.SupervisorMiddlewareServices - } - return nil -} - -func (x *GetSandboxConfigResponse) GetWorkspace() string { - if x != nil { - return x.Workspace - } - return "" -} - -// Connection details for one operator-registered supervisor middleware service. -// V1 supports plaintext and server-authenticated TLS gRPC. -type SupervisorMiddlewareService struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Operator-owned registration name used by policy attachments and diagnostics. - Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` - // gRPC endpoint reachable from the sandbox supervisor. - GrpcEndpoint string `protobuf:"bytes,2,opt,name=grpc_endpoint,json=grpcEndpoint,proto3" json:"grpc_endpoint,omitempty"` - // Operator-owned body limit applied to every binding exposed by the service. - MaxBodyBytes uint64 `protobuf:"varint,3,opt,name=max_body_bytes,json=maxBodyBytes,proto3" json:"max_body_bytes,omitempty"` - // Default RPC timeout for this service. Empty uses the platform default of - // 500ms. Values use an integer with an `ms` or `s` suffix and must be - // between 10ms and 30s. - Timeout string `protobuf:"bytes,4,opt,name=timeout,proto3" json:"timeout,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *SupervisorMiddlewareService) Reset() { - *x = SupervisorMiddlewareService{} - mi := &file_sandbox_proto_msgTypes[21] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *SupervisorMiddlewareService) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*SupervisorMiddlewareService) ProtoMessage() {} - -func (x *SupervisorMiddlewareService) ProtoReflect() protoreflect.Message { - mi := &file_sandbox_proto_msgTypes[21] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use SupervisorMiddlewareService.ProtoReflect.Descriptor instead. -func (*SupervisorMiddlewareService) Descriptor() ([]byte, []int) { - return file_sandbox_proto_rawDescGZIP(), []int{21} -} - -func (x *SupervisorMiddlewareService) GetName() string { - if x != nil { - return x.Name - } - return "" -} - -func (x *SupervisorMiddlewareService) GetGrpcEndpoint() string { - if x != nil { - return x.GrpcEndpoint - } - return "" -} - -func (x *SupervisorMiddlewareService) GetMaxBodyBytes() uint64 { - if x != nil { - return x.MaxBodyBytes - } - return 0 -} - -func (x *SupervisorMiddlewareService) GetTimeout() string { - if x != nil { - return x.Timeout - } - return "" -} - -var File_sandbox_proto protoreflect.FileDescriptor - -const file_sandbox_proto_rawDesc = "" + - "\n" + - "\rsandbox.proto\x12\x14openshell.sandbox.v1\x1a\x1cgoogle/protobuf/struct.proto\"\xa8\x05\n" + - "\rSandboxPolicy\x12\x18\n" + - "\aversion\x18\x01 \x01(\rR\aversion\x12F\n" + - "\n" + - "filesystem\x18\x02 \x01(\v2&.openshell.sandbox.v1.FilesystemPolicyR\n" + - "filesystem\x12@\n" + - "\blandlock\x18\x03 \x01(\v2$.openshell.sandbox.v1.LandlockPolicyR\blandlock\x12=\n" + - "\aprocess\x18\x04 \x01(\v2#.openshell.sandbox.v1.ProcessPolicyR\aprocess\x12c\n" + - "\x10network_policies\x18\x05 \x03(\v28.openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntryR\x0fnetworkPolicies\x12l\n" + - "\x13network_middlewares\x18\x06 \x03(\v2;.openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntryR\x12networkMiddlewares\x1ak\n" + - "\x14NetworkPoliciesEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12=\n" + - "\x05value\x18\x02 \x01(\v2'.openshell.sandbox.v1.NetworkPolicyRuleR\x05value:\x028\x01\x1at\n" + - "\x17NetworkMiddlewaresEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12C\n" + - "\x05value\x18\x02 \x01(\v2-.openshell.sandbox.v1.NetworkMiddlewareConfigR\x05value:\x028\x01\"w\n" + - "\x10FilesystemPolicy\x12'\n" + - "\x0finclude_workdir\x18\x01 \x01(\bR\x0eincludeWorkdir\x12\x1b\n" + - "\tread_only\x18\x02 \x03(\tR\breadOnly\x12\x1d\n" + - "\n" + - "read_write\x18\x03 \x03(\tR\treadWrite\"6\n" + - "\x0eLandlockPolicy\x12$\n" + - "\rcompatibility\x18\x01 \x01(\tR\rcompatibility\"Q\n" + - "\rProcessPolicy\x12\x1e\n" + - "\vrun_as_user\x18\x01 \x01(\tR\trunAsUser\x12 \n" + - "\frun_as_group\x18\x02 \x01(\tR\n" + - "runAsGroup\"\xad\x01\n" + - "\x11NetworkPolicyRule\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12C\n" + - "\tendpoints\x18\x02 \x03(\v2%.openshell.sandbox.v1.NetworkEndpointR\tendpoints\x12?\n" + - "\bbinaries\x18\x03 \x03(\v2#.openshell.sandbox.v1.NetworkBinaryR\bbinaries\"\xff\x01\n" + - "\x17NetworkMiddlewareConfig\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12\x1e\n" + - "\n" + - "middleware\x18\x02 \x01(\tR\n" + - "middleware\x12/\n" + - "\x06config\x18\x03 \x01(\v2\x17.google.protobuf.StructR\x06config\x12\x19\n" + - "\bon_error\x18\x04 \x01(\tR\aonError\x12N\n" + - "\tendpoints\x18\x05 \x01(\v20.openshell.sandbox.v1.MiddlewareEndpointSelectorR\tendpoints\x12\x14\n" + - "\x05order\x18\x06 \x01(\x05R\x05order\"P\n" + - "\x1aMiddlewareEndpointSelector\x12\x18\n" + - "\ainclude\x18\x01 \x03(\tR\ainclude\x12\x18\n" + - "\aexclude\x18\x02 \x03(\tR\aexclude\"\x84\t\n" + - "\x0fNetworkEndpoint\x12\x12\n" + - "\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" + - "\x04port\x18\x02 \x01(\rR\x04port\x12\x1a\n" + - "\bprotocol\x18\x03 \x01(\tR\bprotocol\x12\x10\n" + - "\x03tls\x18\x04 \x01(\tR\x03tls\x12 \n" + - "\venforcement\x18\x05 \x01(\tR\venforcement\x12\x16\n" + - "\x06access\x18\x06 \x01(\tR\x06access\x122\n" + - "\x05rules\x18\a \x03(\v2\x1c.openshell.sandbox.v1.L7RuleR\x05rules\x12\x1f\n" + - "\vallowed_ips\x18\b \x03(\tR\n" + - "allowedIps\x12\x14\n" + - "\x05ports\x18\t \x03(\rR\x05ports\x12?\n" + - "\n" + - "deny_rules\x18\n" + - " \x03(\v2 .openshell.sandbox.v1.L7DenyRuleR\tdenyRules\x12.\n" + - "\x13allow_encoded_slash\x18\v \x01(\bR\x11allowEncodedSlash\x12+\n" + - "\x11persisted_queries\x18\f \x01(\tR\x10persistedQueries\x12~\n" + - "\x19graphql_persisted_queries\x18\r \x03(\v2B.openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntryR\x17graphqlPersistedQueries\x123\n" + - "\x16graphql_max_body_bytes\x18\x0e \x01(\rR\x13graphqlMaxBodyBytes\x12\x12\n" + - "\x04path\x18\x0f \x01(\tR\x04path\x12@\n" + - "\x1cwebsocket_credential_rewrite\x18\x10 \x01(\bR\x1awebsocketCredentialRewrite\x12E\n" + - "\x1frequest_body_credential_rewrite\x18\x11 \x01(\bR\x1crequestBodyCredentialRewrite\x12)\n" + - "\x10advisor_proposed\x18\x12 \x01(\bR\x0fadvisorProposed\x12-\n" + - "\x12credential_signing\x18\x13 \x01(\tR\x11credentialSigning\x12'\n" + - "\x0fsigning_service\x18\x14 \x01(\tR\x0esigningService\x12%\n" + - "\x0esigning_region\x18\x15 \x01(\tR\rsigningRegion\x124\n" + - "\x17json_rpc_max_body_bytes\x18\x16 \x01(\rR\x13jsonRpcMaxBodyBytes\x122\n" + - "\x03mcp\x18\x17 \x01(\v2 .openshell.sandbox.v1.McpOptionsR\x03mcp\x1ar\n" + - "\x1cGraphqlPersistedQueriesEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12<\n" + - "\x05value\x18\x02 \x01(\v2&.openshell.sandbox.v1.GraphqlOperationR\x05value:\x028\x01\"\xb6\x01\n" + - "\n" + - "McpOptions\x12/\n" + - "\x11strict_tool_names\x18\x01 \x01(\bH\x00R\x0fstrictToolNames\x88\x01\x01\x12A\n" + - "\x1ballow_all_known_mcp_methods\x18\x02 \x01(\bH\x01R\x17allowAllKnownMcpMethods\x88\x01\x01B\x14\n" + - "\x12_strict_tool_namesB\x1e\n" + - "\x1c_allow_all_known_mcp_methods\"x\n" + - "\x10GraphqlOperation\x12%\n" + - "\x0eoperation_type\x18\x01 \x01(\tR\roperationType\x12%\n" + - "\x0eoperation_name\x18\x02 \x01(\tR\roperationName\x12\x16\n" + - "\x06fields\x18\x03 \x03(\tR\x06fields\"\x88\x04\n" + - "\n" + - "L7DenyRule\x12\x16\n" + - "\x06method\x18\x01 \x01(\tR\x06method\x12\x12\n" + - "\x04path\x18\x02 \x01(\tR\x04path\x12\x18\n" + - "\acommand\x18\x03 \x01(\tR\acommand\x12A\n" + - "\x05query\x18\x04 \x03(\v2+.openshell.sandbox.v1.L7DenyRule.QueryEntryR\x05query\x12%\n" + - "\x0eoperation_type\x18\x05 \x01(\tR\roperationType\x12%\n" + - "\x0eoperation_name\x18\x06 \x01(\tR\roperationName\x12\x16\n" + - "\x06fields\x18\a \x03(\tR\x06fields\x12D\n" + - "\x06params\x18\t \x03(\v2,.openshell.sandbox.v1.L7DenyRule.ParamsEntryR\x06params\x1a^\n" + - "\n" + - "QueryEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12:\n" + - "\x05value\x18\x02 \x01(\v2$.openshell.sandbox.v1.L7QueryMatcherR\x05value:\x028\x01\x1a_\n" + - "\vParamsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12:\n" + - "\x05value\x18\x02 \x01(\v2$.openshell.sandbox.v1.L7QueryMatcherR\x05value:\x028\x01J\x04\b\b\x10\t\"=\n" + - "\x06L7Rule\x123\n" + - "\x05allow\x18\x01 \x01(\v2\x1d.openshell.sandbox.v1.L7AllowR\x05allow\"\xff\x03\n" + - "\aL7Allow\x12\x16\n" + - "\x06method\x18\x01 \x01(\tR\x06method\x12\x12\n" + - "\x04path\x18\x02 \x01(\tR\x04path\x12\x18\n" + - "\acommand\x18\x03 \x01(\tR\acommand\x12>\n" + - "\x05query\x18\x04 \x03(\v2(.openshell.sandbox.v1.L7Allow.QueryEntryR\x05query\x12%\n" + - "\x0eoperation_type\x18\x05 \x01(\tR\roperationType\x12%\n" + - "\x0eoperation_name\x18\x06 \x01(\tR\roperationName\x12\x16\n" + - "\x06fields\x18\a \x03(\tR\x06fields\x12A\n" + - "\x06params\x18\t \x03(\v2).openshell.sandbox.v1.L7Allow.ParamsEntryR\x06params\x1a^\n" + - "\n" + - "QueryEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12:\n" + - "\x05value\x18\x02 \x01(\v2$.openshell.sandbox.v1.L7QueryMatcherR\x05value:\x028\x01\x1a_\n" + - "\vParamsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12:\n" + - "\x05value\x18\x02 \x01(\v2$.openshell.sandbox.v1.L7QueryMatcherR\x05value:\x028\x01J\x04\b\b\x10\t\"6\n" + - "\x0eL7QueryMatcher\x12\x12\n" + - "\x04glob\x18\x01 \x01(\tR\x04glob\x12\x10\n" + - "\x03any\x18\x02 \x03(\tR\x03any\"A\n" + - "\rNetworkBinary\x12\x12\n" + - "\x04path\x18\x01 \x01(\tR\x04path\x12\x1c\n" + - "\aharness\x18\x02 \x01(\bB\x02\x18\x01R\aharness\"8\n" + - "\x17GetSandboxConfigRequest\x12\x1d\n" + - "\n" + - "sandbox_id\x18\x01 \x01(\tR\tsandboxId\"\x19\n" + - "\x17GetGatewayConfigRequest\"\x82\x02\n" + - "\x18GetGatewayConfigResponse\x12X\n" + - "\bsettings\x18\x01 \x03(\v2<.openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntryR\bsettings\x12+\n" + - "\x11settings_revision\x18\x02 \x01(\x04R\x10settingsRevision\x1a_\n" + - "\rSettingsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x128\n" + - "\x05value\x18\x02 \x01(\v2\".openshell.sandbox.v1.SettingValueR\x05value:\x028\x01\"\x9f\x01\n" + - "\fSettingValue\x12#\n" + - "\fstring_value\x18\x01 \x01(\tH\x00R\vstringValue\x12\x1f\n" + - "\n" + - "bool_value\x18\x02 \x01(\bH\x00R\tboolValue\x12\x1d\n" + - "\tint_value\x18\x03 \x01(\x03H\x00R\bintValue\x12!\n" + - "\vbytes_value\x18\x04 \x01(\fH\x00R\n" + - "bytesValueB\a\n" + - "\x05value\"\x86\x01\n" + - "\x10EffectiveSetting\x128\n" + - "\x05value\x18\x01 \x01(\v2\".openshell.sandbox.v1.SettingValueR\x05value\x128\n" + - "\x05scope\x18\x02 \x01(\x0e2\".openshell.sandbox.v1.SettingScopeR\x05scope\"\xc2\x05\n" + - "\x18GetSandboxConfigResponse\x12;\n" + - "\x06policy\x18\x01 \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x06policy\x12\x18\n" + - "\aversion\x18\x02 \x01(\rR\aversion\x12\x1f\n" + - "\vpolicy_hash\x18\x03 \x01(\tR\n" + - "policyHash\x12X\n" + - "\bsettings\x18\x04 \x03(\v2<.openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntryR\bsettings\x12'\n" + - "\x0fconfig_revision\x18\x05 \x01(\x04R\x0econfigRevision\x12G\n" + - "\rpolicy_source\x18\x06 \x01(\x0e2\".openshell.sandbox.v1.PolicySourceR\fpolicySource\x122\n" + - "\x15global_policy_version\x18\a \x01(\rR\x13globalPolicyVersion\x122\n" + - "\x15provider_env_revision\x18\b \x01(\x04R\x13providerEnvRevision\x12w\n" + - "\x1esupervisor_middleware_services\x18\t \x03(\v21.openshell.sandbox.v1.SupervisorMiddlewareServiceR\x1csupervisorMiddlewareServices\x12\x1c\n" + - "\tworkspace\x18\n" + - " \x01(\tR\tworkspace\x1ac\n" + - "\rSettingsEntry\x12\x10\n" + - "\x03key\x18\x01 \x01(\tR\x03key\x12<\n" + - "\x05value\x18\x02 \x01(\v2&.openshell.sandbox.v1.EffectiveSettingR\x05value:\x028\x01\"\x96\x01\n" + - "\x1bSupervisorMiddlewareService\x12\x12\n" + - "\x04name\x18\x01 \x01(\tR\x04name\x12#\n" + - "\rgrpc_endpoint\x18\x02 \x01(\tR\fgrpcEndpoint\x12$\n" + - "\x0emax_body_bytes\x18\x03 \x01(\x04R\fmaxBodyBytes\x12\x18\n" + - "\atimeout\x18\x04 \x01(\tR\atimeout*b\n" + - "\fSettingScope\x12\x1d\n" + - "\x19SETTING_SCOPE_UNSPECIFIED\x10\x00\x12\x19\n" + - "\x15SETTING_SCOPE_SANDBOX\x10\x01\x12\x18\n" + - "\x14SETTING_SCOPE_GLOBAL\x10\x02*b\n" + - "\fPolicySource\x12\x1d\n" + - "\x19POLICY_SOURCE_UNSPECIFIED\x10\x00\x12\x19\n" + - "\x15POLICY_SOURCE_SANDBOX\x10\x01\x12\x18\n" + - "\x14POLICY_SOURCE_GLOBAL\x10\x02b\x06proto3" - -var ( - file_sandbox_proto_rawDescOnce sync.Once - file_sandbox_proto_rawDescData []byte -) - -func file_sandbox_proto_rawDescGZIP() []byte { - file_sandbox_proto_rawDescOnce.Do(func() { - file_sandbox_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_sandbox_proto_rawDesc), len(file_sandbox_proto_rawDesc))) - }) - return file_sandbox_proto_rawDescData -} - -var file_sandbox_proto_enumTypes = make([]protoimpl.EnumInfo, 2) -var file_sandbox_proto_msgTypes = make([]protoimpl.MessageInfo, 31) -var file_sandbox_proto_goTypes = []any{ - (SettingScope)(0), // 0: openshell.sandbox.v1.SettingScope - (PolicySource)(0), // 1: openshell.sandbox.v1.PolicySource - (*SandboxPolicy)(nil), // 2: openshell.sandbox.v1.SandboxPolicy - (*FilesystemPolicy)(nil), // 3: openshell.sandbox.v1.FilesystemPolicy - (*LandlockPolicy)(nil), // 4: openshell.sandbox.v1.LandlockPolicy - (*ProcessPolicy)(nil), // 5: openshell.sandbox.v1.ProcessPolicy - (*NetworkPolicyRule)(nil), // 6: openshell.sandbox.v1.NetworkPolicyRule - (*NetworkMiddlewareConfig)(nil), // 7: openshell.sandbox.v1.NetworkMiddlewareConfig - (*MiddlewareEndpointSelector)(nil), // 8: openshell.sandbox.v1.MiddlewareEndpointSelector - (*NetworkEndpoint)(nil), // 9: openshell.sandbox.v1.NetworkEndpoint - (*McpOptions)(nil), // 10: openshell.sandbox.v1.McpOptions - (*GraphqlOperation)(nil), // 11: openshell.sandbox.v1.GraphqlOperation - (*L7DenyRule)(nil), // 12: openshell.sandbox.v1.L7DenyRule - (*L7Rule)(nil), // 13: openshell.sandbox.v1.L7Rule - (*L7Allow)(nil), // 14: openshell.sandbox.v1.L7Allow - (*L7QueryMatcher)(nil), // 15: openshell.sandbox.v1.L7QueryMatcher - (*NetworkBinary)(nil), // 16: openshell.sandbox.v1.NetworkBinary - (*GetSandboxConfigRequest)(nil), // 17: openshell.sandbox.v1.GetSandboxConfigRequest - (*GetGatewayConfigRequest)(nil), // 18: openshell.sandbox.v1.GetGatewayConfigRequest - (*GetGatewayConfigResponse)(nil), // 19: openshell.sandbox.v1.GetGatewayConfigResponse - (*SettingValue)(nil), // 20: openshell.sandbox.v1.SettingValue - (*EffectiveSetting)(nil), // 21: openshell.sandbox.v1.EffectiveSetting - (*GetSandboxConfigResponse)(nil), // 22: openshell.sandbox.v1.GetSandboxConfigResponse - (*SupervisorMiddlewareService)(nil), // 23: openshell.sandbox.v1.SupervisorMiddlewareService - nil, // 24: openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntry - nil, // 25: openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntry - nil, // 26: openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntry - nil, // 27: openshell.sandbox.v1.L7DenyRule.QueryEntry - nil, // 28: openshell.sandbox.v1.L7DenyRule.ParamsEntry - nil, // 29: openshell.sandbox.v1.L7Allow.QueryEntry - nil, // 30: openshell.sandbox.v1.L7Allow.ParamsEntry - nil, // 31: openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntry - nil, // 32: openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntry - (*structpb.Struct)(nil), // 33: google.protobuf.Struct -} -var file_sandbox_proto_depIdxs = []int32{ - 3, // 0: openshell.sandbox.v1.SandboxPolicy.filesystem:type_name -> openshell.sandbox.v1.FilesystemPolicy - 4, // 1: openshell.sandbox.v1.SandboxPolicy.landlock:type_name -> openshell.sandbox.v1.LandlockPolicy - 5, // 2: openshell.sandbox.v1.SandboxPolicy.process:type_name -> openshell.sandbox.v1.ProcessPolicy - 24, // 3: openshell.sandbox.v1.SandboxPolicy.network_policies:type_name -> openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntry - 25, // 4: openshell.sandbox.v1.SandboxPolicy.network_middlewares:type_name -> openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntry - 9, // 5: openshell.sandbox.v1.NetworkPolicyRule.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint - 16, // 6: openshell.sandbox.v1.NetworkPolicyRule.binaries:type_name -> openshell.sandbox.v1.NetworkBinary - 33, // 7: openshell.sandbox.v1.NetworkMiddlewareConfig.config:type_name -> google.protobuf.Struct - 8, // 8: openshell.sandbox.v1.NetworkMiddlewareConfig.endpoints:type_name -> openshell.sandbox.v1.MiddlewareEndpointSelector - 13, // 9: openshell.sandbox.v1.NetworkEndpoint.rules:type_name -> openshell.sandbox.v1.L7Rule - 12, // 10: openshell.sandbox.v1.NetworkEndpoint.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule - 26, // 11: openshell.sandbox.v1.NetworkEndpoint.graphql_persisted_queries:type_name -> openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntry - 10, // 12: openshell.sandbox.v1.NetworkEndpoint.mcp:type_name -> openshell.sandbox.v1.McpOptions - 27, // 13: openshell.sandbox.v1.L7DenyRule.query:type_name -> openshell.sandbox.v1.L7DenyRule.QueryEntry - 28, // 14: openshell.sandbox.v1.L7DenyRule.params:type_name -> openshell.sandbox.v1.L7DenyRule.ParamsEntry - 14, // 15: openshell.sandbox.v1.L7Rule.allow:type_name -> openshell.sandbox.v1.L7Allow - 29, // 16: openshell.sandbox.v1.L7Allow.query:type_name -> openshell.sandbox.v1.L7Allow.QueryEntry - 30, // 17: openshell.sandbox.v1.L7Allow.params:type_name -> openshell.sandbox.v1.L7Allow.ParamsEntry - 31, // 18: openshell.sandbox.v1.GetGatewayConfigResponse.settings:type_name -> openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntry - 20, // 19: openshell.sandbox.v1.EffectiveSetting.value:type_name -> openshell.sandbox.v1.SettingValue - 0, // 20: openshell.sandbox.v1.EffectiveSetting.scope:type_name -> openshell.sandbox.v1.SettingScope - 2, // 21: openshell.sandbox.v1.GetSandboxConfigResponse.policy:type_name -> openshell.sandbox.v1.SandboxPolicy - 32, // 22: openshell.sandbox.v1.GetSandboxConfigResponse.settings:type_name -> openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntry - 1, // 23: openshell.sandbox.v1.GetSandboxConfigResponse.policy_source:type_name -> openshell.sandbox.v1.PolicySource - 23, // 24: openshell.sandbox.v1.GetSandboxConfigResponse.supervisor_middleware_services:type_name -> openshell.sandbox.v1.SupervisorMiddlewareService - 6, // 25: openshell.sandbox.v1.SandboxPolicy.NetworkPoliciesEntry.value:type_name -> openshell.sandbox.v1.NetworkPolicyRule - 7, // 26: openshell.sandbox.v1.SandboxPolicy.NetworkMiddlewaresEntry.value:type_name -> openshell.sandbox.v1.NetworkMiddlewareConfig - 11, // 27: openshell.sandbox.v1.NetworkEndpoint.GraphqlPersistedQueriesEntry.value:type_name -> openshell.sandbox.v1.GraphqlOperation - 15, // 28: openshell.sandbox.v1.L7DenyRule.QueryEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher - 15, // 29: openshell.sandbox.v1.L7DenyRule.ParamsEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher - 15, // 30: openshell.sandbox.v1.L7Allow.QueryEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher - 15, // 31: openshell.sandbox.v1.L7Allow.ParamsEntry.value:type_name -> openshell.sandbox.v1.L7QueryMatcher - 20, // 32: openshell.sandbox.v1.GetGatewayConfigResponse.SettingsEntry.value:type_name -> openshell.sandbox.v1.SettingValue - 21, // 33: openshell.sandbox.v1.GetSandboxConfigResponse.SettingsEntry.value:type_name -> openshell.sandbox.v1.EffectiveSetting - 34, // [34:34] is the sub-list for method output_type - 34, // [34:34] is the sub-list for method input_type - 34, // [34:34] is the sub-list for extension type_name - 34, // [34:34] is the sub-list for extension extendee - 0, // [0:34] is the sub-list for field type_name -} - -func init() { file_sandbox_proto_init() } -func file_sandbox_proto_init() { - if File_sandbox_proto != nil { - return - } - file_sandbox_proto_msgTypes[8].OneofWrappers = []any{} - file_sandbox_proto_msgTypes[18].OneofWrappers = []any{ - (*SettingValue_StringValue)(nil), - (*SettingValue_BoolValue)(nil), - (*SettingValue_IntValue)(nil), - (*SettingValue_BytesValue)(nil), - } - type x struct{} - out := protoimpl.TypeBuilder{ - File: protoimpl.DescBuilder{ - GoPackagePath: reflect.TypeOf(x{}).PkgPath(), - RawDescriptor: unsafe.Slice(unsafe.StringData(file_sandbox_proto_rawDesc), len(file_sandbox_proto_rawDesc)), - NumEnums: 2, - NumMessages: 31, - NumExtensions: 0, - NumServices: 0, - }, - GoTypes: file_sandbox_proto_goTypes, - DependencyIndexes: file_sandbox_proto_depIdxs, - EnumInfos: file_sandbox_proto_enumTypes, - MessageInfos: file_sandbox_proto_msgTypes, - }.Build() - File_sandbox_proto = out.File - file_sandbox_proto_goTypes = nil - file_sandbox_proto_depIdxs = nil -} diff --git a/backend/go.mod b/backend/go.mod index cec20fd..d463d39 100644 --- a/backend/go.mod +++ b/backend/go.mod @@ -5,16 +5,16 @@ go 1.25.1 require ( github.com/coreos/go-oidc/v3 v3.20.0 github.com/go-chi/chi/v5 v5.3.1 + github.com/rhuss/openshell-sdk-go v0.3.1 google.golang.org/grpc v1.82.1 - google.golang.org/protobuf v1.36.11 ) require ( github.com/go-jose/go-jose/v4 v4.1.4 // indirect - github.com/gorilla/websocket v1.5.3 // indirect golang.org/x/net v0.53.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sys v0.43.0 // indirect golang.org/x/text v0.36.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect + google.golang.org/protobuf v1.36.11 // indirect ) diff --git a/backend/go.sum b/backend/go.sum index fce9c94..e6fd804 100644 --- a/backend/go.sum +++ b/backend/go.sum @@ -2,6 +2,8 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/coreos/go-oidc/v3 v3.20.0 h1:EtE0WIBHk03N+DqGkY4+UONzzZHk7amKt6IyNd7OsZE= github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= +github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8= github.com/go-chi/chi/v5 v5.3.1/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= @@ -16,8 +18,12 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg= -github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= +github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/rhuss/openshell-sdk-go v0.3.1 h1:OwHWofN59X//KKiAn5h7X95YUfqfmfJ1t1Yd2gPFF38= +github.com/rhuss/openshell-sdk-go v0.3.1/go.mod h1:xlbORGKwyxUOKdYHJ1C4AUY4QzN2Yc8kyu13Y78yCBw= +github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= +github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= @@ -46,3 +52,5 @@ google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= diff --git a/backend/internal/api/app.go b/backend/internal/api/app.go index ef69404..1dd3308 100644 --- a/backend/internal/api/app.go +++ b/backend/internal/api/app.go @@ -9,15 +9,15 @@ import ( "github.com/go-chi/chi/v5" chimiddleware "github.com/go-chi/chi/v5/middleware" + openshell "github.com/rhuss/openshell-sdk-go/openshell/v1" "github.com/Gkrumbach07/openshell-dashboard/backend/internal/auth" - "github.com/Gkrumbach07/openshell-dashboard/backend/internal/gateway" ) -// App wires the gateway client, auth middleware, and REST routes. +// App wires the SDK client, auth middleware, and REST routes. type App struct { - gateway *gateway.Client - auth *auth.Middleware + client openshell.ClientInterface + auth *auth.Middleware // staticDir is the frontend build output; empty disables static serving. staticDir string // allowedOrigins for CORS, e.g. the webpack dev server origin. @@ -25,9 +25,9 @@ type App struct { } // NewApp builds the application. -func NewApp(gw *gateway.Client, authMiddleware *auth.Middleware, staticDir string, allowedOrigins []string) *App { +func NewApp(client openshell.ClientInterface, authMiddleware *auth.Middleware, staticDir string, allowedOrigins []string) *App { return &App{ - gateway: gw, + client: client, auth: authMiddleware, staticDir: staticDir, allowedOrigins: allowedOrigins, @@ -81,7 +81,6 @@ func (app *App) Routes() http.Handler { r.Get("/sandboxes/{name}", app.GetSandbox) r.Delete("/sandboxes/{name}", app.DeleteSandbox) r.Get("/sandboxes/{name}/logs", app.GetSandboxLogs) - r.Get("/sandboxes/{name}/terminal", app.Terminal) r.Get("/sandboxes/{name}/providers", app.ListSandboxProviders) r.Post("/sandboxes/{name}/providers/{provider}", app.AttachSandboxProvider) r.Delete("/sandboxes/{name}/providers/{provider}", app.DetachSandboxProvider) diff --git a/backend/internal/api/files_handler.go b/backend/internal/api/files_handler.go index fd5cee7..700d172 100644 --- a/backend/internal/api/files_handler.go +++ b/backend/internal/api/files_handler.go @@ -4,6 +4,7 @@ import ( "fmt" "io" "net/http" + "os" "path/filepath" "strconv" @@ -14,13 +15,6 @@ func (app *App) UploadFile(w http.ResponseWriter, r *http.Request) { workspace := chi.URLParam(r, "workspace") name := chi.URLParam(r, "name") - sandbox, err := app.gateway.GetSandbox(r.Context(), workspace, name) - if err != nil { - writeGrpcError(w, err) - return - } - sandboxID := sandbox.GetMetadata().GetId() - if err := r.ParseMultipartForm(64 << 20); err != nil { writeError(w, http.StatusBadRequest, "invalid_upload", "failed to parse multipart form") return @@ -32,11 +26,20 @@ func (app *App) UploadFile(w http.ResponseWriter, r *http.Request) { } defer file.Close() - fileBytes, err := io.ReadAll(file) + tmp, err := os.CreateTemp("", "upload-*") + if err != nil { + writeError(w, http.StatusInternalServerError, "temp_error", "failed to create temp file") + return + } + defer os.Remove(tmp.Name()) + defer tmp.Close() + + size, err := io.Copy(tmp, file) if err != nil { writeError(w, http.StatusInternalServerError, "read_error", "failed to read uploaded file") return } + tmp.Close() dest := r.URL.Query().Get("dest") if dest == "" { @@ -44,20 +47,14 @@ func (app *App) UploadFile(w http.ResponseWriter, r *http.Request) { } destPath := filepath.Join(dest, filepath.Base(header.Filename)) - stdout, stderr, exitCode, err := app.gateway.ExecSandbox(r.Context(), sandboxID, - []string{"sh", "-c", fmt.Sprintf("cat > %q", destPath)}, - fileBytes, "", 30) - if err != nil { - writeGrpcError(w, err) + if err := app.client.Files().Upload(r.Context(), workspace, name, tmp.Name(), destPath); err != nil { + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]any{ - "exitCode": exitCode, - "path": destPath, - "size": len(fileBytes), - "stdout": string(stdout), - "stderr": string(stderr), + "path": destPath, + "size": size, }) } @@ -70,28 +67,20 @@ func (app *App) DownloadFile(w http.ResponseWriter, r *http.Request) { return } - sandbox, err := app.gateway.GetSandbox(r.Context(), workspace, name) - if err != nil { - writeGrpcError(w, err) - return - } - sandboxID := sandbox.GetMetadata().GetId() - - stdout, stderr, exitCode, err := app.gateway.ExecSandbox(r.Context(), sandboxID, - []string{"cat", filePath}, nil, "", 30) + result, err := app.client.Exec().Run(r.Context(), workspace, name, []string{"cat", filePath}) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - if exitCode != 0 { + if result.ExitCode != 0 { writeError(w, http.StatusNotFound, "file_not_found", - fmt.Sprintf("cat exited %d: %s", exitCode, string(stderr))) + fmt.Sprintf("cat exited %d: %s", result.ExitCode, result.Stderr)) return } filename := filepath.Base(filePath) w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%q", filename)) w.Header().Set("Content-Type", "application/octet-stream") - w.Header().Set("Content-Length", strconv.Itoa(len(stdout))) - w.Write(stdout) + w.Header().Set("Content-Length", strconv.Itoa(len(result.Stdout))) + w.Write([]byte(result.Stdout)) } diff --git a/backend/internal/api/gateway_handler.go b/backend/internal/api/gateway_handler.go index 9e51560..004820c 100644 --- a/backend/internal/api/gateway_handler.go +++ b/backend/internal/api/gateway_handler.go @@ -15,9 +15,9 @@ func (app *App) GetHealthz(w http.ResponseWriter, r *http.Request) { // GetGateway returns gateway status, version, and compute drivers — the // complete set of gateway self-description the API offers. func (app *App) GetGateway(w http.ResponseWriter, r *http.Request) { - info, err := app.gateway.GetGatewayInfo(r.Context()) + info, err := app.client.Health().GetGatewayInfo(r.Context()) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, models.FromGatewayInfo(info)) @@ -26,13 +26,16 @@ func (app *App) GetGateway(w http.ResponseWriter, r *http.Request) { // FeatureFlags controls which optional features the frontend should render. // Parsed from FEATURE_* env vars in main.go. type FeatureFlags struct { - Terminal bool `json:"terminal"` - FileTransfer bool `json:"fileTransfer"` - Settings bool `json:"settings"` - GlobalPolicy bool `json:"globalPolicy"` - CredentialRefresh bool `json:"credentialRefresh"` - Services bool `json:"services"` - DraftPolicy bool `json:"draftPolicy"` + Terminal bool `json:"terminal"` + FileTransfer bool `json:"fileTransfer"` + Settings bool `json:"settings"` + GlobalPolicy bool `json:"globalPolicy"` + CredentialRefresh bool `json:"credentialRefresh"` + Services bool `json:"services"` + DraftPolicy bool `json:"draftPolicy"` + DeploymentContext string `json:"deploymentContext"` + WorkspaceBinding bool `json:"workspaceBinding"` + ResourceLinks bool `json:"resourceLinks"` } // AuthConfigResponse tells the frontend how to authenticate and which @@ -81,9 +84,9 @@ func (app *App) GetWhoAmI(w http.ResponseWriter, r *http.Request) { return } - resp, err := app.gateway.GetCurrentUser(r.Context()) + user, err := app.client.Health().GetCurrentUser(r.Context()) if err == nil { - writeJSON(w, http.StatusOK, models.FromCurrentUser(resp)) + writeJSON(w, http.StatusOK, models.FromCurrentUser(user)) return } @@ -99,5 +102,5 @@ func (app *App) GetWhoAmI(w http.ResponseWriter, r *http.Request) { return } - writeGrpcError(w, err) + writeSDKError(w, err) } diff --git a/backend/internal/api/inference_handler.go b/backend/internal/api/inference_handler.go index f45f47e..350c582 100644 --- a/backend/internal/api/inference_handler.go +++ b/backend/internal/api/inference_handler.go @@ -5,18 +5,20 @@ import ( "github.com/go-chi/chi/v5" + openshell "github.com/rhuss/openshell-sdk-go/openshell/v1" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/models" ) // GetInferenceRoute fetches the workspace inference route. ?route=sandbox-system // targets the system route; default is the user-facing inference.local route. func (app *App) GetInferenceRoute(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.GetInferenceRoute(r.Context(), chi.URLParam(r, "workspace"), r.URL.Query().Get("route")) + route, err := app.client.Inference().GetRoute(r.Context(), chi.URLParam(r, "workspace"), r.URL.Query().Get("route")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromInferenceRoute(resp)) + writeJSON(w, http.StatusOK, models.FromInferenceRoute(route)) } // SetInferenceRouteRequest configures how inference.local resolves for the @@ -39,26 +41,25 @@ func (app *App) SetInferenceRoute(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_route", "providerName and modelId are required") return } - resp, err := app.gateway.SetInferenceRoute(r.Context(), chi.URLParam(r, "workspace"), body.RouteName, body.ProviderName, body.ModelID, body.TimeoutSecs, body.NoVerify) + route, err := app.client.Inference().SetRoute(r.Context(), chi.URLParam(r, "workspace"), &openshell.InferenceRouteConfig{ + RouteName: body.RouteName, + ProviderName: body.ProviderName, + ModelID: body.ModelID, + TimeoutSecs: body.TimeoutSecs, + NoVerify: body.NoVerify, + }) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.InferenceRoute{ - RouteName: resp.GetRouteName(), - ProviderName: resp.GetProviderName(), - ModelID: resp.GetModelId(), - Version: resp.GetVersion(), - TimeoutSecs: resp.GetTimeoutSecs(), - }) + writeJSON(w, http.StatusOK, models.FromInferenceRoute(route)) } // DeleteInferenceRoute removes the workspace inference route. func (app *App) DeleteInferenceRoute(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.DeleteInferenceRoute(r.Context(), chi.URLParam(r, "workspace"), r.URL.Query().Get("route")) - if err != nil { - writeGrpcError(w, err) + if err := app.client.Inference().DeleteRoute(r.Context(), chi.URLParam(r, "workspace"), r.URL.Query().Get("route")); err != nil { + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, map[string]bool{"deleted": resp.GetDeleted()}) + writeJSON(w, http.StatusOK, map[string]bool{"deleted": true}) } diff --git a/backend/internal/api/logs_handler.go b/backend/internal/api/logs_handler.go index 59b4e73..c300c44 100644 --- a/backend/internal/api/logs_handler.go +++ b/backend/internal/api/logs_handler.go @@ -3,14 +3,17 @@ package api import ( "net/http" "strconv" + "time" "github.com/go-chi/chi/v5" + openshell "github.com/rhuss/openshell-sdk-go/openshell/v1" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/models" ) -// GetSandboxLogs serves the polled logs view. GetSandboxLogs (gRPC) takes -// sandbox_id, not name — the BFF resolves name → metadata.id via GetSandbox. +// GetSandboxLogs serves the polled logs view. The SDK resolves sandbox name +// to sandbox_id internally. // // Query params: lines (default 200), sinceMs, source (repeatable: // gateway|sandbox), level (min level, e.g. INFO). @@ -18,48 +21,46 @@ func (app *App) GetSandboxLogs(w http.ResponseWriter, r *http.Request) { workspace := chi.URLParam(r, "workspace") name := chi.URLParam(r, "name") - sandbox, err := app.gateway.GetSandbox(r.Context(), workspace, name) - if err != nil { - writeGrpcError(w, err) - return - } - sandboxID := sandbox.GetMetadata().GetId() - if sandboxID == "" { - writeError(w, http.StatusNotFound, "not_found", "sandbox has no id") - return - } - query := r.URL.Query() + var opts []openshell.LogOption + lines := uint32(200) if raw := query.Get("lines"); raw != "" { if parsed, parseErr := strconv.ParseUint(raw, 10, 32); parseErr == nil { lines = uint32(parsed) } } - var sinceMs int64 + opts = append(opts, openshell.WithLogLines(lines)) + if raw := query.Get("sinceMs"); raw != "" { - if parsed, parseErr := strconv.ParseInt(raw, 10, 64); parseErr == nil { - sinceMs = parsed + if ms, parseErr := strconv.ParseInt(raw, 10, 64); parseErr == nil { + opts = append(opts, openshell.WithLogSince(time.UnixMilli(ms))) } } + if sources := query["source"]; len(sources) > 0 { + opts = append(opts, openshell.WithLogSources(sources...)) + } + if level := query.Get("level"); level != "" { + opts = append(opts, openshell.WithLogMinLevel(level)) + } - resp, err := app.gateway.GetSandboxLogs(r.Context(), workspace, sandboxID, lines, sinceMs, query["source"], query.Get("level")) + result, err := app.client.Sandboxes().GetLogs(r.Context(), workspace, name, opts...) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromSandboxLogs(resp)) + writeJSON(w, http.StatusOK, models.FromSandboxLogs(result)) } // ListSandboxProviders lists provider records attached to a sandbox. func (app *App) ListSandboxProviders(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.ListSandboxProviders(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) + providers, err := app.client.Sandboxes().ListProviders(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - out := make([]models.Provider, 0, len(resp.GetProviders())) - for _, provider := range resp.GetProviders() { + out := make([]models.Provider, 0, len(providers)) + for _, provider := range providers { out = append(out, models.FromProvider(provider)) } writeJSON(w, http.StatusOK, out) @@ -77,26 +78,26 @@ func (app *App) AttachSandboxProvider(w http.ResponseWriter, r *http.Request) { if r.ContentLength > 0 && !decodeBody(w, r, &body) { return } - resp, err := app.gateway.AttachSandboxProvider(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "provider"), body.ExpectedResourceVersion) + result, err := app.client.Sandboxes().AttachProvider(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "provider"), body.ExpectedResourceVersion) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]any{ - "attached": resp.GetAttached(), - "sandbox": models.FromSandbox(resp.GetSandbox()), + "attached": result.Attached, + "sandbox": models.FromSandbox(result.Sandbox), }) } // DetachSandboxProvider detaches a provider from a sandbox. func (app *App) DetachSandboxProvider(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.DetachSandboxProvider(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "provider"), 0) + result, err := app.client.Sandboxes().DetachProvider(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "provider"), 0) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]any{ - "detached": resp.GetDetached(), - "sandbox": models.FromSandbox(resp.GetSandbox()), + "detached": result.Detached, + "sandbox": models.FromSandbox(result.Sandbox), }) } diff --git a/backend/internal/api/policies_handler.go b/backend/internal/api/policies_handler.go index 67da963..e76e1a3 100644 --- a/backend/internal/api/policies_handler.go +++ b/backend/internal/api/policies_handler.go @@ -5,44 +5,35 @@ import ( "net/http" "github.com/go-chi/chi/v5" - "google.golang.org/protobuf/encoding/protojson" - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" + openshell "github.com/rhuss/openshell-sdk-go/openshell/v1" + sdktypes "github.com/rhuss/openshell-sdk-go/openshell/v1/types" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/models" ) // GetSandboxPolicy returns the latest revision, active version, and revision -// history for a sandbox (GetSandboxPolicyStatus + ListSandboxPolicies). +// history for a sandbox. func (app *App) GetSandboxPolicy(w http.ResponseWriter, r *http.Request) { workspace := chi.URLParam(r, "workspace") name := chi.URLParam(r, "name") - status, err := app.gateway.GetSandboxPolicyStatus(r.Context(), workspace, name, 0, false) - if err != nil { - writeGrpcError(w, err) - return - } - list, err := app.gateway.ListSandboxPolicies(r.Context(), workspace, name, 0, 0, false) + status, err := app.client.Policy().GetStatus(r.Context(), workspace, name) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } + latest := models.FromPolicyRevision(&status.Revision) view := models.SandboxPolicyView{ - ActiveVersion: status.GetActiveVersion(), - Revisions: []models.PolicyRevision{}, - } - if status.GetRevision() != nil { - latest := models.FromPolicyRevision(status.GetRevision()) - view.Latest = &latest - } - for _, revision := range list.GetRevisions() { - view.Revisions = append(view.Revisions, models.FromPolicyRevision(revision)) + ActiveVersion: status.ActiveVersion, + Latest: &latest, + Revisions: []models.PolicyRevision{latest}, } writeJSON(w, http.StatusOK, view) } -// UpdatePolicyRequest carries the full replacement policy as protojson. +// UpdatePolicyRequest carries the full replacement policy as JSON. // Sandbox-scoped updates may only change network_policies and inference // fields — filesystem/landlock/process must match the create-time policy. type UpdatePolicyRequest struct { @@ -50,7 +41,7 @@ type UpdatePolicyRequest struct { ExpectedResourceVersion uint64 `json:"expectedResourceVersion,omitempty"` } -// UpdateSandboxPolicy applies a policy update to a sandbox via UpdateConfig. +// UpdateSandboxPolicy applies a policy update to a sandbox via Config.Update. func (app *App) UpdateSandboxPolicy(w http.ResponseWriter, r *http.Request) { var body UpdatePolicyRequest if !decodeBody(w, r, &body) { @@ -65,27 +56,31 @@ func (app *App) UpdateSandboxPolicy(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_policy", "policy does not match the SandboxPolicy schema: "+err.Error()) return } - resp, err := app.gateway.UpdateSandboxPolicy(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), policy, body.ExpectedResourceVersion) + result, err := app.client.Config().Update(r.Context(), chi.URLParam(r, "workspace"), &openshell.ConfigUpdate{ + Name: chi.URLParam(r, "name"), + Policy: policy, + ExpectedResourceVersion: body.ExpectedResourceVersion, + }) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, models.PolicyUpdateResult{ - Version: resp.GetVersion(), - PolicyHash: resp.GetPolicyHash(), + Version: result.Version, + PolicyHash: result.PolicyHash, }) } // GetGlobalPolicy returns gateway-global policy revisions (Platform Admin). func (app *App) GetGlobalPolicy(w http.ResponseWriter, r *http.Request) { - list, err := app.gateway.ListSandboxPolicies(r.Context(), "", "", 0, 0, true) + revisions, err := app.client.Policy().List(r.Context(), "", sdktypes.WithListGlobal(true)) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } view := models.SandboxPolicyView{Revisions: []models.PolicyRevision{}} - for _, revision := range list.GetRevisions() { - view.Revisions = append(view.Revisions, models.FromPolicyRevision(revision)) + for i := range revisions { + view.Revisions = append(view.Revisions, models.FromPolicyRevision(&revisions[i])) } if len(view.Revisions) > 0 { view.Latest = &view.Revisions[0] @@ -110,22 +105,30 @@ func (app *App) SetGlobalPolicy(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_policy", "policy does not match the SandboxPolicy schema: "+err.Error()) return } - resp, err := app.gateway.SetGlobalPolicy(r.Context(), policy) + result, err := app.client.Config().Update(r.Context(), "", &openshell.ConfigUpdate{ + Policy: policy, + Global: true, + }) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, models.PolicyUpdateResult{ - Version: resp.GetVersion(), - PolicyHash: resp.GetPolicyHash(), + Version: result.Version, + PolicyHash: result.PolicyHash, }) } // DeleteGlobalPolicy removes the gateway-global policy lock, restoring // sandbox-level policy control. Platform Admin operation. func (app *App) DeleteGlobalPolicy(w http.ResponseWriter, r *http.Request) { - if err := app.gateway.DeleteGlobalPolicy(r.Context()); err != nil { - writeGrpcError(w, err) + _, err := app.client.Config().Update(r.Context(), "", &openshell.ConfigUpdate{ + Global: true, + DeleteSetting: true, + SettingKey: "policy", + }) + if err != nil { + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]bool{"deleted": true}) @@ -134,24 +137,28 @@ func (app *App) DeleteGlobalPolicy(w http.ResponseWriter, r *http.Request) { // GetDraftPolicy returns the draft-policy inbox for a sandbox. Optional // ?status=pending|approved|rejected filter. func (app *App) GetDraftPolicy(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.GetDraftPolicy(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), r.URL.Query().Get("status")) + var opts []openshell.GetDraftOption + if status := r.URL.Query().Get("status"); status != "" { + opts = append(opts, openshell.WithStatusFilter(status)) + } + draft, err := app.client.Policy().GetDraft(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), opts...) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromDraftPolicy(resp)) + writeJSON(w, http.StatusOK, models.FromDraftPolicy(draft)) } // ApproveDraftChunk merges one proposed rule into the active policy. func (app *App) ApproveDraftChunk(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.ApproveDraftChunk(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "chunk")) + result, err := app.client.Policy().ApproveDraftChunk(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "chunk")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, models.PolicyUpdateResult{ - Version: resp.GetPolicyVersion(), - PolicyHash: resp.GetPolicyHash(), + Version: result.PolicyVersion, + PolicyHash: result.PolicyHash, }) } @@ -167,8 +174,8 @@ func (app *App) RejectDraftChunk(w http.ResponseWriter, r *http.Request) { if r.ContentLength > 0 && !decodeBody(w, r, &body) { return } - if _, err := app.gateway.RejectDraftChunk(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "chunk"), body.Reason); err != nil { - writeGrpcError(w, err) + if err := app.client.Policy().RejectDraftChunk(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "chunk"), body.Reason); err != nil { + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]bool{"rejected": true}) @@ -186,20 +193,24 @@ func (app *App) ApproveAllDraftChunks(w http.ResponseWriter, r *http.Request) { if r.ContentLength > 0 && !decodeBody(w, r, &body) { return } - resp, err := app.gateway.ApproveAllDraftChunks(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), body.IncludeSecurityFlagged) + var opts []openshell.ApproveAllOption + if body.IncludeSecurityFlagged { + opts = append(opts, openshell.WithIncludeSecurityFlagged()) + } + result, err := app.client.Policy().ApproveAllDraftChunks(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), opts...) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]any{ - "policyVersion": resp.GetPolicyVersion(), - "policyHash": resp.GetPolicyHash(), - "chunksApproved": resp.GetChunksApproved(), - "chunksSkipped": resp.GetChunksSkipped(), + "policyVersion": result.PolicyVersion, + "policyHash": result.PolicyHash, + "chunksApproved": result.ChunksApproved, + "chunksSkipped": result.ChunksSkipped, }) } -// EditDraftChunkRequest carries the replacement proposed rule as protojson. +// EditDraftChunkRequest carries the replacement proposed rule as JSON. type EditDraftChunkRequest struct { ProposedRule json.RawMessage `json:"proposedRule"` } @@ -214,13 +225,13 @@ func (app *App) EditDraftChunk(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_rule", "proposedRule is required") return } - rule := &sandboxv1.NetworkPolicyRule{} - if err := protojson.Unmarshal(body.ProposedRule, rule); err != nil { + rule, err := models.ParseNetworkPolicyRule(body.ProposedRule) + if err != nil { writeError(w, http.StatusBadRequest, "invalid_rule", "proposedRule does not match NetworkPolicyRule schema: "+err.Error()) return } - if err := app.gateway.EditDraftChunk(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "chunk"), rule); err != nil { - writeGrpcError(w, err) + if err := app.client.Policy().EditDraftChunk(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "chunk"), rule); err != nil { + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]bool{"edited": true}) @@ -229,36 +240,37 @@ func (app *App) EditDraftChunk(w http.ResponseWriter, r *http.Request) { // UndoDraftChunk reverts an already-approved chunk, removing its rule from the // active policy. func (app *App) UndoDraftChunk(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.UndoDraftChunk(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "chunk")) + result, err := app.client.Policy().UndoDraftChunk(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "chunk")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, models.PolicyUpdateResult{ - Version: resp.GetPolicyVersion(), - PolicyHash: resp.GetPolicyHash(), + Version: result.PolicyVersion, + PolicyHash: result.PolicyHash, }) } // ClearDraftChunks removes all pending draft chunks for a sandbox. func (app *App) ClearDraftChunks(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.ClearDraftChunks(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) + result, err := app.client.Policy().ClearDraftChunks(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]any{ - "chunksCleared": resp.GetChunksCleared(), + "chunksCleared": result.ChunksCleared, }) } // GetDraftHistory returns the chronological decision history for a sandbox's // draft policy. func (app *App) GetDraftHistory(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.GetDraftHistory(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) + entries, err := app.client.Policy().GetDraftHistory(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromDraftHistory(resp)) + writeJSON(w, http.StatusOK, models.FromDraftHistory(entries)) } + diff --git a/backend/internal/api/providers_handler.go b/backend/internal/api/providers_handler.go index ebb8fb0..cf74044 100644 --- a/backend/internal/api/providers_handler.go +++ b/backend/internal/api/providers_handler.go @@ -2,13 +2,13 @@ package api import ( "net/http" + "time" "github.com/go-chi/chi/v5" - "github.com/Gkrumbach07/openshell-dashboard/backend/internal/models" + openshell "github.com/rhuss/openshell-sdk-go/openshell/v1" - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/models" ) // CreateProviderRequest is the create-provider body. Credentials are @@ -22,9 +22,9 @@ type CreateProviderRequest struct { } func (app *App) ListProviders(w http.ResponseWriter, r *http.Request) { - providers, err := app.gateway.ListProviders(r.Context(), chi.URLParam(r, "workspace"), 0, 0) + providers, err := app.client.Providers().List(r.Context(), chi.URLParam(r, "workspace")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } out := make([]models.Provider, 0, len(providers)) @@ -43,39 +43,38 @@ func (app *App) CreateProvider(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_provider", "name and type are required") return } - provider := &datamodelv1.Provider{ - Metadata: &datamodelv1.ObjectMeta{ - Name: body.Name, - Labels: body.Labels, + provider := &openshell.Provider{ + Name: body.Name, + Type: body.Type, + Labels: body.Labels, + Spec: openshell.ProviderSpec{ + Credentials: body.Credentials, + Config: body.Config, }, - Type: body.Type, - Credentials: body.Credentials, - Config: body.Config, } - created, err := app.gateway.CreateProvider(r.Context(), chi.URLParam(r, "workspace"), provider) + created, err := app.client.Providers().Create(r.Context(), chi.URLParam(r, "workspace"), provider) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusCreated, models.FromProvider(created)) } func (app *App) GetProvider(w http.ResponseWriter, r *http.Request) { - provider, err := app.gateway.GetProvider(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) + provider, err := app.client.Providers().Get(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, models.FromProvider(provider)) } func (app *App) DeleteProvider(w http.ResponseWriter, r *http.Request) { - deleted, err := app.gateway.DeleteProvider(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) - if err != nil { - writeGrpcError(w, err) + if err := app.client.Providers().Delete(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")); err != nil { + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, map[string]bool{"deleted": deleted}) + writeJSON(w, http.StatusOK, map[string]bool{"deleted": true}) } // UpdateProviderBody is the update-provider body. Only non-nil maps are @@ -94,48 +93,54 @@ func (app *App) UpdateProvider(w http.ResponseWriter, r *http.Request) { workspace := chi.URLParam(r, "workspace") name := chi.URLParam(r, "name") - existing, err := app.gateway.GetProvider(r.Context(), workspace, name) + existing, err := app.client.Providers().Get(r.Context(), workspace, name) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } provider := existing if body.Credentials != nil { - provider.Credentials = body.Credentials + provider.Spec.Credentials = body.Credentials } if body.Config != nil { - provider.Config = body.Config + provider.Spec.Config = body.Config + } + if body.CredentialExpiresAtMs != nil { + expires := make(map[string]time.Time, len(body.CredentialExpiresAtMs)) + for k, ms := range body.CredentialExpiresAtMs { + expires[k] = time.UnixMilli(ms) + } + provider.Spec.CredentialExpiresAt = expires } - updated, err := app.gateway.UpdateProvider(r.Context(), workspace, provider, body.CredentialExpiresAtMs) + updated, err := app.client.Providers().Update(r.Context(), workspace, provider) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, models.FromProvider(updated)) } func (app *App) GetProviderRefreshStatus(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.GetProviderRefreshStatus(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), "") + statuses, err := app.client.Providers().Refresh().GetStatus(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), "") if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - out := make([]models.CredentialRefreshStatus, 0, len(resp.GetCredentials())) - for _, cred := range resp.GetCredentials() { - out = append(out, models.FromCredentialRefreshStatus(cred)) + out := make([]models.CredentialRefreshStatus, 0, len(statuses)) + for _, s := range statuses { + out = append(out, models.FromCredentialRefreshStatus(s)) } writeJSON(w, http.StatusOK, out) } -var refreshStrategyMap = map[string]openshellv1.ProviderCredentialRefreshStrategy{ - "oauth2-refresh-token": openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN, - "oauth2-client-credentials": openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS, - "google-service-account-jwt": openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT, - "aws-sts-assume-role": openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE, - "static": openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC, - "external": openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL, +var refreshStrategyMap = map[string]openshell.RefreshStrategy{ + "oauth2-refresh-token": openshell.RefreshStrategyOAuth2RefreshToken, + "oauth2-client-credentials": openshell.RefreshStrategyOAuth2ClientCredentials, + "google-service-account-jwt": openshell.RefreshStrategyGoogleServiceAccountJWT, + "static": openshell.RefreshStrategyStatic, + "external": openshell.RefreshStrategyExternal, } type ConfigureProviderRefreshBody struct { @@ -160,21 +165,23 @@ func (app *App) ConfigureProviderRefresh(w http.ResponseWriter, r *http.Request) writeError(w, http.StatusBadRequest, "invalid_strategy", "unknown refresh strategy: "+body.Strategy) return } - resp, err := app.gateway.ConfigureProviderRefresh( - r.Context(), - chi.URLParam(r, "workspace"), - chi.URLParam(r, "name"), - body.CredentialKey, - strategy, - body.Material, - body.SecretMaterialKeys, - body.ExpiresAtMs, - ) + cfg := &openshell.RefreshConfig{ + Provider: chi.URLParam(r, "name"), + CredentialKey: body.CredentialKey, + Strategy: strategy, + Material: body.Material, + SecretMaterialKeys: body.SecretMaterialKeys, + } + if body.ExpiresAtMs != nil { + t := time.UnixMilli(*body.ExpiresAtMs) + cfg.ExpiresAt = &t + } + status, err := app.client.Providers().Refresh().Configure(r.Context(), chi.URLParam(r, "workspace"), cfg) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromCredentialRefreshStatus(resp.GetStatus())) + writeJSON(w, http.StatusOK, models.FromCredentialRefreshStatus(status)) } type RotateProviderCredentialBody struct { @@ -190,17 +197,17 @@ func (app *App) RotateProviderCredential(w http.ResponseWriter, r *http.Request) writeError(w, http.StatusBadRequest, "invalid_request", "credentialKey is required") return } - resp, err := app.gateway.RotateProviderCredential( + status, err := app.client.Providers().Refresh().Rotate( r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), body.CredentialKey, ) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromCredentialRefreshStatus(resp.GetStatus())) + writeJSON(w, http.StatusOK, models.FromCredentialRefreshStatus(status)) } func (app *App) DeleteProviderRefresh(w http.ResponseWriter, r *http.Request) { @@ -209,14 +216,14 @@ func (app *App) DeleteProviderRefresh(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_request", "credentialKey query parameter is required") return } - deleted, err := app.gateway.DeleteProviderRefresh( + deleted, err := app.client.Providers().Refresh().Delete( r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), credentialKey, ) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]bool{"deleted": deleted}) @@ -225,9 +232,9 @@ func (app *App) DeleteProviderRefresh(w http.ResponseWriter, r *http.Request) { // ListProviderProfiles returns the provider type profiles whose credential // schemas drive the Add Provider form. func (app *App) ListProviderProfiles(w http.ResponseWriter, r *http.Request) { - profiles, err := app.gateway.ListProviderProfiles(r.Context(), chi.URLParam(r, "workspace"), 0, 0) + profiles, err := app.client.Providers().Profiles().List(r.Context(), chi.URLParam(r, "workspace")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } out := make([]models.ProviderProfile, 0, len(profiles)) diff --git a/backend/internal/api/respond.go b/backend/internal/api/respond.go index e405142..3541799 100644 --- a/backend/internal/api/respond.go +++ b/backend/internal/api/respond.go @@ -6,6 +6,7 @@ import ( "net/http" "regexp" + openshell "github.com/rhuss/openshell-sdk-go/openshell/v1" "google.golang.org/grpc/codes" "google.golang.org/grpc/status" ) @@ -28,34 +29,53 @@ func writeError(w http.ResponseWriter, statusCode int, code, message string) { writeJSON(w, statusCode, ErrorResponse{Code: code, Message: message}) } -// writeGrpcError maps a gateway gRPC error onto a safe HTTP error response. -func writeGrpcError(w http.ResponseWriter, err error) { - st, ok := status.FromError(err) - if !ok { - slog.Error("gateway call failed", "error", err) - writeError(w, http.StatusInternalServerError, "internal", "internal error") - return - } - slog.Warn("gateway error", "code", st.Code().String(), "message", st.Message()) - switch st.Code() { - case codes.NotFound: - writeError(w, http.StatusNotFound, "not_found", st.Message()) - case codes.AlreadyExists: - writeError(w, http.StatusConflict, "already_exists", st.Message()) - case codes.InvalidArgument, codes.FailedPrecondition, codes.OutOfRange: - writeError(w, http.StatusBadRequest, "invalid_argument", st.Message()) - case codes.PermissionDenied: - writeError(w, http.StatusForbidden, "permission_denied", st.Message()) - case codes.Unauthenticated: - writeError(w, http.StatusUnauthorized, "unauthenticated", st.Message()) - case codes.Aborted: - writeError(w, http.StatusConflict, "conflict", st.Message()) - case codes.ResourceExhausted: - writeError(w, http.StatusTooManyRequests, "resource_exhausted", st.Message()) - case codes.Unavailable, codes.DeadlineExceeded: +// writeSDKError maps an SDK/gRPC error onto a safe HTTP error response. +func writeSDKError(w http.ResponseWriter, err error) { + msg := err.Error() + + switch { + case openshell.IsNotFound(err): + slog.Warn("gateway error", "code", "NotFound", "message", msg) + writeError(w, http.StatusNotFound, "not_found", msg) + case openshell.IsAlreadyExists(err): + slog.Warn("gateway error", "code", "AlreadyExists", "message", msg) + writeError(w, http.StatusConflict, "already_exists", msg) + case openshell.IsInvalidArgument(err): + slog.Warn("gateway error", "code", "InvalidArgument", "message", msg) + writeError(w, http.StatusBadRequest, "invalid_argument", msg) + case openshell.IsPermissionDenied(err): + slog.Warn("gateway error", "code", "PermissionDenied", "message", msg) + writeError(w, http.StatusForbidden, "permission_denied", msg) + case openshell.IsUnauthenticated(err): + slog.Warn("gateway error", "code", "Unauthenticated", "message", msg) + writeError(w, http.StatusUnauthorized, "unauthenticated", msg) + case openshell.IsConflict(err): + slog.Warn("gateway error", "code", "Aborted", "message", msg) + writeError(w, http.StatusConflict, "conflict", msg) + case openshell.IsUnavailable(err): + slog.Warn("gateway error", "code", "Unavailable", "message", msg) + writeError(w, http.StatusBadGateway, "gateway_unavailable", "OpenShell gateway is unreachable") + case openshell.IsDeadlineExceeded(err): + slog.Warn("gateway error", "code", "DeadlineExceeded", "message", msg) writeError(w, http.StatusBadGateway, "gateway_unavailable", "OpenShell gateway is unreachable") default: - writeError(w, http.StatusInternalServerError, "internal", "internal error") + // Fallback to gRPC status codes for edge cases (FailedPrecondition, + // OutOfRange, ResourceExhausted) that may surface from raw gRPC errors. + st, ok := status.FromError(err) + if !ok { + slog.Error("gateway call failed", "error", err) + writeError(w, http.StatusInternalServerError, "internal", "internal error") + return + } + slog.Warn("gateway error", "code", st.Code().String(), "message", st.Message()) + switch st.Code() { + case codes.FailedPrecondition, codes.OutOfRange: + writeError(w, http.StatusBadRequest, "invalid_argument", st.Message()) + case codes.ResourceExhausted: + writeError(w, http.StatusTooManyRequests, "resource_exhausted", st.Message()) + default: + writeError(w, http.StatusInternalServerError, "internal", "internal error") + } } } diff --git a/backend/internal/api/sandboxes_handler.go b/backend/internal/api/sandboxes_handler.go index ce31dc9..f7750d5 100644 --- a/backend/internal/api/sandboxes_handler.go +++ b/backend/internal/api/sandboxes_handler.go @@ -5,12 +5,10 @@ import ( "net/http" "github.com/go-chi/chi/v5" - "google.golang.org/protobuf/proto" - "google.golang.org/protobuf/types/known/structpb" - "github.com/Gkrumbach07/openshell-dashboard/backend/internal/models" + openshell "github.com/rhuss/openshell-sdk-go/openshell/v1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/models" ) // CreateSandboxRequest is the create-sandbox body. Policy is required by the @@ -34,9 +32,13 @@ type CreateSandboxRequest struct { } func (app *App) ListSandboxes(w http.ResponseWriter, r *http.Request) { - sandboxes, err := app.gateway.ListSandboxes(r.Context(), chi.URLParam(r, "workspace"), 0, 0, r.URL.Query().Get("labelSelector")) + var opts []openshell.ListOptions + if sel := r.URL.Query().Get("labelSelector"); sel != "" { + opts = append(opts, openshell.ListOptions{LabelSelector: sel}) + } + sandboxes, err := app.client.Sandboxes().List(r.Context(), chi.URLParam(r, "workspace"), opts...) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } out := make([]models.Sandbox, 0, len(sandboxes)) @@ -69,57 +71,38 @@ func (app *App) CreateSandbox(w http.ResponseWriter, r *http.Request) { return } - template := &openshellv1.SandboxTemplate{Image: body.Image} - if body.Cpu != "" || body.Memory != "" { - limits := map[string]any{} - if body.Cpu != "" { - limits["cpu"] = body.Cpu - } - if body.Memory != "" { - limits["memory"] = body.Memory - } - resources, err := structpb.NewStruct(map[string]any{"limits": limits}) - if err != nil { - writeError(w, http.StatusBadRequest, "invalid_resources", "invalid cpu/memory values") - return - } - template.Resources = resources - } - - spec := &openshellv1.SandboxSpec{ + spec := &openshell.SandboxSpec{ LogLevel: body.LogLevel, Environment: body.Environment, - Template: template, + Template: &openshell.SandboxTemplate{Image: body.Image}, Policy: policy, Providers: body.Providers, } if body.GpuCount > 0 { - spec.ResourceRequirements = &openshellv1.ResourceRequirements{ - Gpu: &openshellv1.GpuResourceRequirements{Count: proto.Uint32(body.GpuCount)}, - } + gpu := body.GpuCount + spec.GPUCount = &gpu } - sandbox, err := app.gateway.CreateSandbox(r.Context(), chi.URLParam(r, "workspace"), body.Name, spec, body.Labels, body.Annotations) + sandbox, err := app.client.Sandboxes().Create(r.Context(), chi.URLParam(r, "workspace"), body.Name, spec, body.Labels) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusCreated, models.FromSandbox(sandbox)) } func (app *App) GetSandbox(w http.ResponseWriter, r *http.Request) { - sandbox, err := app.gateway.GetSandbox(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) + sandbox, err := app.client.Sandboxes().Get(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, models.FromSandbox(sandbox)) } func (app *App) DeleteSandbox(w http.ResponseWriter, r *http.Request) { - deleted, err := app.gateway.DeleteSandbox(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) - if err != nil { - writeGrpcError(w, err) + if err := app.client.Sandboxes().Delete(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")); err != nil { + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, map[string]bool{"deleted": deleted}) + writeJSON(w, http.StatusOK, map[string]bool{"deleted": true}) } diff --git a/backend/internal/api/services_handler.go b/backend/internal/api/services_handler.go index a95e705..fc02dae 100644 --- a/backend/internal/api/services_handler.go +++ b/backend/internal/api/services_handler.go @@ -15,14 +15,14 @@ type ExposeServiceRequest struct { } func (app *App) ListServices(w http.ResponseWriter, r *http.Request) { - services, err := app.gateway.ListServices(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) + services, err := app.client.Services().List(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } out := make([]models.ServiceEndpoint, 0, len(services)) for _, svc := range services { - out = append(out, models.FromServiceEndpointResponse(svc)) + out = append(out, models.FromServiceEndpoint(svc)) } writeJSON(w, http.StatusOK, out) } @@ -40,19 +40,18 @@ func (app *App) ExposeService(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_port", "targetPort must be greater than 0") return } - resp, err := app.gateway.ExposeService(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), body.Service, body.TargetPort, body.Domain) + svc, err := app.client.Services().Expose(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), body.Service, body.TargetPort, body.Domain) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusCreated, models.FromServiceEndpointResponse(resp)) + writeJSON(w, http.StatusCreated, models.FromServiceEndpoint(svc)) } func (app *App) DeleteService(w http.ResponseWriter, r *http.Request) { - deleted, err := app.gateway.DeleteService(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "svc")) - if err != nil { - writeGrpcError(w, err) + if err := app.client.Services().Delete(r.Context(), chi.URLParam(r, "workspace"), chi.URLParam(r, "name"), chi.URLParam(r, "svc")); err != nil { + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, map[string]bool{"deleted": deleted}) + writeJSON(w, http.StatusOK, map[string]bool{"deleted": true}) } diff --git a/backend/internal/api/settings_handler.go b/backend/internal/api/settings_handler.go index 7c16894..c8e21bc 100644 --- a/backend/internal/api/settings_handler.go +++ b/backend/internal/api/settings_handler.go @@ -3,16 +3,18 @@ package api import ( "net/http" + openshell "github.com/rhuss/openshell-sdk-go/openshell/v1" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/models" ) func (app *App) GetGlobalSettings(w http.ResponseWriter, r *http.Request) { - resp, err := app.gateway.GetGatewaySettings(r.Context()) + config, err := app.client.Config().GetGateway(r.Context()) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, models.FromGatewaySettings(resp)) + writeJSON(w, http.StatusOK, models.FromGatewaySettings(config)) } type SetSettingRequest struct { @@ -29,8 +31,12 @@ func (app *App) SetGlobalSetting(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_setting", "key is required") return } - if err := app.gateway.SetSetting(r.Context(), body.Key, body.Value); err != nil { - writeGrpcError(w, err) + if _, err := app.client.Config().Update(r.Context(), "", &openshell.ConfigUpdate{ + SettingKey: body.Key, + SettingValue: &openshell.SettingValue{Type: openshell.SettingValueString, StringVal: body.Value}, + Global: true, + }); err != nil { + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]bool{"updated": true}) @@ -42,8 +48,12 @@ func (app *App) DeleteGlobalSetting(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_setting", "key query parameter is required") return } - if err := app.gateway.DeleteSetting(r.Context(), key); err != nil { - writeGrpcError(w, err) + if _, err := app.client.Config().Update(r.Context(), "", &openshell.ConfigUpdate{ + SettingKey: key, + DeleteSetting: true, + Global: true, + }); err != nil { + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, map[string]bool{"deleted": true}) diff --git a/backend/internal/api/terminal_handler.go b/backend/internal/api/terminal_handler.go deleted file mode 100644 index 77af61f..0000000 --- a/backend/internal/api/terminal_handler.go +++ /dev/null @@ -1,133 +0,0 @@ -package api - -import ( - "context" - "encoding/json" - "log/slog" - "net/http" - "strconv" - - "github.com/go-chi/chi/v5" - "github.com/gorilla/websocket" - - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" -) - -var upgrader = websocket.Upgrader{ - CheckOrigin: func(r *http.Request) bool { return true }, -} - -type resizeMessage struct { - Type string `json:"type"` - Cols uint32 `json:"cols"` - Rows uint32 `json:"rows"` -} - -func (app *App) Terminal(w http.ResponseWriter, r *http.Request) { - workspace := chi.URLParam(r, "workspace") - name := chi.URLParam(r, "name") - - sandbox, err := app.gateway.GetSandbox(r.Context(), workspace, name) - if err != nil { - writeGrpcError(w, err) - return - } - sandboxID := sandbox.GetMetadata().GetId() - - cols := uint32(80) - rows := uint32(24) - if c, err := strconv.ParseUint(r.URL.Query().Get("cols"), 10, 32); err == nil { - cols = uint32(c) - } - if ro, err := strconv.ParseUint(r.URL.Query().Get("rows"), 10, 32); err == nil { - rows = uint32(ro) - } - - ws, err := upgrader.Upgrade(w, r, nil) - if err != nil { - slog.Error("websocket upgrade failed", "error", err) - return - } - defer ws.Close() - - ctx, cancel := context.WithCancel(r.Context()) - defer cancel() - - slog.Info("opening exec stream", "sandbox_id", sandboxID, "cols", cols, "rows", rows) - stream, err := app.gateway.ExecSandboxInteractive(ctx) - if err != nil { - slog.Error("exec stream open failed", "error", err) - ws.WriteMessage(websocket.CloseMessage, - websocket.FormatCloseMessage(websocket.CloseInternalServerErr, "failed to open exec stream")) - return - } - slog.Info("exec stream opened, sending start") - - if err := stream.Send(&openshellv1.ExecSandboxInput{ - Payload: &openshellv1.ExecSandboxInput_Start{ - Start: &openshellv1.ExecSandboxRequest{ - SandboxId: sandboxID, - Command: []string{"/bin/bash"}, - Tty: true, - Cols: cols, - Rows: rows, - }, - }, - }); err != nil { - slog.Error("exec start failed", "error", err) - ws.WriteMessage(websocket.CloseMessage, - websocket.FormatCloseMessage(websocket.CloseInternalServerErr, "failed to start exec")) - return - } - slog.Info("exec start sent, entering relay loop") - - // gRPC -> WS - go func() { - defer cancel() - for { - event, err := stream.Recv() - if err != nil { - return - } - switch p := event.Payload.(type) { - case *openshellv1.ExecSandboxEvent_Stdout: - ws.WriteMessage(websocket.BinaryMessage, p.Stdout.Data) - case *openshellv1.ExecSandboxEvent_Stderr: - ws.WriteMessage(websocket.BinaryMessage, p.Stderr.Data) - case *openshellv1.ExecSandboxEvent_Exit: - msg := websocket.FormatCloseMessage(websocket.CloseNormalClosure, - strconv.Itoa(int(p.Exit.ExitCode))) - ws.WriteMessage(websocket.CloseMessage, msg) - return - } - } - }() - - // WS -> gRPC - for { - msgType, data, err := ws.ReadMessage() - if err != nil { - cancel() - return - } - if msgType == websocket.TextMessage { - var resize resizeMessage - if json.Unmarshal(data, &resize) == nil && resize.Type == "resize" { - stream.Send(&openshellv1.ExecSandboxInput{ - Payload: &openshellv1.ExecSandboxInput_Resize{ - Resize: &openshellv1.ExecSandboxWindowResize{ - Cols: resize.Cols, - Rows: resize.Rows, - }, - }, - }) - continue - } - } - stream.Send(&openshellv1.ExecSandboxInput{ - Payload: &openshellv1.ExecSandboxInput_Stdin{ - Stdin: data, - }, - }) - } -} diff --git a/backend/internal/api/workspaces_handler.go b/backend/internal/api/workspaces_handler.go index 21ffb23..7b0b329 100644 --- a/backend/internal/api/workspaces_handler.go +++ b/backend/internal/api/workspaces_handler.go @@ -6,6 +6,8 @@ import ( "github.com/go-chi/chi/v5" + openshell "github.com/rhuss/openshell-sdk-go/openshell/v1" + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/models" ) @@ -16,9 +18,13 @@ type CreateWorkspaceRequest struct { } func (app *App) ListWorkspaces(w http.ResponseWriter, r *http.Request) { - workspaces, err := app.gateway.ListWorkspaces(r.Context(), 0, 0, r.URL.Query().Get("labelSelector")) + var opts []openshell.ListOptions + if sel := r.URL.Query().Get("labelSelector"); sel != "" { + opts = append(opts, openshell.ListOptions{LabelSelector: sel}) + } + workspaces, err := app.client.Workspaces().List(r.Context(), opts...) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } out := make([]models.Workspace, 0, len(workspaces)) @@ -37,30 +43,29 @@ func (app *App) CreateWorkspace(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_name", "workspace name must be a valid DNS-1123 label") return } - workspace, err := app.gateway.CreateWorkspace(r.Context(), body.Name, body.Labels) + workspace, err := app.client.Workspaces().Create(r.Context(), body.Name, body.Labels) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusCreated, models.FromWorkspace(workspace)) } func (app *App) GetWorkspace(w http.ResponseWriter, r *http.Request) { - workspace, err := app.gateway.GetWorkspace(r.Context(), chi.URLParam(r, "workspace")) + workspace, err := app.client.Workspaces().Get(r.Context(), chi.URLParam(r, "workspace")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusOK, models.FromWorkspace(workspace)) } func (app *App) DeleteWorkspace(w http.ResponseWriter, r *http.Request) { - deleted, err := app.gateway.DeleteWorkspace(r.Context(), chi.URLParam(r, "workspace")) - if err != nil { - writeGrpcError(w, err) + if err := app.client.Workspaces().Delete(r.Context(), chi.URLParam(r, "workspace")); err != nil { + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, map[string]bool{"deleted": deleted}) + writeJSON(w, http.StatusOK, map[string]bool{"deleted": true}) } // AddMemberRequest is the add-member body. Role is USER or ADMIN. @@ -70,9 +75,9 @@ type AddMemberRequest struct { } func (app *App) ListMembers(w http.ResponseWriter, r *http.Request) { - members, err := app.gateway.ListWorkspaceMembers(r.Context(), chi.URLParam(r, "workspace"), 0, 0) + members, err := app.client.Workspaces().ListMembers(r.Context(), chi.URLParam(r, "workspace")) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } out := make([]models.WorkspaceMember, 0, len(members)) @@ -96,9 +101,9 @@ func (app *App) AddMember(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_role", "role must be USER or ADMIN") return } - member, err := app.gateway.AddWorkspaceMember(r.Context(), chi.URLParam(r, "workspace"), body.PrincipalSubject, role) + member, err := app.client.Workspaces().AddMember(r.Context(), chi.URLParam(r, "workspace"), body.PrincipalSubject, role) if err != nil { - writeGrpcError(w, err) + writeSDKError(w, err) return } writeJSON(w, http.StatusCreated, models.FromWorkspaceMember(member)) @@ -111,10 +116,9 @@ func (app *App) RemoveMember(w http.ResponseWriter, r *http.Request) { writeError(w, http.StatusBadRequest, "invalid_subject", "invalid member subject") return } - removed, err := app.gateway.RemoveWorkspaceMember(r.Context(), chi.URLParam(r, "workspace"), subject) - if err != nil { - writeGrpcError(w, err) + if err := app.client.Workspaces().RemoveMember(r.Context(), chi.URLParam(r, "workspace"), subject); err != nil { + writeSDKError(w, err) return } - writeJSON(w, http.StatusOK, map[string]bool{"removed": removed}) + writeJSON(w, http.StatusOK, map[string]bool{"removed": true}) } diff --git a/backend/internal/gateway/client.go b/backend/internal/gateway/client.go deleted file mode 100644 index 5608c07..0000000 --- a/backend/internal/gateway/client.go +++ /dev/null @@ -1,120 +0,0 @@ -// Package gateway is a thin wrapper over the protoc-generated OpenShell gRPC -// stubs. It wraps only the user-facing RPCs the dashboard needs (Phase 1) and -// forwards the caller's OIDC bearer token on every RPC. -package gateway - -import ( - "context" - "crypto/tls" - "crypto/x509" - "fmt" - "os" - "strings" - - "google.golang.org/grpc" - "google.golang.org/grpc/credentials" - "google.golang.org/grpc/credentials/insecure" - - "github.com/Gkrumbach07/openshell-dashboard/backend/internal/auth" - - inferencev1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/inferencev1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" -) - -// Client wraps the OpenShell gateway gRPC connection. -type Client struct { - conn *grpc.ClientConn - openshell openshellv1.OpenShellClient - inference inferencev1.InferenceClient -} - -// tokenCredentials implements grpc.PerRPCCredentials by forwarding the OIDC -// bearer token stored on the request context by the auth middleware. -type tokenCredentials struct { - requireTLS bool -} - -func (c tokenCredentials) GetRequestMetadata(ctx context.Context, _ ...string) (map[string]string, error) { - token := auth.TokenFromContext(ctx) - if token == "" { - return nil, nil - } - return map[string]string{"authorization": "Bearer " + token}, nil -} - -func (c tokenCredentials) RequireTransportSecurity() bool { - return c.requireTLS -} - -// New connects to the OpenShell gateway. The URL may be a bare host:port -// (plaintext) or prefixed with grpcs:// / https:// for TLS. If caCertPath -// is non-empty, the PEM file is loaded into the TLS RootCAs pool for -// trusting self-signed certificates. -func New(gatewayURL, caCertPath string) (*Client, error) { - target := gatewayURL - useTLS := false - for _, prefix := range []string{"grpcs://", "https://"} { - if strings.HasPrefix(target, prefix) { - target = strings.TrimPrefix(target, prefix) - useTLS = true - } - } - for _, prefix := range []string{"grpc://", "http://"} { - target = strings.TrimPrefix(target, prefix) - } - - transport := insecure.NewCredentials() - if useTLS { - tlsCfg := &tls.Config{MinVersion: tls.VersionTLS12} - if caCertPath != "" { - caCert, err := os.ReadFile(caCertPath) - if err != nil { - return nil, fmt.Errorf("read CA cert %q: %w", caCertPath, err) - } - pool := x509.NewCertPool() - if !pool.AppendCertsFromPEM(caCert) { - return nil, fmt.Errorf("failed to parse CA cert %q", caCertPath) - } - tlsCfg.RootCAs = pool - } - transport = credentials.NewTLS(tlsCfg) - } - - conn, err := grpc.NewClient(target, - grpc.WithTransportCredentials(transport), - grpc.WithPerRPCCredentials(tokenCredentials{requireTLS: useTLS}), - ) - if err != nil { - return nil, fmt.Errorf("connect to gateway %q: %w", gatewayURL, err) - } - - return &Client{ - conn: conn, - openshell: openshellv1.NewOpenShellClient(conn), - inference: inferencev1.NewInferenceClient(conn), - }, nil -} - -// Close tears down the gRPC connection. -func (c *Client) Close() error { - return c.conn.Close() -} - -// Health checks gateway health (unauthenticated RPC). -func (c *Client) Health(ctx context.Context) (*openshellv1.HealthResponse, error) { - return c.openshell.Health(ctx, &openshellv1.HealthRequest{}) -} - -// GetGatewayInfo fetches gateway status, version, and compute drivers. -func (c *Client) GetGatewayInfo(ctx context.Context) (*openshellv1.GetGatewayInfoResponse, error) { - return c.openshell.GetGatewayInfo(ctx, &openshellv1.GetGatewayInfoRequest{}) -} - -// GetCurrentUser returns the authenticated user's identity from the gateway. -func (c *Client) GetCurrentUser(ctx context.Context) (*openshellv1.GetCurrentUserResponse, error) { - return c.openshell.GetCurrentUser(ctx, &openshellv1.GetCurrentUserRequest{}) -} - -func (c *Client) ExecSandboxInteractive(ctx context.Context) (openshellv1.OpenShell_ExecSandboxInteractiveClient, error) { - return c.openshell.ExecSandboxInteractive(ctx) -} diff --git a/backend/internal/gateway/inference.go b/backend/internal/gateway/inference.go deleted file mode 100644 index a63caa3..0000000 --- a/backend/internal/gateway/inference.go +++ /dev/null @@ -1,37 +0,0 @@ -package gateway - -import ( - "context" - - inferencev1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/inferencev1" -) - -// SetInferenceRoute configures how inference.local routes for a workspace. -// routeName "" targets the user-facing route; "sandbox-system" targets the -// system route used by platform functions. -func (c *Client) SetInferenceRoute(ctx context.Context, workspace, routeName, providerName, modelID string, timeoutSecs uint64, noVerify bool) (*inferencev1.SetInferenceRouteResponse, error) { - return c.inference.SetInferenceRoute(ctx, &inferencev1.SetInferenceRouteRequest{ - ProviderName: providerName, - ModelId: modelID, - RouteName: routeName, - NoVerify: noVerify, - TimeoutSecs: timeoutSecs, - Workspace: workspace, - }) -} - -// GetInferenceRoute fetches the configured route for a workspace. -func (c *Client) GetInferenceRoute(ctx context.Context, workspace, routeName string) (*inferencev1.GetInferenceRouteResponse, error) { - return c.inference.GetInferenceRoute(ctx, &inferencev1.GetInferenceRouteRequest{ - RouteName: routeName, - Workspace: workspace, - }) -} - -// DeleteInferenceRoute removes a route from a workspace. -func (c *Client) DeleteInferenceRoute(ctx context.Context, workspace, routeName string) (*inferencev1.DeleteInferenceRouteResponse, error) { - return c.inference.DeleteInferenceRoute(ctx, &inferencev1.DeleteInferenceRouteRequest{ - RouteName: routeName, - Workspace: workspace, - }) -} diff --git a/backend/internal/gateway/logs.go b/backend/internal/gateway/logs.go deleted file mode 100644 index c708d4d..0000000 --- a/backend/internal/gateway/logs.go +++ /dev/null @@ -1,50 +0,0 @@ -package gateway - -import ( - "context" - - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" -) - -// GetSandboxLogs fetches recent logs one-shot (the dashboard polls this; no -// streaming). NOTE: the RPC takes sandbox_id (UUID from metadata.id), not the -// sandbox name — callers resolve name → id via GetSandbox first. -func (c *Client) GetSandboxLogs(ctx context.Context, workspace, sandboxID string, lines uint32, sinceMs int64, sources []string, minLevel string) (*openshellv1.GetSandboxLogsResponse, error) { - return c.openshell.GetSandboxLogs(ctx, &openshellv1.GetSandboxLogsRequest{ - SandboxId: sandboxID, - Lines: lines, - SinceMs: sinceMs, - Sources: sources, - MinLevel: minLevel, - Workspace: workspace, - }) -} - -// ListSandboxProviders lists provider records attached to a sandbox (by name). -func (c *Client) ListSandboxProviders(ctx context.Context, workspace, sandboxName string) (*openshellv1.ListSandboxProvidersResponse, error) { - return c.openshell.ListSandboxProviders(ctx, &openshellv1.ListSandboxProvidersRequest{ - SandboxName: sandboxName, - Workspace: workspace, - }) -} - -// AttachSandboxProvider attaches a provider to a sandbox with optimistic -// concurrency (expectedResourceVersion 0 = skip the check). -func (c *Client) AttachSandboxProvider(ctx context.Context, workspace, sandboxName, providerName string, expectedResourceVersion uint64) (*openshellv1.AttachSandboxProviderResponse, error) { - return c.openshell.AttachSandboxProvider(ctx, &openshellv1.AttachSandboxProviderRequest{ - SandboxName: sandboxName, - ProviderName: providerName, - ExpectedResourceVersion: expectedResourceVersion, - Workspace: workspace, - }) -} - -// DetachSandboxProvider detaches a provider from a sandbox. -func (c *Client) DetachSandboxProvider(ctx context.Context, workspace, sandboxName, providerName string, expectedResourceVersion uint64) (*openshellv1.DetachSandboxProviderResponse, error) { - return c.openshell.DetachSandboxProvider(ctx, &openshellv1.DetachSandboxProviderRequest{ - SandboxName: sandboxName, - ProviderName: providerName, - ExpectedResourceVersion: expectedResourceVersion, - Workspace: workspace, - }) -} diff --git a/backend/internal/gateway/policies.go b/backend/internal/gateway/policies.go deleted file mode 100644 index be91a06..0000000 --- a/backend/internal/gateway/policies.go +++ /dev/null @@ -1,157 +0,0 @@ -package gateway - -import ( - "context" - - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" -) - -// UpdateSandboxPolicy replaces a sandbox's policy via UpdateConfig. Only -// network_policies and inference fields may differ from the create-time -// policy — filesystem/landlock/process are immutable and must match version 1. -func (c *Client) UpdateSandboxPolicy(ctx context.Context, workspace, name string, policy *sandboxv1.SandboxPolicy, expectedResourceVersion uint64) (*openshellv1.UpdateConfigResponse, error) { - return c.openshell.UpdateConfig(ctx, &openshellv1.UpdateConfigRequest{ - Name: name, - Policy: policy, - ExpectedResourceVersion: expectedResourceVersion, - Workspace: workspace, - }) -} - -// SetGlobalPolicy applies a gateway-global policy to all sandboxes (no -// merge). Platform Admin operation. -func (c *Client) SetGlobalPolicy(ctx context.Context, policy *sandboxv1.SandboxPolicy) (*openshellv1.UpdateConfigResponse, error) { - return c.openshell.UpdateConfig(ctx, &openshellv1.UpdateConfigRequest{ - Policy: policy, - Global: true, - }) -} - -// DeleteGlobalPolicy removes the gateway-global policy lock, restoring -// sandbox-level policy control. -func (c *Client) DeleteGlobalPolicy(ctx context.Context) error { - _, err := c.openshell.UpdateConfig(ctx, &openshellv1.UpdateConfigRequest{ - Global: true, - DeleteSetting: true, - SettingKey: "policy", - }) - return err -} - -// GetSandboxPolicyStatus fetches one policy revision and the active version. -// version 0 means latest. global=true queries global revisions (name ignored). -func (c *Client) GetSandboxPolicyStatus(ctx context.Context, workspace, name string, version uint32, global bool) (*openshellv1.GetSandboxPolicyStatusResponse, error) { - return c.openshell.GetSandboxPolicyStatus(ctx, &openshellv1.GetSandboxPolicyStatusRequest{ - Name: name, - Version: version, - Global: global, - Workspace: workspace, - }) -} - -// ListSandboxPolicies lists policy revision history for a sandbox, or the -// global policy revisions when global=true. -func (c *Client) ListSandboxPolicies(ctx context.Context, workspace, name string, limit, offset uint32, global bool) (*openshellv1.ListSandboxPoliciesResponse, error) { - return c.openshell.ListSandboxPolicies(ctx, &openshellv1.ListSandboxPoliciesRequest{ - Name: name, - Limit: limit, - Offset: offset, - Global: global, - Workspace: workspace, - }) -} - -// GetDraftPolicy fetches draft policy recommendations for a sandbox. -// statusFilter is "pending", "approved", "rejected", or "" for all. -func (c *Client) GetDraftPolicy(ctx context.Context, workspace, name, statusFilter string) (*openshellv1.GetDraftPolicyResponse, error) { - return c.openshell.GetDraftPolicy(ctx, &openshellv1.GetDraftPolicyRequest{ - Name: name, - StatusFilter: statusFilter, - Workspace: workspace, - }) -} - -// ApproveDraftChunk merges one draft chunk into the active policy. -func (c *Client) ApproveDraftChunk(ctx context.Context, workspace, name, chunkID string) (*openshellv1.ApproveDraftChunkResponse, error) { - return c.openshell.ApproveDraftChunk(ctx, &openshellv1.ApproveDraftChunkRequest{ - Name: name, - ChunkId: chunkID, - Workspace: workspace, - }) -} - -// RejectDraftChunk rejects one draft chunk; the optional reason is surfaced -// back to the in-sandbox agent. -func (c *Client) RejectDraftChunk(ctx context.Context, workspace, name, chunkID, reason string) (*openshellv1.RejectDraftChunkResponse, error) { - return c.openshell.RejectDraftChunk(ctx, &openshellv1.RejectDraftChunkRequest{ - Name: name, - ChunkId: chunkID, - Reason: reason, - Workspace: workspace, - }) -} - -// ApproveAllDraftChunks approves all pending chunks; security-flagged chunks -// are skipped unless includeSecurityFlagged is set. -func (c *Client) ApproveAllDraftChunks(ctx context.Context, workspace, name string, includeSecurityFlagged bool) (*openshellv1.ApproveAllDraftChunksResponse, error) { - return c.openshell.ApproveAllDraftChunks(ctx, &openshellv1.ApproveAllDraftChunksRequest{ - Name: name, - IncludeSecurityFlagged: includeSecurityFlagged, - Workspace: workspace, - }) -} - -func (c *Client) GetGatewaySettings(ctx context.Context) (*sandboxv1.GetGatewayConfigResponse, error) { - return c.openshell.GetGatewayConfig(ctx, &sandboxv1.GetGatewayConfigRequest{}) -} - -func (c *Client) SetSetting(ctx context.Context, key, value string) error { - _, err := c.openshell.UpdateConfig(ctx, &openshellv1.UpdateConfigRequest{ - SettingKey: key, - SettingValue: &sandboxv1.SettingValue{Value: &sandboxv1.SettingValue_StringValue{StringValue: value}}, - Global: true, - }) - return err -} - -func (c *Client) DeleteSetting(ctx context.Context, key string) error { - _, err := c.openshell.UpdateConfig(ctx, &openshellv1.UpdateConfigRequest{ - SettingKey: key, - DeleteSetting: true, - Global: true, - }) - return err -} - -func (c *Client) EditDraftChunk(ctx context.Context, workspace, name, chunkID string, proposedRule *sandboxv1.NetworkPolicyRule) error { - _, err := c.openshell.EditDraftChunk(ctx, &openshellv1.EditDraftChunkRequest{ - Name: name, - ChunkId: chunkID, - ProposedRule: proposedRule, - Workspace: workspace, - }) - return err -} - -func (c *Client) UndoDraftChunk(ctx context.Context, workspace, name, chunkID string) (*openshellv1.UndoDraftChunkResponse, error) { - return c.openshell.UndoDraftChunk(ctx, &openshellv1.UndoDraftChunkRequest{ - Name: name, - ChunkId: chunkID, - Workspace: workspace, - }) -} - -func (c *Client) ClearDraftChunks(ctx context.Context, workspace, name string) (*openshellv1.ClearDraftChunksResponse, error) { - return c.openshell.ClearDraftChunks(ctx, &openshellv1.ClearDraftChunksRequest{ - Name: name, - Workspace: workspace, - }) -} - -func (c *Client) GetDraftHistory(ctx context.Context, workspace, name string) (*openshellv1.GetDraftHistoryResponse, error) { - return c.openshell.GetDraftHistory(ctx, &openshellv1.GetDraftHistoryRequest{ - Name: name, - Workspace: workspace, - }) -} diff --git a/backend/internal/gateway/providers.go b/backend/internal/gateway/providers.go deleted file mode 100644 index 1673f49..0000000 --- a/backend/internal/gateway/providers.go +++ /dev/null @@ -1,133 +0,0 @@ -package gateway - -import ( - "context" - - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" -) - -// CreateProvider registers a provider in a workspace. Credentials are secret -// fields — callers must never echo them back to the browser. -func (c *Client) CreateProvider(ctx context.Context, workspace string, provider *datamodelv1.Provider) (*datamodelv1.Provider, error) { - resp, err := c.openshell.CreateProvider(ctx, &openshellv1.CreateProviderRequest{ - Provider: provider, - Workspace: workspace, - }) - if err != nil { - return nil, err - } - return resp.Provider, nil -} - -// GetProvider fetches a provider by name within a workspace. -func (c *Client) GetProvider(ctx context.Context, workspace, name string) (*datamodelv1.Provider, error) { - resp, err := c.openshell.GetProvider(ctx, &openshellv1.GetProviderRequest{ - Name: name, - Workspace: workspace, - }) - if err != nil { - return nil, err - } - return resp.Provider, nil -} - -// ListProviders lists providers in a workspace. -func (c *Client) ListProviders(ctx context.Context, workspace string, limit, offset uint32) ([]*datamodelv1.Provider, error) { - resp, err := c.openshell.ListProviders(ctx, &openshellv1.ListProvidersRequest{ - Limit: limit, - Offset: offset, - Workspace: workspace, - }) - if err != nil { - return nil, err - } - return resp.Providers, nil -} - -// DeleteProvider deletes a provider by name. -func (c *Client) DeleteProvider(ctx context.Context, workspace, name string) (bool, error) { - resp, err := c.openshell.DeleteProvider(ctx, &openshellv1.DeleteProviderRequest{ - Name: name, - Workspace: workspace, - }) - if err != nil { - return false, err - } - return resp.Deleted, nil -} - -// UpdateProvider updates a provider's credentials and config. -func (c *Client) UpdateProvider(ctx context.Context, workspace string, provider *datamodelv1.Provider, credentialExpiresAtMs map[string]int64) (*datamodelv1.Provider, error) { - resp, err := c.openshell.UpdateProvider(ctx, &openshellv1.UpdateProviderRequest{ - Provider: provider, - CredentialExpiresAtMs: credentialExpiresAtMs, - Workspace: workspace, - }) - if err != nil { - return nil, err - } - return resp.Provider, nil -} - -// GetProviderRefreshStatus returns credential refresh status for a provider. -func (c *Client) GetProviderRefreshStatus(ctx context.Context, workspace, provider, credentialKey string) (*openshellv1.GetProviderRefreshStatusResponse, error) { - return c.openshell.GetProviderRefreshStatus(ctx, &openshellv1.GetProviderRefreshStatusRequest{ - Provider: provider, - CredentialKey: credentialKey, - Workspace: workspace, - }) -} - -// ConfigureProviderRefresh sets up automatic credential refresh for a provider. -func (c *Client) ConfigureProviderRefresh(ctx context.Context, workspace, provider, credentialKey string, strategy openshellv1.ProviderCredentialRefreshStrategy, material map[string]string, secretMaterialKeys []string, expiresAtMs *int64) (*openshellv1.ConfigureProviderRefreshResponse, error) { - req := &openshellv1.ConfigureProviderRefreshRequest{ - Provider: provider, - CredentialKey: credentialKey, - Strategy: strategy, - Material: material, - SecretMaterialKeys: secretMaterialKeys, - Workspace: workspace, - } - if expiresAtMs != nil { - req.ExpiresAtMs = expiresAtMs - } - return c.openshell.ConfigureProviderRefresh(ctx, req) -} - -// RotateProviderCredential triggers an immediate credential rotation. -func (c *Client) RotateProviderCredential(ctx context.Context, workspace, provider, credentialKey string) (*openshellv1.RotateProviderCredentialResponse, error) { - return c.openshell.RotateProviderCredential(ctx, &openshellv1.RotateProviderCredentialRequest{ - Provider: provider, - CredentialKey: credentialKey, - Workspace: workspace, - }) -} - -// DeleteProviderRefresh removes credential refresh configuration. -func (c *Client) DeleteProviderRefresh(ctx context.Context, workspace, provider, credentialKey string) (bool, error) { - resp, err := c.openshell.DeleteProviderRefresh(ctx, &openshellv1.DeleteProviderRefreshRequest{ - Provider: provider, - CredentialKey: credentialKey, - Workspace: workspace, - }) - if err != nil { - return false, err - } - return resp.Deleted, nil -} - -// ListProviderProfiles lists provider type profiles visible in a workspace -// (workspace-scoped + built-in when workspace is set; platform + built-in when -// empty). Profile ids are the valid Provider.type slugs. -func (c *Client) ListProviderProfiles(ctx context.Context, workspace string, limit, offset uint32) ([]*openshellv1.ProviderProfile, error) { - resp, err := c.openshell.ListProviderProfiles(ctx, &openshellv1.ListProviderProfilesRequest{ - Limit: limit, - Offset: offset, - Workspace: workspace, - }) - if err != nil { - return nil, err - } - return resp.Profiles, nil -} diff --git a/backend/internal/gateway/sandboxes.go b/backend/internal/gateway/sandboxes.go deleted file mode 100644 index abb2914..0000000 --- a/backend/internal/gateway/sandboxes.go +++ /dev/null @@ -1,98 +0,0 @@ -package gateway - -import ( - "context" - "io" - - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" -) - -// CreateSandbox creates a sandbox. spec.policy is required by the gateway. -func (c *Client) CreateSandbox(ctx context.Context, workspace, name string, spec *openshellv1.SandboxSpec, labels, annotations map[string]string) (*openshellv1.Sandbox, error) { - resp, err := c.openshell.CreateSandbox(ctx, &openshellv1.CreateSandboxRequest{ - Spec: spec, - Name: name, - Labels: labels, - Annotations: annotations, - Workspace: workspace, - }) - if err != nil { - return nil, err - } - return resp.Sandbox, nil -} - -// GetSandbox fetches a sandbox by name within a workspace. -func (c *Client) GetSandbox(ctx context.Context, workspace, name string) (*openshellv1.Sandbox, error) { - resp, err := c.openshell.GetSandbox(ctx, &openshellv1.GetSandboxRequest{ - Name: name, - Workspace: workspace, - }) - if err != nil { - return nil, err - } - return resp.Sandbox, nil -} - -// ListSandboxes lists sandboxes in a workspace. -func (c *Client) ListSandboxes(ctx context.Context, workspace string, limit, offset uint32, labelSelector string) ([]*openshellv1.Sandbox, error) { - resp, err := c.openshell.ListSandboxes(ctx, &openshellv1.ListSandboxesRequest{ - Limit: limit, - Offset: offset, - LabelSelector: labelSelector, - Workspace: workspace, - }) - if err != nil { - return nil, err - } - return resp.Sandboxes, nil -} - -// ExecSandbox runs a non-interactive command inside a sandbox and collects the -// streamed stdout/stderr/exit. Uses sandbox_id (not name). -func (c *Client) ExecSandbox(ctx context.Context, sandboxID string, command []string, stdin []byte, workdir string, timeoutSeconds uint32) ([]byte, []byte, int32, error) { - stream, err := c.openshell.ExecSandbox(ctx, &openshellv1.ExecSandboxRequest{ - SandboxId: sandboxID, - Command: command, - Stdin: stdin, - Workdir: workdir, - TimeoutSeconds: timeoutSeconds, - }) - if err != nil { - return nil, nil, -1, err - } - - var stdout, stderr []byte - var exitCode int32 = -1 - for { - event, err := stream.Recv() - if err != nil { - if err == io.EOF { - break - } - return stdout, stderr, exitCode, err - } - switch p := event.Payload.(type) { - case *openshellv1.ExecSandboxEvent_Stdout: - stdout = append(stdout, p.Stdout.Data...) - case *openshellv1.ExecSandboxEvent_Stderr: - stderr = append(stderr, p.Stderr.Data...) - case *openshellv1.ExecSandboxEvent_Exit: - exitCode = p.Exit.ExitCode - } - } - return stdout, stderr, exitCode, nil -} - -// DeleteSandbox deletes a sandbox by name. This is the only lifecycle -// operation besides create — the gateway API has no stop/start. -func (c *Client) DeleteSandbox(ctx context.Context, workspace, name string) (bool, error) { - resp, err := c.openshell.DeleteSandbox(ctx, &openshellv1.DeleteSandboxRequest{ - Name: name, - Workspace: workspace, - }) - if err != nil { - return false, err - } - return resp.Deleted, nil -} diff --git a/backend/internal/gateway/services.go b/backend/internal/gateway/services.go deleted file mode 100644 index a8eefc6..0000000 --- a/backend/internal/gateway/services.go +++ /dev/null @@ -1,48 +0,0 @@ -package gateway - -import ( - "context" - - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" -) - -func (c *Client) ExposeService(ctx context.Context, workspace, sandbox, service string, targetPort uint32, domain bool) (*openshellv1.ServiceEndpointResponse, error) { - return c.openshell.ExposeService(ctx, &openshellv1.ExposeServiceRequest{ - Sandbox: sandbox, - Service: service, - TargetPort: targetPort, - Domain: domain, - Workspace: workspace, - }) -} - -func (c *Client) ListServices(ctx context.Context, workspace, sandbox string) ([]*openshellv1.ServiceEndpointResponse, error) { - resp, err := c.openshell.ListServices(ctx, &openshellv1.ListServicesRequest{ - Sandbox: sandbox, - Workspace: workspace, - }) - if err != nil { - return nil, err - } - return resp.Services, nil -} - -func (c *Client) GetService(ctx context.Context, workspace, sandbox, service string) (*openshellv1.ServiceEndpointResponse, error) { - return c.openshell.GetService(ctx, &openshellv1.GetServiceRequest{ - Sandbox: sandbox, - Service: service, - Workspace: workspace, - }) -} - -func (c *Client) DeleteService(ctx context.Context, workspace, sandbox, service string) (bool, error) { - resp, err := c.openshell.DeleteService(ctx, &openshellv1.DeleteServiceRequest{ - Sandbox: sandbox, - Service: service, - Workspace: workspace, - }) - if err != nil { - return false, err - } - return resp.Deleted, nil -} diff --git a/backend/internal/gateway/workspaces.go b/backend/internal/gateway/workspaces.go deleted file mode 100644 index 703c46b..0000000 --- a/backend/internal/gateway/workspaces.go +++ /dev/null @@ -1,90 +0,0 @@ -package gateway - -import ( - "context" - - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" -) - -// CreateWorkspace creates a workspace. Name must be a valid DNS-1123 label. -func (c *Client) CreateWorkspace(ctx context.Context, name string, labels map[string]string) (*datamodelv1.Workspace, error) { - resp, err := c.openshell.CreateWorkspace(ctx, &openshellv1.CreateWorkspaceRequest{ - Name: name, - Labels: labels, - }) - if err != nil { - return nil, err - } - return resp.Workspace, nil -} - -// GetWorkspace fetches a workspace by name. -func (c *Client) GetWorkspace(ctx context.Context, name string) (*datamodelv1.Workspace, error) { - resp, err := c.openshell.GetWorkspace(ctx, &openshellv1.GetWorkspaceRequest{Name: name}) - if err != nil { - return nil, err - } - return resp.Workspace, nil -} - -// ListWorkspaces lists workspaces. -func (c *Client) ListWorkspaces(ctx context.Context, limit, offset uint32, labelSelector string) ([]*datamodelv1.Workspace, error) { - resp, err := c.openshell.ListWorkspaces(ctx, &openshellv1.ListWorkspacesRequest{ - Limit: limit, - Offset: offset, - LabelSelector: labelSelector, - }) - if err != nil { - return nil, err - } - return resp.Workspaces, nil -} - -// DeleteWorkspace deletes a workspace by name. -func (c *Client) DeleteWorkspace(ctx context.Context, name string) (bool, error) { - resp, err := c.openshell.DeleteWorkspace(ctx, &openshellv1.DeleteWorkspaceRequest{Name: name}) - if err != nil { - return false, err - } - return resp.Deleted, nil -} - -// AddWorkspaceMember adds a member (OIDC subject + role) to a workspace. -// There is no role-update RPC — a role change is remove + re-add. -func (c *Client) AddWorkspaceMember(ctx context.Context, workspace, principalSubject string, role openshellv1.WorkspaceRole) (*openshellv1.WorkspaceMember, error) { - resp, err := c.openshell.AddWorkspaceMember(ctx, &openshellv1.AddWorkspaceMemberRequest{ - Workspace: workspace, - PrincipalSubject: principalSubject, - Role: role, - }) - if err != nil { - return nil, err - } - return resp.Member, nil -} - -// RemoveWorkspaceMember removes a member from a workspace. -func (c *Client) RemoveWorkspaceMember(ctx context.Context, workspace, principalSubject string) (bool, error) { - resp, err := c.openshell.RemoveWorkspaceMember(ctx, &openshellv1.RemoveWorkspaceMemberRequest{ - Workspace: workspace, - PrincipalSubject: principalSubject, - }) - if err != nil { - return false, err - } - return resp.Removed, nil -} - -// ListWorkspaceMembers lists members of a workspace. -func (c *Client) ListWorkspaceMembers(ctx context.Context, workspace string, limit, offset uint32) ([]*openshellv1.WorkspaceMember, error) { - resp, err := c.openshell.ListWorkspaceMembers(ctx, &openshellv1.ListWorkspaceMembersRequest{ - Workspace: workspace, - Limit: limit, - Offset: offset, - }) - if err != nil { - return nil, err - } - return resp.Members, nil -} diff --git a/backend/internal/models/models.go b/backend/internal/models/models.go index 2ad3642..02f112e 100644 --- a/backend/internal/models/models.go +++ b/backend/internal/models/models.go @@ -1,21 +1,33 @@ // Package models defines the JSON DTOs the BFF returns to the frontend and -// the converters from protoc-generated types. Proto fields marked -// [(openshell.options.v1.secret) = true] (provider credentials, tokens) are -// never serialized here — only credential key names are exposed. +// the converters from SDK domain types. Provider credentials (secret fields) +// are never serialized here. package models import ( + "bytes" "encoding/json" "fmt" + "strings" + "time" - "google.golang.org/protobuf/encoding/protojson" - - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" + openshell "github.com/rhuss/openshell-sdk-go/openshell/v1" ) -// ObjectMeta mirrors openshell.datamodel.v1.ObjectMeta. +func timeToMs(t time.Time) int64 { + if t.IsZero() { + return 0 + } + return t.UnixMilli() +} + +func timePtrToMs(t *time.Time) int64 { + if t == nil { + return 0 + } + return t.UnixMilli() +} + +// ObjectMeta is the common metadata DTO. type ObjectMeta struct { ID string `json:"id"` Name string `json:"name"` @@ -27,76 +39,62 @@ type ObjectMeta struct { DeletionTimestampMs int64 `json:"deletionTimestampMs,omitempty"` } -func FromObjectMeta(meta *datamodelv1.ObjectMeta) ObjectMeta { - if meta == nil { - return ObjectMeta{} - } - return ObjectMeta{ - ID: meta.Id, - Name: meta.Name, - Workspace: meta.Workspace, - Labels: meta.Labels, - Annotations: meta.Annotations, - CreatedAtMs: meta.CreatedAtMs, - ResourceVersion: meta.ResourceVersion, - DeletionTimestampMs: meta.DeletionTimestampMs, - } -} - -// Workspace mirrors openshell.datamodel.v1.Workspace. +// Workspace mirrors openshell.Workspace. type Workspace struct { Metadata ObjectMeta `json:"metadata"` - // Phase is ACTIVE or TERMINATING. - Phase string `json:"phase"` + Phase string `json:"phase"` } -func FromWorkspace(ws *datamodelv1.Workspace) Workspace { - out := Workspace{Metadata: FromObjectMeta(ws.GetMetadata()), Phase: "UNSPECIFIED"} - switch ws.GetStatus().GetPhase() { - case datamodelv1.WorkspacePhase_WORKSPACE_PHASE_ACTIVE: - out.Phase = "ACTIVE" - case datamodelv1.WorkspacePhase_WORKSPACE_PHASE_TERMINATING: - out.Phase = "TERMINATING" +func FromWorkspace(ws *openshell.Workspace) Workspace { + return Workspace{ + Metadata: ObjectMeta{ + ID: ws.ID, + Name: ws.Name, + Workspace: ws.Workspace, + Labels: ws.Labels, + Annotations: ws.Annotations, + CreatedAtMs: timeToMs(ws.CreatedAt), + ResourceVersion: ws.ResourceVersion, + DeletionTimestampMs: timePtrToMs(ws.DeletionTimestamp), + }, + Phase: strings.ToUpper(string(ws.Phase)), } - return out } -// WorkspaceMember mirrors openshell.v1.WorkspaceMember. +// WorkspaceMember mirrors openshell.WorkspaceMember. type WorkspaceMember struct { Metadata ObjectMeta `json:"metadata"` PrincipalSubject string `json:"principalSubject"` - // Role is USER or ADMIN. There is no role-update RPC — changing a role - // means remove + re-add. - Role string `json:"role"` + Role string `json:"role"` } -func FromWorkspaceMember(member *openshellv1.WorkspaceMember) WorkspaceMember { - out := WorkspaceMember{ - Metadata: FromObjectMeta(member.GetMetadata()), - PrincipalSubject: member.GetPrincipalSubject(), - Role: "UNSPECIFIED", +func FromWorkspaceMember(member *openshell.WorkspaceMember) WorkspaceMember { + return WorkspaceMember{ + Metadata: ObjectMeta{ + ID: member.ID, + Name: member.Name, + Labels: member.Labels, + Annotations: member.Annotations, + CreatedAtMs: timeToMs(member.CreatedAt), + ResourceVersion: member.ResourceVersion, + }, + PrincipalSubject: member.PrincipalSubject, + Role: strings.ToUpper(string(member.Role)), } - switch member.GetRole() { - case openshellv1.WorkspaceRole_WORKSPACE_ROLE_USER: - out.Role = "USER" - case openshellv1.WorkspaceRole_WORKSPACE_ROLE_ADMIN: - out.Role = "ADMIN" - } - return out } -// WorkspaceRoleFromString maps USER/ADMIN to the proto enum. -func WorkspaceRoleFromString(role string) (openshellv1.WorkspaceRole, bool) { +// WorkspaceRoleFromString maps USER/ADMIN to the SDK WorkspaceRole. +func WorkspaceRoleFromString(role string) (openshell.WorkspaceRole, bool) { switch role { case "USER": - return openshellv1.WorkspaceRole_WORKSPACE_ROLE_USER, true + return openshell.WorkspaceRoleUser, true case "ADMIN": - return openshellv1.WorkspaceRole_WORKSPACE_ROLE_ADMIN, true + return openshell.WorkspaceRoleAdmin, true } - return openshellv1.WorkspaceRole_WORKSPACE_ROLE_UNSPECIFIED, false + return "", false } -// SandboxCondition mirrors openshell.v1.SandboxCondition. +// SandboxCondition mirrors openshell.SandboxCondition. type SandboxCondition struct { Type string `json:"type"` Status string `json:"status"` @@ -105,21 +103,18 @@ type SandboxCondition struct { LastTransitionTime string `json:"lastTransitionTime,omitempty"` } -// SandboxStatus mirrors openshell.v1.SandboxStatus. +// SandboxStatus mirrors openshell.SandboxStatus. type SandboxStatus struct { - SandboxName string `json:"sandboxName,omitempty"` - AgentPod string `json:"agentPod,omitempty"` - Conditions []SandboxCondition `json:"conditions,omitempty"` - // Phase is PROVISIONING, READY, ERROR, DELETING, or UNKNOWN. The - // lifecycle is create → ready/error → delete; there is no stopped or - // suspended state in the gateway API. - Phase string `json:"phase"` - CurrentPolicyVersion uint32 `json:"currentPolicyVersion"` -} - -// SandboxSpec is the dashboard view of openshell.v1.SandboxSpec. Policy is -// carried as protojson (camelCase field names) so the full -// openshell.sandbox.v1.SandboxPolicy schema passes through untouched. + SandboxName string `json:"sandboxName,omitempty"` + AgentPod string `json:"agentPod,omitempty"` + Conditions []SandboxCondition `json:"conditions,omitempty"` + Phase string `json:"phase"` + CurrentPolicyVersion uint32 `json:"currentPolicyVersion"` +} + +// SandboxSpec is the dashboard view of openshell.SandboxSpec. Policy is +// carried as camelCase JSON so the full SandboxPolicy schema passes through +// untouched. type SandboxSpec struct { LogLevel string `json:"logLevel,omitempty"` Environment map[string]string `json:"environment,omitempty"` @@ -128,56 +123,46 @@ type SandboxSpec struct { Policy json.RawMessage `json:"policy,omitempty"` } -// Sandbox mirrors openshell.v1.Sandbox. +// Sandbox mirrors openshell.Sandbox. type Sandbox struct { Metadata ObjectMeta `json:"metadata"` Spec SandboxSpec `json:"spec"` Status SandboxStatus `json:"status"` } -func sandboxPhaseString(phase openshellv1.SandboxPhase) string { - switch phase { - case openshellv1.SandboxPhase_SANDBOX_PHASE_PROVISIONING: - return "PROVISIONING" - case openshellv1.SandboxPhase_SANDBOX_PHASE_READY: - return "READY" - case openshellv1.SandboxPhase_SANDBOX_PHASE_ERROR: - return "ERROR" - case openshellv1.SandboxPhase_SANDBOX_PHASE_DELETING: - return "DELETING" - case openshellv1.SandboxPhase_SANDBOX_PHASE_UNKNOWN: - return "UNKNOWN" +func FromSandbox(sandbox *openshell.Sandbox) Sandbox { + out := Sandbox{ + Metadata: ObjectMeta{ + ID: sandbox.ID, + Name: sandbox.Name, + Workspace: sandbox.Workspace, + Labels: sandbox.Labels, + Annotations: sandbox.Annotations, + CreatedAtMs: timeToMs(sandbox.CreatedAt), + ResourceVersion: sandbox.ResourceVersion, + DeletionTimestampMs: timePtrToMs(sandbox.DeletionTimestamp), + }, } - return "UNSPECIFIED" -} - -var policyMarshaler = protojson.MarshalOptions{UseProtoNames: false} -func FromSandbox(sandbox *openshellv1.Sandbox) Sandbox { - out := Sandbox{Metadata: FromObjectMeta(sandbox.GetMetadata())} - - if spec := sandbox.GetSpec(); spec != nil { - out.Spec = SandboxSpec{ - LogLevel: spec.LogLevel, - Environment: spec.Environment, - Image: spec.GetTemplate().GetImage(), - Providers: spec.Providers, - } - if spec.Policy != nil { - if raw, err := policyMarshaler.Marshal(spec.Policy); err == nil { - out.Spec.Policy = raw - } - } + out.Spec = SandboxSpec{ + LogLevel: sandbox.Spec.LogLevel, + Environment: sandbox.Spec.Environment, + Providers: sandbox.Spec.Providers, + } + if sandbox.Spec.Template != nil { + out.Spec.Image = sandbox.Spec.Template.Image + } + if sandbox.Spec.Policy != nil { + out.Spec.Policy = marshalPolicy(sandbox.Spec.Policy) } - status := sandbox.GetStatus() out.Status = SandboxStatus{ - SandboxName: status.GetSandboxName(), - AgentPod: status.GetAgentPod(), - Phase: sandboxPhaseString(status.GetPhase()), - CurrentPolicyVersion: status.GetCurrentPolicyVersion(), + SandboxName: sandbox.Status.SandboxName, + AgentPod: sandbox.Status.AgentPod, + Phase: strings.ToUpper(string(sandbox.Status.Phase)), + CurrentPolicyVersion: sandbox.Status.CurrentPolicyVersion, } - for _, cond := range status.GetConditions() { + for _, cond := range sandbox.Status.Conditions { out.Status.Conditions = append(out.Status.Conditions, SandboxCondition{ Type: cond.Type, Status: cond.Status, @@ -189,44 +174,57 @@ func FromSandbox(sandbox *openshellv1.Sandbox) Sandbox { return out } -// ParsePolicy converts protojson policy from the frontend into the proto -// message. spec.policy is a required field on CreateSandbox. -func ParsePolicy(raw json.RawMessage) (*sandboxv1.SandboxPolicy, error) { - policy := &sandboxv1.SandboxPolicy{} - if err := protojson.Unmarshal(raw, policy); err != nil { +// ParsePolicy converts camelCase JSON policy from the frontend into the SDK +// SandboxPolicy. Unknown fields are rejected to catch malformed input. +func ParsePolicy(raw json.RawMessage) (*openshell.SandboxPolicy, error) { + policy := &openshell.SandboxPolicy{} + dec := json.NewDecoder(bytes.NewReader(raw)) + dec.DisallowUnknownFields() + if err := dec.Decode(policy); err != nil { return nil, err } return policy, nil } -// Provider is the dashboard view of openshell.datamodel.v1.Provider. The -// credentials map is secret-marked in proto and is intentionally absent — -// only the credential key names are surfaced. +// Provider is the dashboard view of openshell.Provider. The credentials map +// is secret and intentionally absent; only credential key names are surfaced. type Provider struct { - Metadata ObjectMeta `json:"metadata"` - Type string `json:"type"` - Config map[string]string `json:"config,omitempty"` - // CredentialNames lists which credential keys are set, without values. - CredentialNames []string `json:"credentialNames,omitempty"` - CredentialExpiresAtMs map[string]int64 `json:"credentialExpiresAtMs,omitempty"` - ProfileWorkspace string `json:"profileWorkspace,omitempty"` + Metadata ObjectMeta `json:"metadata"` + Type string `json:"type"` + Config map[string]string `json:"config,omitempty"` + CredentialNames []string `json:"credentialNames,omitempty"` + CredentialExpiresAtMs map[string]int64 `json:"credentialExpiresAtMs,omitempty"` + ProfileWorkspace string `json:"profileWorkspace,omitempty"` } -func FromProvider(provider *datamodelv1.Provider) Provider { +func FromProvider(provider *openshell.Provider) Provider { out := Provider{ - Metadata: FromObjectMeta(provider.GetMetadata()), - Type: provider.GetType(), - Config: provider.GetConfig(), - CredentialExpiresAtMs: provider.GetCredentialExpiresAtMs(), - ProfileWorkspace: provider.GetProfileWorkspace(), + Metadata: ObjectMeta{ + ID: provider.ID, + Name: provider.Name, + Workspace: provider.Workspace, + Labels: provider.Labels, + Annotations: provider.Annotations, + CreatedAtMs: timeToMs(provider.CreatedAt), + ResourceVersion: provider.ResourceVersion, + DeletionTimestampMs: timePtrToMs(provider.DeletionTimestamp), + }, + Type: provider.Type, + Config: provider.Spec.Config, } - for name := range provider.GetCredentials() { + for name := range provider.Spec.Credentials { out.CredentialNames = append(out.CredentialNames, name) } + if len(provider.Spec.CredentialExpiresAt) > 0 { + out.CredentialExpiresAtMs = make(map[string]int64, len(provider.Spec.CredentialExpiresAt)) + for k, t := range provider.Spec.CredentialExpiresAt { + out.CredentialExpiresAtMs[k] = timeToMs(t) + } + } return out } -// CredentialRefreshStatus mirrors openshell.v1.ProviderCredentialRefreshStatus. +// CredentialRefreshStatus mirrors openshell.RefreshStatus. type CredentialRefreshStatus struct { CredentialKey string `json:"credentialKey"` Strategy string `json:"strategy"` @@ -237,108 +235,94 @@ type CredentialRefreshStatus struct { LastError string `json:"lastError,omitempty"` } -func refreshStrategyString(strategy openshellv1.ProviderCredentialRefreshStrategy) string { +func refreshStrategyString(strategy openshell.RefreshStrategy) string { switch strategy { - case openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC: + case openshell.RefreshStrategyStatic: return "STATIC" - case openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL: + case openshell.RefreshStrategyExternal: return "EXTERNAL" - case openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN: + case openshell.RefreshStrategyOAuth2RefreshToken: return "OAUTH2_REFRESH_TOKEN" - case openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS: + case openshell.RefreshStrategyOAuth2ClientCredentials: return "OAUTH2_CLIENT_CREDENTIALS" - case openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT: + case openshell.RefreshStrategyGoogleServiceAccountJWT: return "GOOGLE_SERVICE_ACCOUNT_JWT" - case openshellv1.ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE: - return "AWS_STS_ASSUME_ROLE" } - return "UNSPECIFIED" + return string(strategy) } -func FromCredentialRefreshStatus(status *openshellv1.ProviderCredentialRefreshStatus) CredentialRefreshStatus { +func FromCredentialRefreshStatus(status *openshell.RefreshStatus) CredentialRefreshStatus { return CredentialRefreshStatus{ - CredentialKey: status.GetCredentialKey(), - Strategy: refreshStrategyString(status.GetStrategy()), - Status: status.GetStatus(), - ExpiresAtMs: status.GetExpiresAtMs(), - NextRefreshAtMs: status.GetNextRefreshAtMs(), - LastRefreshAtMs: status.GetLastRefreshAtMs(), - LastError: status.GetLastError(), + CredentialKey: status.CredentialKey, + Strategy: refreshStrategyString(status.Strategy), + Status: status.Status, + ExpiresAtMs: timeToMs(status.ExpiresAt), + NextRefreshAtMs: timeToMs(status.NextRefreshAt), + LastRefreshAtMs: timeToMs(status.LastRefreshAt), + LastError: status.LastError, } } -// ProfileCredential mirrors openshell.v1.ProviderProfileCredential — the -// credential *schema* (no secret values), used to drive the Add Provider form. +// ProfileCredential mirrors the credential schema from a ProviderProfile. type ProfileCredential struct { - Name string `json:"name"` - Description string `json:"description,omitempty"` - EnvVars []string `json:"envVars,omitempty"` - Required bool `json:"required"` - AuthStyle string `json:"authStyle,omitempty"` + Name string `json:"name"` + Description string `json:"description,omitempty"` + Required bool `json:"required"` + Secret bool `json:"secret,omitempty"` } -// ProviderProfile mirrors openshell.v1.ProviderProfile (schema-relevant subset). +// ProviderProfile mirrors openshell.ProviderProfile (schema-relevant subset). type ProviderProfile struct { ID string `json:"id"` DisplayName string `json:"displayName"` Description string `json:"description,omitempty"` Category string `json:"category"` Credentials []ProfileCredential `json:"credentials"` - // Endpoints summarizes the profile's NetworkEndpoints as host:port strings. - Endpoints []string `json:"endpoints,omitempty"` - InferenceCapable bool `json:"inferenceCapable"` - Source string `json:"source,omitempty"` - Scope string `json:"scope,omitempty"` + Endpoints []string `json:"endpoints,omitempty"` + InferenceCapable bool `json:"inferenceCapable"` } -func profileCategoryString(category openshellv1.ProviderProfileCategory) string { +func profileCategoryString(category openshell.ProfileCategory) string { switch category { - case openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_OTHER: + case openshell.ProfileCategoryOther: return "OTHER" - case openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_INFERENCE: + case openshell.ProfileCategoryInference: return "INFERENCE" - case openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_AGENT: + case openshell.ProfileCategoryAgent: return "AGENT" - case openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL: + case openshell.ProfileCategorySourceControl: return "SOURCE_CONTROL" - case openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_MESSAGING: + case openshell.ProfileCategoryMessaging: return "MESSAGING" - case openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_DATA: + case openshell.ProfileCategoryData: return "DATA" - case openshellv1.ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_KNOWLEDGE: + case openshell.ProfileCategoryKnowledge: return "KNOWLEDGE" } return "UNSPECIFIED" } -func FromProviderProfile(profile *openshellv1.ProviderProfile) ProviderProfile { +func FromProviderProfile(profile *openshell.ProviderProfile) ProviderProfile { out := ProviderProfile{ - ID: profile.GetId(), - DisplayName: profile.GetDisplayName(), - Description: profile.GetDescription(), - Category: profileCategoryString(profile.GetCategory()), + ID: profile.ID, + DisplayName: profile.DisplayName, + Description: profile.Description, + Category: profileCategoryString(profile.Category), Credentials: []ProfileCredential{}, - InferenceCapable: profile.GetInferenceCapable(), - Source: profile.GetSource(), - Scope: profile.GetScope(), + InferenceCapable: profile.InferenceCapable, } - for _, cred := range profile.GetCredentials() { + for _, cred := range profile.Credentials { out.Credentials = append(out.Credentials, ProfileCredential{ Name: cred.Name, Description: cred.Description, - EnvVars: cred.EnvVars, Required: cred.Required, - AuthStyle: cred.AuthStyle, + Secret: cred.Secret, }) } - for _, endpoint := range profile.GetEndpoints() { - host := endpoint.GetHost() - if len(endpoint.GetPorts()) > 0 { - for _, port := range endpoint.GetPorts() { - out.Endpoints = append(out.Endpoints, fmt.Sprintf("%s:%d", host, port)) - } - } else if endpoint.GetPort() > 0 { - out.Endpoints = append(out.Endpoints, fmt.Sprintf("%s:%d", host, endpoint.GetPort())) + for _, endpoint := range profile.Endpoints { + host := endpoint.Host + if endpoint.Port > 0 { + out.Endpoints = append(out.Endpoints, fmt.Sprintf("%s:%d", host, endpoint.Port)) } else if host != "" { out.Endpoints = append(out.Endpoints, host) } @@ -346,7 +330,7 @@ func FromProviderProfile(profile *openshellv1.ProviderProfile) ProviderProfile { return out } -// CurrentUser mirrors openshell.v1.GetCurrentUserResponse. +// CurrentUser mirrors openshell.CurrentUser. type CurrentUser struct { Subject string `json:"subject"` DisplayName string `json:"displayName,omitempty"` @@ -356,55 +340,350 @@ type CurrentUser struct { IdentityProvider string `json:"identityProvider,omitempty"` } -func FromCurrentUser(resp *openshellv1.GetCurrentUserResponse) CurrentUser { +func FromCurrentUser(user *openshell.CurrentUser) CurrentUser { return CurrentUser{ - Subject: resp.GetSubject(), - DisplayName: resp.GetDisplayName(), - Roles: resp.GetRoles(), - Scopes: resp.GetScopes(), - IdentityProvider: resp.GetIdentityProvider(), + Subject: user.Subject, + DisplayName: user.DisplayName, + Roles: user.Roles, + Scopes: user.Scopes, + IdentityProvider: user.IdentityProvider, } } -// ComputeDriver flattens openshell.v1.ComputeDriverInfo + capabilities. +// ComputeDriver flattens openshell.ComputeDriverInfo. type ComputeDriver struct { Name string `json:"name"` DriverName string `json:"driverName,omitempty"` DriverVersion string `json:"driverVersion,omitempty"` } -// GatewayInfo mirrors openshell.v1.GetGatewayInfoResponse — status, version, -// and compute drivers are all the gateway exposes about itself. +// GatewayInfo mirrors openshell.GatewayInfo. type GatewayInfo struct { Status string `json:"status"` GatewayVersion string `json:"gatewayVersion"` ComputeDrivers []ComputeDriver `json:"computeDrivers"` } -func serviceStatusString(status openshellv1.ServiceStatus) string { - switch status { - case openshellv1.ServiceStatus_SERVICE_STATUS_HEALTHY: - return "HEALTHY" - case openshellv1.ServiceStatus_SERVICE_STATUS_DEGRADED: - return "DEGRADED" - case openshellv1.ServiceStatus_SERVICE_STATUS_UNHEALTHY: - return "UNHEALTHY" - } - return "UNSPECIFIED" -} - -func FromGatewayInfo(info *openshellv1.GetGatewayInfoResponse) GatewayInfo { +func FromGatewayInfo(info *openshell.GatewayInfo) GatewayInfo { out := GatewayInfo{ - Status: serviceStatusString(info.GetStatus()), - GatewayVersion: info.GetGatewayVersion(), + Status: strings.ToUpper(string(info.Status)), + GatewayVersion: info.Version, ComputeDrivers: []ComputeDriver{}, } - for _, driver := range info.GetComputeDrivers() { + for _, driver := range info.ComputeDrivers { out.ComputeDrivers = append(out.ComputeDrivers, ComputeDriver{ - Name: driver.GetName(), - DriverName: driver.GetCapabilities().GetDriverName(), - DriverVersion: driver.GetCapabilities().GetDriverVersion(), + Name: driver.Name, + DriverName: driver.DriverName, + DriverVersion: driver.DriverVersion, }) } return out } + +// --- Policy JSON serialization types (camelCase for frontend compatibility) --- + +type policyJSON struct { + Version uint32 `json:"version,omitempty"` + Filesystem *filesystemJSON `json:"filesystem,omitempty"` + Landlock *landlockJSON `json:"landlock,omitempty"` + Process *processJSON `json:"process,omitempty"` + NetworkPolicies map[string]networkPolicyRuleJSON `json:"networkPolicies,omitempty"` +} + +type filesystemJSON struct { + IncludeWorkdir bool `json:"includeWorkdir,omitempty"` + ReadOnly []string `json:"readOnly,omitempty"` + ReadWrite []string `json:"readWrite,omitempty"` +} + +type landlockJSON struct { + Compatibility string `json:"compatibility,omitempty"` +} + +type processJSON struct { + RunAsUser string `json:"runAsUser,omitempty"` + RunAsGroup string `json:"runAsGroup,omitempty"` +} + +type networkPolicyRuleJSON struct { + Name string `json:"name,omitempty"` + Endpoints []policyNetworkEndpointJSON `json:"endpoints,omitempty"` + Binaries []policyNetworkBinaryJSON `json:"binaries,omitempty"` +} + +type policyNetworkEndpointJSON struct { + Host string `json:"host,omitempty"` + Port uint32 `json:"port,omitempty"` + Ports []uint32 `json:"ports,omitempty"` + Protocol string `json:"protocol,omitempty"` + Tls string `json:"tls,omitempty"` + Enforcement string `json:"enforcement,omitempty"` + Access string `json:"access,omitempty"` + Rules []l7RuleJSON `json:"rules,omitempty"` + AllowedIps []string `json:"allowedIps,omitempty"` + DenyRules []l7DenyRuleJSON `json:"denyRules,omitempty"` + AllowEncodedSlash bool `json:"allowEncodedSlash,omitempty"` + PersistedQueries string `json:"persistedQueries,omitempty"` + GraphqlPersistedQueries map[string]graphqlOpJSON `json:"graphqlPersistedQueries,omitempty"` + GraphqlMaxBodyBytes uint32 `json:"graphqlMaxBodyBytes,omitempty"` + Path string `json:"path,omitempty"` + WebsocketCredentialRewrite bool `json:"websocketCredentialRewrite,omitempty"` + RequestBodyCredentialRewrite bool `json:"requestBodyCredentialRewrite,omitempty"` + AdvisorProposed bool `json:"advisorProposed,omitempty"` +} + +type policyNetworkBinaryJSON struct { + Path string `json:"path,omitempty"` +} + +type l7RuleJSON struct { + Allow *l7AllowJSON `json:"allow,omitempty"` +} + +type l7AllowJSON struct { + Method string `json:"method,omitempty"` + Path string `json:"path,omitempty"` + Command string `json:"command,omitempty"` + Query map[string]l7QueryMatcherJSON `json:"query,omitempty"` + OperationType string `json:"operationType,omitempty"` + OperationName string `json:"operationName,omitempty"` + Fields []string `json:"fields,omitempty"` +} + +type l7DenyRuleJSON struct { + Method string `json:"method,omitempty"` + Path string `json:"path,omitempty"` + Command string `json:"command,omitempty"` + Query map[string]l7QueryMatcherJSON `json:"query,omitempty"` + OperationType string `json:"operationType,omitempty"` + OperationName string `json:"operationName,omitempty"` + Fields []string `json:"fields,omitempty"` +} + +type l7QueryMatcherJSON struct { + Glob string `json:"glob,omitempty"` + Any []string `json:"any,omitempty"` +} + +type graphqlOpJSON struct { + OperationType string `json:"operationType,omitempty"` + OperationName string `json:"operationName,omitempty"` + Fields []string `json:"fields,omitempty"` +} + +func marshalPolicy(p *openshell.SandboxPolicy) json.RawMessage { + pj := policyJSON{Version: p.Version} + if p.Filesystem != nil { + pj.Filesystem = &filesystemJSON{ + IncludeWorkdir: p.Filesystem.IncludeWorkdir, + ReadOnly: p.Filesystem.ReadOnly, + ReadWrite: p.Filesystem.ReadWrite, + } + } + if p.Landlock != nil { + pj.Landlock = &landlockJSON{Compatibility: p.Landlock.Compatibility} + } + if p.Process != nil { + pj.Process = &processJSON{ + RunAsUser: p.Process.RunAsUser, + RunAsGroup: p.Process.RunAsGroup, + } + } + if p.NetworkPolicies != nil { + pj.NetworkPolicies = make(map[string]networkPolicyRuleJSON, len(p.NetworkPolicies)) + for k, rule := range p.NetworkPolicies { + pj.NetworkPolicies[k] = convertNetworkPolicyRule(rule) + } + } + raw, err := json.Marshal(pj) + if err != nil { + return nil + } + return raw +} + +// MarshalNetworkPolicyRule converts an SDK NetworkPolicyRule to camelCase JSON. +func MarshalNetworkPolicyRule(rule *openshell.NetworkPolicyRule) json.RawMessage { + if rule == nil { + return nil + } + rj := convertNetworkPolicyRule(*rule) + raw, err := json.Marshal(rj) + if err != nil { + return nil + } + return raw +} + +func convertNetworkPolicyRule(rule openshell.NetworkPolicyRule) networkPolicyRuleJSON { + rj := networkPolicyRuleJSON{Name: rule.Name} + for _, ep := range rule.Endpoints { + ej := policyNetworkEndpointJSON{ + Host: ep.Host, + Port: ep.Port, + Ports: ep.Ports, + Protocol: ep.Protocol, + Tls: ep.TLS, + Enforcement: ep.Enforcement, + Access: ep.Access, + AllowedIps: ep.AllowedIPs, + AllowEncodedSlash: ep.AllowEncodedSlash, + PersistedQueries: ep.PersistedQueries, + GraphqlMaxBodyBytes: ep.GraphqlMaxBodyBytes, + Path: ep.Path, + WebsocketCredentialRewrite: ep.WebsocketCredentialRewrite, + RequestBodyCredentialRewrite: ep.RequestBodyCredentialRewrite, + AdvisorProposed: ep.AdvisorProposed, + } + for _, r := range ep.Rules { + ej.Rules = append(ej.Rules, convertL7Rule(r)) + } + for _, dr := range ep.DenyRules { + ej.DenyRules = append(ej.DenyRules, convertL7DenyRule(dr)) + } + if len(ep.GraphqlPersistedQueries) > 0 { + ej.GraphqlPersistedQueries = make(map[string]graphqlOpJSON, len(ep.GraphqlPersistedQueries)) + for k, op := range ep.GraphqlPersistedQueries { + ej.GraphqlPersistedQueries[k] = graphqlOpJSON{ + OperationType: op.OperationType, + OperationName: op.OperationName, + Fields: op.Fields, + } + } + } + rj.Endpoints = append(rj.Endpoints, ej) + } + for _, b := range rule.Binaries { + rj.Binaries = append(rj.Binaries, policyNetworkBinaryJSON{Path: b.Path}) + } + return rj +} + +func convertL7Rule(r openshell.L7Rule) l7RuleJSON { + rj := l7RuleJSON{} + if r.Allow != nil { + rj.Allow = &l7AllowJSON{ + Method: r.Allow.Method, + Path: r.Allow.Path, + Command: r.Allow.Command, + OperationType: r.Allow.OperationType, + OperationName: r.Allow.OperationName, + Fields: r.Allow.Fields, + } + if len(r.Allow.Query) > 0 { + rj.Allow.Query = make(map[string]l7QueryMatcherJSON, len(r.Allow.Query)) + for k, q := range r.Allow.Query { + rj.Allow.Query[k] = l7QueryMatcherJSON{Glob: q.Glob, Any: q.Any} + } + } + } + return rj +} + +// ParseNetworkPolicyRule parses camelCase JSON into an SDK NetworkPolicyRule. +func ParseNetworkPolicyRule(raw json.RawMessage) (*openshell.NetworkPolicyRule, error) { + var rj networkPolicyRuleJSON + dec := json.NewDecoder(bytes.NewReader(raw)) + dec.DisallowUnknownFields() + if err := dec.Decode(&rj); err != nil { + return nil, err + } + rule := &openshell.NetworkPolicyRule{Name: rj.Name} + for _, ej := range rj.Endpoints { + ep := openshell.PolicyNetworkEndpoint{ + Host: ej.Host, + Port: ej.Port, + Ports: ej.Ports, + Protocol: ej.Protocol, + TLS: ej.Tls, + Enforcement: ej.Enforcement, + Access: ej.Access, + AllowedIPs: ej.AllowedIps, + AllowEncodedSlash: ej.AllowEncodedSlash, + PersistedQueries: ej.PersistedQueries, + GraphqlMaxBodyBytes: ej.GraphqlMaxBodyBytes, + Path: ej.Path, + WebsocketCredentialRewrite: ej.WebsocketCredentialRewrite, + RequestBodyCredentialRewrite: ej.RequestBodyCredentialRewrite, + AdvisorProposed: ej.AdvisorProposed, + } + for _, rJSON := range ej.Rules { + ep.Rules = append(ep.Rules, parseL7Rule(rJSON)) + } + for _, drJSON := range ej.DenyRules { + ep.DenyRules = append(ep.DenyRules, parseL7DenyRule(drJSON)) + } + if len(ej.GraphqlPersistedQueries) > 0 { + ep.GraphqlPersistedQueries = make(map[string]openshell.GraphqlOperation, len(ej.GraphqlPersistedQueries)) + for k, op := range ej.GraphqlPersistedQueries { + ep.GraphqlPersistedQueries[k] = openshell.GraphqlOperation{ + OperationType: op.OperationType, + OperationName: op.OperationName, + Fields: op.Fields, + } + } + } + rule.Endpoints = append(rule.Endpoints, ep) + } + for _, bj := range rj.Binaries { + rule.Binaries = append(rule.Binaries, openshell.PolicyNetworkBinary{Path: bj.Path}) + } + return rule, nil +} + +func parseL7Rule(rj l7RuleJSON) openshell.L7Rule { + r := openshell.L7Rule{} + if rj.Allow != nil { + r.Allow = &openshell.L7Allow{ + Method: rj.Allow.Method, + Path: rj.Allow.Path, + Command: rj.Allow.Command, + OperationType: rj.Allow.OperationType, + OperationName: rj.Allow.OperationName, + Fields: rj.Allow.Fields, + } + if len(rj.Allow.Query) > 0 { + r.Allow.Query = make(map[string]openshell.L7QueryMatcher, len(rj.Allow.Query)) + for k, q := range rj.Allow.Query { + r.Allow.Query[k] = openshell.L7QueryMatcher{Glob: q.Glob, Any: q.Any} + } + } + } + return r +} + +func parseL7DenyRule(dj l7DenyRuleJSON) openshell.L7DenyRule { + dr := openshell.L7DenyRule{ + Method: dj.Method, + Path: dj.Path, + Command: dj.Command, + OperationType: dj.OperationType, + OperationName: dj.OperationName, + Fields: dj.Fields, + } + if len(dj.Query) > 0 { + dr.Query = make(map[string]openshell.L7QueryMatcher, len(dj.Query)) + for k, q := range dj.Query { + dr.Query[k] = openshell.L7QueryMatcher{Glob: q.Glob, Any: q.Any} + } + } + return dr +} + +func convertL7DenyRule(dr openshell.L7DenyRule) l7DenyRuleJSON { + dj := l7DenyRuleJSON{ + Method: dr.Method, + Path: dr.Path, + Command: dr.Command, + OperationType: dr.OperationType, + OperationName: dr.OperationName, + Fields: dr.Fields, + } + if len(dr.Query) > 0 { + dj.Query = make(map[string]l7QueryMatcherJSON, len(dr.Query)) + for k, q := range dr.Query { + dj.Query[k] = l7QueryMatcherJSON{Glob: q.Glob, Any: q.Any} + } + } + return dj +} diff --git a/backend/internal/models/models_test.go b/backend/internal/models/models_test.go index e0829e8..68e1cbe 100644 --- a/backend/internal/models/models_test.go +++ b/backend/internal/models/models_test.go @@ -5,20 +5,20 @@ import ( "strings" "testing" - datamodelv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/datamodelv1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" + openshell "github.com/rhuss/openshell-sdk-go/openshell/v1" ) -// Provider credentials are secret-marked in proto; the DTO must never carry -// their values, only key names. func TestFromProviderStripsCredentialValues(t *testing.T) { - provider := &datamodelv1.Provider{ - Metadata: &datamodelv1.ObjectMeta{Id: "p1", Name: "claude"}, - Type: "claude", - Credentials: map[string]string{ - "api_key": "sk-super-secret", + provider := &openshell.Provider{ + ID: "p1", + Name: "claude", + Type: "claude", + Spec: openshell.ProviderSpec{ + Credentials: map[string]string{ + "api_key": "sk-super-secret", + }, + Config: map[string]string{"region": "us"}, }, - Config: map[string]string{"region": "us"}, } dto := FromProvider(provider) @@ -36,19 +36,18 @@ func TestFromProviderStripsCredentialValues(t *testing.T) { func TestSandboxPhaseMapping(t *testing.T) { cases := []struct { - phase openshellv1.SandboxPhase + phase openshell.SandboxPhase want string }{ - {openshellv1.SandboxPhase_SANDBOX_PHASE_PROVISIONING, "PROVISIONING"}, - {openshellv1.SandboxPhase_SANDBOX_PHASE_READY, "READY"}, - {openshellv1.SandboxPhase_SANDBOX_PHASE_ERROR, "ERROR"}, - {openshellv1.SandboxPhase_SANDBOX_PHASE_DELETING, "DELETING"}, - {openshellv1.SandboxPhase_SANDBOX_PHASE_UNKNOWN, "UNKNOWN"}, - {openshellv1.SandboxPhase_SANDBOX_PHASE_UNSPECIFIED, "UNSPECIFIED"}, + {openshell.SandboxProvisioning, "PROVISIONING"}, + {openshell.SandboxReady, "READY"}, + {openshell.SandboxError, "ERROR"}, + {openshell.SandboxDeleting, "DELETING"}, + {openshell.SandboxUnknown, "UNKNOWN"}, } for _, tc := range cases { - sandbox := &openshellv1.Sandbox{ - Status: &openshellv1.SandboxStatus{Phase: tc.phase}, + sandbox := &openshell.Sandbox{ + Status: openshell.SandboxStatus{Phase: tc.phase}, } if got := FromSandbox(sandbox).Status.Phase; got != tc.want { t.Errorf("phase %v: got %q, want %q", tc.phase, got, tc.want) @@ -58,13 +57,13 @@ func TestSandboxPhaseMapping(t *testing.T) { func TestParsePolicyRoundTrip(t *testing.T) { raw := json.RawMessage(`{ - "version": 1, - "filesystem": {"includeWorkdir": true, "readOnly": ["/usr"], "readWrite": ["/sandbox"]}, - "landlock": {"compatibility": "best_effort"}, - "process": {"runAsUser": "sandbox", "runAsGroup": "sandbox"}, - "networkPolicies": { + "Version": 1, + "Filesystem": {"IncludeWorkdir": true, "ReadOnly": ["/usr"], "ReadWrite": ["/sandbox"]}, + "Landlock": {"Compatibility": "best_effort"}, + "Process": {"RunAsUser": "sandbox", "RunAsGroup": "sandbox"}, + "NetworkPolicies": { "anthropic": { - "endpoints": [{"host": "api.anthropic.com", "port": 443, "protocol": "rest", "enforcement": "enforce", "access": "read-write"}] + "Endpoints": [{"Host": "api.anthropic.com", "Port": 443, "Protocol": "rest", "Enforcement": "enforce", "Access": "read-write"}] } } }`) @@ -75,8 +74,8 @@ func TestParsePolicyRoundTrip(t *testing.T) { if policy.Version != 1 { t.Errorf("version: got %d", policy.Version) } - if !policy.Filesystem.IncludeWorkdir { - t.Error("filesystem.includeWorkdir not parsed") + if policy.Filesystem == nil || !policy.Filesystem.IncludeWorkdir { + t.Error("filesystem.IncludeWorkdir not parsed") } rule, ok := policy.NetworkPolicies["anthropic"] if !ok { diff --git a/backend/internal/models/observability.go b/backend/internal/models/observability.go index ed76f4b..f99779a 100644 --- a/backend/internal/models/observability.go +++ b/backend/internal/models/observability.go @@ -4,17 +4,14 @@ import ( "encoding/json" "fmt" "sort" + "strings" - inferencev1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/inferencev1" - openshellv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/openshellv1" - sandboxv1 "github.com/Gkrumbach07/openshell-dashboard/backend/gen/sandboxv1" + openshell "github.com/rhuss/openshell-sdk-go/openshell/v1" ) -// LogLine mirrors openshell.v1.SandboxLogLine. The fields map carries -// structured network-decision context (dst_host, action, …) — the dashboard's -// only window into security decisions (there is no events API). +// LogLine mirrors openshell.LogLine. The fields map carries structured +// network-decision context (dst_host, action, ...). type LogLine struct { - SandboxID string `json:"sandboxId,omitempty"` TimestampMs int64 `json:"timestampMs"` Level string `json:"level,omitempty"` Target string `json:"target,omitempty"` @@ -23,18 +20,17 @@ type LogLine struct { Fields map[string]string `json:"fields,omitempty"` } -// SandboxLogs mirrors GetSandboxLogsResponse. +// SandboxLogs mirrors openshell.LogResult. type SandboxLogs struct { Logs []LogLine `json:"logs"` BufferTotal uint32 `json:"bufferTotal"` } -func FromSandboxLogs(resp *openshellv1.GetSandboxLogsResponse) SandboxLogs { - out := SandboxLogs{Logs: []LogLine{}, BufferTotal: resp.GetBufferTotal()} - for _, line := range resp.GetLogs() { +func FromSandboxLogs(result *openshell.LogResult) SandboxLogs { + out := SandboxLogs{Logs: []LogLine{}, BufferTotal: result.BufferTotal} + for _, line := range result.Lines { out.Logs = append(out.Logs, LogLine{ - SandboxID: line.SandboxId, - TimestampMs: line.TimestampMs, + TimestampMs: timeToMs(line.Timestamp), Level: line.Level, Target: line.Target, Message: line.Message, @@ -45,48 +41,29 @@ func FromSandboxLogs(resp *openshellv1.GetSandboxLogsResponse) SandboxLogs { return out } -// PolicyRevision mirrors openshell.v1.SandboxPolicyRevision. Policy content -// is protojson when the gateway populated it. +// PolicyRevision mirrors openshell.SandboxPolicyRevision. Policy content +// is camelCase JSON when the gateway populated it. type PolicyRevision struct { - Version uint32 `json:"version"` - PolicyHash string `json:"policyHash,omitempty"` - // Status is PENDING, LOADED, FAILED, or SUPERSEDED. - Status string `json:"status"` - LoadError string `json:"loadError,omitempty"` - CreatedAtMs int64 `json:"createdAtMs"` - LoadedAtMs int64 `json:"loadedAtMs,omitempty"` - Policy json.RawMessage `json:"policy,omitempty"` - Provenance map[string]string `json:"provenance,omitempty"` -} - -func policyStatusString(status openshellv1.PolicyStatus) string { - switch status { - case openshellv1.PolicyStatus_POLICY_STATUS_PENDING: - return "PENDING" - case openshellv1.PolicyStatus_POLICY_STATUS_LOADED: - return "LOADED" - case openshellv1.PolicyStatus_POLICY_STATUS_FAILED: - return "FAILED" - case openshellv1.PolicyStatus_POLICY_STATUS_SUPERSEDED: - return "SUPERSEDED" - } - return "UNSPECIFIED" + Version uint32 `json:"version"` + PolicyHash string `json:"policyHash,omitempty"` + Status string `json:"status"` + LoadError string `json:"loadError,omitempty"` + CreatedAtMs int64 `json:"createdAtMs"` + LoadedAtMs int64 `json:"loadedAtMs,omitempty"` + Policy json.RawMessage `json:"policy,omitempty"` } -func FromPolicyRevision(revision *openshellv1.SandboxPolicyRevision) PolicyRevision { +func FromPolicyRevision(revision *openshell.SandboxPolicyRevision) PolicyRevision { out := PolicyRevision{ - Version: revision.GetVersion(), - PolicyHash: revision.GetPolicyHash(), - Status: policyStatusString(revision.GetStatus()), - LoadError: revision.GetLoadError(), - CreatedAtMs: revision.GetCreatedAtMs(), - LoadedAtMs: revision.GetLoadedAtMs(), - Provenance: revision.GetProvenance(), + Version: revision.Version, + PolicyHash: revision.PolicyHash, + Status: strings.ToUpper(revision.Status.String()), + LoadError: revision.LoadError, + CreatedAtMs: timeToMs(revision.CreatedAt), + LoadedAtMs: timeToMs(revision.LoadedAt), } - if revision.GetPolicy() != nil { - if raw, err := policyMarshaler.Marshal(revision.GetPolicy()); err == nil { - out.Policy = raw - } + if revision.Policy != nil { + out.Policy = marshalPolicy(revision.Policy) } return out } @@ -99,15 +76,13 @@ type SandboxPolicyView struct { Revisions []PolicyRevision `json:"revisions"` } -// PolicyUpdateResult mirrors UpdateConfigResponse for policy updates. +// PolicyUpdateResult mirrors ConfigUpdateResult for policy updates. type PolicyUpdateResult struct { Version uint32 `json:"version"` PolicyHash string `json:"policyHash,omitempty"` } -// PolicyChunk mirrors openshell.v1.PolicyChunk — one draft policy proposal. -// ProposedRule is protojson of a NetworkPolicyRule. ValidationResult carries -// the gateway prover verdict (there is no separate verify RPC). +// PolicyChunk mirrors openshell.PolicyChunk. type PolicyChunk struct { ID string `json:"id"` Status string `json:"status"` @@ -124,7 +99,7 @@ type PolicyChunk struct { RejectionReason string `json:"rejectionReason,omitempty"` } -// DraftPolicy mirrors GetDraftPolicyResponse. +// DraftPolicy mirrors openshell.DraftPolicy. type DraftPolicy struct { Chunks []PolicyChunk `json:"chunks"` RollingSummary string `json:"rollingSummary,omitempty"` @@ -132,39 +107,35 @@ type DraftPolicy struct { LastAnalyzedAtMs int64 `json:"lastAnalyzedAtMs,omitempty"` } -func FromDraftPolicy(resp *openshellv1.GetDraftPolicyResponse) DraftPolicy { +func FromDraftPolicy(draft *openshell.DraftPolicy) DraftPolicy { out := DraftPolicy{ Chunks: []PolicyChunk{}, - RollingSummary: resp.GetRollingSummary(), - DraftVersion: resp.GetDraftVersion(), - LastAnalyzedAtMs: resp.GetLastAnalyzedAtMs(), + RollingSummary: draft.RollingSummary, + DraftVersion: draft.DraftVersion, + LastAnalyzedAtMs: timeToMs(draft.LastAnalyzedAt), } - for _, chunk := range resp.GetChunks() { + for _, chunk := range draft.Chunks { item := PolicyChunk{ - ID: chunk.Id, + ID: chunk.ID, Status: chunk.Status, RuleName: chunk.RuleName, Rationale: chunk.Rationale, SecurityNotes: chunk.SecurityNotes, Confidence: chunk.Confidence, - CreatedAtMs: chunk.CreatedAtMs, - DecidedAtMs: chunk.DecidedAtMs, + CreatedAtMs: timeToMs(chunk.CreatedAt), + DecidedAtMs: timeToMs(chunk.DecidedAt), HitCount: chunk.HitCount, Binary: chunk.Binary, ValidationResult: chunk.ValidationResult, RejectionReason: chunk.RejectionReason, } - if chunk.ProposedRule != nil { - if raw, err := policyMarshaler.Marshal(chunk.ProposedRule); err == nil { - item.ProposedRule = raw - } - } + item.ProposedRule = MarshalNetworkPolicyRule(chunk.ProposedRule) out.Chunks = append(out.Chunks, item) } return out } -// DraftHistoryEntry mirrors openshell.v1.DraftHistoryEntry. +// DraftHistoryEntry mirrors openshell.DraftHistoryEntry. type DraftHistoryEntry struct { TimestampMs int64 `json:"timestampMs"` EventType string `json:"eventType"` @@ -172,20 +143,20 @@ type DraftHistoryEntry struct { ChunkID string `json:"chunkId,omitempty"` } -func FromDraftHistory(resp *openshellv1.GetDraftHistoryResponse) []DraftHistoryEntry { - out := make([]DraftHistoryEntry, 0, len(resp.GetEntries())) - for _, e := range resp.GetEntries() { +func FromDraftHistory(entries []openshell.DraftHistoryEntry) []DraftHistoryEntry { + out := make([]DraftHistoryEntry, 0, len(entries)) + for _, e := range entries { out = append(out, DraftHistoryEntry{ - TimestampMs: e.GetTimestampMs(), - EventType: e.GetEventType(), - Description: e.GetDescription(), - ChunkID: e.GetChunkId(), + TimestampMs: timeToMs(e.Timestamp), + EventType: e.EventType, + Description: e.Description, + ChunkID: e.ChunkID, }) } return out } -// ServiceEndpoint mirrors openshell.v1.ServiceEndpointResponse. +// ServiceEndpoint mirrors openshell.ServiceEndpoint. type ServiceEndpoint struct { SandboxName string `json:"sandboxName"` ServiceName string `json:"serviceName"` @@ -194,14 +165,13 @@ type ServiceEndpoint struct { URL string `json:"url,omitempty"` } -func FromServiceEndpointResponse(resp *openshellv1.ServiceEndpointResponse) ServiceEndpoint { - ep := resp.GetEndpoint() +func FromServiceEndpoint(ep *openshell.ServiceEndpoint) ServiceEndpoint { return ServiceEndpoint{ - SandboxName: ep.GetSandboxName(), - ServiceName: ep.GetServiceName(), - TargetPort: ep.GetTargetPort(), - Domain: ep.GetDomain(), - URL: resp.GetUrl(), + SandboxName: ep.SandboxName, + ServiceName: ep.ServiceName, + TargetPort: ep.TargetPort, + Domain: ep.Domain, + URL: ep.URL, } } @@ -211,35 +181,32 @@ type SettingEntry struct { Value string `json:"value"` } -// GatewaySettings mirrors GetGatewayConfigResponse as a flat list. +// GatewaySettings mirrors openshell.GatewayConfig as a flat list. type GatewaySettings struct { Settings []SettingEntry `json:"settings"` SettingsRevision uint64 `json:"settingsRevision"` } -func settingValueString(sv *sandboxv1.SettingValue) string { - if sv == nil { - return "" - } - switch v := sv.Value.(type) { - case *sandboxv1.SettingValue_StringValue: - return v.StringValue - case *sandboxv1.SettingValue_BoolValue: - return fmt.Sprintf("%t", v.BoolValue) - case *sandboxv1.SettingValue_IntValue: - return fmt.Sprintf("%d", v.IntValue) - case *sandboxv1.SettingValue_BytesValue: - return fmt.Sprintf("%x", v.BytesValue) +func settingValueString(sv openshell.SettingValue) string { + switch sv.Type { + case "string": + return sv.StringVal + case "bool": + return fmt.Sprintf("%t", sv.BoolVal) + case "int": + return fmt.Sprintf("%d", sv.IntVal) + case "bytes": + return fmt.Sprintf("%x", sv.BytesVal) } return "" } -func FromGatewaySettings(resp *sandboxv1.GetGatewayConfigResponse) GatewaySettings { +func FromGatewaySettings(config *openshell.GatewayConfig) GatewaySettings { out := GatewaySettings{ Settings: []SettingEntry{}, - SettingsRevision: resp.GetSettingsRevision(), + SettingsRevision: config.SettingsRevision, } - for key, val := range resp.GetSettings() { + for key, val := range config.Settings { out.Settings = append(out.Settings, SettingEntry{ Key: key, Value: settingValueString(val), @@ -251,8 +218,7 @@ func FromGatewaySettings(resp *sandboxv1.GetGatewayConfigResponse) GatewaySettin return out } -// InferenceRoute mirrors GetInferenceRouteResponse. Route "" is the -// user-facing inference.local route; "sandbox-system" is the system route. +// InferenceRoute mirrors openshell.InferenceRoute. type InferenceRoute struct { RouteName string `json:"routeName"` ProviderName string `json:"providerName"` @@ -261,12 +227,12 @@ type InferenceRoute struct { TimeoutSecs uint64 `json:"timeoutSecs"` } -func FromInferenceRoute(resp *inferencev1.GetInferenceRouteResponse) InferenceRoute { +func FromInferenceRoute(route *openshell.InferenceRoute) InferenceRoute { return InferenceRoute{ - RouteName: resp.GetRouteName(), - ProviderName: resp.GetProviderName(), - ModelID: resp.GetModelId(), - Version: resp.GetVersion(), - TimeoutSecs: resp.GetTimeoutSecs(), + RouteName: route.RouteName, + ProviderName: route.ProviderName, + ModelID: route.ModelID, + Version: route.Version, + TimeoutSecs: route.TimeoutSecs, } } diff --git a/backend/internal/sdkclient/auth.go b/backend/internal/sdkclient/auth.go new file mode 100644 index 0000000..327bdcc --- /dev/null +++ b/backend/internal/sdkclient/auth.go @@ -0,0 +1,24 @@ +package sdkclient + +import ( + "context" + + "github.com/Gkrumbach07/openshell-dashboard/backend/internal/auth" +) + +// ContextAuthProvider implements grpc.PerRPCCredentials by reading the JWT +// from the request context on every gRPC call. This allows a single shared +// SDK client to forward per-request user tokens to the gateway. +type ContextAuthProvider struct{} + +func (ContextAuthProvider) GetRequestMetadata(ctx context.Context, _ ...string) (map[string]string, error) { + token := auth.TokenFromContext(ctx) + if token == "" { + return nil, nil + } + return map[string]string{"authorization": "Bearer " + token}, nil +} + +func (ContextAuthProvider) RequireTransportSecurity() bool { + return false +} diff --git a/backend/proto/datamodel.proto b/backend/proto/datamodel.proto deleted file mode 100644 index 1fc22a9..0000000 --- a/backend/proto/datamodel.proto +++ /dev/null @@ -1,88 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -syntax = "proto3"; - -package openshell.datamodel.v1; - -import "options.proto"; - -// Kubernetes-style metadata shared by all top-level OpenShell domain objects. -// -// This structure provides consistent metadata (identity, labels, annotations, -// timestamps, resource versioning) across Sandbox, Provider, SshSession, and -// other resources. -message ObjectMeta { - // Stable object ID generated by the gateway. - string id = 1; - - // Human-readable object name (unique per object type). - string name = 2; - - // Milliseconds since Unix epoch when the object was created. - int64 created_at_ms = 3; - - // Key-value labels for filtering and organization. - // Labels must follow Kubernetes conventions: alphanumeric + `-._/`, max 63 chars per segment. - map labels = 4; - - // Optimistic concurrency control version. - // Incremented by the gateway on each update. Clients can use this for compare-and-swap operations. - uint64 resource_version = 5; - - // Opaque key-value metadata that is not used for selectors. - // Annotation keys use the same qualified-key shape as labels, but values may be longer. - map annotations = 6; - - // Workspace that owns this resource. Empty is normalized to "default" by the - // gateway. Immutable after creation. - string workspace = 7; - - // Milliseconds since Unix epoch when graceful deletion was initiated. - // Zero means the object is not being deleted. Once set, this field is - // immutable — the only path forward is completing deletion. - int64 deletion_timestamp_ms = 8; -} - -// Phase of a workspace's lifecycle. -enum WorkspacePhase { - WORKSPACE_PHASE_UNSPECIFIED = 0; - WORKSPACE_PHASE_ACTIVE = 1; - WORKSPACE_PHASE_TERMINATING = 2; -} - -// Status of a workspace. -message WorkspaceStatus { - WorkspacePhase phase = 1; -} - -// Workspace resource. A hard isolation boundary for sandboxes, providers, and -// other workspace-scoped resources. -message Workspace { - // Kubernetes-style metadata (id, name, labels, timestamps, resource version). - // The workspace field in this ObjectMeta is unused (a workspace does not - // belong to another workspace). - ObjectMeta metadata = 1; - - // Current lifecycle status. - WorkspaceStatus status = 2; -} - -// Provider model stored by OpenShell. -message Provider { - // Kubernetes-style metadata (id, name, labels, timestamps, resource version). - ObjectMeta metadata = 1; - // Canonical provider type slug (for example: "claude", "gitlab"). - string type = 2; - // Secret values used for authentication. - map credentials = 3 [(openshell.options.v1.secret) = true]; - // Non-secret provider configuration. - map config = 4; - // Expiration timestamps for credential values, keyed by credential/env var - // name. A zero or missing value means the credential does not expire. - map credential_expires_at_ms = 5; - // Workspace where this provider's type profile is stored. - // Empty string = platform/global scope. Must be empty or match - // metadata.workspace; cross-workspace references are rejected. - string profile_workspace = 6; -} diff --git a/backend/proto/inference.proto b/backend/proto/inference.proto deleted file mode 100644 index a28d714..0000000 --- a/backend/proto/inference.proto +++ /dev/null @@ -1,173 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -syntax = "proto3"; - -package openshell.inference.v1; - -import "datamodel.proto"; -import "options.proto"; - -// Inference service provides workspace-scoped inference route configuration and bundle delivery. -service Inference { - // Return the resolved inference route bundle for sandbox-local execution. - rpc GetInferenceBundle(GetInferenceBundleRequest) - returns (GetInferenceBundleResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "sandbox" - }; - } - - // Set the inference route for a workspace. - // - // This controls how requests sent to `inference.local` are routed - // for sandboxes in the specified workspace. - rpc SetInferenceRoute(SetInferenceRouteRequest) - returns (SetInferenceRouteResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "inference:write" - workspace_role: "admin" - }; - } - - // Get the inference route for a workspace. - rpc GetInferenceRoute(GetInferenceRouteRequest) - returns (GetInferenceRouteResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "inference:read" - workspace_role: "user" - }; - } - - // Delete an inference route from a workspace. - rpc DeleteInferenceRoute(DeleteInferenceRouteRequest) - returns (DeleteInferenceRouteResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "inference:write" - workspace_role: "admin" - }; - } -} - -// Persisted inference route configuration. -// -// Only `provider_name` and `model_id` are stored; endpoint, protocols, -// credentials, and auth style are resolved from the provider at bundle time. -message InferenceRouteConfig { - // Provider record name backing this route. - string provider_name = 1; - // Model identifier to force on generation calls. - string model_id = 2; - // Per-route request timeout in seconds. 0 means use default (60s). - uint64 timeout_secs = 3; -} - -// Storage envelope for a workspace-scoped inference route. -message InferenceRoute { - openshell.datamodel.v1.ObjectMeta metadata = 1; - InferenceRouteConfig config = 2; - // Monotonic version incremented on every update. - uint64 version = 3; -} - -message SetInferenceRouteRequest { - // Provider record name to use for credentials + endpoint mapping. - string provider_name = 1; - // Model identifier to force on generation calls. - string model_id = 2; - // Route name to target. Empty string defaults to "inference.local" (user-facing). - // Use "sandbox-system" for the sandbox system-level inference route. - string route_name = 3; - // Verify the resolved upstream endpoint synchronously before persistence. - bool verify = 4; - // Skip synchronous endpoint validation before persistence. - bool no_verify = 5; - // Per-route request timeout in seconds. 0 means use default (60s). - uint64 timeout_secs = 6; - // Target workspace. Empty string defaults to "default". - string workspace = 7; -} - -message ValidatedEndpoint { - string url = 1; - string protocol = 2; -} - -message SetInferenceRouteResponse { - string provider_name = 1; - string model_id = 2; - uint64 version = 3; - // Route name that was configured. - string route_name = 4; - // Whether endpoint verification ran as part of this request. - bool validation_performed = 5; - // The concrete endpoints that were probed during validation, when available. - repeated ValidatedEndpoint validated_endpoints = 6; - // Per-route request timeout in seconds that was persisted. - uint64 timeout_secs = 7; - // Workspace the route was configured in. - string workspace = 8; -} - -message GetInferenceRouteRequest { - // Route name to query. Empty string defaults to "inference.local" (user-facing). - // Use "sandbox-system" for the sandbox system-level inference route. - string route_name = 1; - // Target workspace. Empty string defaults to "default". - string workspace = 2; -} - -message GetInferenceRouteResponse { - string provider_name = 1; - string model_id = 2; - uint64 version = 3; - // Route name that was queried. - string route_name = 4; - // Per-route request timeout in seconds. 0 means default (60s). - uint64 timeout_secs = 5; - // Workspace the route belongs to. - string workspace = 6; -} - -message DeleteInferenceRouteRequest { - // Route name to delete. Empty string defaults to "inference.local" (user-facing). - // Use "sandbox-system" for the sandbox system-level inference route. - string route_name = 1; - // Target workspace. Empty string defaults to "default". - string workspace = 2; -} - -message DeleteInferenceRouteResponse { - // Whether a route was actually deleted. - bool deleted = 1; -} - -message GetInferenceBundleRequest {} - -// A single resolved route ready for sandbox-local execution. -message ResolvedRoute { - string name = 1; - string base_url = 2; - repeated string protocols = 3; - string api_key = 4 [(openshell.options.v1.secret) = true]; - string model_id = 5; - string provider_type = 6; - // Per-route request timeout in seconds. 0 means use default (60s). - uint64 timeout_secs = 7; - // When true, the model identifier is embedded in the URL path (e.g. Vertex AI). - bool model_in_path = 8; - // Optional override for the request path. When set, replaces the protocol-derived path. - // An empty string means POST directly to base_url/model_id with no additional path. - optional string request_path_override = 9; -} - -message GetInferenceBundleResponse { - repeated ResolvedRoute routes = 1; - // Opaque revision tag for cache freshness checks. - string revision = 2; - // Timestamp (epoch ms) when this bundle was generated. - int64 generated_at_ms = 3; -} diff --git a/backend/proto/openshell.proto b/backend/proto/openshell.proto deleted file mode 100644 index 9f2fdf9..0000000 --- a/backend/proto/openshell.proto +++ /dev/null @@ -1,2600 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -syntax = "proto3"; - -package openshell.v1; - -import "datamodel.proto"; -import "google/protobuf/struct.proto"; -import "options.proto"; -import "sandbox.proto"; - -// OpenShell service provides sandbox, provider, and runtime management capabilities. -// -// Conventions: -// - This file owns the public API resource model exposed to OpenShell clients. -// - `Sandbox`, `SandboxSpec`, `SandboxStatus`, and `SandboxPhase` are gateway-owned -// public types. Internal compute drivers must not import or return them directly. -// - The gateway translates internal compute-driver observations into these public -// resource messages before persisting or returning them to clients. -service OpenShell { - // Check the health of the service. - rpc Health(HealthRequest) returns (HealthResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "unauthenticated" - }; - } - - // Return the authenticated caller identity established by the gateway. - rpc GetCurrentUser(GetCurrentUserRequest) returns (GetCurrentUserResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - }; - } - - // Fetch elevated live gateway runtime metadata. - rpc GetGatewayInfo(GetGatewayInfoRequest) returns (GetGatewayInfoResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "config:read" - global_role: "platform_admin" - }; - } - - // Create a new sandbox. - rpc CreateSandbox(CreateSandboxRequest) returns (SandboxResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:write" - workspace_role: "user" - }; - } - - // Fetch a sandbox by name. - rpc GetSandbox(GetSandboxRequest) returns (SandboxResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:read" - workspace_role: "user" - }; - } - - // List sandboxes. - rpc ListSandboxes(ListSandboxesRequest) returns (ListSandboxesResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:read" - workspace_role: "user" - }; - } - - // List provider records attached to a sandbox. - rpc ListSandboxProviders(ListSandboxProvidersRequest) - returns (ListSandboxProvidersResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:read" - workspace_role: "user" - }; - } - - // Attach a provider record to an existing sandbox. - rpc AttachSandboxProvider(AttachSandboxProviderRequest) - returns (AttachSandboxProviderResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:write" - workspace_role: "user" - }; - } - - // Detach a provider record from an existing sandbox. - rpc DetachSandboxProvider(DetachSandboxProviderRequest) - returns (DetachSandboxProviderResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:write" - workspace_role: "user" - }; - } - - // Delete a sandbox by name. - rpc DeleteSandbox(DeleteSandboxRequest) returns (DeleteSandboxResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:write" - workspace_role: "user" - }; - } - - // Create a short-lived SSH session for a sandbox. - rpc CreateSshSession(CreateSshSessionRequest) returns (CreateSshSessionResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:write" - workspace_role: "user" - }; - } - - // Create or update a sandbox HTTP service endpoint for local routing. - rpc ExposeService(ExposeServiceRequest) returns (ServiceEndpointResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:write" - workspace_role: "user" - }; - } - - // Fetch one sandbox HTTP service endpoint. - rpc GetService(GetServiceRequest) returns (ServiceEndpointResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:read" - workspace_role: "user" - }; - } - - // List sandbox HTTP service endpoints. - rpc ListServices(ListServicesRequest) returns (ListServicesResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:read" - workspace_role: "user" - }; - } - - // Delete one sandbox HTTP service endpoint. - rpc DeleteService(DeleteServiceRequest) returns (DeleteServiceResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:write" - workspace_role: "user" - }; - } - - // Revoke a previously issued SSH session. - rpc RevokeSshSession(RevokeSshSessionRequest) returns (RevokeSshSessionResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:write" - workspace_role: "user" - }; - } - - // Execute a command in a ready sandbox and stream output. - rpc ExecSandbox(ExecSandboxRequest) returns (stream ExecSandboxEvent) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:write" - workspace_role: "user" - }; - } - - // Forward one CLI-side TCP connection to a loopback TCP target in a sandbox. - rpc ForwardTcp(stream TcpForwardFrame) returns (stream TcpForwardFrame) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:write" - workspace_role: "user" - }; - } - - // Execute an interactive command with bidirectional stdin/stdout streaming. - // The first client message MUST carry an ExecSandboxInput with the start - // variant. Subsequent messages carry stdin bytes or window resize events. - rpc ExecSandboxInteractive(stream ExecSandboxInput) returns (stream ExecSandboxEvent) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:write" - workspace_role: "user" - }; - } - - // Create a provider. - rpc CreateProvider(CreateProviderRequest) returns (ProviderResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "provider:write" - workspace_role: "admin" - }; - } - - // Fetch a provider by name. - rpc GetProvider(GetProviderRequest) returns (ProviderResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "provider:read" - workspace_role: "user" - }; - } - - // List providers. - rpc ListProviders(ListProvidersRequest) returns (ListProvidersResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "provider:read" - workspace_role: "user" - }; - } - - // List available provider type profiles. - rpc ListProviderProfiles(ListProviderProfilesRequest) - returns (ListProviderProfilesResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "provider:read" - workspace_role: "user" - }; - } - - // Fetch one provider type profile by id. - rpc GetProviderProfile(GetProviderProfileRequest) - returns (ProviderProfileResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "provider:read" - workspace_role: "user" - }; - } - - // Import custom provider type profiles. - rpc ImportProviderProfiles(ImportProviderProfilesRequest) - returns (ImportProviderProfilesResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "provider:write" - workspace_role: "admin" - }; - } - - // Update an existing custom provider type profile. - rpc UpdateProviderProfiles(UpdateProviderProfilesRequest) - returns (UpdateProviderProfilesResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "provider:write" - workspace_role: "admin" - }; - } - - // Validate provider type profiles without registering them. - rpc LintProviderProfiles(LintProviderProfilesRequest) - returns (LintProviderProfilesResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "provider:read" - workspace_role: "user" - }; - } - - // Update an existing provider by name. - rpc UpdateProvider(UpdateProviderRequest) returns (ProviderResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "provider:write" - workspace_role: "admin" - }; - } - - // Fetch refresh status for one provider or provider credential. - rpc GetProviderRefreshStatus(GetProviderRefreshStatusRequest) - returns (GetProviderRefreshStatusResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "provider:read" - workspace_role: "user" - }; - } - - // Configure gateway-owned refresh material for one provider credential. - rpc ConfigureProviderRefresh(ConfigureProviderRefreshRequest) - returns (ConfigureProviderRefreshResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "provider:write" - workspace_role: "admin" - }; - } - - // Record a gateway-owned refresh request for one provider credential. - rpc RotateProviderCredential(RotateProviderCredentialRequest) - returns (RotateProviderCredentialResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "provider:write" - workspace_role: "admin" - }; - } - - // Delete gateway-owned refresh configuration for one provider credential. - rpc DeleteProviderRefresh(DeleteProviderRefreshRequest) - returns (DeleteProviderRefreshResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "provider:write" - workspace_role: "admin" - }; - } - - // Delete a provider by name. - rpc DeleteProvider(DeleteProviderRequest) returns (DeleteProviderResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "provider:write" - workspace_role: "admin" - }; - } - - // Delete a custom provider type profile by id. - rpc DeleteProviderProfile(DeleteProviderProfileRequest) - returns (DeleteProviderProfileResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "provider:write" - workspace_role: "admin" - }; - } - - // Get sandbox settings by id (called by sandbox entrypoint and poll loop). - rpc GetSandboxConfig(openshell.sandbox.v1.GetSandboxConfigRequest) - returns (openshell.sandbox.v1.GetSandboxConfigResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "dual" - scope: "config:read" - workspace_role: "user" - }; - } - - // Get gateway-global settings (read-only feature flags; any authenticated - // user may read these so the CLI and TUI can discover capabilities like - // providers_v2_enabled without requiring Platform Admin). - // - // Scope-only (no role): scopes are granted by the IdP at token issuance, - // orthogonal to workspace membership. Deployments that enable scope - // enforcement configure the IdP to grant config:read (or openshell:all) - // to all sandbox users, so this does not block least-privilege flows. - rpc GetGatewayConfig(openshell.sandbox.v1.GetGatewayConfigRequest) - returns (openshell.sandbox.v1.GetGatewayConfigResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "config:read" - }; - } - - // Update settings or policy at sandbox or global scope. - rpc UpdateConfig(UpdateConfigRequest) - returns (UpdateConfigResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "dual" - scope: "config:write" - workspace_role: "admin" - }; - } - - // Get the load status of a specific policy version. - rpc GetSandboxPolicyStatus(GetSandboxPolicyStatusRequest) - returns (GetSandboxPolicyStatusResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:read" - workspace_role: "user" - }; - } - - // List policy history for a sandbox. - rpc ListSandboxPolicies(ListSandboxPoliciesRequest) - returns (ListSandboxPoliciesResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:read" - workspace_role: "user" - }; - } - - // Report policy load result (called by sandbox after reload attempt). - rpc ReportPolicyStatus(ReportPolicyStatusRequest) - returns (ReportPolicyStatusResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "sandbox" - }; - } - - // Get provider environment for a sandbox (called by sandbox supervisor at startup). - rpc GetSandboxProviderEnvironment(GetSandboxProviderEnvironmentRequest) - returns (GetSandboxProviderEnvironmentResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "sandbox" - }; - } - - // Fetch recent sandbox logs (one-shot). - rpc GetSandboxLogs(GetSandboxLogsRequest) returns (GetSandboxLogsResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:read" - workspace_role: "user" - }; - } - - // Push sandbox supervisor logs to the server (client-streaming). - rpc PushSandboxLogs(stream PushSandboxLogsRequest) returns (PushSandboxLogsResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "sandbox" - }; - } - - // Persistent supervisor-to-gateway session (bidirectional streaming). - // - // The supervisor opens this stream at startup and keeps it alive for the - // sandbox lifetime. The gateway uses it to coordinate relay channels for - // SSH connect, ExecSandbox, and targetable sandbox services. Raw service - // bytes flow over RelayStream calls (separate HTTP/2 streams on the same - // connection), not over this stream. - rpc ConnectSupervisor(stream SupervisorMessage) returns (stream GatewayMessage) { - option (openshell.options.v1.authorization) = { - auth_mode: "sandbox" - }; - } - - // Raw byte relay between supervisor and gateway. - // - // The supervisor initiates this call after receiving a RelayOpen message - // on its ConnectSupervisor stream. The first RelayFrame carries a - // RelayInit with the channel_id to associate the new HTTP/2 stream with - // the pending relay slot on the gateway. Subsequent frames carry raw bytes in either - // direction between the gateway-side waiter (ForwardTcp / exec handler) - // and the supervisor-side target bridge. - // - // This rides the same TCP+TLS+HTTP/2 connection as ConnectSupervisor — - // no new TLS handshake, no reverse HTTP CONNECT. - rpc RelayStream(stream RelayFrame) returns (stream RelayFrame) { - option (openshell.options.v1.authorization) = { - auth_mode: "sandbox" - }; - } - - // Watch a sandbox and stream updates. - // - // This stream can include: - // - Sandbox status snapshots (phase/status) - // - OpenShell server process logs correlated by sandbox_id - // - Platform events correlated to the sandbox - rpc WatchSandbox(WatchSandboxRequest) returns (stream SandboxStreamEvent) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "sandbox:read" - workspace_role: "user" - }; - } - - // --------------------------------------------------------------------------- - // Draft policy recommendation RPCs - // --------------------------------------------------------------------------- - - // Submit denial analysis results from sandbox (summaries + proposed chunks). - rpc SubmitPolicyAnalysis(SubmitPolicyAnalysisRequest) - returns (SubmitPolicyAnalysisResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "sandbox" - }; - } - - // Get draft policy recommendations for a sandbox. - rpc GetDraftPolicy(GetDraftPolicyRequest) returns (GetDraftPolicyResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "dual" - scope: "config:read" - workspace_role: "user" - }; - } - - // Approve a single draft policy chunk (merges into active policy). - rpc ApproveDraftChunk(ApproveDraftChunkRequest) - returns (ApproveDraftChunkResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "config:write" - workspace_role: "admin" - }; - } - - // Reject a single draft policy chunk. - rpc RejectDraftChunk(RejectDraftChunkRequest) - returns (RejectDraftChunkResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "config:write" - workspace_role: "admin" - }; - } - - // Approve all pending draft chunks (skips security-flagged unless forced). - rpc ApproveAllDraftChunks(ApproveAllDraftChunksRequest) - returns (ApproveAllDraftChunksResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "config:write" - workspace_role: "admin" - }; - } - - // Edit a pending draft chunk in-place (e.g. narrow allowed_ips). - rpc EditDraftChunk(EditDraftChunkRequest) returns (EditDraftChunkResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "config:write" - workspace_role: "admin" - }; - } - - // Reverse an approval (remove merged rule from active policy). - rpc UndoDraftChunk(UndoDraftChunkRequest) returns (UndoDraftChunkResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "config:write" - workspace_role: "admin" - }; - } - - // Clear all pending draft chunks for a sandbox. - rpc ClearDraftChunks(ClearDraftChunksRequest) - returns (ClearDraftChunksResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "config:write" - workspace_role: "admin" - }; - } - - // Get decision history for a sandbox's draft policy. - rpc GetDraftHistory(GetDraftHistoryRequest) returns (GetDraftHistoryResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "config:read" - workspace_role: "user" - }; - } - - // Exchange a sandbox-bootstrap credential (e.g. a Kubernetes projected - // ServiceAccount token) for a gateway-minted JWT bound to the calling - // sandbox's UUID. Used by the Kubernetes driver path; singleplayer - // drivers receive the gateway JWT directly from the create-sandbox flow - // and never call this RPC. - rpc IssueSandboxToken(IssueSandboxTokenRequest) returns (IssueSandboxTokenResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "sandbox" - }; - } - - // Renew the calling sandbox's gateway JWT. Older tokens remain valid - // until their own expiry; deployments should keep token TTLs short to - // bound replay exposure. The supervisor calls this from a background - // task at ~80% of the token's lifetime; the new token is cached in - // memory only — the on-disk bootstrap file is intentionally not - // rewritten. - rpc RefreshSandboxToken(RefreshSandboxTokenRequest) - returns (RefreshSandboxTokenResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "sandbox" - }; - } - - // --------------------------------------------------------------------------- - // Workspace management RPCs - // --------------------------------------------------------------------------- - - // Create a workspace. - rpc CreateWorkspace(CreateWorkspaceRequest) returns (CreateWorkspaceResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "workspace:write" - global_role: "platform_admin" - }; - } - - // Fetch a workspace by name. - rpc GetWorkspace(GetWorkspaceRequest) returns (GetWorkspaceResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "workspace:read" - workspace_role: "user" - }; - } - - // List workspaces. - rpc ListWorkspaces(ListWorkspacesRequest) returns (ListWorkspacesResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "workspace:read" - workspace_role: "user" - }; - } - - // Delete a workspace by name. - rpc DeleteWorkspace(DeleteWorkspaceRequest) returns (DeleteWorkspaceResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "workspace:write" - global_role: "platform_admin" - }; - } - - // Add a member to a workspace. - rpc AddWorkspaceMember(AddWorkspaceMemberRequest) returns (AddWorkspaceMemberResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "workspace:write" - workspace_role: "admin" - }; - } - - // Remove a member from a workspace. - rpc RemoveWorkspaceMember(RemoveWorkspaceMemberRequest) returns (RemoveWorkspaceMemberResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "workspace:write" - workspace_role: "admin" - }; - } - - // List members of a workspace. - rpc ListWorkspaceMembers(ListWorkspaceMembersRequest) returns (ListWorkspaceMembersResponse) { - option (openshell.options.v1.authorization) = { - auth_mode: "bearer" - scope: "workspace:read" - workspace_role: "user" - }; - } -} - -// IssueSandboxToken request. Empty body; identity is established by the -// authentication credentials carried in the request headers (a projected -// Kubernetes ServiceAccount JWT in the K8s driver path). -message IssueSandboxTokenRequest {} - -// IssueSandboxToken response. The supervisor caches the returned token in -// memory and presents it as `Authorization: Bearer` on every subsequent -// gateway RPC. -message IssueSandboxTokenResponse { - // Gateway-minted JWT bound to the calling sandbox's UUID. - string token = 1 [(openshell.options.v1.secret) = true]; - // Absolute expiry of the issued token, milliseconds since the epoch. 0 means - // the token is non-expiring. - int64 expires_at_ms = 2; -} - -// RefreshSandboxToken request. Empty body; the calling principal must -// already be a sandbox principal (i.e. the request carries a still-valid -// gateway-minted JWT in its Authorization header). -message RefreshSandboxTokenRequest {} - -// RefreshSandboxToken response. The new token replaces the supervisor's -// in-memory bearer credential. -message RefreshSandboxTokenResponse { - // Fresh gateway-minted JWT bound to the same sandbox UUID. - string token = 1 [(openshell.options.v1.secret) = true]; - // Absolute expiry of the new token, milliseconds since the epoch. 0 means - // the token is non-expiring. - int64 expires_at_ms = 2; -} - -// Health check request. -message HealthRequest {} - -// Health check response. -message HealthResponse { - // Service status. - ServiceStatus status = 1; - - // Service version. - string version = 2; -} - -// Current-user request. The identity comes from the authenticated request. -message GetCurrentUserRequest {} - -// Authenticated user identity as validated by the gateway. -message GetCurrentUserResponse { - // Stable identity subject (for example, the OIDC `sub` claim). - string subject = 1; - - // Human-readable identity name when supplied by the authentication provider. - string display_name = 2; - - // Roles granted to the authenticated identity. - repeated string roles = 3; - - // OAuth2 scopes granted to the authenticated identity. - repeated string scopes = 4; - - // Authentication provider that established the identity. - string identity_provider = 5; -} - -// Gateway info request. -message GetGatewayInfoRequest {} - -// Gateway info response. -message GetGatewayInfoResponse { - // Service status. - ServiceStatus status = 1; - - // OpenShell gateway binary version. - string gateway_version = 2; - - // Compute driver runtimes initialized by this gateway. Current gateways - // return exactly one entry. - repeated ComputeDriverInfo compute_drivers = 3; -} - -// Info for one initialized compute driver runtime. -message ComputeDriverInfo { - // Gateway-selected driver name used for routing and driver_config keys. - string name = 1; - - // Capabilities reported by the driver during gateway runtime initialization. - ComputeDriverCapabilities capabilities = 2; -} - -// Public compute driver capability snapshot. -message ComputeDriverCapabilities { - // Driver-reported human-readable name from the startup capability snapshot. - string driver_name = 1; - - // Driver-reported implementation version from the startup capability snapshot. - string driver_version = 2; -} - -// Public sandbox resource exposed by the OpenShell API. -// -// This is the canonical gateway-owned view of a sandbox. It merges user intent -// (`spec`) with gateway-managed metadata and status derived from internal -// compute-driver observations. -// -// Note: The `namespace` field has been removed from the public API. It remains -// in the internal `DriverSandbox` message as a compute-driver implementation detail. -message Sandbox { - // Kubernetes-style metadata (id, name, labels, timestamps, resource version). - openshell.datamodel.v1.ObjectMeta metadata = 1; - // Desired sandbox configuration submitted through the API. - SandboxSpec spec = 2; - // Latest user-facing observed status derived by the gateway. - SandboxStatus status = 3; - - reserved 4, 5; - reserved "phase", "current_policy_version"; -} - -// Desired sandbox configuration provided through the public API. -message SandboxSpec { - // Log level exposed to processes running inside the sandbox. - string log_level = 1; - // Environment variables injected into the sandbox runtime. - map environment = 5; - // Container or VM template used to provision the sandbox. - SandboxTemplate template = 6; - // Required sandbox policy configuration. - openshell.sandbox.v1.SandboxPolicy policy = 7; - // Provider names to attach to this sandbox. - repeated string providers = 8; - // Portable resource requirements used by the gateway for driver selection - // and by drivers for provisioning. - ResourceRequirements resource_requirements = 9; - reserved 10; - reserved "gpu_device"; - // Field 11 was `proposal_approval_mode`. The approval mode is now a - // runtime setting (gateway or sandbox scope) read via UpdateConfig / - // GetSandboxConfig, so it can be flipped on a running sandbox and - // managed fleet-wide. - reserved 11; - reserved "proposal_approval_mode"; -} - -message ResourceRequirements { - // GPU requirements for the sandbox. Presence indicates a GPU request. - GpuResourceRequirements gpu = 1; -} - -// Public GPU resource requirements. -message GpuResourceRequirements { - // Optional number of GPUs requested. When omitted, the request is for one - // GPU using the selected driver's default assignment behavior. - optional uint32 count = 1; -} - -// Public sandbox template mapped onto compute-driver template inputs. -message SandboxTemplate { - // Fully-qualified OCI image reference used to boot the sandbox. - string image = 1; - // Optional runtime class name requested from the compute platform. - string runtime_class_name = 2; - // Optional agent socket path exposed to the workload. - string agent_socket = 3; - // Labels applied to compute-platform resources for this sandbox. - map labels = 4; - // Annotations applied to compute-platform resources for this sandbox. - map annotations = 5; - // Additional environment variables injected by the template. - map environment = 6; - // Platform-specific compute resource requirements and limits. - google.protobuf.Struct resources = 7; - reserved 9; - reserved "volume_claim_templates"; - // Enable Kubernetes user namespace isolation (hostUsers: false). - // When true, container UID 0 maps to a non-root host UID and capabilities - // become namespaced. Requires Kubernetes 1.33+ with user namespace support - // available (beta through 1.35, GA in 1.36+) and a supporting runtime. - // When unset, the cluster-wide default is used. - optional bool user_namespaces = 10; - // Driver-keyed opaque config envelope supplied by the caller. - // The gateway selects the block matching the active compute driver and - // forwards only that inner Struct to DriverSandboxTemplate.driver_config. - // The selected driver owns nested schema validation. - google.protobuf.Struct driver_config = 11; -} - -// User-facing sandbox status derived by the gateway from compute-driver observations. -// -// Public status does not embed driver-only flags such as `deleting`. -message SandboxStatus { - // Compute-platform sandbox object name. - string sandbox_name = 1; - // Name of the agent pod or equivalent runtime instance. - string agent_pod = 2; - // File descriptor or endpoint for reaching the agent service, when available. - string agent_fd = 3; - // File descriptor or endpoint for reaching the sandbox service, when available. - string sandbox_fd = 4; - // Latest user-facing readiness and lifecycle conditions. - repeated SandboxCondition conditions = 5; - // Gateway-derived lifecycle summary. - SandboxPhase phase = 6; - // Currently active policy version (updated when sandbox reports loaded). - uint32 current_policy_version = 7; -} - -// User-facing sandbox condition derived from driver-native conditions. -message SandboxCondition { - // Condition class, typically mirroring the underlying platform condition type. - string type = 1; - // Condition status value such as `True`, `False`, or `Unknown`. - string status = 2; - // Short machine-readable reason associated with the condition. - string reason = 3; - // Human-readable condition message. - string message = 4; - // Timestamp reported by the underlying platform for the last transition. - string last_transition_time = 5; -} - -// High-level sandbox lifecycle phase derived by the gateway. -// -// Clients should rely on this normalized lifecycle summary for readiness and -// deletion decisions instead of interpreting raw conditions. -enum SandboxPhase { - SANDBOX_PHASE_UNSPECIFIED = 0; - SANDBOX_PHASE_PROVISIONING = 1; - SANDBOX_PHASE_READY = 2; - SANDBOX_PHASE_ERROR = 3; - SANDBOX_PHASE_DELETING = 4; - SANDBOX_PHASE_UNKNOWN = 5; -} - -// Public platform event exposed on the sandbox watch stream. -message PlatformEvent { - // Event timestamp in milliseconds since epoch. - int64 timestamp_ms = 1; - // Event source (e.g. "kubernetes", "docker", "process"). - string source = 2; - // Event type/severity (e.g. "Normal", "Warning"). - string type = 3; - // Short reason code (e.g. "Started", "Pulled", "Failed"). - string reason = 4; - // Human-readable event message. - string message = 5; - // Optional metadata as key-value pairs. - map metadata = 6; -} - -// Create sandbox request. -message CreateSandboxRequest { - SandboxSpec spec = 1; - // Optional user-supplied sandbox name. When empty the server generates one. - string name = 2; - // Optional labels for the sandbox (key-value metadata). - map labels = 3; - // Optional annotations for the sandbox (non-selector metadata). - map annotations = 4; - // Workspace for the sandbox. Empty defaults to "default". - string workspace = 5; -} - -// Get sandbox request. -message GetSandboxRequest { - // Sandbox name (canonical lookup key). - string name = 1; - // Workspace scope. Empty defaults to "default". - string workspace = 2; -} - -// List sandboxes request. -message ListSandboxesRequest { - uint32 limit = 1; - uint32 offset = 2; - // Optional label selector for filtering (format: "key1=value1,key2=value2"). - string label_selector = 3; - // Workspace scope. Empty defaults to "default". - string workspace = 4; - // List across all workspaces. Mutually exclusive with workspace. - bool all_workspaces = 5; -} - -// List providers attached to a sandbox request. -message ListSandboxProvidersRequest { - // Sandbox name (canonical lookup key). - string sandbox_name = 1; - // Workspace scope. Empty defaults to "default". - string workspace = 2; -} - -// Attach provider to sandbox request. -message AttachSandboxProviderRequest { - // Sandbox name (canonical lookup key). - string sandbox_name = 1; - // Provider name to attach. - string provider_name = 2; - // Expected resource version for optimistic concurrency control. - // If 0, the server uses the current version (backward compatibility). - // If non-zero, the server validates that the sandbox's current resource_version - // matches this value before applying the mutation, returning ABORTED on mismatch. - uint64 expected_resource_version = 3; - // Workspace scope. Empty defaults to "default". - string workspace = 4; -} - -// Detach provider from sandbox request. -message DetachSandboxProviderRequest { - // Sandbox name (canonical lookup key). - string sandbox_name = 1; - // Provider name to detach. - string provider_name = 2; - // Expected resource version for optimistic concurrency control. - // If 0, the server uses the current version (backward compatibility). - // If non-zero, the server validates that the sandbox's current resource_version - // matches this value before applying the mutation, returning ABORTED on mismatch. - uint64 expected_resource_version = 3; - // Workspace scope. Empty defaults to "default". - string workspace = 4; -} - -// Delete sandbox request. -message DeleteSandboxRequest { - // Sandbox name (canonical lookup key). - string name = 1; - // Workspace scope. Empty defaults to "default". - string workspace = 2; -} - -// Sandbox response. -message SandboxResponse { - Sandbox sandbox = 1; -} - -// List sandboxes response. -message ListSandboxesResponse { - repeated Sandbox sandboxes = 1; -} - -// List providers attached to a sandbox response. -message ListSandboxProvidersResponse { - repeated openshell.datamodel.v1.Provider providers = 1; -} - -// Attach provider to sandbox response. -message AttachSandboxProviderResponse { - Sandbox sandbox = 1; - // True when the provider was newly attached. False means it was already attached. - bool attached = 2; -} - -// Detach provider from sandbox response. -message DetachSandboxProviderResponse { - Sandbox sandbox = 1; - // True when the provider was removed. False means it was not attached. - bool detached = 2; -} - -// Delete sandbox response. -message DeleteSandboxResponse { - bool deleted = 1; -} - -// Create SSH session request. -message CreateSshSessionRequest { - // Sandbox id. - string sandbox_id = 1; -} - -// Create SSH session response. -// -// Fields are interpolated into an SSH `ProxyCommand` string that OpenSSH -// executes through `/bin/sh -c` on the caller's workstation. Servers MUST -// uphold the charset contract below; clients MUST reject responses that -// violate it. The client's own escaping provides defense-in-depth, but -// narrow charsets close injection vectors at the trust boundary. -message CreateSshSessionResponse { - // Sandbox id. [A-Za-z0-9._-]{1,128}. - string sandbox_id = 1; - - // Session token for the gateway tunnel. URL-safe ASCII - // ([A-Za-z0-9._~+/=-]) up to 4096 bytes. No shell metacharacters or - // whitespace. - string token = 2 [(openshell.options.v1.secret) = true]; - - // Gateway host for SSH proxy connection. IPv4 address, bracketed IPv6 - // address, or DNS hostname (Punycode-encoded for IDN). Alphanumeric plus - // `.-:[]` only, up to 253 bytes. - string gateway_host = 3; - - // Gateway port for SSH proxy connection. Must be in range 1..=65535. - uint32 gateway_port = 4; - - // Gateway scheme. Must be exactly "http" or "https". - string gateway_scheme = 5; - - // Optional host key fingerprint. If non-empty, [A-Za-z0-9:+/=-] only. - string host_key_fingerprint = 7; - - // Expiry timestamp in milliseconds since epoch. 0 means no expiry. - int64 expires_at_ms = 8; -} - -// Request to expose an HTTP service running inside a sandbox. -message ExposeServiceRequest { - // Sandbox name. - string sandbox = 1; - // Service name within the sandbox. - string service = 2; - // Loopback TCP port inside the sandbox. - uint32 target_port = 3; - // Whether to print/use the browser-facing service URL. - bool domain = 4; - // Workspace scope. Empty defaults to "default". - string workspace = 5; -} - -// Request to fetch an exposed sandbox service endpoint. -message GetServiceRequest { - // Sandbox name. - string sandbox = 1; - // Service name within the sandbox. Empty selects the unnamed endpoint. - string service = 2; - // Workspace scope. Empty defaults to "default". - string workspace = 3; -} - -// Request to list exposed sandbox service endpoints. -message ListServicesRequest { - // Optional sandbox name. Empty lists endpoints for all sandboxes. - string sandbox = 1; - // Page size. Zero uses the server default. - uint32 limit = 2; - // Page offset. - uint32 offset = 3; - // Workspace scope. Empty defaults to "default". - string workspace = 4; - // List across all workspaces. Mutually exclusive with workspace. - bool all_workspaces = 5; -} - -// Response containing exposed sandbox service endpoints. -message ListServicesResponse { - repeated ServiceEndpointResponse services = 1; -} - -// Request to delete an exposed sandbox service endpoint. -message DeleteServiceRequest { - // Sandbox name. - string sandbox = 1; - // Service name within the sandbox. Empty selects the unnamed endpoint. - string service = 2; - // Workspace scope. Empty defaults to "default". - string workspace = 3; -} - -// Response for deleting an exposed sandbox service endpoint. -message DeleteServiceResponse { - // True when an endpoint existed and was deleted. - bool deleted = 1; -} - -// Persisted sandbox service endpoint. -message ServiceEndpoint { - // Kubernetes-style metadata. - openshell.datamodel.v1.ObjectMeta metadata = 1; - // Sandbox object ID. - string sandbox_id = 2; - // Sandbox name. - string sandbox_name = 3; - // Service name within the sandbox. - string service_name = 4; - // Loopback TCP port inside the sandbox. - uint32 target_port = 5; - // Whether browser-facing service routing is enabled for this endpoint. - bool domain = 6; -} - -// Response containing a service endpoint and, when available, its local URL. -message ServiceEndpointResponse { - ServiceEndpoint endpoint = 1; - string url = 2; -} - -// Revoke SSH session request. -message RevokeSshSessionRequest { - // Session token to revoke. - string token = 1 [(openshell.options.v1.secret) = true]; -} - -// Revoke SSH session response. -message RevokeSshSessionResponse { - // True when a session was revoked. - bool revoked = 1; -} - -// Execute command request. -message ExecSandboxRequest { - // Sandbox id. - string sandbox_id = 1; - - // Command and arguments. - repeated string command = 2; - - // Optional working directory. - string workdir = 3; - - // Optional environment overrides. - map environment = 4; - - // Optional timeout in seconds. 0 means no timeout. - uint32 timeout_seconds = 5; - - // Optional stdin payload passed to the command. - bytes stdin = 6; - - // Request a pseudo-terminal for the remote command. - bool tty = 7; - - // Initial terminal columns (used when tty=true, 0 = use default). - uint32 cols = 8; - - // Initial terminal rows (used when tty=true, 0 = use default). - uint32 rows = 9; -} - -// One stdout chunk from a sandbox exec. -message ExecSandboxStdout { - bytes data = 1; -} - -// One stderr chunk from a sandbox exec. -message ExecSandboxStderr { - bytes data = 1; -} - -// Final exit status for a sandbox exec. -message ExecSandboxExit { - int32 exit_code = 1; -} - -// One event in a sandbox exec stream. -message ExecSandboxEvent { - oneof payload { - ExecSandboxStdout stdout = 1; - ExecSandboxStderr stderr = 2; - ExecSandboxExit exit = 3; - } -} - -// Initial frame for one TCP forward stream. -message TcpForwardInit { - // Sandbox id. - string sandbox_id = 1; - // Optional service identifier for audit/correlation. - string service_id = 4; - // Target the gateway should request from the supervisor. - oneof target { - SshRelayTarget ssh = 5; - TcpRelayTarget tcp = 6; - } - // Optional target-specific authorization token. SSH targets use this as the - // short-lived SSH session token issued by CreateSshSession. - string authorization_token = 7 [(openshell.options.v1.secret) = true]; -} - -// A single frame on the CLI-to-gateway TCP forward stream. -message TcpForwardFrame { - oneof payload { - TcpForwardInit init = 1; - bytes data = 2; - } -} - -// Client-to-server message for interactive exec. -message ExecSandboxInput { - oneof payload { - // First message: exec request metadata. - ExecSandboxRequest start = 1; - // Subsequent messages: raw stdin bytes. - bytes stdin = 2; - // Terminal window size change. - ExecSandboxWindowResize resize = 3; - } -} - -// Terminal window resize event for interactive exec. -message ExecSandboxWindowResize { - uint32 cols = 1; - uint32 rows = 2; -} - - -// SSH session record stored in persistence. -message SshSession { - // Kubernetes-style metadata (id, name, labels, timestamps, resource version). - openshell.datamodel.v1.ObjectMeta metadata = 1; - - // Sandbox id. - string sandbox_id = 2; - - // Session token. - string token = 3 [(openshell.options.v1.secret) = true]; - - // Expiry timestamp in milliseconds since epoch. 0 means no expiry - // (backward-compatible default for sessions created before this field existed). - int64 expires_at_ms = 4; - - // Revoked flag. - bool revoked = 5; -} - -// Watch sandbox request. -message WatchSandboxRequest { - // Sandbox id. - string id = 1; - - // Stream sandbox status snapshots. - bool follow_status = 2; - - // Stream openshell-server process logs correlated to this sandbox. - bool follow_logs = 3; - - // Stream platform events correlated to this sandbox. - bool follow_events = 4; - - // Replay the last N log lines (best-effort) before following. - uint32 log_tail_lines = 5; - - // Replay the last N platform events (best-effort) before following. - uint32 event_tail = 6; - - // Stop streaming once the sandbox reaches a terminal phase (READY or ERROR). - bool stop_on_terminal = 7; - - // Only include log lines with timestamp >= this value (milliseconds since epoch). - // 0 means no time filter. Applies to both tail replay and live streaming. - int64 log_since_ms = 8; - - // Filter by log source (e.g. "gateway", "sandbox"). Empty means all sources. - repeated string log_sources = 9; - - // Minimum log level to include (e.g. "INFO", "WARN", "ERROR"). Empty means all levels. - string log_min_level = 10; -} - -// One event in a sandbox watch stream. -message SandboxStreamEvent { - oneof payload { - // Latest sandbox snapshot. - Sandbox sandbox = 1; - // One server log line/event. - SandboxLogLine log = 2; - // One platform event. - PlatformEvent event = 3; - // Warning from the server (e.g. missed messages due to lag). - SandboxStreamWarning warning = 4; - // Draft policy update notification. - DraftPolicyUpdate draft_policy_update = 5; - } -} - -// Log line correlated to a sandbox. -message SandboxLogLine { - string sandbox_id = 1; - int64 timestamp_ms = 2; - string level = 3; - string target = 4; - string message = 5; - // Log source: "gateway" (server-side) or "sandbox" (supervisor). - // Empty is treated as "gateway" for backward compatibility. - string source = 6; - // Structured key-value fields from the tracing event (e.g. dst_host, action). - map fields = 7; -} - -message SandboxStreamWarning { - string message = 1; -} - -// Create provider request. -message CreateProviderRequest { - openshell.datamodel.v1.Provider provider = 1; - // Workspace for the provider. Empty defaults to "default". - string workspace = 2; -} - -// Get provider request. -message GetProviderRequest { - string name = 1; - // Workspace scope. Empty defaults to "default". - string workspace = 2; -} - -// List providers request. -message ListProvidersRequest { - uint32 limit = 1; - uint32 offset = 2; - // Workspace scope. Empty defaults to "default". - string workspace = 3; - // List across all workspaces. Mutually exclusive with workspace. - bool all_workspaces = 4; -} - -// Update provider request. -message UpdateProviderRequest { - openshell.datamodel.v1.Provider provider = 1; - // Optional per-credential expiry timestamps to merge into the provider. - // A zero value removes the expiry for that credential. - map credential_expires_at_ms = 2; - // Workspace scope. Empty defaults to "default". - string workspace = 3; -} - -// Delete provider request. -message DeleteProviderRequest { - string name = 1; - // Workspace scope. Empty defaults to "default". - string workspace = 2; -} - -// Provider response. -message ProviderResponse { - openshell.datamodel.v1.Provider provider = 1; -} - -// List providers response. -message ListProvidersResponse { - repeated openshell.datamodel.v1.Provider providers = 1; -} - -// List provider type profiles request. -message ListProviderProfilesRequest { - uint32 limit = 1; - uint32 offset = 2; - // Workspace scope. When set, returns workspace-scoped + built-in profiles. - // When empty, returns platform-scoped + built-in only. - string workspace = 3; -} - -// Fetch provider type profile request. -message GetProviderProfileRequest { - string id = 1; - // Workspace scope for two-tier profile resolution. When set, checks - // workspace-scoped profiles first, then platform-scoped, then built-in. - // When empty, checks platform-scoped then built-in only. - string workspace = 2; -} - -// Provider profile payload with optional source metadata for diagnostics. -message ProviderProfileImportItem { - ProviderProfile profile = 1; - string source = 2; -} - -// Provider profile validation diagnostic. -message ProviderProfileDiagnostic { - string source = 1; - string profile_id = 2; - string field = 3; - string message = 4; - string severity = 5; -} - -// Endpoint selector for token grant audience overrides. -message ProviderCredentialTokenGrantAudienceOverride { - // Optional: endpoint host selector. If omitted, inherits the profile endpoint host. - string host = 1; - - // Optional: endpoint port selector. If omitted, matches the expanded profile endpoint port. - uint32 port = 2; - - // Optional: endpoint path selector. If omitted, inherits the profile endpoint path. - string path = 3; - - // Resource audience to request for matching endpoints. - string audience = 4; - - // Optional: OAuth2 scopes to request. If omitted, inherits the token grant scopes. - repeated string scopes = 5; -} - -// Provider credential token grant configuration. -// When present, the credential is obtained dynamically via OAuth2 grant when needed. -message ProviderCredentialTokenGrant { - // OAuth2 token endpoint URL (e.g., https://keycloak.example.com/realms/my-realm/protocol/openid-connect/token) - string token_endpoint = 1; - - // Optional: default resource audience to request from the token service - string audience = 2; - - // Optional: audience to request when fetching the JWT-SVID from SPIRE. - // If omitted, the sandbox derives this from token_endpoint. - string jwt_svid_audience = 6; - - // Optional: OAuth2 scopes to request - repeated string scopes = 3; - - // Optional: override token cache TTL (seconds) - // If 0 or omitted, use expires_in from token response - int64 cache_ttl_seconds = 4; - - // Optional: endpoint-specific resource audience overrides. - repeated ProviderCredentialTokenGrantAudienceOverride audience_overrides = 5; - - // Optional: OAuth2 client_assertion_type value. If omitted, OpenShell uses - // urn:ietf:params:oauth:client-assertion-type:jwt-bearer. - string client_assertion_type = 7; -} - -// Provider credential declaration. -message ProviderProfileCredential { - string name = 1; - string description = 2; - repeated string env_vars = 3; - bool required = 4; - string auth_style = 5; - string header_name = 6; - string query_param = 7; - ProviderCredentialRefresh refresh = 8; - string path_template = 9; - ProviderCredentialTokenGrant token_grant = 10; -} - -enum ProviderCredentialRefreshStrategy { - PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED = 0; - PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC = 1; - PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL = 2; - PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN = 3; - PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS = 4; - PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT = 5; - PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE = 6; -} - -message ProviderCredentialRefreshMaterial { - string name = 1; - string description = 2; - bool required = 3; - bool secret = 4; -} - -// Declares that a single refresh operation mints more than one credential. -// The refresh is attached to a primary credential; each additional output -// maps a strategy-defined semantic output id to a sibling credential whose -// env_vars receive the minted value. -message ProviderCredentialRefreshOutput { - string output = 1; // strategy-defined semantic output id (e.g. "session_token") - string credential = 2; // sibling credential name whose env_vars receive this output -} - -message ProviderCredentialRefresh { - ProviderCredentialRefreshStrategy strategy = 1; - string token_url = 2; - repeated string scopes = 3; - int64 refresh_before_seconds = 4; - int64 max_lifetime_seconds = 5; - repeated ProviderCredentialRefreshMaterial material = 6; - repeated ProviderCredentialRefreshOutput additional_outputs = 7; -} - -message ProviderCredentialRefreshStatus { - string provider_name = 1; - string provider_id = 2; - string credential_key = 3; - ProviderCredentialRefreshStrategy strategy = 4; - string status = 5; - int64 expires_at_ms = 6; - int64 next_refresh_at_ms = 7; - int64 last_refresh_at_ms = 8; - string last_error = 9; -} - -// Provider profile local discovery declaration. -message ProviderProfileDiscovery { - // Credential names from ProviderProfile.credentials eligible for local discovery. - repeated string credentials = 1; -} - -message StoredProviderCredentialRefreshState { - openshell.datamodel.v1.ObjectMeta metadata = 1; - string provider_id = 2; - string provider_name = 3; - string credential_key = 4; - ProviderCredentialRefreshStrategy strategy = 5; - map material = 6 [(openshell.options.v1.secret) = true]; - repeated string secret_material_keys = 7; - int64 expires_at_ms = 8; - int64 next_refresh_at_ms = 9; - int64 last_refresh_at_ms = 10; - string status = 11; - string last_error = 12; - string token_url = 13; - repeated string scopes = 14; - int64 refresh_before_seconds = 15; - int64 max_lifetime_seconds = 16; - // Resolved mapping of strategy-defined output id -> concrete env key, pinned - // at configure time from the profile's additional_outputs. Read by minting, - // collision reservation, and env-key surfacing so later profile edits cannot - // silently redirect writes. - map additional_output_keys = 17; -} - -message GetProviderRefreshStatusRequest { - string provider = 1; - string credential_key = 2; - // Workspace scope. Empty defaults to "default". - string workspace = 3; -} - -message GetProviderRefreshStatusResponse { - repeated ProviderCredentialRefreshStatus credentials = 1; -} - -message ConfigureProviderRefreshRequest { - string provider = 1; - string credential_key = 2; - ProviderCredentialRefreshStrategy strategy = 3; - map material = 4 [(openshell.options.v1.secret) = true]; - repeated string secret_material_keys = 5; - optional int64 expires_at_ms = 6; - // Workspace scope. Empty defaults to "default". - string workspace = 7; -} - -message ConfigureProviderRefreshResponse { - ProviderCredentialRefreshStatus status = 1; -} - -message RotateProviderCredentialRequest { - string provider = 1; - string credential_key = 2; - // Workspace scope. Empty defaults to "default". - string workspace = 3; -} - -message RotateProviderCredentialResponse { - ProviderCredentialRefreshStatus status = 1; -} - -message DeleteProviderRefreshRequest { - string provider = 1; - string credential_key = 2; - // Workspace scope. Empty defaults to "default". - string workspace = 3; -} - -message DeleteProviderRefreshResponse { - bool deleted = 1; -} - -// Stable provider profile categories used by clients for grouping and filtering. -enum ProviderProfileCategory { - PROVIDER_PROFILE_CATEGORY_UNSPECIFIED = 0; - PROVIDER_PROFILE_CATEGORY_OTHER = 1; - PROVIDER_PROFILE_CATEGORY_INFERENCE = 2; - PROVIDER_PROFILE_CATEGORY_AGENT = 3; - PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL = 4; - PROVIDER_PROFILE_CATEGORY_MESSAGING = 5; - PROVIDER_PROFILE_CATEGORY_DATA = 6; - PROVIDER_PROFILE_CATEGORY_KNOWLEDGE = 7; -} - -// Provider type profile metadata exposed to clients. -message ProviderProfile { - string id = 1; - string display_name = 2; - string description = 3; - ProviderProfileCategory category = 4; - repeated ProviderProfileCredential credentials = 5; - repeated openshell.sandbox.v1.NetworkEndpoint endpoints = 6; - repeated openshell.sandbox.v1.NetworkBinary binaries = 7; - bool inference_capable = 8; - ProviderProfileDiscovery discovery = 9; - // Storage resource version for custom profiles. Built-in profiles and new - // profile files use 0. Gateway responses set this for stored custom profiles. - // Update calls use this for optimistic concurrency. - uint64 resource_version = 10; - // Optional non-secret annotations attached by profile sources or importers. - map annotations = 11; - // Server-set provenance: "builtin", "user", or "interceptor/{name}". - // Ignored on import/update payloads. - string source = 12; - // Server-set visibility: "platform", "workspace", or empty for - // non-scoped sources. Ignored on import/update payloads. - string scope = 13; -} - -// Stored custom provider profile object. -message StoredProviderProfile { - openshell.datamodel.v1.ObjectMeta metadata = 1; - ProviderProfile profile = 2; -} - -// Provider profile response. -message ProviderProfileResponse { - ProviderProfile profile = 1; -} - -// List provider profiles response. -message ListProviderProfilesResponse { - repeated ProviderProfile profiles = 1; -} - -// Import custom provider profiles request. -message ImportProviderProfilesRequest { - repeated ProviderProfileImportItem profiles = 1; - // Workspace scope. When set, profiles are workspace-scoped (Workspace Admin). - // When empty, profiles are platform-scoped (Platform Admin). - string workspace = 2; -} - -// Import custom provider profiles response. -message ImportProviderProfilesResponse { - repeated ProviderProfileDiagnostic diagnostics = 1; - repeated ProviderProfile profiles = 2; - bool imported = 3; -} - -// Update one custom provider profile request. -message UpdateProviderProfilesRequest { - ProviderProfileImportItem profile = 1; - // Expected storage resource version for optimistic concurrency control. - // If 0, the server uses the resource_version embedded in profile.profile. - // Updates without a non-zero version are rejected to prevent stale files from - // silently overwriting newer profile definitions. - uint64 expected_resource_version = 2; - // Existing custom provider profile ID to update. The payload ID must match. - string id = 3; - // Workspace scope. When set, targets workspace-scoped profile. When empty, - // targets platform-scoped profile. - string workspace = 4; -} - -// Update one custom provider profile response. -message UpdateProviderProfilesResponse { - repeated ProviderProfileDiagnostic diagnostics = 1; - ProviderProfile profile = 2; - bool updated = 3; -} - -// Lint provider profiles request. -message LintProviderProfilesRequest { - repeated ProviderProfileImportItem profiles = 1; - // Workspace scope. Used to check for conflicts against existing profiles - // in the target workspace. - string workspace = 2; -} - -// Lint provider profiles response. -message LintProviderProfilesResponse { - repeated ProviderProfileDiagnostic diagnostics = 1; - bool valid = 2; -} - -// Delete provider response. -message DeleteProviderResponse { - bool deleted = 1; -} - -// Delete custom provider profile request. -message DeleteProviderProfileRequest { - string id = 1; - // Workspace scope. When set, targets workspace-scoped profile. When empty, - // targets platform-scoped profile. - string workspace = 2; -} - -// Delete custom provider profile response. -message DeleteProviderProfileResponse { - bool deleted = 1; -} - -// Get sandbox provider environment request. -message GetSandboxProviderEnvironmentRequest { - // The sandbox ID. - string sandbox_id = 1; -} - -// Get sandbox provider environment response. -message GetSandboxProviderEnvironmentResponse { - // Provider credential environment variables. - map environment = 1 [(openshell.options.v1.secret) = true]; - // Fingerprint for the provider credential inputs that produced environment. - uint64 provider_env_revision = 2; - // Expiration timestamps for returned environment variables. - map credential_expires_at_ms = 3; - // Dynamic credentials that require token grants or other runtime injection. - // Maps endpoint-bound provider metadata to credential metadata. - // Supervisor uses this to inject Authorization headers for token grant credentials. - map dynamic_credentials = 4; -} - -// --------------------------------------------------------------------------- -// Policy update messages -// --------------------------------------------------------------------------- - -// Update sandbox policy request. -message UpdateConfigRequest { - // Sandbox name (canonical lookup key). Required for sandbox-scoped updates. - // Not required when `global=true`. - string name = 1; - // The new policy to apply. - // - // Sandbox scope (`global=false`): - // - only network_policies and inference fields may differ from create-time - // policy; static fields must match version 1. - // - // Global scope (`global=true`): - // - applies to all sandboxes in full (no merge). - openshell.sandbox.v1.SandboxPolicy policy = 2; - // Optional single setting key to mutate. - string setting_key = 3; - // Setting value for upsert operations. - openshell.sandbox.v1.SettingValue setting_value = 4; - // Delete the setting key from scope. - // Sandbox-scoped deletes are rejected; only global delete is supported. - bool delete_setting = 5; - // Apply mutation at gateway-global scope. - bool global = 6; - // Batched incremental policy merge operations. Sandbox-scoped only. - repeated PolicyMergeOperation merge_operations = 7; - // Expected resource version for optimistic concurrency control (sandbox-scoped only). - // If 0, the server uses the current version (backward compatibility). - // If non-zero, the server validates that the sandbox's current resource_version - // matches this value before applying the mutation, returning ABORTED on mismatch. - // Ignored for global-scoped updates. - uint64 expected_resource_version = 8; - // Caller-provided annotations associated with a sandbox-scoped update. Values - // must not contain secrets; the gateway treats them as opaque metadata and does - // not interpret or verify their semantics. For policy updates, the gateway - // stores the annotations immutably with the revision and merges them into - // sandbox metadata as a convenience projection. For setting-only updates, it - // only merges them into sandbox metadata. - map annotations = 9; - // Workspace scope. Empty defaults to "default". Ignored for global-scoped updates. - string workspace = 10; -} - -message PolicyMergeOperation { - oneof operation { - AddNetworkRule add_rule = 1; - RemoveNetworkEndpoint remove_endpoint = 2; - RemoveNetworkRule remove_rule = 3; - AddDenyRules add_deny_rules = 4; - AddAllowRules add_allow_rules = 5; - RemoveNetworkBinary remove_binary = 6; - } -} - -message AddNetworkRule { - string rule_name = 1; - openshell.sandbox.v1.NetworkPolicyRule rule = 2; -} - -message RemoveNetworkEndpoint { - string rule_name = 1; - string host = 2; - uint32 port = 3; -} - -message RemoveNetworkRule { - string rule_name = 1; -} - -message AddDenyRules { - string host = 1; - uint32 port = 2; - repeated openshell.sandbox.v1.L7DenyRule deny_rules = 3; -} - -message AddAllowRules { - string host = 1; - uint32 port = 2; - repeated openshell.sandbox.v1.L7Rule rules = 3; -} - -message RemoveNetworkBinary { - string rule_name = 1; - string binary_path = 2; -} - -// Update sandbox policy response. -message UpdateConfigResponse { - // Assigned policy version (monotonically increasing per sandbox). - uint32 version = 1; - // SHA-256 hash of the serialized policy payload. - string policy_hash = 2; - // Settings revision for the scope that was modified. - uint64 settings_revision = 3; - // True when a setting delete operation removed an existing key. - bool deleted = 4; - // Sandbox metadata annotations after the update. Empty for global updates. - map annotations = 5; -} - -// Get sandbox policy status request. -message GetSandboxPolicyStatusRequest { - // Sandbox name (canonical lookup key). Ignored when global is true. - string name = 1; - // The specific policy version to query. 0 means latest. - uint32 version = 2; - // Query global policy revisions instead of a sandbox-scoped one. - bool global = 3; - // Workspace scope. Empty defaults to "default". Ignored when global is true. - string workspace = 4; -} - -// Get sandbox policy status response. -message GetSandboxPolicyStatusResponse { - // The queried policy revision. - SandboxPolicyRevision revision = 1; - // The currently active (loaded) policy version for this sandbox. - uint32 active_version = 2; -} - -// List sandbox policies request. -message ListSandboxPoliciesRequest { - // Sandbox name (canonical lookup key). Ignored when global is true. - string name = 1; - uint32 limit = 2; - uint32 offset = 3; - // List global policy revisions instead of sandbox-scoped ones. - bool global = 4; - // Workspace scope. Empty defaults to "default". Ignored when global is true. - string workspace = 5; -} - -// List sandbox policies response. -message ListSandboxPoliciesResponse { - repeated SandboxPolicyRevision revisions = 1; -} - -// Report policy load status (called by sandbox runtime after reload attempt). -message ReportPolicyStatusRequest { - // Sandbox id. - string sandbox_id = 1; - // The policy version that was attempted. - uint32 version = 2; - // Load result status. - PolicyStatus status = 3; - // Error message if status is FAILED. - string load_error = 4; -} - -// Report policy status response. -message ReportPolicyStatusResponse {} - -// A versioned policy revision with metadata. -message SandboxPolicyRevision { - // Policy version (monotonically increasing per sandbox). - uint32 version = 1; - // SHA-256 hash of the serialized policy payload. - string policy_hash = 2; - // Load status of this revision. - PolicyStatus status = 3; - // Error message if status is FAILED. - string load_error = 4; - // Milliseconds since epoch when this revision was created. - int64 created_at_ms = 5; - // Milliseconds since epoch when this revision was loaded by the sandbox. - int64 loaded_at_ms = 6; - // The full policy (only populated when explicitly requested). - openshell.sandbox.v1.SandboxPolicy policy = 7; - // Immutable provenance supplied with this policy revision. - map provenance = 8; -} - -// Policy load status. -enum PolicyStatus { - POLICY_STATUS_UNSPECIFIED = 0; - // Server received the update; sandbox has not yet loaded it. - POLICY_STATUS_PENDING = 1; - // Sandbox successfully applied this policy version. - POLICY_STATUS_LOADED = 2; - // Sandbox attempted to apply but failed; LKG policy remains active. - POLICY_STATUS_FAILED = 3; - // A newer version was persisted before the sandbox loaded this one. - POLICY_STATUS_SUPERSEDED = 4; -} - -// --------------------------------------------------------------------------- -// Sandbox logs messages -// --------------------------------------------------------------------------- - -// Get sandbox logs request (one-shot fetch). -message GetSandboxLogsRequest { - // Sandbox id. - string sandbox_id = 1; - // Maximum number of log lines to return. 0 means use default (2000). - uint32 lines = 2; - // Only include logs with timestamp >= this value (ms since epoch). 0 means no filter. - int64 since_ms = 3; - // Filter by log source (e.g. "gateway", "sandbox"). Empty means all sources. - repeated string sources = 4; - // Minimum log level to include (e.g. "INFO", "WARN", "ERROR"). Empty means all levels. - string min_level = 5; - // Workspace scope. Empty defaults to "default". - string workspace = 6; -} - -// Batch of log lines pushed from sandbox to server. -message PushSandboxLogsRequest { - // The sandbox ID. - string sandbox_id = 1; - // Log lines to ingest. - repeated SandboxLogLine logs = 2; -} - -// Push sandbox logs response. -message PushSandboxLogsResponse {} - -// Get sandbox logs response. -message GetSandboxLogsResponse { - // Log lines in chronological order. - repeated SandboxLogLine logs = 1; - // Total number of lines in the server's buffer for this sandbox. - uint32 buffer_total = 2; -} - -// --------------------------------------------------------------------------- -// Supervisor session messages -// --------------------------------------------------------------------------- - -// Envelope for supervisor-to-gateway messages on the ConnectSupervisor stream. -message SupervisorMessage { - oneof payload { - SupervisorHello hello = 1; - SupervisorHeartbeat heartbeat = 2; - RelayOpenResult relay_open_result = 3; - RelayClose relay_close = 4; - } -} - -// Envelope for gateway-to-supervisor messages on the ConnectSupervisor stream. -message GatewayMessage { - oneof payload { - SessionAccepted session_accepted = 1; - SessionRejected session_rejected = 2; - GatewayHeartbeat heartbeat = 3; - RelayOpen relay_open = 4; - RelayClose relay_close = 5; - } -} - -// Supervisor identifies itself and the sandbox it manages. -message SupervisorHello { - // Sandbox ID this supervisor manages. - string sandbox_id = 1; - // Supervisor instance ID (e.g. boot id or process epoch). - string instance_id = 2; -} - -// Gateway accepts the supervisor session. -message SessionAccepted { - // Gateway-assigned session ID for this connection. - string session_id = 1; - // Recommended heartbeat interval in seconds. - uint32 heartbeat_interval_secs = 2; -} - -// Gateway rejects the supervisor session. -message SessionRejected { - // Human-readable rejection reason. - string reason = 1; -} - -// Supervisor heartbeat. -message SupervisorHeartbeat {} - -// Gateway heartbeat. -message GatewayHeartbeat {} - -// Gateway requests the supervisor to open a relay channel. -// -// On receiving this, the supervisor should initiate a RelayStream RPC to -// the gateway, sending a RelayInit in the first RelayFrame to associate -// the new HTTP/2 stream with the pending relay slot. The supervisor -// bridges that stream to the requested local target. -message RelayOpen { - // Gateway-allocated channel identifier (UUID). - string channel_id = 1; - // Target the supervisor should dial inside the sandbox. - // If absent, supervisors treat the relay as SSH for compatibility. - oneof target { - SshRelayTarget ssh = 2; - TcpRelayTarget tcp = 3; - } - // Optional service identifier for audit/correlation. - string service_id = 5; -} - -// Built-in SSH relay target. -message SshRelayTarget {} - -// TCP target dialed by the supervisor from inside the sandbox. -message TcpRelayTarget { - // Phase 1 accepts loopback only: 127.0.0.1, ::1, or localhost. - string host = 1; - // Target port. Must fit in u16 and be non-zero. - uint32 port = 2; -} - -// Initial RelayStream frame sent by the supervisor to claim a pending relay. -message RelayInit { - // Gateway-allocated channel identifier (UUID). - string channel_id = 1; -} - -// A single frame on the RelayStream RPC. -// -// The supervisor MUST send `init` as the first frame. All subsequent frames -// in either direction carry raw bytes in `data`. -message RelayFrame { - oneof payload { - RelayInit init = 1; - bytes data = 2; - } -} - -// Supervisor reports the result of a relay open request. -message RelayOpenResult { - // Channel identifier from the RelayOpen request. - string channel_id = 1; - // True if the relay was successfully established. - bool success = 2; - // Error message if success is false. - string error = 3; -} - -// Either side requests closure of a relay channel. -message RelayClose { - // Channel identifier to close. - string channel_id = 1; - // Optional reason for closure. - string reason = 2; -} - -// --------------------------------------------------------------------------- -// Service status -// --------------------------------------------------------------------------- - -// Service status enum. -enum ServiceStatus { - SERVICE_STATUS_UNSPECIFIED = 0; - SERVICE_STATUS_HEALTHY = 1; - SERVICE_STATUS_DEGRADED = 2; - SERVICE_STATUS_UNHEALTHY = 3; -} - -// --------------------------------------------------------------------------- -// Draft policy recommendation messages -// --------------------------------------------------------------------------- - -// Observed HTTP method+path pattern from L7 inspection. -message L7RequestSample { - // HTTP method: GET, POST, PUT, DELETE, etc. - string method = 1; - // HTTP path: /v1/models, /repos/myorg/issues - string path = 2; - // L7 decision: "audit" or "deny" (allowed requests not collected). - string decision = 3; - // Number of times this (method, path) was observed. - uint32 count = 4; -} - -// Structured denial summary from sandbox aggregator. -message DenialSummary { - // Sandbox ID that produced this summary. - string sandbox_id = 1; - // Denied destination host. - string host = 2; - // Denied destination port. - uint32 port = 3; - // Binary that attempted the connection. - string binary = 4; - // Process ancestor chain. - repeated string ancestors = 5; - // Denial reason from OPA evaluation. - string deny_reason = 6; - // First denial timestamp (ms since epoch). - int64 first_seen_ms = 7; - // Most recent denial timestamp (ms since epoch). - int64 last_seen_ms = 8; - // Number of denials in the current window. - uint32 count = 9; - // Events dropped during aggregator cooldown. - uint32 suppressed_count = 10; - // Cumulative lifetime count (never resets). - uint32 total_count = 11; - // Distinct cmdline strings observed (sanitized of credentials). - repeated string sample_cmdlines = 12; - // SHA-256 of the binary for audit trail. - string binary_sha256 = 13; - // True if emitted by stale-flush rather than threshold. - bool persistent = 14; - // Denial category: "l4_deny", "l7_deny", "l7_audit", "ssrf". - string denial_stage = 15; - // Observed HTTP request patterns (from L7 inspection). - repeated L7RequestSample l7_request_samples = 16; - // True if L7 inspection was active during observation window. - bool l7_inspection_active = 17; -} - -// Count of denied actions grouped only by sanitized telemetry category. -message DenialGroupCount { - // Sanitized denial category, e.g. "connect_policy", "l7_policy", "ssrf". - string deny_group = 1; - // Number of denied actions in this category. - uint32 denied_count = 2; -} - -// Anonymous sandbox network activity counters. This intentionally excludes -// hosts, paths, binaries, raw deny reasons, sandbox IDs, and user content. -message NetworkActivitySummary { - // Total observed network activities in the current window. - uint32 network_activity_count = 1; - // Total denied actions in the current window. - uint32 denied_action_count = 2; - // Denied action counts grouped by sanitized category. - repeated DenialGroupCount denials_by_group = 3; -} - -// A proposed policy rule with rationale and approval status. -message PolicyChunk { - // Unique chunk identifier. - string id = 1; - // Approval status: "pending", "approved", "rejected". - string status = 2; - // Proposed network_policies map key. - string rule_name = 3; - // The proposed network policy rule. - openshell.sandbox.v1.NetworkPolicyRule proposed_rule = 4; - // Human-readable explanation of why this rule is proposed. - string rationale = 5; - // Security concerns flagged by analysis (empty if none). - string security_notes = 6; - // Analysis confidence (0.0-1.0). 0 for mechanistic mode. - float confidence = 7; - // IDs of denial summaries that led to this chunk. - repeated string denial_summary_ids = 8; - // Creation timestamp (ms since epoch). - int64 created_at_ms = 9; - // When the user approved/rejected (ms since epoch). 0 if undecided. - int64 decided_at_ms = 10; - // Recommendation stage: "initial" or "refined" (progressive L7 visibility). - string stage = 11; - // For stage="refined": the initial chunk this replaces. - string supersedes_chunk_id = 12; - // How many times this endpoint has been seen across denial flush cycles. - int32 hit_count = 13; - // First time this endpoint was proposed (ms since epoch). - int64 first_seen_ms = 14; - // Most recent time this endpoint was re-proposed (ms since epoch). - int64 last_seen_ms = 15; - // Binary path that triggered the denial (denormalized for display convenience). - string binary = 16; - // Validation verdict from gateway-side static checks (prover output). - // Free-form summary string for human consumption in the inbox card. - // Empty until the prover has run for this chunk. - string validation_result = 17; - // Operator-supplied free-form text accompanying a rejection. Populated - // when the reviewer rejects via `RejectDraftChunkRequest.reason`; surfaced - // back to the in-sandbox agent so it can revise the proposal. - // Empty for non-rejected chunks. - string rejection_reason = 18; -} - -// Notification that the draft policy was updated. -message DraftPolicyUpdate { - // Current draft version. - uint64 draft_version = 1; - // Number of new chunks added in this update. - uint32 new_chunks = 2; - // Total pending chunks awaiting approval. - uint32 total_pending = 3; - // Brief description of what changed. - string summary = 4; -} - -// Submit analysis results from sandbox to gateway. -message SubmitPolicyAnalysisRequest { - // Aggregated denial summaries. - repeated DenialSummary summaries = 1; - // Proposed policy chunks (validated by sandbox OPA engine). - repeated PolicyChunk proposed_chunks = 2; - // Analysis mode. `mechanistic` is the observation-driven path from the - // denial aggregator — chunks targeting the same host|port|binary fold - // into one row with hit_count incremented. `agent_authored` is an - // intentional proposal from an in-sandbox agent — each submission lands - // as its own chunk so the redraft-after-rejection loop has a stable id - // to watch. Other values are treated as agent-style (no dedup) so a new - // mode does not silently collapse proposals. - string analysis_mode = 3; - // Sandbox name. - string name = 4; - // Anonymous network activity counters. - repeated NetworkActivitySummary network_activity_summaries = 5; - // Workspace scope. Empty defaults to "default". - string workspace = 6; -} - -message SubmitPolicyAnalysisResponse { - // Number of chunks accepted by the gateway. - uint32 accepted_chunks = 1; - // Number of chunks rejected by gateway validation. - uint32 rejected_chunks = 2; - // Reasons for each rejected chunk. - repeated string rejection_reasons = 3; - // Server-assigned chunk IDs for the accepted chunks, in submission order. - // Agents use these to watch proposal state via policy.local's - // GET /v1/proposals/{id} and /wait endpoints. - repeated string accepted_chunk_ids = 4; -} - -// Get draft policy for a sandbox. -message GetDraftPolicyRequest { - // Sandbox name. - string name = 1; - // Optional status filter: "pending", "approved", "rejected", or "" for all. - string status_filter = 2; - // Workspace scope. Empty defaults to "default". - string workspace = 3; -} - -message GetDraftPolicyResponse { - // Draft policy chunks. - repeated PolicyChunk chunks = 1; - // LLM-generated summary of all analysis (empty in mechanistic mode). - string rolling_summary = 2; - // Current draft version. - uint64 draft_version = 3; - // When the last analysis completed (ms since epoch). - int64 last_analyzed_at_ms = 4; -} - -// Approve a single draft chunk. -message ApproveDraftChunkRequest { - // Sandbox name. - string name = 1; - // Chunk ID to approve. - string chunk_id = 2; - // Workspace scope. Empty defaults to "default". - string workspace = 3; -} - -message ApproveDraftChunkResponse { - // New policy version after merge. - uint32 policy_version = 1; - // SHA-256 hash of the new policy. - string policy_hash = 2; -} - -// Reject a single draft chunk. -message RejectDraftChunkRequest { - // Sandbox name. - string name = 1; - // Chunk ID to reject. - string chunk_id = 2; - // Optional reason for rejection (fed to LLM context in future analysis). - string reason = 3; - // Workspace scope. Empty defaults to "default". - string workspace = 4; -} - -message RejectDraftChunkResponse {} - -// Approve all pending chunks. -message ApproveAllDraftChunksRequest { - // Sandbox name. - string name = 1; - // Include chunks with security_notes (default false: skips them). - bool include_security_flagged = 2; - // Workspace scope. Empty defaults to "default". - string workspace = 3; -} - -message ApproveAllDraftChunksResponse { - // New policy version after merge. - uint32 policy_version = 1; - // SHA-256 hash of the new policy. - string policy_hash = 2; - // Number of chunks approved. - uint32 chunks_approved = 3; - // Number of chunks skipped (security-flagged). - uint32 chunks_skipped = 4; -} - -// Edit a pending chunk in-place. -message EditDraftChunkRequest { - // Sandbox name. - string name = 1; - // Chunk ID to edit. - string chunk_id = 2; - // The modified rule (replaces existing proposed_rule). - openshell.sandbox.v1.NetworkPolicyRule proposed_rule = 3; - // Workspace scope. Empty defaults to "default". - string workspace = 4; -} - -message EditDraftChunkResponse {} - -// Reverse an approval (remove merged rule from active policy). -message UndoDraftChunkRequest { - // Sandbox name. - string name = 1; - // Chunk ID to undo. - string chunk_id = 2; - // Workspace scope. Empty defaults to "default". - string workspace = 3; -} - -message UndoDraftChunkResponse { - // New policy version after removal. - uint32 policy_version = 1; - // SHA-256 hash of the updated policy. - string policy_hash = 2; -} - -// Clear all pending draft chunks for a sandbox. -message ClearDraftChunksRequest { - // Sandbox name. - string name = 1; - // Workspace scope. Empty defaults to "default". - string workspace = 2; -} - -message ClearDraftChunksResponse { - // Number of chunks cleared. - uint32 chunks_cleared = 1; -} - -// Get decision history for a sandbox's draft policy. -message GetDraftHistoryRequest { - // Sandbox name. - string name = 1; - // Workspace scope. Empty defaults to "default". - string workspace = 2; -} - -message DraftHistoryEntry { - // Event timestamp (ms since epoch). - int64 timestamp_ms = 1; - // Event type: "denial_detected", "analysis_cycle", "approved", - // "rejected", "edited", "undone", "cleared". - string event_type = 2; - // Human-readable description. - string description = 3; - // Associated chunk ID (if applicable). - string chunk_id = 4; -} - -message GetDraftHistoryResponse { - // Chronological decision history. - repeated DraftHistoryEntry entries = 1; -} - -// Stored payload for a policy revision row in the generic objects table. -message PolicyRevisionPayload { - // Serialized policy contents. - openshell.sandbox.v1.SandboxPolicy policy = 1; - // Deterministic hash of the policy payload. - string hash = 2; - // Load error reported by the sandbox, if any. - string load_error = 3; - // When the policy version was reported as loaded (ms since epoch). 0 if unset. - int64 loaded_at_ms = 4; - // Immutable provenance supplied when this revision was created. - map provenance = 5; -} - -// Stored payload for a draft policy chunk row in the generic objects table. -message DraftChunkPayload { - // Proposed network_policies map key. - string rule_name = 1; - // Proposed network policy rule. - openshell.sandbox.v1.NetworkPolicyRule proposed_rule = 2; - // Human-readable explanation of why this rule is proposed. - string rationale = 3; - // Security concerns flagged by analysis (empty if none). - string security_notes = 4; - // Analysis confidence (0.0-1.0). 0 for mechanistic mode. - float confidence = 5; - // When the user approved/rejected (ms since epoch). 0 if undecided. - int64 decided_at_ms = 6; - // Denormalized endpoint host for dedup and display. - string host = 7; - // Denormalized endpoint port for dedup and display. - int32 port = 8; - // Binary path that triggered the denial. - string binary = 9; - // Current draft version for the owning sandbox. - int64 draft_version = 10; - // Gateway prover verdict for this chunk; empty until prover runs. - // Mirrors PolicyChunk.validation_result. - string validation_result = 11; - // Operator-supplied free-form rejection text; empty for non-rejected - // chunks. Mirrors PolicyChunk.rejection_reason. - string rejection_reason = 12; -} - -// Internal stored policy revision row materialized from the generic objects table. -message StoredPolicyRevision { - string id = 1; - string sandbox_id = 2; - int64 version = 3; - bytes policy_payload = 4; - string policy_hash = 5; - string status = 6; - optional string load_error = 7; - int64 created_at_ms = 8; - optional int64 loaded_at_ms = 9; - map provenance = 10; -} - -// Internal stored draft chunk row materialized from the generic objects table. -message StoredDraftChunk { - string id = 1; - string sandbox_id = 2; - int64 draft_version = 3; - string status = 4; - string rule_name = 5; - bytes proposed_rule = 6; - string rationale = 7; - string security_notes = 8; - double confidence = 9; - int64 created_at_ms = 10; - optional int64 decided_at_ms = 11; - string host = 12; - int32 port = 13; - string binary = 14; - int32 hit_count = 15; - int64 first_seen_ms = 16; - int64 last_seen_ms = 17; - // Gateway prover verdict; empty until the prover runs. See PolicyChunk. - string validation_result = 18; - // Operator-supplied free-form rejection text. See PolicyChunk. - string rejection_reason = 19; -} - -// --------------------------------------------------------------------------- -// Workspace messages -// --------------------------------------------------------------------------- - -// Create workspace request. -message CreateWorkspaceRequest { - // Workspace name. Must be a valid DNS-1123 label. - string name = 1; - // Optional labels for the workspace (key-value metadata). - map labels = 2; -} - -// Create workspace response. -message CreateWorkspaceResponse { - openshell.datamodel.v1.Workspace workspace = 1; -} - -// Get workspace request. -message GetWorkspaceRequest { - // Workspace name (canonical lookup key). - string name = 1; -} - -// Get workspace response. -message GetWorkspaceResponse { - openshell.datamodel.v1.Workspace workspace = 1; -} - -// List workspaces request. -message ListWorkspacesRequest { - uint32 limit = 1; - uint32 offset = 2; - // Optional label selector for filtering (format: "key1=value1,key2=value2"). - string label_selector = 3; -} - -// List workspaces response. -message ListWorkspacesResponse { - repeated openshell.datamodel.v1.Workspace workspaces = 1; -} - -// Delete workspace request. -message DeleteWorkspaceRequest { - // Workspace name (canonical lookup key). - string name = 1; -} - -// Delete workspace response. -message DeleteWorkspaceResponse { - bool deleted = 1; -} - -// --------------------------------------------------------------------------- -// Workspace membership messages -// --------------------------------------------------------------------------- - -// Workspace-scoped role for members. -enum WorkspaceRole { - WORKSPACE_ROLE_UNSPECIFIED = 0; - WORKSPACE_ROLE_USER = 1; - WORKSPACE_ROLE_ADMIN = 2; -} - -// Workspace membership record. -message WorkspaceMember { - openshell.datamodel.v1.ObjectMeta metadata = 1; - // OIDC subject claim identifying the principal. - string principal_subject = 2; - // Role assigned to the principal within the workspace. - WorkspaceRole role = 3; -} - -// Add workspace member request. -message AddWorkspaceMemberRequest { - // Workspace name. - string workspace = 1; - // OIDC subject claim identifying the principal. - string principal_subject = 2; - // Role to assign. - WorkspaceRole role = 3; -} - -// Add workspace member response. -message AddWorkspaceMemberResponse { - WorkspaceMember member = 1; -} - -// Remove workspace member request. -message RemoveWorkspaceMemberRequest { - // Workspace name. - string workspace = 1; - // OIDC subject claim identifying the principal to remove. - string principal_subject = 2; -} - -// Remove workspace member response. -message RemoveWorkspaceMemberResponse { - bool removed = 1; -} - -// List workspace members request. -message ListWorkspaceMembersRequest { - // Workspace name. - string workspace = 1; - uint32 limit = 2; - uint32 offset = 3; -} - -// List workspace members response. -message ListWorkspaceMembersResponse { - repeated WorkspaceMember members = 1; -} diff --git a/backend/proto/options.proto b/backend/proto/options.proto deleted file mode 100644 index 7669e2f..0000000 --- a/backend/proto/options.proto +++ /dev/null @@ -1,35 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -syntax = "proto3"; - -package openshell.options.v1; - -import "google/protobuf/descriptor.proto"; - -// Per-method authorization rule. Consumed at runtime by the gateway's -// descriptor-pool-based auth table to enforce auth mode, role, and scope. -message AuthorizationRule { - // Authentication mode: "bearer", "sandbox", "dual", or "unauthenticated". - string auth_mode = 1; - // Minimum workspace-level role required (checked by handler via - // authorize_workspace): "user" or "admin". Mutually exclusive with - // global_role. - string workspace_role = 2; - // Global role required (checked by middleware via OIDC claims): - // "platform_admin". Mutually exclusive with workspace_role. - string global_role = 3; - // Required OIDC scope on the bearer path (e.g. "sandbox:read"). - string scope = 4; -} - -extend google.protobuf.MethodOptions { - // Authorization metadata for a gRPC method. - AuthorizationRule authorization = 50000; -} - -// Marks a protobuf field whose value must not cross generic observation or -// extension boundaries such as gateway interceptors. -extend google.protobuf.FieldOptions { - bool secret = 50001; -} diff --git a/backend/proto/sandbox.proto b/backend/proto/sandbox.proto deleted file mode 100644 index 16b3ca9..0000000 --- a/backend/proto/sandbox.proto +++ /dev/null @@ -1,385 +0,0 @@ -// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -// SPDX-License-Identifier: Apache-2.0 - -syntax = "proto3"; - -package openshell.sandbox.v1; - -import "google/protobuf/struct.proto"; - -// Sandbox-supervisor configuration and policy messages. -// -// Conventions: -// - This file owns messages exchanged between the gateway and the sandbox -// supervisor/runtime. -// - Public sandbox resource types live in `openshell.proto`. -// - Internal compute-driver sandbox observation types live in `compute_driver.proto`. - -// Sandbox security policy configuration. -message SandboxPolicy { - // Policy version. - uint32 version = 1; - // Filesystem access policy. - FilesystemPolicy filesystem = 2; - // Landlock configuration. - LandlockPolicy landlock = 3; - // Process execution policy. - ProcessPolicy process = 4; - // Network access policies keyed by name (e.g. "claude_code", "gitlab"). - map network_policies = 5; - // Reusable supervisor middleware configs for network egress, keyed by their - // policy-local names. At most 10 configs are accepted, and at most 10 stages - // can be selected per request. - map network_middlewares = 6; -} - -// Filesystem access policy. -message FilesystemPolicy { - // Automatically include the workdir as read-write. - bool include_workdir = 1; - // Read-only directory allow list. - repeated string read_only = 2; - // Read-write directory allow list. - repeated string read_write = 3; -} - -// Landlock policy configuration. -message LandlockPolicy { - // Compatibility mode (e.g. "best_effort", "hard_requirement"). - string compatibility = 1; -} - -// Process execution policy. -message ProcessPolicy { - // User name to run the sandboxed process as. - string run_as_user = 1; - // Group name to run the sandboxed process as. - string run_as_group = 2; -} - -// A named network access policy rule. -message NetworkPolicyRule { - // Human-readable name for this policy rule. - string name = 1; - // Allowed endpoint (host:port) pairs. - repeated NetworkEndpoint endpoints = 2; - // Allowed binary identities. - repeated NetworkBinary binaries = 3; -} - -// A reusable middleware config selected for admitted egress by host. -message NetworkMiddlewareConfig { - // Human-readable name for this middleware config. - string name = 1; - // Built-in middleware name or operator-owned registration name. - string middleware = 2; - // Service-specific configuration. - google.protobuf.Struct config = 3; - // Failure behavior: "fail_closed" (default) or "fail_open". - string on_error = 4; - // Host selector controlling which admitted destinations use this config. - MiddlewareEndpointSelector endpoints = 5; - // Execution order. Values must be unique within a policy; lower values run first. - int32 order = 6; -} - -// Host selector controlling which admitted destinations use a middleware config. -message MiddlewareEndpointSelector { - // Exact host or DNS glob patterns included in the selection. Include and - // exclude accept at most 32 combined patterns. - repeated string include = 1; - // Exact host or DNS glob patterns removed from the selection. - // Exclusions take precedence over inclusions. - repeated string exclude = 2; -} - -// A network endpoint (host + port) with optional L7 inspection config. -message NetworkEndpoint { - // Hostname or host glob pattern. Exact match is case-insensitive. - // Glob patterns use "." as delimiter: "*.example.com" matches a single - // subdomain label, "**.example.com" matches across labels. - string host = 1; - // Single port (backwards compat). Use `ports` for multiple ports. - // Mutually exclusive with `ports` — if both are set, `ports` takes precedence. - uint32 port = 2; - // Application protocol for L7 inspection: "rest", "websocket", "graphql", "sql", or "" (L4-only). - string protocol = 3; - // TLS handling: "terminate" or "passthrough" (default). - string tls = 4; - // Enforcement mode: "enforce" or "audit" (default). - string enforcement = 5; - // Access preset shorthand: "read-only", "read-write", "full". - // Mutually exclusive with rules. - string access = 6; - // Explicit L7 rules (mutually exclusive with access). - repeated L7Rule rules = 7; - // Allowed resolved IP addresses or CIDR ranges for this endpoint. - // When non-empty, the SSRF internal-IP check is replaced by an allowlist check: - // - If host is also set: domain must resolve to an IP in this list. - // - If host is empty: any domain is allowed as long as it resolves to an IP in this list. - // Supports exact IPs ("10.0.5.20") and CIDR notation ("10.0.5.0/24"). - // Loopback (127.0.0.0/8) and link-local (169.254.0.0/16) are always blocked - // regardless of this field. - repeated string allowed_ips = 8; - // Multiple ports. When non-empty, this endpoint covers all listed ports. - // If `port` is set and `ports` is empty, `port` is normalized to `ports: [port]`. - // If both are set, `ports` takes precedence. - repeated uint32 ports = 9; - // Explicit L7 deny rules. When present, requests matching any deny rule - // are blocked even if they match an allow rule or access preset. - // Deny rules take precedence over allow rules. - repeated L7DenyRule deny_rules = 10; - // When true, percent-encoded '/' (%2F) is preserved in path segments - // rather than rejected by the L7 path canonicalizer. Required for - // upstreams like GitLab that embed %2F in namespaced resource paths. - // Defaults to false (strict). - bool allow_encoded_slash = 11; - // GraphQL persisted-query behavior for hash-only/saved-query requests: - // "deny" (default) or "allow_registered". - string persisted_queries = 12; - // Trusted GraphQL persisted-query registry keyed by hash or service-specific ID. - // Only used when persisted_queries is "allow_registered". - map graphql_persisted_queries = 13; - // Maximum GraphQL request body bytes to buffer for inspection. - // Defaults to 65536 when unset. - uint32 graphql_max_body_bytes = 14; - // Optional HTTP path glob that scopes this L7 endpoint on shared host:port APIs. - // Example: use path "/graphql" for protocol "graphql" and "/repos/**" for - // protocol "rest" when both surfaces live under api.example.com:443. - // Empty means all paths. - string path = 15; - // When true on a "rest" endpoint, OpenShell rewrites credential placeholders - // inside client-to-server WebSocket text messages after an allowed HTTP 101 - // upgrade. Defaults to false. - bool websocket_credential_rewrite = 16; - // When true on a "rest" endpoint, OpenShell rewrites credential placeholders - // inside supported textual HTTP request bodies before forwarding upstream. - // Defaults to false. - bool request_body_credential_rewrite = 17; - // Internal provenance marker for policy-advisor generated endpoints. - // Advisor-proposed endpoints must not satisfy exact-host SSRF trust unless - // they are converted through an explicit user-authored policy path. - bool advisor_proposed = 18; - // Proxy-side credential signing mode: "sigv4" for AWS SigV4 re-signing. - // When set, the proxy strips the client's Authorization header and computes - // a fresh SigV4 signature using real credentials from the provider. - string credential_signing = 19; - // AWS signing service name override. Required when credential_signing is - // "sigv4" — e.g. "bedrock" for bedrock-runtime endpoints. - string signing_service = 20; - // AWS region override for SigV4 signing. When set, takes precedence over - // hostname-based region extraction. Required for non-standard endpoints. - string signing_region = 21; - // Maximum JSON-RPC-over-HTTP request body bytes to buffer for inspection. - // Defaults to 65536 when unset. - uint32 json_rpc_max_body_bytes = 22; - // MCP-only policy and inspection options. Only used when protocol is "mcp". - McpOptions mcp = 23; -} - -// MCP options are grouped so MCP-specific policy can grow without adding more -// top-level NetworkEndpoint fields. Current enforcement targets the active -// 2025-11-25 Streamable HTTP/tools behavior, while preserving space for -// version-profile policy if OpenShell adopts 2026-07-28 draft behavior later. -// -// Planned policy extensions should use OpenShell-owned static definitions for -// MCP method/version profiles rather than treating dependency enums as the -// policy contract. Candidate profile checks include request metadata/header -// validation, response/SSE introspection, trusted annotation handling, -// resultType/cache metadata validation, x-mcp-header tool-definition checks, -// and subscriptions/listen handling. -// -// Sources: -// - https://modelcontextprotocol.io/specification/2025-11-25/server/tools -// - https://modelcontextprotocol.io/specification/draft/changelog -// - https://modelcontextprotocol.io/specification/draft/basic/transports/streamable-http -// - https://modelcontextprotocol.io/specification/draft/server/tools -message McpOptions { - // Hardening boundary for tools/call params.name. When unset or true, the - // supervisor enforces the MCP recommended tool-name syntax - // ^[A-Za-z0-9_.-]{1,128}$ before policy evaluation. Set false only for - // compatibility with servers that intentionally use non-recommended names. - // - // Source: - // - https://modelcontextprotocol.io/specification/2025-11-25/server/tools#tool-names - optional bool strict_tool_names = 1; - // Method-layer default for MCP endpoints. When true, OpenShell allows parsed - // MCP-family methods at the method layer unless a tool-name policy narrows - // tools/call. When unset or false, explicit method rules are required. - optional bool allow_all_known_mcp_methods = 2; -} - -// Trusted GraphQL operation classification. -message GraphqlOperation { - // Operation type: "query", "mutation", or "subscription". - string operation_type = 1; - // Operation name, if known. - string operation_name = 2; - // Root field names selected by the operation. - repeated string fields = 3; -} - -// An L7 deny rule that blocks specific requests. -// Mirrors L7Allow — same fields, same matching semantics, inverted effect. -// Deny rules are evaluated after allow rules and take precedence. -message L7DenyRule { - // Protocol method: HTTP method (REST/WebSocket), JSON-RPC method name, or - // "*" for any when supported by the protocol. - string method = 1; - // URL path glob pattern (REST): "/repos/*/pulls/*/reviews", "**" for any. - string path = 2; - // SQL command (SQL): SELECT, INSERT, etc. or "*" for any. - string command = 3; - // Query parameter matcher map (REST). - // Same semantics as L7Allow.query. - map query = 4; - // GraphQL operation type: "query", "mutation", "subscription", or "*" for any. - string operation_type = 5; - // GraphQL operation name glob. "*" matches any operation name. - string operation_name = 6; - // GraphQL root field globs. Deny rules match when any selected root field - // matches any configured glob. - repeated string fields = 7; - reserved 8; - // MCP params matcher map. Currently only params.name is supported for - // tools/call filtering. Generic protocol "json-rpc" rejects params matchers. - map params = 9; -} - -// An L7 policy rule (allow-only). -message L7Rule { - L7Allow allow = 1; -} - -// Allowed action definition for L7 rules. -message L7Allow { - // Protocol method: HTTP method (REST/WebSocket), JSON-RPC method name, or - // "*" for any when supported by the protocol. - string method = 1; - // URL path glob pattern (REST): "/repos/**", "**" for any. - string path = 2; - // SQL command (SQL): SELECT, INSERT, etc. or "*" for any. - string command = 3; - // Query parameter matcher map (REST). - // Key is the decoded query parameter name (case-sensitive). - // Value supports either a single glob (`glob`) or a list (`any`). - map query = 4; - // GraphQL operation type: "query", "mutation", "subscription", or "*" for any. - string operation_type = 5; - // GraphQL operation name glob. "*" matches any operation name. - string operation_name = 6; - // GraphQL root field globs. Allow rules match only when every selected root - // field matches one of the configured globs. Omit to match all fields. - repeated string fields = 7; - reserved 8; - // MCP params matcher map. Currently only params.name is supported for - // tools/call filtering. Generic protocol "json-rpc" rejects params matchers. - map params = 9; -} - -// Query value matcher for one query parameter key. -message L7QueryMatcher { - // Single glob pattern. - string glob = 1; - // Any-of glob patterns. - repeated string any = 2; -} - -// A binary identity for network policy matching. -message NetworkBinary { - string path = 1; - // Deprecated: the harness concept has been removed. This field is ignored. - bool harness = 2 [deprecated = true]; -} - -// Request to get sandbox settings by sandbox ID. -message GetSandboxConfigRequest { - // The sandbox ID. - string sandbox_id = 1; -} - -// Request to get gateway-global settings. -message GetGatewayConfigRequest {} - -// Response containing gateway-global settings. -message GetGatewayConfigResponse { - // Gateway-global settings map excluding the reserved policy key. - // Registered keys without a configured value are returned with an empty SettingValue. - map settings = 1; - // Monotonically increasing revision for gateway-global settings. - uint64 settings_revision = 2; -} - -// Scope that currently controls a setting. -enum SettingScope { - SETTING_SCOPE_UNSPECIFIED = 0; - SETTING_SCOPE_SANDBOX = 1; - SETTING_SCOPE_GLOBAL = 2; -} - -// Type-aware setting value for sandbox/gateway settings. -message SettingValue { - oneof value { - string string_value = 1; - bool bool_value = 2; - int64 int_value = 3; - bytes bytes_value = 4; - } -} - -// Effective setting value and the scope it was resolved from. -message EffectiveSetting { - SettingValue value = 1; - SettingScope scope = 2; -} - -// Source used for the policy payload in GetSandboxConfigResponse. -enum PolicySource { - POLICY_SOURCE_UNSPECIFIED = 0; - POLICY_SOURCE_SANDBOX = 1; - POLICY_SOURCE_GLOBAL = 2; -} - -// Response containing effective sandbox settings and policy. -message GetSandboxConfigResponse { - // The sandbox policy configuration. - SandboxPolicy policy = 1; - // Current policy version (monotonically increasing per sandbox). - uint32 version = 2; - // SHA-256 hash of the serialized policy payload. - string policy_hash = 3; - // Effective settings resolved for this sandbox, excluding the reserved policy key. - // Registered keys without a configured value are returned with an empty EffectiveSetting.value. - map settings = 4; - // Fingerprint for effective config (policy + settings). Changes when any effective input changes. - uint64 config_revision = 5; - // Source of the policy payload for this response. - PolicySource policy_source = 6; - // When policy_source is GLOBAL, the version of the global policy revision. - // Zero when no global policy is active or when policy_source is SANDBOX. - uint32 global_policy_version = 7; - // Fingerprint for provider credential inputs attached to this sandbox. - // Changes when attached provider names or attached provider records change. - uint64 provider_env_revision = 8; - // Operator-registered supervisor middleware services required by the - // effective policy. Built-in middleware is not included. - repeated SupervisorMiddlewareService supervisor_middleware_services = 9; - // Workspace the sandbox belongs to. Allows the supervisor to learn its - // workspace context for subsequent workspace-scoped RPCs. - string workspace = 10; -} - -// Connection details for one operator-registered supervisor middleware service. -// V1 supports plaintext and server-authenticated TLS gRPC. -message SupervisorMiddlewareService { - // Operator-owned registration name used by policy attachments and diagnostics. - string name = 1; - // gRPC endpoint reachable from the sandbox supervisor. - string grpc_endpoint = 2; - // Operator-owned body limit applied to every binding exposed by the service. - uint64 max_body_bytes = 3; - // Default RPC timeout for this service. Empty uses the platform default of - // 500ms. Values use an integer with an `ms` or `s` suffix and must be - // between 10ms and 30s. - string timeout = 4; -} diff --git a/frontend/package.json b/frontend/package.json index 2e3b783..95f1c81 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -11,7 +11,8 @@ "./pages": "./src/pages/index.ts", "./components": "./src/components/index.ts", "./api": "./src/api/index.ts", - "./types": "./src/types/index.ts" + "./types": "./src/types/index.ts", + "./slots": "./src/slots/index.ts" }, "scripts": { "start": "webpack serve --mode development", diff --git a/frontend/public/favicon.svg b/frontend/public/favicon.svg new file mode 100644 index 0000000..6ba4fee --- /dev/null +++ b/frontend/public/favicon.svg @@ -0,0 +1,7 @@ + + + + + + + diff --git a/frontend/public/index.html b/frontend/public/index.html index b26b301..2ddbbce 100644 --- a/frontend/public/index.html +++ b/frontend/public/index.html @@ -3,6 +3,7 @@ + OpenShell Dashboard diff --git a/frontend/src/api/auth.ts b/frontend/src/api/auth.ts index 518d307..7592da4 100644 --- a/frontend/src/api/auth.ts +++ b/frontend/src/api/auth.ts @@ -43,6 +43,9 @@ export const useFeatureFlags = () => { credentialRefresh: true, services: true, draftPolicy: true, + deploymentContext: 'standalone', + workspaceBinding: false, + resourceLinks: false, }; return data?.features ?? defaults; }; diff --git a/frontend/src/api/index.ts b/frontend/src/api/index.ts index 57b13d7..6913454 100644 --- a/frontend/src/api/index.ts +++ b/frontend/src/api/index.ts @@ -8,3 +8,4 @@ export * from './sandboxes'; export * from './providers'; export * from './policy'; export * from './inference'; +export * from './rbac'; diff --git a/frontend/src/api/policy.ts b/frontend/src/api/policy.ts index ddeb70c..09be243 100644 --- a/frontend/src/api/policy.ts +++ b/frontend/src/api/policy.ts @@ -1,9 +1,11 @@ -import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'; +import { useMemo } from 'react'; +import { useMutation, useQueries, useQuery, useQueryClient } from '@tanstack/react-query'; import { apiFetch, del, get, post, put } from './client'; import type { DraftHistoryEntry, DraftPolicy, + DraftSummary, NetworkPolicyRule, PolicyUpdateResult, SandboxPolicy, @@ -82,6 +84,26 @@ export const useSandboxPolicy = (workspace: string, name: string) => queryFn: () => getSandboxPolicy(workspace, name), }); +export const useSandboxPolicies = (workspace: string, names: string[]) => { + const queries = useQueries({ + queries: names.map((name) => ({ + queryKey: ['sandbox-policy', workspace, name], + queryFn: () => getSandboxPolicy(workspace, name), + })), + }); + + const dataFingerprint = queries.map((q) => q.dataUpdatedAt).join(','); + + return useMemo(() => { + const views: Record = {}; + queries.forEach((q, i) => { + if (q.data) views[names[i]] = q.data; + }); + return views; + // eslint-disable-next-line react-hooks/exhaustive-deps + }, [dataFingerprint]); +}; + export const useUpdateSandboxPolicy = (workspace: string, name: string) => { const queryClient = useQueryClient(); return useMutation({ @@ -214,3 +236,24 @@ export const useDraftHistory = (workspace: string, name: string) => queryKey: ['draft-history', workspace, name], queryFn: () => getDraftHistory(workspace, name), }); + +const getDraftSummary = (workspace?: string): Promise => + get( + `/api/v1/draft-summary${workspace ? `?workspace=${encodeURIComponent(workspace)}` : ''}`, + ); + +export const useDraftNotifications = (enabled = true) => { + const query = useQuery({ + queryKey: ['draft-summary'], + queryFn: () => getDraftSummary(), + refetchInterval: 15_000, + enabled, + }); + + return { + items: query.data?.sandboxes ?? [], + totalPending: query.data?.totalPending ?? 0, + isLoading: query.isLoading, + }; +}; + diff --git a/frontend/src/api/rbac.ts b/frontend/src/api/rbac.ts new file mode 100644 index 0000000..772700c --- /dev/null +++ b/frontend/src/api/rbac.ts @@ -0,0 +1,36 @@ +import { useCurrentUser } from './auth'; +import { useMembers } from './workspaces'; + +export const PLATFORM_ADMIN_ROLE = 'openshell-admin'; +export const USER_ROLE = 'openshell-user'; + +export const useUserRole = () => { + const { data: user } = useCurrentUser(); + const roles = user?.roles ?? []; + return { + isPlatformAdmin: roles.includes(PLATFORM_ADMIN_ROLE), + isUser: roles.includes(USER_ROLE) || roles.includes(PLATFORM_ADMIN_ROLE), + roles, + subject: user?.subject, + }; +}; + +export const useWorkspaceRole = (workspace: string) => { + const { data: user } = useCurrentUser(); + const members = useMembers(workspace); + + const isPlatformAdmin = (user?.roles ?? []).includes(PLATFORM_ADMIN_ROLE); + + if (isPlatformAdmin) { + return { isWorkspaceAdmin: true, isLoading: false }; + } + + const currentMember = (members.data ?? []).find( + (m) => m.principalSubject === user?.subject, + ); + + return { + isWorkspaceAdmin: currentMember?.role === 'ADMIN', + isLoading: members.isLoading, + }; +}; diff --git a/frontend/src/app/App.tsx b/frontend/src/app/App.tsx index 7cf7db6..b4c90c4 100644 --- a/frontend/src/app/App.tsx +++ b/frontend/src/app/App.tsx @@ -11,6 +11,7 @@ import { useParams, } from 'react-router-dom'; +import { SlotProvider } from '../slots'; import LoginPage from '../pages/LoginPage'; import GatewayOverviewPage from '../pages/GatewayOverviewPage'; import WorkspaceListPage from '../pages/WorkspaceListPage'; @@ -155,11 +156,13 @@ const AppRoutes: React.FC = () => { const App: React.FC = () => ( - - - - - + + + + + + + ); diff --git a/frontend/src/app/AppLayout.tsx b/frontend/src/app/AppLayout.tsx index 9c271ec..6620bc8 100644 --- a/frontend/src/app/AppLayout.tsx +++ b/frontend/src/app/AppLayout.tsx @@ -33,6 +33,7 @@ import { import { BarsIcon, QuestionCircleIcon } from '@patternfly/react-icons'; import { Link, useLocation } from 'react-router-dom'; +import openshellLogo from '~/assets/openshell-logo.svg'; import { useGatewayInfo } from '../api/gateway'; import { useCurrentUser, useFeatureFlags } from '../api/auth'; import { useUserRole } from './useUserRole'; @@ -80,9 +81,7 @@ const AppLayout: React.FC = ({ children }) => { )} > - - OpenShell Dashboard - + OpenShell Dashboard @@ -209,8 +208,8 @@ const AppLayout: React.FC = ({ children }) => { onClose={() => setAboutOpen(false)} productName="OpenShell Dashboard" trademark="Apache-2.0 license." - brandImageSrc="" - brandImageAlt="" + brandImageSrc={openshellLogo} + brandImageAlt="OpenShell Dashboard" > diff --git a/frontend/src/app/useUserRole.ts b/frontend/src/app/useUserRole.ts index b59e966..c88ca70 100644 --- a/frontend/src/app/useUserRole.ts +++ b/frontend/src/app/useUserRole.ts @@ -1,15 +1 @@ -import { useCurrentUser } from '../api/auth'; - -export const PLATFORM_ADMIN_ROLE = 'openshell-admin'; -export const USER_ROLE = 'openshell-user'; - -export const useUserRole = () => { - const { data: user } = useCurrentUser(); - const roles = user?.roles ?? []; - return { - isPlatformAdmin: roles.includes(PLATFORM_ADMIN_ROLE), - isUser: roles.includes(USER_ROLE) || roles.includes(PLATFORM_ADMIN_ROLE), - roles, - subject: user?.subject, - }; -}; +export { PLATFORM_ADMIN_ROLE, USER_ROLE, useUserRole } from '../api/rbac'; diff --git a/frontend/src/app/useWorkspaceRole.ts b/frontend/src/app/useWorkspaceRole.ts index d508d96..1d5c3cb 100644 --- a/frontend/src/app/useWorkspaceRole.ts +++ b/frontend/src/app/useWorkspaceRole.ts @@ -1,23 +1 @@ -import { useCurrentUser } from '../api/auth'; -import { useMembers } from '../api/workspaces'; -import { PLATFORM_ADMIN_ROLE } from './useUserRole'; - -export const useWorkspaceRole = (workspace: string) => { - const { data: user } = useCurrentUser(); - const members = useMembers(workspace); - - const isPlatformAdmin = (user?.roles ?? []).includes(PLATFORM_ADMIN_ROLE); - - if (isPlatformAdmin) { - return { isWorkspaceAdmin: true, isLoading: false }; - } - - const currentMember = (members.data ?? []).find( - (m) => m.principalSubject === user?.subject, - ); - - return { - isWorkspaceAdmin: currentMember?.role === 'ADMIN', - isLoading: members.isLoading, - }; -}; +export { useWorkspaceRole } from '../api/rbac'; diff --git a/frontend/src/assets/openshell-logo.svg b/frontend/src/assets/openshell-logo.svg new file mode 100644 index 0000000..daec178 --- /dev/null +++ b/frontend/src/assets/openshell-logo.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/frontend/src/components/CreateProviderModal.tsx b/frontend/src/components/CreateProviderModal.tsx index 7657423..4bfd0d4 100644 --- a/frontend/src/components/CreateProviderModal.tsx +++ b/frontend/src/components/CreateProviderModal.tsx @@ -23,6 +23,7 @@ import { import { useCreateProvider, useProviderProfiles } from '../api/providers'; import { useAlerts } from '../app/AlertContext'; +import { useSlots } from '../slots'; import type { CredentialInputSlot } from '../types'; type CreateProviderModalProps = { @@ -38,6 +39,8 @@ type CreateProviderModalProps = { // generated from the selected profile's credentials[] schema. Credential // values are write-only: sent to the gateway, never displayed again. const CreateProviderModal: React.FC = ({ workspace, isOpen, onClose, onSuccess, renderCredentialInput }) => { + const slots = useSlots(); + const resolvedCredentialInput = renderCredentialInput ?? slots.credentialInput; const [name, setName] = useState(''); const [profileId, setProfileId] = useState(''); const [credentialValues, setCredentialValues] = useState>({}); @@ -150,8 +153,8 @@ const CreateProviderModal: React.FC = ({ workspace, is isRequired={credential.required} fieldId={`credential-${credential.name}`} > - {renderCredentialInput ? ( - renderCredentialInput( + {resolvedCredentialInput ? ( + resolvedCredentialInput( credential, credentialValues[credential.name] ?? '', (value) => diff --git a/frontend/src/components/InferenceTab.tsx b/frontend/src/components/InferenceTab.tsx index 73cecac..f330c51 100644 --- a/frontend/src/components/InferenceTab.tsx +++ b/frontend/src/components/InferenceTab.tsx @@ -28,6 +28,7 @@ import { import { useDeleteInferenceRoute, useInferenceRoute, useSetInferenceRoute } from '../api/inference'; import { useProviders } from '../api/providers'; import { useWorkspaceRole } from '../app/useWorkspaceRole'; +import { useSlots } from '../slots'; import type { ApiError } from '../api/client'; import type { ModelPickerSlot } from '../types'; @@ -111,6 +112,8 @@ const RouteCard: React.FC<{ workspace: string; route: string; title: string; not // Inference routing: all sandboxes in the workspace reach inference.local, // and the gateway routes it to the configured provider/model. const InferenceTab: React.FC = ({ workspace, renderModelPicker }) => { + const slots = useSlots(); + const resolvedModelPicker = renderModelPicker ?? slots.modelPicker; const { isWorkspaceAdmin } = useWorkspaceRole(workspace); const providers = useProviders(workspace); const setRoute = useSetInferenceRoute(workspace); @@ -188,8 +191,8 @@ const InferenceTab: React.FC = ({ workspace, renderModelPicke - {renderModelPicker ? ( - renderModelPicker(modelId, setModelId) + {resolvedModelPicker ? ( + resolvedModelPicker(modelId, setModelId) ) : ( ; + numLabels?: number; }; -const LabelsList: React.FC = ({ labels }) => { +const LabelsList: React.FC = ({ labels, numLabels = 3 }) => { const entries = Object.entries(labels ?? {}); if (entries.length === 0) { return -; } return ( - + {entries.map(([key, value]) => (